[Alert] PR1.2 install bug - take action now! - Page 2 - maemo.org

Active Topics

Firefox with Leste (5)
to Maemo 7 / Leste by teroyk - 4 days, 10 hrs ago
Handbook (2)
to Maemo 7 / Leste by teroyk - 5 days, 10 hrs ago
more...

Page 2 of 3

< Prev

Next >

Thread Tools

itsnotabigtruck	2012-02-21 , 22:17
Posts: 245 \| Thanked: 915 times \| Joined on Feb 2012	#11

Originally Posted by caco3

@itsnotabigtruck:
Do you have any source for your statements?

This is all based on tests by N950 PR1.2beta users on the #harmattan IRC - you can see an example of exactly what happens when the problem hits in the attachments of Harmattan Bug 978.

Note that the bug doesn't affect installing .debs that aren't part of an unsigned APT repository - so you won't experience this if you're running dpkg -i on your own packages.

If you want to try testing on your N9, I've sent you my IM info in PM.

Originally Posted by caco3

Also, I am wondering, do apps in the OVI store somehow get signed?
I pack my (Python) apps in scratchbox, so I am sure there is no signing there, especially since I never generated a key.
I have a N9 for testing my apps with a quite up to date PR 1.2 beta and haven’t seen any issues with this.

Apps submitted to the Ovi Store get signed when published. Try downloading a .deb from the store and running ar tv package.deb - the _x509sig file is the signature. However, that's a different system from what I'm talking about; with APT repository signing, the list of packages is signed instead of each individual .deb. Unlike the other system, repository signing is part of APT itself and is used on other distros like Debian, Ubuntu, etc.

Last edited by itsnotabigtruck; 2012-02-21 at 22:24.

Quote & Reply |

The Following User Says Thank You to itsnotabigtruck For This Useful Post:
pelago

	www.rzr.online.fr	2012-02-21 , 23:38
	Posts: 1,348 \| Thanked: 1,863 times \| Joined on Jan 2009 @ fr/35/rennes	#12

hi

Can you tell us how could obs been setup to handle signed package ?

it looks this need to be configured server side isnt it ?

# rzr@lap:home:rzr/ # [1] # osc signkey
home:rzr has no key, trying home
Server returned an error: HTTP Error 404: Not Found
home
# rzr@lap:home:rzr/ # [1] # osc signkey --create
Server returned an error: HTTP Error 400: Bad Request
don't know how to create a key

__________________
Current obsession:

https://purl.org/rzr/abandonware

Please help to list all maemo existing apps :

https://github.com/abandonware/aband...ment-578143760

https://wiki.maemo.org/Apps#

I am looking for " 4 inch TFT LCD display screen " for Nokia n950 HandSet

http://rzr.online.fr/q/lcd

Also, I need online storage to archive files :

http://db.tt/gn5Qffd6#

https://my.pcloud.com/#page=register...e=g8ikZmcfEJy#

Quote & Reply |

Zoxir	2012-02-22 , 00:15
Posts: 273 \| Thanked: 463 times \| Joined on May 2011 @ Athens	#13

What about the packages we have already installed from the SDK repo????? I have quite a few. If this breaks or removes something I will be very very pissed.

Quote & Reply |

itsnotabigtruck	2012-02-22 , 00:18
Posts: 245 \| Thanked: 915 times \| Joined on Feb 2012	#14

Originally Posted by Zoxir

What about the packages we have already installed from the SDK repo????? I have quite a few. If this breaks or removes something I will be very very pissed.

Those should be left alone during the upgrade - this only affects new installations. Also, the bug can be worked around, so you'll still be able to install SDK packages if you need to post-upgrade...it just won't be a matter of a simple apt-get anymore.

Quote & Reply |

The Following User Says Thank You to itsnotabigtruck For This Useful Post:
Zoxir

Zoxir	2012-02-22 , 01:08
Posts: 273 \| Thanked: 463 times \| Joined on May 2011 @ Athens	#15

Originally Posted by itsnotabigtruck

Those should be left alone during the upgrade - this only affects new installations. Also, the bug can be worked around, so you'll still be able to install SDK packages if you need to post-upgrade...it just won't be a matter of a simple apt-get anymore.

Ok man thanx I already saw the workaround but I was worried about the already installed packages. hopefully you are right

Quote & Reply |

	ibrakalifa	2012-02-22 , 02:11
	Posts: 1,583 \| Thanked: 1,203 times \| Joined on Dec 2011 @ Everywhere	#16

really limited N9, maybe this device is not that good, *sigh

__________________
~$
~#

Quote & Reply |

itsnotabigtruck	2012-02-22 , 02:13
Posts: 245 \| Thanked: 915 times \| Joined on Feb 2012	#17

Originally Posted by ibrakalifa

really limited N9, maybe this device is not that good, *sigh

Not to worry...for every limitation, there's always an unlimitation.

Quote & Reply |

The Following 2 Users Say Thank You to itsnotabigtruck For This Useful Post:
caco3, ibrakalifa

	ibrakalifa	2012-02-22 , 02:28
	Posts: 1,583 \| Thanked: 1,203 times \| Joined on Dec 2011 @ Everywhere	#18

i still cant find 64gb version here in Indonesia, ty sir, N900 also limited one, but became an unlimited when came to the right hand,

__________________
~$
~#

Quote & Reply |

munozferna	2012-02-22 , 17:47
Posts: 203 \| Thanked: 538 times \| Joined on Oct 2009 @ Colombia	#19

Originally Posted by itsnotabigtruck

THE ISSUE

In the upcoming PR1.2 release, the installer contains an issue that will block packages from custom APT repositories from being installed unless they contain Secure APT signatures.

I suppose they don't want us to use the SDK repo on the devices, we should be allowed if we wanted though. Just a question, if they release an updated Harmattan Scratchbox (for PR1.2) with the new apt, wouldn't it be affected by the same issue?

Quote & Reply |

mikecomputing	2012-02-22 , 19:03
Posts: 3,464 \| Thanked: 5,107 times \| Joined on Feb 2010 @ Gothenburg in Sweden	#20

Originally Posted by itsnotabigtruck

This isn't the same as SSL certificates - APT security doesn't even use SSL, or certificates. While APT signatures can make things more secure for expert users, this isn't going to provide any benefit to anyone in most cases. Instead, it'll just make it harder to set up repositories distributing additional N9 apps, and confuse users with strange error messages.

Deploying APT signatures also does nothing to protect against malware in any realistic scenario - though since malware follows the money, I highly doubt such programs will ever be a serious threat on Harmattan.

However, in order to have things continue to work smoothly on PR1.2, it's going to be necessary to use APT signatures anyway, so it's time to get started.

I know apt security is no SSL... My point was moe about allow/deny dialogs etc...

But why would debian implement apt security framework if everyone setting up a repo decided to not use it!? I see is as an ENDUSER not as dev. Endusers doesnt understand all those security warnings and better not include all those damn warnings and just deny them.

I am way from an expert on this but to me it looks like no issue.

Because devs(and nokia) SHOULD provide "the keys" and the problem is gone.

To me there is more important stuff that should be fixed...

Last edited by mikecomputing; 2012-02-22 at 19:22.