Subject: [alpine-devel] APK Packages Missing Signatures

From: Ladar Levison <[email-masked]>
Date: Mon, 4 Jun 2018 20:53:31 -0500

It seems several packages have made it out to the mirrors without
signatures. It doesn't appear to be every package. The following are the
ones I know about:

ERROR: busybox-1.27.2-r10: UNTRUSTED signature
ERROR: ssl_client-1.27.2-r10: UNTRUSTED signature
ERROR: busybox-suid-1.27.2-r10: UNTRUSTED signature

And if you run:

curl --silent
https://dl-3.alpinelinux.org/alpine/v3.7/main/x86_64/busybox-1.27.2-r10.apk
| gunzip | tar --list

Note lack of an SIGN.RSA file. (I'm assuming that is the file which is
supposed to hold the signature.)

L~

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Natanael Copa <[email-masked]>
Date: Thu, 7 Jun 2018 13:23:08 +0200

On Mon, 4 Jun 2018 20:53:31 -0500

> ERROR: busybox-suid-1.27.2-r10: UNTRUSTED signature

This should be fixed now. Thanks for the report.

-nc

---

---

From: Ladar Levison <[email-masked]>
Date: Fri, 8 Jun 2018 05:03:40 -0500

> This should be fixed now. Thanks for the report.

Fix confirmed. The box building robots are once again happy. Thank you.

L~

---