We can ask Nokia to point <a href="http://maemo.nokia.org">maemo.nokia.org</a>'s DNS records to whatever is set up in the future - they'll likely oblige, as we'll be taking the problem off their hands. (Hopefully. If they don't, then the N900 users who don't browse Maemo.org are in for quite some trouble)<br>
<br>As for the repo signing keys, can we get Nokia to push out an update (mp-fremantle-pr) signed with <b>their</b> keys, and whose purpose it is to change the APT signing key to Maemo.org's new signing key.<br><br>CSSU team and other packagers of alternative mp-fremantle-pr metapackage can follow suit.<br>
<br>That's how we can get signing keys changed with the least user interaction.<br><br><div class="gmail_quote">On Mon, Dec 17, 2012 at 5:40 PM, Iván Gálvez Junquera <span dir="ltr"><<a href="mailto:ivgalvez@gmail.com" target="_blank">ivgalvez@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I have informed Nokia about the problem to try to have a short term solution for the signature expiration.<div><br></div>
<div>In any case, a long term solution needs to be planned. As Joerg commented, even if we can host all files in the future (which is still unclear, specially for third party binaries), keys and URLs would need to be updated.</div>
<div><br></div><div>In the meantime, backuping is essential.</div><div><br></div><div>Regards<br><br><div class="gmail_quote">2012/12/17 Pali Rohár <span dir="ltr"><<a href="mailto:pali.rohar@gmail.com" target="_blank">pali.rohar@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div><div>On Sunday 16 December 2012 18:57:03 robert bauer wrote:<br>
> On Sun, Dec 16, 2012 at 4:51 PM, joerg reisenweber<br>
<<a href="mailto:reisenweber@web.de" target="_blank">reisenweber@web.de</a>>wrote:<br>
> > So 16. Dezember 2012<br>
> ><br>
> > > Hello Maemo Community!<br>
> > ><br>
> > > We have big problem with repositories. Two months ago GPG<br>
> > > key for <a href="http://downloads.maemo.nokia.com" target="_blank">downloads.maemo.nokia.com</a> expired and Hildon<br>
> > > Application Manager refusing to install or reinstall<br>
> > > packages from these<br>
> > > repositories. Part of <a href="http://downloads.maemo.nokia.com" target="_blank">downloads.maemo.nokia.com</a> is OTA and<br>
> > > OVI<br>
> > > Store repository. This means that OVI Store not working<br>
> > > anymore and OTA updates (from PR1.1 or PR1.2) to PR1.3.1<br>
> > > not working too.<br>
> > ><br>
> > > Possible solution could be change expiration of this key,<br>
> > > but<br>
> > > only owner of private GPG key can do that (so only Nokia).<br>
> > ><br>
> > > GPG key used for all OTA & Ovi store repositories is:<br>
> > ><br>
> > > pub 1024D/13FA4ED6 2007-10-05 [expired: 2012-10-03]<br>
> > > uid Nokia repository signing key 4v1<br>
> > ><br>
> > > OVI apt repo:<br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle1.2/ovi/" target="_blank">https://downloads.maemo.nokia.com/fremantle1.2/ovi/</a><br>
> > ><br>
> > > OTA apt repos:<br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/apps/" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/apps/</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/mr0" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/mr0</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/002" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/002</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/003" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/003</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/004" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/004</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/203" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/203</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/204" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/204</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/205" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/205</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/206" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/206</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/207" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/207</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/208" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/208</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/210" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/210</a><br>
> > ><br>
> > > BCCing council & board about this, because Hildon<br>
> > > Application<br>
> > > Manager not working without proper gpg signature and non<br>
> > > working OVI store and OTA repositories are big problem for<br>
> > > N900 users.><br>
> > the more 'interesting' aspect of this problem: it gets<br>
> > *worse* with migration/handover of <a href="http://maemo.org" target="_blank">maemo.org</a> to<br>
> > community/board. Since a) it's unclear if<br>
> > Nokia is planning to continue hosting of those fremantle<br>
> > repos under <a href="http://maemo.nokia.com" target="_blank">maemo.nokia.com</a>, and b) even if community<br>
> > inherits those repos too, we neither<br>
> > can keep the URL nor manage the keys since both is explicitly<br>
> > nokia.<br>
> ><br>
> > /j<br>
> ><br>
> ><br>
> > Nokia does not plan to continue hosting of any maemo repos.<br>
> > Do those<br>
> repos contain 3rd party paid apps? There may be agreements<br>
> between app developers and OVI store, but is there any<br>
> technical reason why we can't make those repos available at<br>
> <a href="http://downloads.maemo.org" target="_blank">downloads.maemo.org</a> and get our own GPG key?<br>
<br>
</div></div>Problem is that if you generate new GPG key and sign with it OVI<br>
store and OTA repos, you must install that GPG key to *every*<br>
N900 device to Hildon Application Manager settings (somewhere in<br>
/usr/share/hildon-application-manager). Without it HAM will<br>
always refuse OTA & OVI repositories, because it has *invalid*<br>
key in configuration...<br>
<span><font color="#888888"><br>
--<br>
Pali Rohár<br>
<a href="mailto:pali.rohar@gmail.com" target="_blank">pali.rohar@gmail.com</a></font></span><br></div></div>_______________________________________________<br>
maemo-community mailing list<br>
<a href="mailto:maemo-community@maemo.org" target="_blank">maemo-community@maemo.org</a><br>
<a href="https://lists.maemo.org/mailman/listinfo/maemo-community" target="_blank">https://lists.maemo.org/mailman/listinfo/maemo-community</a><br>
<br></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><div><br></div>-- <br>Iván Gálvez Junquera<br>
</font></span></div>
<br>_______________________________________________<br>
maemo-community mailing list<br>
<a href="mailto:maemo-community@maemo.org">maemo-community@maemo.org</a><br>
<a href="https://lists.maemo.org/mailman/listinfo/maemo-community" target="_blank">https://lists.maemo.org/mailman/listinfo/maemo-community</a><br>
<br></blockquote></div><br>