<br><br><div class="gmail_quote">On Mon, Dec 17, 2012 at 1:50 AM, Pali Rohár <span dir="ltr"><<a href="mailto:pali.rohar@gmail.com" target="_blank">pali.rohar@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">On Sunday 16 December 2012 18:57:03 robert bauer wrote:<br>
> On Sun, Dec 16, 2012 at 4:51 PM, joerg reisenweber<br>
<<a href="mailto:reisenweber@web.de">reisenweber@web.de</a>>wrote:<br>
> > So 16. Dezember 2012<br>
> ><br>
> > > Hello Maemo Community!<br>
> > ><br>
> > > We have big problem with repositories. Two months ago GPG<br>
> > > key for <a href="http://downloads.maemo.nokia.com" target="_blank">downloads.maemo.nokia.com</a> expired and Hildon<br>
> > > Application Manager refusing to install or reinstall<br>
> > > packages from these<br>
> > > repositories. Part of <a href="http://downloads.maemo.nokia.com" target="_blank">downloads.maemo.nokia.com</a> is OTA and<br>
> > > OVI<br>
> > > Store repository. This means that OVI Store not working<br>
> > > anymore and OTA updates (from PR1.1 or PR1.2) to PR1.3.1<br>
> > > not working too.<br>
> > ><br>
> > > Possible solution could be change expiration of this key,<br>
> > > but<br>
> > > only owner of private GPG key can do that (so only Nokia).<br>
> > ><br>
> > > GPG key used for all OTA & Ovi store repositories is:<br>
> > ><br>
> > > pub 1024D/13FA4ED6 2007-10-05 [expired: 2012-10-03]<br>
> > > uid Nokia repository signing key 4v1<br>
> > ><br>
> > > OVI apt repo:<br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle1.2/ovi/" target="_blank">https://downloads.maemo.nokia.com/fremantle1.2/ovi/</a><br>
> > ><br>
> > > OTA apt repos:<br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/apps/" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/apps/</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/mr0" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/mr0</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/002" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/002</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/003" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/003</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/004" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/004</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/203" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/203</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/204" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/204</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/205" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/205</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/206" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/206</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/207" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/207</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/208" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/208</a><br>
> > > <a href="https://downloads.maemo.nokia.com/fremantle/ssu/210" target="_blank">https://downloads.maemo.nokia.com/fremantle/ssu/210</a><br>
> > ><br>
> > > BCCing council & board about this, because Hildon<br>
> > > Application<br>
> > > Manager not working without proper gpg signature and non<br>
> > > working OVI store and OTA repositories are big problem for<br>
> > > N900 users.><br>
> > the more 'interesting' aspect of this problem: it gets<br>
> > *worse* with migration/handover of <a href="http://maemo.org" target="_blank">maemo.org</a> to<br>
> > community/board. Since a) it's unclear if<br>
> > Nokia is planning to continue hosting of those fremantle<br>
> > repos under <a href="http://maemo.nokia.com" target="_blank">maemo.nokia.com</a>, and b) even if community<br>
> > inherits those repos too, we neither<br>
> > can keep the URL nor manage the keys since both is explicitly<br>
> > nokia.<br>
> ><br>
> > /j<br>
> ><br>
> ><br>
> > Nokia does not plan to continue hosting of any maemo repos.<br>
> > Do those<br>
> repos contain 3rd party paid apps? There may be agreements<br>
> between app developers and OVI store, but is there any<br>
> technical reason why we can't make those repos available at<br>
> <a href="http://downloads.maemo.org" target="_blank">downloads.maemo.org</a> and get our own GPG key?<br>
<br>
</div></div>Problem is that if you generate new GPG key and sign with it OVI<br>
store and OTA repos, you must install that GPG key to *every*<br>
N900 device to Hildon Application Manager settings (somewhere in<br>
/usr/share/hildon-application-manager). Without it HAM will<br>
always refuse OTA & OVI repositories, because it has *invalid*<br>
key in configuration...<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Pali Rohár<br>
<a href="mailto:pali.rohar@gmail.com">pali.rohar@gmail.com</a></font></span></blockquote></div><br><font color="#ff0000">I think there's little chance that maemo apps will continue to be available at OVI store. I know it's not preferred, but the solution seems to be a new GPG key signed with repos at <a href="http://maemo.org">maemo.org</a>. CSSU could put it in their next update. I know it's not preferable and obviously we'll have to notify N900 users, but in the absence of any alternative, is there any technical reason we could not provide a simple download button </font><font color="#ff0000"><font color="#ff0000">at <a href="http://maemo.org">maemo.org</a> (which we will soon control) </font>for N900 users to get the new GPG key?<br>
<br>Rob</font><br><br><br>