I've created yum repository, to which I've uploaded an unsigned rpm file.
I've indexed and signed the repo itself, by creating a repodata directory with the following files:
repomd.xml.key (the public key with which I've signed the repomd.xml.asc)
on the client side i've created a new repo configuration file, at: /etc/yum.repos.d, ad set the gpgcheck=1 so that the will be a signature check.
When using 'yum install', it seems that the repomd.xml.asc and repomd.xml.key are ignored, and only a signing of the rpm file passes the signature check.
I was under the impression that signing the repo and placing the repomd.xml.asc and repomd.xml.key would come instead of signing each rpm file separately.
- was that assumption wrong?
- is there any benefit in signing the repo?
- is there any other way to sign the repo, and bypass the need to sign each rpm package?
*using centos 6.6 on Oracle vm *
Thanks in advance.