Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is a gpg key and why do i need it?

I get this nagging error when i install a fresh centos vps machine:

GPG key retrieval failed: [Errno 5] OSError: [Errno 2] No such file or directory: '/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL'

share|improve this question

1 Answer 1

up vote 4 down vote accepted

A key like this is used to sign and verify the packages you are downloading to be sure they are legit.

If the error you describe happens you should be prompted to download a replacement set of keys from the net. If not you can do so by hand.

Strictly speaking these signatures are not necessary - you can still install software as you have seen - but the security of your system is significantly reduced without their use.

share|improve this answer
    
Ah thank you. great answer! –  chrisjlee Feb 1 '12 at 18:44
    
I don't know about significantly reduced. If you are retrieving the GPG key using from the same source over the same network as the package, it seems just as likely that someone could serve up an invalid key for you to download as they could the package. –  Zoredache Feb 1 '12 at 18:47
    
@Zoredache - fair enough. My understanding is that the file is downloaded one time and cached, therefore unless the mirror was compromised at the time the new repo started use that would be detected. Sound right to you? –  Tim Brigham Feb 1 '12 at 19:18
1  
Normally you would get your first key via the installation media, which you would have verified via some other method. The first key will then be used to verify any other keys. If you are talking about 3rd party repos, you would want to verify those using some other method. –  Zoredache Feb 1 '12 at 19:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.