[packman] digests SIGNATURES NOT OK

[Stefan Seyfried]

Hi Marc,

On 13.12.21 09:35, Marc Schiffbauer wrote:
> * Stefan Seyfried schrieb am 12.12.21 um 00:04 Uhr: >> Really the best solution (if possible) would be if the new key could be
>> signed by the old one and thus automatically accepted by zypper et al.
>> I have no idea if this is even possible, nor how to implement it in OBS. A
>> plain "osc signkey --create" will simply wipe the old one and create a new
>> key, but that would cause a bad user experience :-(
>>
>> Maybe we should ask security-team at suse.de for help on how to handle this
>> best? They surely must be prepared for updating a key.
> 
> 
> The signatures, that obs is attaching to the packages are not the same
> that the package sin the repo are signed with: All packages are being
> resigned in the release process to the mirrors.

Ok, this at least saves us from having to teach OBS to use a very custom 
key ;-)

> But yes, signing a new key with the old one is a good idea.

...only if the tools (zypper, yast, rpm) actually accept this "new key 
signed with old one" without crazy warnings ;-)

If they still complain, then we do not win too much (but also will not 
lose anything) by signing the new key with te old one.
-- 
Stefan Seyfried

"For a successful technology, reality must take precedence over
  public relations, for nature cannot be fooled." -- Richard Feynman