Problem importing Mandrake Cooker public GPG key
 

I have noticed that the cooker RPMS I have been using have been signed with a gpg key of key ID 26752624.

$ gpg -v cooker.pubkey
gpg: armor header: Version: PGP Key Server 0.9.6
pub 1024D/26752624 2003-12-10 MandrakeCooker <cooker@linux-mandrake.com>
sig 70771FF3 2003-12-10 Mandrake Linux <mandrake@mandrakesoft.com>
sig 78D019F5 2003-12-10 [User id not found]
sig 26752624 2003-12-10 [selfsig]
sub 1024g/E5CC3CAA 2003-12-10
sig 26752624 2003-12-10 [keybind]

I obtained a copy of this key from http://pgp.mit.edu:11371/pks/lookup?...2624&op=index. I couldn't find a copy of this key on a Mandrake site.

Every time I try to import this key instead of taking on the key ID 0x26752624 it takes on a key ID of 70771ff3.

rpm -qai gpg-pubkey
[output omitted]
Name : gpg-pubkey Relocations: (not relocateable)
Version : 70771ff3 Vendor: (none)
Release : 3fd755e4 Build Date: Fri 05 Mar 2004 00:00:29
CST
Install Date: Fri 05 Mar 2004 00:00:29 CST Build Host: localhost
Group : Public Keys Source RPM: (none)
Size : 0 License: pubkey
Signature : (none)
Summary : gpg(MandrakeCooker <cooker@linux-mandrake.com>)
Description :
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: rpm-4.2 (beecrypt-2.2.0)

mQGiBD/XT6oRBADPpYAPClDtKLGSZKmDU3pI9XCrsa+sR3CAJgrscSsffDQFEV7VjgO520G3
+qBMG/ArgFHrJyFEWk4dNQsR7zRb8B+/ZFo3IhZKbk3gbjYsTrd05t4zDDYIS/GhWKHyhopK
6B9uhcKNbuAqA0fM9jDG2j46wmwtLpIrfLa/1SgQQwCgxF4Bdw4YoNhwUM98JTn3/Ojw8TcE
AKLxQsGCjLQNl4DTEev7w4BKzx95eCVnQ7r7XXldgVOgAxlywGYDJVQn3Zn9Ad4/+8g2wHXc
JxLNHUEIrsdZVqllzdYiQa27TtI3RLF09leKZQD1awX6sAZxYgCUlQhCukPc61FP3upyna0g
WFO6Jf/iS/PhZ96T00h2GliwePGTA/97g61DjVFKTlWUH1Bzz61rwtE3apsCX50W8J76Uris
ipl4niZC9Ns30ulyLUgLhTiCvdejqy9O1ONdH9W0ALwv1ThbRlo5I92rWLCwgUpko38qo1bS
NQ7DrCfKegKqiCpUltZ00gyUmAkKQTS9/nI/+lEKYkQJvY6ha5d3PC5SkLQqTWFuZHJha2VD
b29rZXIgPGNvb2tlckBsaW51eC1tYW5kcmFrZS5jb20+iEYEExECAAYFAj/XVeQACgkQ54mK
4HB3H/OgQQCdECI6SKQHUuNr5P2teLVkZzRRHtgAn04q+NhEnzdll0Ga3SjZyV3kkCxtiEYE
ExECAAYFAj/XV68ACgkQRFk1+HjQGfXYaQCeK932DKZ/k7YNaFpE/RTDTVAE3uwAoKFJgC8D
PPZUvF/9//kCG6ZImPKhiF4EExECAB4FAj/XT6oCGwMGCwkIBwMCAxUCAwMWAgECHgECF4AA
CgkQ3WhNeiZ1JiRczQCdGbsWsP/kMRVHdl1RKh8SRwpLeVcAoKc6QNmnR5a7FvrBvF1+qeeO
e/cXuQENBD/XT6sQBAD5JPDpZ1toBcgDPsutvUfFBPJ0Iwi25p6rExQFssH7Pc9LVP1w/pXX
uenuW9d1WqivU6AhBC7hqgjhyf12WJ/rouM52w+RqqNtcIRK4gqHqYkuP54TD6bAXERC1eTJ
u4/XzZPRh5OR9FQSEmLGp7f662EqANPP3zZlE9El4zu1ywADBQQAvjEq5o0FD0zEoVhfjhsP
U/uHBG9JIwOPiWBWJlYnLefWgEU/qqGrq23bfBnHvrfS1nmBLId0j6BBhUhDWk2baP5GPcPb
9AKXsqUtTiJGFJaIJtVJ5FQT0jvHgcgaCRAfGBCe9zBCPzxV+jaEXI269n4VvGRpcK8uFTAw
iFnvzmWISQQYEQIACQUCP9dPqwIbDAAKCRDdaE16JnUmJIZUAKC45vNS3JYh5MPbW0UhOgw6
9M1sZgCfZI0GCIVleeEzgIx+eDBjS4zDtDU=
=MpaC
-----END PGP PUBLIC KEY BLOCK-----
[output omitted]

Running the key displayed by RPM through gpg confirms it is infact the key that I imported. I pasted it into gpg stdin.

gpg -v
[input omitted]
gpg: armor header: Version: rpm-4.2 (beecrypt-2.2.0)
pub 1024D/26752624 2003-12-10 MandrakeCooker <cooker@linux-mandrake.com>
sig 70771FF3 2003-12-10 Mandrake Linux <mandrake@mandrakesoft.com>
sig 78D019F5 2003-12-10 [User id not found]
sig 26752624 2003-12-10 [selfsig]
sub 1024g/E5CC3CAA 2003-12-10
sig 26752624 2003-12-10 [keybind]

When I try to verify a cooker RPM signed with key ID 0x26752624 it does not find the key I imported due to the differing key ID.

$ rpm -K mozilla-firefox-0.8-14mdk.i586.rpm
mozilla-firefox-0.8-14mdk.i586.rpm: (SHA1) DSA sha1 md5 (GPG) NOT OK (MISSING KEYS: GPG#26752624)

I also imported this key under Fedora to see if the same problem would occur and it did. They key was not imported under the key ID of 0x26752624. Has anyone else experienced this problem and found a solution? Maybe a cooker key from a different source?

Same thing going on here on Mandrake 10.0!!!!!!!!!!!!
Have the cooker files been forged???????????

This problem has occurred when trying to verify other gpg signatures of rpms. RPM does not seem to import some keys properly. One example is importing the key that was used to sign gaim, key ID 0x4c292fcc, which I found by searching http://pgp.mit.edu/. I imported the key with

# rpm --import 4c292fcc.asc

RPM however imports this key as

gpg-pubkey-492ddb7e-3f232b3d

The key ID of 0x492ddb7e that RPM has used is actually the key ID of one of the public key's signatures. The sub key ID doesn't seem to correspond to anything.

I eventually found a version of the cooker public gpg key that rpm could cope with included with one of the test/RC isos I downloaded. I couldn't find a version that worked myself that wasn't contained in an iso despite an extensive search. I'll post it here so you don't have to do that same.

$ rpm -qi gpg-pubkey-26752624
Name : gpg-pubkey Relocations: (not relocateable)
Version : 26752624 Vendor: (none)
Release : 3fd74faa Build Date: Fri 05 Mar 2004 00:57:23 CST
Install Date: Fri 05 Mar 2004 00:57:23 CST Build Host: localhost
Group : Public Keys Source RPM: (none)
Size : 0 License: pubkey
Signature : (none)
Summary : gpg(MandrakeCooker <cooker@linux-mandrake.com>)
Description :
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: rpm-4.2 (beecrypt-2.2.0)

mQGiBD/XT6oRBADPpYAPClDtKLGSZKmDU3pI9XCrsa+sR3CAJgrscSsffDQFEV7VjgO520G3
+qBMG/ArgFHrJyFEWk4dNQsR7zRb8B+/ZFo3IhZKbk3gbjYsTrd05t4zDDYIS/GhWKHyhopK
6B9uhcKNbuAqA0fM9jDG2j46wmwtLpIrfLa/1SgQQwCgxF4Bdw4YoNhwUM98JTn3/Ojw8TcE
AKLxQsGCjLQNl4DTEev7w4BKzx95eCVnQ7r7XXldgVOgAxlywGYDJVQn3Zn9Ad4/+8g2wHXc
JxLNHUEIrsdZVqllzdYiQa27TtI3RLF09leKZQD1awX6sAZxYgCUlQhCukPc61FP3upyna0g
WFO6Jf/iS/PhZ96T00h2GliwePGTA/97g61DjVFKTlWUH1Bzz61rwtE3apsCX50W8J76Uris
ipl4niZC9Ns30ulyLUgLhTiCvdejqy9O1ONdH9W0ALwv1ThbRlo5I92rWLCwgUpko38qo1bS
NQ7DrCfKegKqiCpUltZ00gyUmAkKQTS9/nI/+lEKYkQJvY6ha5d3PC5SkLQqTWFuZHJha2VD
b29rZXIgPGNvb2tlckBsaW51eC1tYW5kcmFrZS5jb20+iF4EExECAB4FAj/XT6oCGwMGCwkI
BwMCAxUCAwMWAgECHgECF4AACgkQ3WhNeiZ1JiRczQCdGbsWsP/kMRVHdl1RKh8SRwpLeVcA
oKc6QNmnR5a7FvrBvF1+qeeOe/cXiEYEExECAAYFAj/XVeQACgkQ54mK4HB3H/OgQQCdECI6
SKQHUuNr5P2teLVkZzRRHtgAn04q+NhEnzdll0Ga3SjZyV3kkCxtiEYEExECAAYFAj/XV68A
CgkQRFk1+HjQGfXYaQCeK932DKZ/k7YNaFpE/RTDTVAE3uwAoKFJgC8DPPZUvF/9//kCG6ZI
mPKhuQENBD/XT6sQBAD5JPDpZ1toBcgDPsutvUfFBPJ0Iwi25p6rExQFssH7Pc9LVP1w/pXX
uenuW9d1WqivU6AhBC7hqgjhyf12WJ/rouM52w+RqqNtcIRK4gqHqYkuP54TD6bAXERC1eTJ
u4/XzZPRh5OR9FQSEmLGp7f662EqANPP3zZlE9El4zu1ywADBQQAvjEq5o0FD0zEoVhfjhsP
U/uHBG9JIwOPiWBWJlYnLefWgEU/qqGrq23bfBnHvrfS1nmBLId0j6BBhUhDWk2baP5GPcPb
9AKXsqUtTiJGFJaIJtVJ5FQT0jvHgcgaCRAfGBCe9zBCPzxV+jaEXI269n4VvGRpcK8uFTAw
iFnvzmWISQQYEQIACQUCP9dPqwIbDAAKCRDdaE16JnUmJIZUAKC45vNS3JYh5MPbW0UhOgw6
9M1sZgCfZI0GCIVleeEzgIx+eDBjS4zDtDU=
=NfCd
-----END PGP PUBLIC KEY BLOCK-----

Have a go using this key after importing it as it worked for me last time I checked.