Concerted about README instruction of gpg key

[sarim]

This continues from PR #788

The instruction for Fedora produces the follow repo file

[shiftkey]
name=GitHub Desktop
baseurl=https://mirror.mwt.me/ghd/rpm
enabled=1
gpgcheck=0
repo_gpgcheck=1
gpgkey=https://mirror.mwt.me/ghd/gpgkey

gpgcheck=0 is troublesome, it should be gpgcheck=1. But then dnf complains that packages are not signed.
Also gpgkey= file refers to the url of gpgkey, making dnf import key from this url. This kinda makes previous rpm --import command confusing (and redundant?). If it's really needed to be mentioned twice, Maybe save the url to a variable, ex:

SHIFTKEY_GPG_KEY=https://mirror.mwt.me/ghd/gpgkey

rpm --import $SHIFTKEY_GPG_KEY

echo -e "[shiftkey]\nname=GitHub Desktop\nbaseurl=https://mirror.mwt.me/ghd/rpm\nenabled=1\ngpgcheck=0\nrep
o_gpgcheck=1\ngpgkey=$SHIFTKEY_GPG_KEY"

[shiftkey]

@sarim

gpgcheck=0 is troublesome, it should be gpgcheck=1.

I've set both gpgcheck=1 and repo_gpgcheck=1 in #836 which seems to work for my package feed but I've left this config alone for @mwt's feed as it mirrors PackageCloud which doesn't satisfy gpgcheck=1 currently.

Trying to set both:

$ cat /etc/yum.repos.d/mwt-packages.repo 
[mwt-packages]
name=GitHub Desktop
baseurl=https://mirror.mwt.me/ghd/rpm
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirror.mwt.me/ghd/gpgkey

This is what sudo yum install github-desktop does:

Total                                                                                                              32 MB/s | 169 MB     00:05     
Package github-desktop-3.0.5.linux1-1.x86_64.rpm is not signed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'yum clean packages'.
Error: GPG check FAILED

Backing this out succeeds:

$ cat /etc/yum.repos.d/mwt-packages.repo 
[mwt-packages]
name=GitHub Desktop
baseurl=https://mirror.mwt.me/ghd/rpm
enabled=1
gpgcheck=0
repo_gpgcheck=1
gpgkey=https://mirror.mwt.me/ghd/gpgkey

And using the other feed works:

$ cat /etc/yum.repos.d/shiftkey-packages.repo 
[shiftkey-packages]
name=GitHub Desktop
baseurl=https://rpm.packages.shiftkey.dev/rpm/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm.packages.shiftkey.dev/gpg.key

With sudo yum install github-desktop installing the latest version successfully:

  Verifying        : github-desktop-3.1.7.linux1-1.x86_64                                                                                 122/122 
Installed products updated.

Installed:
  ...                       
  giflib-5.2.1-9.el9.x86_64                                                      github-desktop-3.1.7.linux1-1.x86_64                            
  ...

Complete!

Also gpgkey= file refers to the url of gpgkey, making dnf import key from this url. This kinda makes previous rpm --import command confusing (and redundant?).

I don't have a strong opinion on this.

[mwt]

Presumably, I'm going to change the mirror to pull from yours so that the packages are up to date. When I do that, we can turn the verification on.

[shiftkey]

Closing this out as #838 now sets both GPG values to 1. Feel free to comment in #835 about any other RPM-specific suggestions.

[mwt]

What is important....? How it was fixed? Or THAT it was fixed.

It's not important. There are two competing signing methods. One of them was always working. Now both work.

[sarim]

What is important....? How it was fixed? Or THAT it was fixed.

It's not important. There are two competing signing methods. One of them was always working. Now both work.

Which signing method is competing with what?

From manpage

gpgcheck Either '1' or '0'. This tells yum whether or not it should perform a GPG signature check on the packages gotten from this repository.

repo_gpgcheck Either '1' or '0'. This tells yum whether or not it should perform a GPG signature check on the repodata from this repository.

[mwt]

Which signing method is competing with what?

From manpage

gpgcheck Either '1' or '0'. This tells yum whether or not it should perform a GPG signature check on the packages gotten from this repository.
repo_gpgcheck Either '1' or '0'. This tells yum whether or not it should perform a GPG signature check on the repodata from this repository.

It is totally fine to use both, but either one alone ensures integrity of the update. The repodata contains checksums for all of the packages. So, each package file is validated either way. It's just a question of whether the validation comes in a separate file or not.

APT-based systems use a system similar to repo_gpgcheck without gpgcheck. Most enterprise Linux repos used to use gpgcheck without repo_gpgcheck by default. I don't know if this is still true.

[sarim]

Yeah, that makes sense. The signing method is always "gpg". So "two competing signing method" kinda had me confused. :P