Signatures?

[Kaboosh]

This is just a curiosity that came up but are our PCLinuxOS repositories signed?  I don't see any <KEY> entries in /etc/apt/sources.list so what are we doing to ensure integrity?  Do we sign individual RPMs?

[Texstar]

1. All new packages are processed through a central server from trusted sources and verified before they are uploaded to the repos.

2. The repos are secured via md5sums through the package lists. If you try to replace a rpm in the repo, the md5sum would not match the package list and error out. While someone might be able to also replace a package list on a server it would get corrected in less than 12 hours due to the repos being dynamic instead of static.

[melodie]

Hi,

There is a section in Synaptic to configure the signature ? Is it of no use ?

I mean:



Thanks.