Confirm package before install

[Anders F Björklund]

Hai Ho Thanh wrote:

> Hi there,
> Now I am investigating smart as update tool for my system. I  
> installed smart in CentOS, created a http repository with some  
> packages. I signed these packages with my gpg key and I want smart  
> using that key to confirm these packages before install.
> I used: smart config --set keyserver=http://myserver/MY-GPG-KEY-file
> But smart did not import the key and it could not install the  
> signed package.
> Is there something wrong in my config?
> Have smart got the other method to import the key?

As far as I know, Smart doesn't (yet) support keys for RPM metadata  
channels (only for APT)
So there is no straightforward translation for the "gpgcheck" and  
"gpgkey" Yum options...

e.g.
[base]
name=CentOS-$releasever - Base
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch= 
$basearch&repo=os
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5

You can still install the key with RPM, but I guess it would make a  
nice feature to have.
Should be a patch for it available ? http://tracker.labix.org/issue96  
(and issue97 too)

--anders