On the subject of debian...

[John Heim]

I would say you can *probably* safely live with those warnings.  Some 
people I work with would refuse to use debian  because this particular 
security feature was absent.  It's a long over due addition.  I haven't 
used Red Hat in years but i guess they had the equivalent feature for quite 
some time.

Anyway, I never heard of anyone having a problem with a spoofed mirror.

At 05:52 PM 4/19/2006, Charles Hallenbeck wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Gena,
>
>There are three steps to follow, maybe the first is already done. If you
>are not a gnupg user, this is the first step, as root:
>
>apt-get install gnupg
>
>
>Then you must use your cut and paste speakup feature to examine that
>error, and capture the fingerprint of the encryption key that is shown
>to you. Plug it into the second step in place of the one that is shown.
>Again as root, type this:
>
>gpg --keyserver keyring.debian.org --recv 60B6B958
>
>
>Finally, there is a third step. Again, as root, type this:
>
>gpg --armor --export  | apt-key add -
>
>
>That should do it. What is happening is that the archives have begun to
>offer public key signing as an authentication method for the indices of
>the repositories. There is just one key per repository that uses this
>method. You can safely ignore the whole thing and just live with those
>errors if you wish, they are only harmless warnings, but following the
>above steps will retrieve the public key required by your system to
>verify the signature that now accompanies some of those repository
>indices when you do an apt-get update.
>
>This whole subject is covered in painful detail on discussion lists and
>in several wiki's, but the above steps should do it for you.
>
>HTH
>Chuck
>
>
>
>- --
>The Moon is Waning Gibbous (63% of Full)
>Get downloads from http://www.mhcable.com/~chuckh
>   and remember, INFORMATION WANTS TO BE FREE!
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.3 (GNU/Linux)
>
>iD8DBQFERr9IXnuiIOyDVQURAkJXAJ9YggVLFGig1EsuJAOabDpuDqCLfACfUR9g
>n/kh03CX99xK2gbHlpLjxf0=
>=g5R3
>-----END PGP SIGNATURE-----
>
>_______________________________________________
>Speakup mailing list
>Speakup at braille.uwo.ca
>http://speech.braille.uwo.ca/mailman/listinfo/speakup