Resigning RPMv3 packages in RPM v4

kenneho · 06-19-2008, 07:59 AM

Hi.

I have a package that was build for RPMv3. I'm in need of resigning the package on my RPMv4 system, but I've learnt that resigning RPMv3 packages in RPMv4 corrupts the package.

So, the way I see it, I need to either find a way to resign the package on my RPMv4 system, or downgrade RPMv4 to RPMv3 and then do the resigning.

Has anyone come across this issue? How can one downgrade RPM from version 4 to version 3?

Regards,
kenneho

unSpawn · 06-19-2008, 08:34 AM

I think downgrading the RPMDB to version 3 would be a mistake. What's the *real* problem? Wouldn't it be more efficient, safe, easier to rebuild the package for RPMv4 and *then* sign it?

kenneho · 06-19-2008, 09:24 AM

Quote:

Originally Posted by unSpawn

I think downgrading the RPMDB to version 3 would be a mistake. What's the *real* problem? Wouldn't it be more efficient, safe, easier to rebuild the package for RPMv4 and *then* sign it?

I guess it would, but I don't have access to the source RPM. I've never rebuilt an RPM before, but thought I'd need the source RPM.

Is it possible to rebuild based on the ordinary RPM itself?

unSpawn · 06-19-2008, 09:40 AM

Yes, you'll need the .src.rpm or a tarball (plus .spec file). You can reconstruct an RPM manually or based on contents as the RPMDB sees them (see Sourceforge: "rpmrebuild") but the results can not be distributed publicly *ever*, are possibly incomplete and as such nobody in their right mind would support problems caused by a package rebuilt that way. Can you be more specific about what package(s) this is about?

kenneho · 06-20-2008, 04:23 AM

Quote:

Originally Posted by unSpawn

Yes, you'll need the .src.rpm or a tarball (plus .spec file). You can reconstruct an RPM manually or based on contents as the RPMDB sees them (see Sourceforge: "rpmrebuild") but the results can not be distributed publicly *ever*, are possibly incomplete and as such nobody in their right mind would support problems caused by a package rebuilt that way. Can you be more specific about what package(s) this is about?

I totaly agree on the support thing. I'm pretty sure the vendor wouldn't want to provide support on such modified packages.

The packages I wish to resign are Legato NetWorker packages. So to sum up:

There is no way the vendor is just going to give me the source code.
I could hope that the vendor rebuild the package for RPMv4, men who knows how long that would take.
I do not wish to rebuild the package myself due to support problems.
I could downgrade RPMv3 on one of my servers and do the resigning there. I'm not sure if this would work, as the RPM DB probably would get broken.

Any suggestions?

unSpawn · 06-20-2008, 10:29 AM

Thanks for clarifying. Basically there should be no resigning because the signature should match the vendor or publisher and they should only initiate resigning if the key was faulty, expired, retracted or replaced. Explaining in detail what problems you encounter installing these packages (incl. error messages if any) could help us find you a workaround or solution.