Re: deb-multimedia repository
On 8/21/13, Ralf Mardorf <ralf.mardorf@alice-dsl.net> wrote:
> On Wed, 2013-08-21 at 13:38 +0200, Jochen Spieker wrote:
>> Essentially, you have a chicken and egg problem.
>
> Wrong!
Subtle!
> Keys usually are available by a keyserver you could trust, so for the
> first time you'll get the key this way. Such a package will update keys
> as long as the older keys still can be used.
This makes sense, but aren't you just pushing the "chicken or egg"
problem to the keyserver?
Ie, how do you trust the keyserver?
If this 'problem' were not the case, then why does not the packages
pre-depends on -keyring, and automatically install it first, without
any security problems, and without any warning to user?
Surely if this were possible, that's what would be done?
Regards
Zenaan
Reply to: