Gluster users - Mar 2014 - Gluster EPEL packages not signed

Hi,

I saw that this issue has been raised before for staging packages, but I'm
wanting to bring to the attention of the relevant people/person that the LATEST
Gluster stable packages are also not signed. There are no contact details within
the package headers (see below), so I can't simply email the package
maintainer. In any case, there can be zero trust placed in these packages. There
is a GPG key assigned to the repo. Why not use it?

# rpm -qpi /var/www/html/repo/gluster-epel-5-x86_64/glusterfs-fuse-3.4.2-1.e
l5.x86_64.rpm
Name        : glusterfs-fuse               Relocations: (not relocatable)
Version     : 3.4.2                             Vendor: Fedora Project
Release     : 1.el5                         Build Date: Fri 03 Jan 2014 10:39:14
PM EST
Install Date: (not installed)               Build Host: buildvm-26.phx2.fedorapr
oject.org
Group       : Applications/File             Source RPM: glusterfs-3.4.2-1.el5.sr
c.rpm
Size        : 225484                           License: GPLv2 or LGPLv3+
Signature   : (none)
Packager    : Fedora Project
URL         : http://www.gluster.org/docs/index.php/GlusterFS
Summary     : Fuse client
Description :

Regards,
Grant

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://supercolony.gluster.org/pipermail/gluster-users/attachments/20140307/de748be6/attachment.html>

> 
> I saw that this issue has been raised before for staging packages, but
I'm
> wanting to bring to the attention of the relevant people/person that the
> LATEST Gluster stable packages are also not signed. There are no contact
> details within the package headers (see below), so I can't simply email
the
> package maintainer. In any case, there can be zero trust placed in these
> packages. There is a GPG key assigned to the repo. Why not use it?
> 
> 
> 
> # rpm -qpi
/var/www/html/repo/gluster-epel-5-x86_64/glusterfs-fuse-3.4.2-1.el5.x86_64.rpm
> 
>
First off, it's only the el5 RPMs that are not signed.

They aren't signed because YUM install of signed packages on RHEL5 and
CentOS5 barfs on the signature.

If you know how to sign el5 packages so that yum doesn't barf, please share.

--

Kaleb