Hide Forgot
Description of problem: Fedora 15 version has a change in yum that doesn't check for gpg signatures for local packages by default. Yum still checks gpg signatures for repo packages. It is configurable. This change is not safe and wise. It should check for all packages, but be configurable for local ones, that is the other way around. The sys admin should make that conscious decision. Version-Release number of selected component (if applicable): yum How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
http://lists.fedoraproject.org/pipermail/users/2011-January/391463.html
1. you need root access to install a local rpm 2. most of the time the local rpms you are installing are not signed at all, so there is no signature to validate. 3. rpm -ivh foo.rpm don't give you any problems So why should yum foo.rpm force you to type --nogpgcheck every time. I agree it is a potential security risk to install some rpm from an untrusted place, but i don't see that forcing the user to use --nogpgcheck every time, reduce the risk.
Actually, I often download RPMs from my enabled repos that need to be up/downgraded several times, simply to save bandwidth, and appreciate that yum (used to) check the signature for me. Rpm can work with either local or remote rpms ("rpm -ivh http://foo.com/foo.rpm", for example) and doesn't check either way, so is consistent in that regard. I think it makes more sense for yum to be consistent as well in terms of behaving the same regardless of the source of the package. Local rpms that aren't signed probably aren't installed very often, and when they are it's often because the packager is neglecting to sign them, as they should (for example RealPlayer, or more recently Skype). Not doing the local signature check takes the pressure off them to package properly.
Actually, yum is consistent. "yum install http://example.com/foo.rpm" is considered "local" and is thus. checked via. the new config. method. The difference is between "local" and "repo." packages. For your usecase where you are doing upgrades/downgrades I'd suggest you create a repo. with those packages in it (maybe using the "yum-plugin-local" package, maybe doing something else).