Date: Mon, 19 Aug 2013 22:27:13 -0600 From: Kevin Fenzi <kevin@...ye.com> To: kseifried@...hat.com Cc: oss-security@...ts.openwall.com, "Eric H. Christensen" <echriste@...hat.com>, security@...tgresql.org Subject: Re: PostgreSQL insecure install via yum (multiple problems) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Mon, 19 Aug 2013 22:11:13 -0600 Kurt Seifried <kseifried@...hat.com> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 08/19/2013 07:19 PM, Eric H. Christensen wrote: > > On Mon, Aug 19, 2013 at 06:58:22PM -0600, Kurt Seifried wrote: > >> Signing RPM's isn't very useful if you never make the signing > >> key available! > > > > You mean like this: > > http://keys.fedoraproject.org/pks/lookup?search=0x442df0f8&op=vindex > > > > I'm pretty sure pgp.mit.edu isn't the best source for PGP keys any > > longer, unfortunately. > > Dunno who to ask, so adding Scrye: can we make sure Google indexes the > Fedora key server? I'm happy to answer, but am not on some of the list's CC'ed, so feel free to pass my reply on. ;) keys.fedoraproject.org is just recently revived. We had some issues with the sks software that runs on it and it was down for quite some time. Those issues are hopefully solved now so we can bring it up full time. Hopefully google will notice it once it's been up for a while. > This actually raises a good point, what are the key > servers now? The big 3 used to be: > > http://pgp.mit.edu/ > http://keyserver.pgp.com/ > http://sks-keyservers.net/ keys.fedoraproject.org should sync with sks-keyservers.net. Not sure about the other 2. kevin -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (GNU/Linux) iQIcBAEBCgAGBQJSEvAkAAoJEEs3sNgP+7teOI4QAJa9pLrruBTevGKTL64nnHoP P+wVKOIeKLc00OCiF0zmLgCvgjG2i6FgcWgvbdzOvS3fBTF3P29fqZ1CtwQEWUko cU0i/sDOYspImg0F3kM65BzLZpTOW6jJFU29LFcNYDkFOailCfoszL9FX25wPDe4 0pB6I3o7fAe4knQ4hUzyNrbWrwtUpE1IJVJedipC5pJu3OGt2lkT7jP48WiugWyz 0lCQ/MZtcwOVmAztkK4PYH2iJfYI36EyviKRYHjbsywrrgAFshIKzYLROVkQco8C EVWt89L16wU/zFLYt00J6FJUGU+6xAkAYKg5GaUfcwI/swpd76FP71COfsz3c5l+ HyXwtDRADNb3cCnFzCuBqNnaaDrT7hTxin69/XaFjKIuNSMm8YsnkbCYcNzHzKGh jBJ5gST6yJYaIlLIB2rlADdQ1jIeJG1plLMhmwjayi+m5lQh54mgWiok2jIKvENu /o0gJemhjzc4E3o8yMKzqiMsH9jwKeS70FRO1zpo87VTD/P+8v3SPTw9H/GpyrN0 U1dc4S/XDoJEuUIHCoZCBRvWnnnl9Eue7wYjlCsj1Un0wtJz2hXbTfZONvSfO52A fHC5U5WZyDwl4NjBg/M0A1bHMwA90UztnYaQXJai326jsTLjf+5v1mT+9iRRFwKU AeZZpZZPugIEychcXVL0 =mXzc -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.