Confusion with RPM Fusion's signing keys.
Hello. I'm a little confused about RPM Fusion and it's signing keys. I've been reading something about PGP, but in general terms I am illiterate with respect to cryptography.
What I understand by what I've read is that each package in RPM Fusion has associated a GPG Signature such that, before the package is installed, yum verifies. This is to check integrity of the package.
But here is where I get confused: it seems that you can also check the integrity of the whole RPM Fusion repo, so you are given the fingerprint keys to compare them after you have installed the repo.
So my questions would be:
- Is what I wrote above correct or I am misunderstanding something?
- If I understood well then, how can I check the fingerprint of RPM Fusion?
- The instruction to install the repos is to type the following command:
su -c 'yum localinstall --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm'
. So I wonder: if I remove the--nogpgcheck
option in the command above, do I not spare the after-installation gpg key checking? - How necessary is it really to check the repo's keys? I'm asking this because the Livna repo (which I also plan to install since it is complementary to RPM Fusion) does not provide any.
Thank you and excuse me for this long post.
Livna is now obsolete... for security all repository should include a gpg key...