Fedora converts package keys

Sep 10, 2008

After discovering that some Fedora servers have been illegally accessed, the Fedora Project is, as of today, converting the signing keys for Linux distribution packages.

The Red Hat sponsored Linux distribution became aware of the intrusion at the end of August. One of the servers compromised was a server used for signing Fedora packages and as a result, the project has decided to change the key. Project leader Paul Frields writes: "While there is no definitive evidence that the Fedora key has been compromised, because Fedora packages are distributed via multiple
third-party mirrors and repositories, we have decided to convert to new Fedora signing keys."

The project developers will use the so called Phase 1 to initiate updates for Fedora 8 and 9, which will begin the conversion. From today the new packages are available on the mirror servers. Among others, the packages 'fedora-release', 'package-kit' and 'gnome-package kit' are being re-vamped.

The user will have to verify and import the updates with the new GPG key. The software guides the user through the download process but instructions are also available at Fedora-Wiki. After that, the package management receives updates as newly signed packages from a new repository.

In Phase 2, Fedora developers will not only update, but will assign new keys to all Fedora 8 and 9 releases.

Related content

  • (Update:) Fedora: Chronicle of a Server Break-in

    In August 2008, the Fedora team noticed irregularities on its server. Project leader Paul W. Frields has now released a detailed report of the break-in.

  • Fedora Core 5

    Fedora opens the spring fashion season with a bold new release. We took a look at the latest collection.

  • Fedora Backpedals on Password Free Installation

    A new feature in Fedora 12 was that users could install RPM packages from signed repositories without a root password. "Not good," said many users, so the project decided to reverse the policy.

  • Fedora Investigates Security Incident

    "Based on the results of our investigation so far, we do not believe that any Fedora packages or other Fedora contributor accounts were affected by thiscompromise," said Fedora project leader, Jared Smith in an email to the Fedora announce mailing list.

  • Fedora 21

    Fedora 21 appears with a new vision and some interesting new tools for developers and system administrators.

comments powered by Disqus

Issue 199/2017

Buy this issue as a PDF

Digital Issue: Price $9.99
(incl. VAT)