I installed my newly downloaded and burned Mandrake 10.0 CDs at work today, and I wanted to update my software to get all the security updates and bug fixes. However when I tried to install the updated software I received the error that the packages I was trying to install had bad signatures.
Package signatures are a way for the users to verify that the software they are about to install has not been changed since the original developers released it. A bad signature on a package can be caused by the package being corrupted, the package being compromised by some evil doer, but the most common reason is that you don’t have the public key required to verify the package signature. In my case I had the wrong keys.
You can see what keys you have available via the command line with:
rpm -qa gpg-pubkey .
The key can be displayed on the command line with:
rpm -qi gpg-pubkey-XXXXXXXX .
Where XXXXXXXX is the key-id.
I found that these keys differed from the ones in /etc/RPM-GPG-KEYS/
After removing the old keys:
rpm -e rpm -e gpg-pubkey-22458a98-3969e7de … .
I imported the new keys:
rpm –import /etc/RPM-GPG-KEYS/*.asc .
And all was well. Now I can install packages from Mandrake and not have to worry about the dreaded bad signatures error.
* Sources: This link helped me get going.
I did what you said about fixing the bad signature error by doing an rpm -import. IT added all three keys in my etc\rpm-gpg-keys folder to the list making two of the keys redundant as they were irremovable due to some software dependencies on them. So now I have five keys in there and two are redundant and I still can’t install appache for some reason. I am a first time linux user and I want to serve out mysql and php scripts I’m having a rocky time configuring the whole thing and any help you could give me would be great. – Thanks Sam
Sam,
I recommend asking this question on the IRC channels ##mandrake or the newer ##mandriva on irc.freenode.org as my blog is not meant to be a support forum.
Thank you.