[maemo-community] BIG problem with Maemo repositories!

[From: robert bauer]

On Mon, Dec 17, 2012 at 1:50 AM, Pali Rohár <pali.rohar at gmail.com> wrote:

> On Sunday 16 December 2012 18:57:03 robert bauer wrote:
> > On Sun, Dec 16, 2012 at 4:51 PM, joerg reisenweber
> <reisenweber at web.de>wrote:
> > > So  16. Dezember 2012
> > >
> > > > Hello Maemo Community!
> > > >
> > > > We have big problem with repositories. Two months ago GPG
> > > > key for downloads.maemo.nokia.com expired and Hildon
> > > > Application Manager refusing to install or reinstall
> > > > packages from these
> > > > repositories. Part of downloads.maemo.nokia.com is OTA and
> > > > OVI
> > > > Store repository. This means that OVI Store not working
> > > > anymore and OTA updates (from PR1.1 or PR1.2) to PR1.3.1
> > > > not working too.
> > > >
> > > > Possible solution could be change expiration of this key,
> > > > but
> > > > only owner of private GPG key can do that (so only Nokia).
> > > >
> > > > GPG key used for all OTA & Ovi store repositories is:
> > > >
> > > > pub   1024D/13FA4ED6 2007-10-05 [expired: 2012-10-03]
> > > > uid                  Nokia repository signing key 4v1
> > > >
> > > > OVI apt repo:
> > > > https://downloads.maemo.nokia.com/fremantle1.2/ovi/
> > > >
> > > > OTA apt repos:
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/apps/
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/mr0
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/002
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/003
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/004
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/203
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/204
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/205
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/206
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/207
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/208
> > > > https://downloads.maemo.nokia.com/fremantle/ssu/210
> > > >
> > > > BCCing council & board about this, because Hildon
> > > > Application
> > > > Manager not working without proper gpg signature and non
> > > > working OVI store and OTA repositories are big problem for
> > > > N900 users.>
> > > the more 'interesting' aspect of this problem: it gets
> > > *worse* with migration/handover of maemo.org to
> > > community/board. Since a) it's unclear if
> > > Nokia is planning to continue hosting of those fremantle
> > > repos under maemo.nokia.com, and b) even if community
> > > inherits those repos too, we neither
> > > can keep the URL nor manage the keys since both is explicitly
> > > nokia.
> > >
> > > /j
> > >
> > >
> > > Nokia does not plan to continue hosting of any maemo repos.
> > > Do those
> > repos contain 3rd party paid apps?  There may be agreements
> > between app developers and OVI store, but is there any
> > technical reason why we can't make those repos available at
> > downloads.maemo.org and get our own GPG key?
>
> Problem is that if you generate new GPG key and sign with it OVI
> store and OTA repos, you must install that GPG key to *every*
> N900 device to Hildon Application Manager settings (somewhere in
> /usr/share/hildon-application-manager). Without it HAM will
> always refuse OTA & OVI repositories, because it has *invalid*
> key in configuration...
>
> --
> Pali Rohár
> pali.rohar at gmail.com


I think there's little chance that maemo apps will continue to be available
at OVI store.  I know it's not preferred, but the solution seems to be a
new GPG key signed with repos at maemo.org.  CSSU could put it in their
next update.  I know it's not preferable and obviously we'll have to notify
N900 users, but in the absence of any alternative, is there any technical
reason we could not provide a simple download button at maemo.org (which we
will soon control) for N900 users to get the new GPG key?

Rob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.maemo.org/pipermail/maemo-community/attachments/20121221/d1cdeb0c/attachment.htm>