Distributions: GPG key for RPM packages

Created on 7 Oct 2016 · 4Comments · Source: nodesource/distributions

I can see that the RPM packages are signed with GPG key ID 5ddbe8d434fa74dd but I can not find the key anywhere. Please could you provide the GPG key on the web as you did for DEB packages?

Source

jtyr

Most helpful comment

Request to reopen..

I really do not understand why the GPG signing key is not published in the same way as the GPG signing key for Debian packages already is..

Please define "standard keyservers" - I didn't find it anywhere - Even not on the Ubuntu keyservers

And please explain your decision to close this request without any further actions..

Current Situation:
The installation method for nodejs under RHEL is horrible. Curling a bash script and pipe it to a root shell... Seriously? Disgusting!

Requirement:
We use Configuration Management to provisionize repository configurations. As we need to provide a GPG Key for the yum repository configuration we need to grab it from at least somewhere.

Definition of Done:
Host the GPG signing key for RPM packages the same way you are doing it for DEB packages.

Debian: https://deb.nodesource.com/gpgkey/nodesource.gpg.key
RHEL (proposed): https://rpm.nodesource.com/gpgkey/nodesource.gpg.key

n3ph on 5 Apr 2019

👍5 ❤1

All 4 comments

It _should_ be available from the standard keyservers. If it's not for some reason, you can grab a release rpm and unpack it to get the key with something like:

rpm2cpio nodesource-release-fc24-1.noarch.rpm | cpio -ivd

and it will be one of the files that gets unpacked.

chrislea on 7 Oct 2016

👎3 😕1

Users shouldn't need to get the GPG key from a key server or extract it from RPM. The key should be available for download from your page in the same way as it's for the Debian packages.

Please expose the GPG key on your web in order users can freely download it without any additional complications.

jtyr on 13 Oct 2016

👍3 👀1 ❤1

Request to reopen..

I really do not understand why the GPG signing key is not published in the same way as the GPG signing key for Debian packages already is..

Please define "standard keyservers" - I didn't find it anywhere - Even not on the Ubuntu keyservers

And please explain your decision to close this request without any further actions..

Current Situation:
The installation method for nodejs under RHEL is horrible. Curling a bash script and pipe it to a root shell... Seriously? Disgusting!

Definition of Done:
Host the GPG signing key for RPM packages the same way you are doing it for DEB packages.

Debian: https://deb.nodesource.com/gpgkey/nodesource.gpg.key
RHEL (proposed): https://rpm.nodesource.com/gpgkey/nodesource.gpg.key

n3ph on 5 Apr 2019

👍5 ❤1

Please define "standard keyservers" - I didn't find it anywhere - Even not on the Ubuntu keyservers

gpg --keyserver ha.pool.sks-keyservers.net --recv-key 5ddbe8d434fa74dd
gpg: key 5DDBE8D434FA74DD: public key "NodeSource <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1