Bug 890616 - Cannot install unsigned packages
Summary: Cannot install unsigned packages
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: PackageKit
Version: 18
Hardware: All
OS: All
unspecified
high
Target Milestone: ---
Assignee: Richard Hughes
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: https://fedoraproject.org/wiki/Common...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-12-28 06:19 UTC by Adam Williamson
Modified: 2013-05-16 02:06 UTC (History)
13 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-01-18 20:46:26 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Adam Williamson 2012-12-28 06:19:29 UTC
gnome-packagekit in Fedora 18 no longer seems to have any mechanism for installing unsigned packages or packages signed with an unknown key. It used to allow you to do this with warnings and root password entry and so on, but in F18, it just pops up a window that says 'Missing security signature...The package security signature is missing and this package is untrusted. This package was not signed when created." (it seems to pop this up even for packages that *are* signed, but with an unknown key - there's a 'More details' expander which shows "Public key for foo.rpm is not installed" in this case). The dialog just has a 'Close' button, and you're done. No option to override and install the package.

I assumed this was an intentional policy change and didn't report it as a bug before, but Richard said it wasn't, so I'm filing a bug now.

This has been noted in the forums, and will cause trouble for people enabling popular third-party repositories and downloading RPM packages provided directly by third-party projects.

Comment 1 Richard Hughes 2013-01-02 14:01:14 UTC
I've fixed this upstream with:

commit 9db3c60866e17a2cae60725106c2addc21f24ee8
Author: Richard Hughes <richard>
Date:   Wed Jan 2 13:59:41 2013 +0000

    If a simulated only-trusted transaction returns with need-untrusted then re-simulate with only-trusted=FALSE

:100644 100644 0a1f295... 4fc1587... M  lib/packagekit-glib2/pk-task.c

I don't know why it wasn't picked up in the unit tests, so apologies there. I've built a test (f18ish) package here: http://people.freedesktop.org/~hughsient/fedora/17/

I'd appreciate some testing. If it works, I'll roll an F18 update ASAP. Thanks.

Richard.

Comment 2 Adam Williamson 2013-01-04 04:08:00 UTC
Test confirmed, it prompts for admin password then installs the package. Thanks.

Comment 3 Adam Williamson 2013-01-15 00:51:26 UTC
Richard: can you please build the F18 update with the fix? Thanks! It would be nice to have this available ASAP.

Comment 4 Fedora Update System 2013-01-16 18:20:30 UTC
PackageKit-0.8.7-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/PackageKit-0.8.7-1.fc18

Comment 5 Fedora Update System 2013-01-18 20:46:28 UTC
PackageKit-0.8.7-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Ken Berry 2013-01-19 09:38:56 UTC
What's up with the PackageKit-0.8.7-1.fc18.x86_64.rpm? Can not install with the installer and can not install through a terminal yet either yet. I downloaded and same error as any other package that is unsigned. Please advise.

Comment 7 DanielS 2013-02-14 02:36:28 UTC
The following page links here:
http://fedoraproject.org/wiki/Common_F18_bugs#PackageKit_cannot_install_unsigned_packages_or_packages_signed_with_an_untrusted_key

According to the bug title, this issue is fixed. But it only fixes half of the problem described above.
- Unsigned packages (e.g. Skype) can now be installed.
- Signed packages with unknown key (e.g. TeamViewer unless you import the key from http://www.teamviewer.com/en/help/363-How-do-I-install-TeamViewer-on-my-Linux-distribution.aspx) can not be installed. Very annoying as there is no error indication. Should that be a separate issue?

Comment 8 Rex Dieter 2013-02-14 13:49:24 UTC
separate issue, yes (please)


Note You need to log in before you can comment on or make changes to this bug.