Hi Eric,

Because I cannot tell which file it's stating these about, this is all I can paste.

Hopefully this helps.

Well obviously you're checking a directory with tarballs and signature files of many individuals, none of whose GPG keys you've yet imported.
For one that occurs several times, key number 6D1ECD07:
I don't know the guy and the software he created but you have tried verifying his.

Eric

I don't know who he is either.

I'm just checking the files that are rsync'd using your slack current but I changed the path to be slack 10.2

Is it possible that other files are distributed by Slackware and they include original sources from the original writer's of the sources/software so they are there too?

here's copy paste of your modified script:

In an effort to make this go quick to find which files are bad, I tried looking for a gui application to do this, that is recurses thru subdirectories and echoe's file names and their validity and I can't find anything for this.

I really think the KDE team needs to make a service menu for konqueror that allows you to alt+click on two files, file.tar.gz.asc and file.tar.gz and a service menu come up, gpg verify it for you and show results in konqueror or a dialog box.

I'm shocked there is nothing like this.

Antivir, clam-av have context menu / service menu items that scan files or directories.

A simple desktop item in /home/user/.kde/share/apps/konqueror/servicemenus would be something like this, but my 'bash scripting' is so bad I have no idea how to do this.

I know file is %U

But soemthign in the order of

In the essence of time, I guess basically, is there a way for the terminal/konsole to report/print/echo the name of the file that is not able to be verified because I do not have their key while I run the gpg verify stuff?

I'd just like to further investigate it, tho I'm really disappointed at this and may never work off of a mirror again, but I dont want to kill pat's bandwith either tho. Dilema.

Could you please tell me from which directory you run, and what exact command you run?
On my Slackware 10.2 mirrored packages I get nothing but:
Other GPG key signed packages should not be present there. If there are those in your Slackware mirrored tree, I'd start looking for serious abberations.

Eric

I have the script called rsync_slackware10-2.sh in my home

I just go into home, open up terminal and ./rsync_slackware10.2sh and let it go in terminal.

The files are saved as in /home/fogie/slackware-10-2-rsync

the contents of the script that I tweaked are above.

well,

I figure out how to make a kde service menu.

just open text editor and add:

Now save it to ~/.kde/share/apps/konqueror/servicemenus/new-gpg-menu.desktop

Your file is to be saved with .desktop extension.

Now you just go into the folder you rsync'd, right click on any file there, you need to do this so that the exec command above registers the %D (directory) command, now go to actions and select GPG Verify and it brings up konsole and will dive into subfolders, and list file names.

I recommend to go into konsole, settings, history, check off to have unlimited history and then settings 'save as default'.

Now to get a text file, you can save it from konsole.

Further notes:

-do I need the 2>&1 ? as Alien bob had?
-how do I get this to just dump a text output file too to ~/Desktop/gpg-verify.log

Any ideas appreciated.

License: eh?

Submit to kde?

Any thoughts appreciated.

oh the quote command here is playing with font sizes:

that's just one line, I just used that as a finder to asc files when I was making this, it's a good note so i left it in the file for myself.

oh so to make it short, all of the sources for /patches...that were rsync'd are all bad and a few of the regular sources for slackware itself. none of the install files or patches.

well time to format,gdisk/dod, reinstall all

see ya's when slack 12 is out

Before I dumped my pc I decided to do some investigating of the compromised(?) files vs that shown on slackware's ftp site, Pat V's. Basically, Pat "does" have stuff from "others" on the site in /patches/sources they check out vs what I have via the rsync, so now I'm really baffled but going to play it safe.

Aha! I checked only the Slackware packages, not the sources. Of course, Pat can only gpg-sign the stuff he creates himself.
So, problem solved - nothing was compromised.

Eric

Yeah that's what I'm thinking too because the "goofy named files" as I refer to them are also listed in his files list in the top level directory of slackware10.2 on the ftp site. so they do have a corresponding checksum, and those worked too.

Maybe I need to modify the script to also ignore source? in addition to ignoring pasture.

oh in case anyone finds this thread i changed the "q" to a "v" in Alien Bob's line and therefore that show's the file names and path to files. hope that helps.

now I'm off to try and figure out how to get enigmail/pgp to work. I think i need a gpg101 class.

@Alien Bob

Remember the gpg signature file above that I had for 'snort'

I made a thread over there and one of the snort employee's replied to my thread here:

http://www.snort.org/reg-bin/forums.cgi?topic_id=3267

So all well for now, and now they are going to do detached for future use.

I'm gonna notify admin's here at LQ maybe they want to make a sticky in 'security'.

Cool. I could not read the thread since it required registering at the snort forum site (which I did not want), so perhaps you could paste some of the relevant bits here?.

Eric