signing yum repository doesn't help passing the gpg check upon 'yum install'

Question

I've created yum repository, to which I've uploaded an unsigned rpm file.

I've indexed and signed the repo itself, by creating a repodata directory with the following files:

filelists.xml.gz,

other.xml.gz,

primary.xml.gz,

repomd.xml,

repomd.xml.asc,

repomd.xml.key (the public key with which I've signed the repomd.xml.asc)

on the client side i've created a new repo configuration file, at: /etc/yum.repos.d, ad set the gpgcheck=1 so that the will be a signature check.

When using 'yum install', it seems that the repomd.xml.asc and repomd.xml.key are ignored, and only a signing of the rpm file passes the signature check.

I was under the impression that signing the repo and placing the repomd.xml.asc and repomd.xml.key would come instead of signing each rpm file separately.

1. was that assumption wrong?
2. is there any benefit in signing the repo?
3. is there any other way to sign the repo, and bypass the need to sign each rpm package?

*using centos 6.6 on Oracle vm *

Thanks in advance.

Answer 1

Answers below. 1: gpgcheck controls verifying package signatures after download, not repositories. 2: signing the repository provides a means to verify no tampering with repository metadata. that is a benefit albeit minor when downloading from a FQDN. 3) you can resign all the packages in the repository with a single rpm command.

Answer 2

to have yum check the repository signature, you need to add an option to the repo in /etc/yum.repos.d :

repo_gpgcheck=1

if you did not sign your rpms individually set gpgcheck=0 in that file.