Julian,
There is no such thing as perfect security. I was and am using a trusted
mirror, so I'm much more worried about the Windows machines I have to use
at work, and are necessarily linked to my linux boxes. So, please,
understand that I understand the (small) risk I have taken. I wouldn't even
take the time to verify my packages later, as it's not worth the
investment. I have good backups of all my important stuff, and I would
notice a bot eventually. So, could we please get back to my question?
Is there any way to fix my keys?
BTW, I have worked on systems that deal with legal property ownership, so I
appreciate matching effort to risk.
Thanks, Pete
On 25 May 2017 at 19:00, Julian Andres Klode <j...@debian.org> wrote:
> On Thu, May 25, 2017 at 06:49:31PM +1000, Peter Miller wrote:
> > David,
> >
> > Thanks for your time on this. I am surprised that the answer to this
> issue
> > is a re-install: it's only the keys that are corrupt somehow, and I am
> > surprised there is not a simple way to fix this. I have an unusual setup
> > with a mirrored ZFS pool as my home directory, so I'm a little
> > apprehensive. I know a re-install is usually not a big issue, but I'd
> > rather not take that risk in this situation.
>
> You are completely missing the point (any package you installed unchecked
> could be MITMed was what he said), and the second half of David's email
> (to look at the files in trusted.gpg.d and fix/remove the wrong ones).
>
> You know, that bit:
>
> > On 23 May 2017 at 21:35, David Kalnischkies <da...@kalnischkies.de>
> wrote:
> > > Julian was asking basically for running both:
> > > ls -l /etc/apt/trusted.gpg{,.d}
> > > file /etc/apt/trusted.gpg{,.d/*}
> > >
> > > As he thinks it might be a permission/wrong-file-in-there problem,
> which
> > > is the most likely cause… I would add a "stat /tmp" as I have seen it
> > > a few times by now that people had very strange permissions on /tmp
> > > – all of which usually caused by "fixing" some problem earlier…
>
> --
> Debian Developer - deb.li/jak | jak-linux.org - free software dev
> | Ubuntu Core Developer |
> When replying, only quote what is necessary, and write each reply
> directly below the part(s) it pertains to ('inline'). Thank you.
>
