What happens when it fails to find a Release.gpg on the server ? Does it warn you that it is not signed? Must every application be signed when released to Ubuntu ? How does Synaptic tell the difference between an application which was never signed ? <div>On 12/6/05, Christian Bjälevik <<a href="mailto:nafallo@magicalforest.se">nafallo@magicalforest.se</a>> wrote:<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> mån 2005-12-05 klockan 13:47 -0500 skrev Peter Pun: > Hi, > > Does Synaptic authenticate all packagaes ? Or are only packages named > "something-ubuntu" authenticated? Does it use gpg and md5 ? > > Peter It tries to authenticate everything, but it will only succeed if there is a Release.gpg on the mirror/repo. Sincerely, /C -- Christian Bjälevik <<a href="mailto:nafallo@ubuntu.com"> nafallo@ubuntu.com</a>> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQBDlbmvLdqCW1CcunERAgw0AKCSHFmKKkcE4yHkgJFRx6PWMvKA1wCffh6f NZRFOL40REzt2yT9XAZBoVE= =MOmm -----END PGP SIGNATURE----- -- ubuntu-hardened mailing list <a href="mailto:ubuntu-hardened@lists.ubuntu.com">ubuntu-hardened@lists.ubuntu.com</a> <a href="http://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened">http://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened </a> </blockquote></div>