I have Fedora Core 1 installed.

When I try to download Fedora's updates from Redhat, some of the updates return the following message; "The package 'does not have a valid GPG signature. It has been tampered with or corrupted.' Continue No, Yes."

Is there a security risk if I continue?
Will the packages corrupt my system if I try to install them?
Is anyone maintaining redhat's downloads to protect against scriptkiddies tampering with files? These Fedora update files have been on there web site for quite some time now and no one has done anything to change them.

Can anyone answer these questions or does anyone have any comments or suggestions!

I found some other mirrors that had the same packages and used them. You
need to put them in the same directory that the packages from redhat go in.

Something like /usr/var/spool/up2date

I'm at work, so using Win, I don't have access to the actual path.

The mirror closest to me is mirror.clarkson.edu

Hope this helps out.

remove the package from /var/spool/up2date

example...

rm /var/spool/up2date/gftp*


then run this if there are more packages to be installed in the up2date folder.

rpm -Uv /var/spool/up2date/*rpm


now try this..

up2date gftp

Hi Dave

I installed all the good files from Redhat because I downloaded them individually. It was the only way I could do it to prevent me from installing the files the produced the above error message. Therefore I do not want to install anymore files in the directory /var/spool/up2date until I know it is safe to do so.

Since I have installed the the good files, is it now safe to delete everything in that directory and if so what is the command I would use?

Hi whtriced

By mirror site, do you mean

ftp://mirror.clarkson.edu in my web browser?

I am having difficulty trying to determine how to connect to a mirror site to find these files

Yes, that is what I was driving at.

If you put the package name into goole it will bring up sites that contain that package. I try to use mirror sites that are in universities, as they are usually pretty careful about security. Always use the md5 checksum from Redhat to deterine if the package has been tampered with or contains errors.

Hope this helps.

rm -rf /var/spool/up2date/*


the rpm install always checks by default so if you are successful by running rpm -iv *rpm in the up2date folder that is ok. If you get errors remove the bad file.