On Slackware -current, because I wasn't concentrating, I typed slackpkg update gpg when I meant to type slackpkg update.

I would have run slackpkg update gpg when I first used slackpkg, so this means I have updated the gpg for a second time.

I ran
afterwards and it completed the updates successfully.

Is running slackpkg update gpg by mistake going to cause a problem?

No problem

No problem is reassuring. Thanks for the reply.

I run gpg update every time before update mainly because I use bash history and all the commands are in an && command line, including install-new. It hasn't hurt anything so far.

2 members found this post helpful.

No. Running 'slackpkg update gpg' simply checks your key file for the signatures, if not found, adds them; otherwise nothing is changed. If you look closely at the output of 'slackpkg update gpg' you will see the following after each signature is checked if nothing has changed.

1 members found this post helpful.

Thank you johnny23 and chrisretusn.

It is reassuring to know I have done no harm.

I must be more careful with slackpkg in future though. I might not be so lucky next time.

I typed when what I meant to say was

1 members found this post helpful.

I have never managed to do that...

but there's a first time for everything

slackpkg is fairly safe to use. The gotcha could be 'slackpkg clean-system' and third party packages, if they are not in the blacklist, they could be removed. The good thing is with the default settings in /etc/slackpkg/slackpkg.conf, you get a chance before committing with the selection screen dialog. True is for other options that will upgrade or install new slackware packages.

I use slackpkg with slackpkg+, which allows third party packages to be handled by slackpkg. You don't blacklist third party package in this case as slackpkg+ handles this.

This actually circumvents the purpose of GPG. From the man page:
The idea is that you run the command once to obtain Slackware's "true" public key (ignoring all the trust issues around this), which slackpkg subsequently relies on for each update to check that the downloaded files really came from the Slackware team (I didn't look, but I guess it verifies CHECKSUMS.md5.asc, and then the MD5 hashes inside CHECKSUMS.md5 for the individual packages prior to installing. I really wish the Slackware team would stop using MD5 for this purpose, but anyway..).

As an example, let's say someone hacked your favourite mirror and put malware on there: What would normally happen is that they couldn't produce a proper signature which verifies against Slackware's real public key (which your system would have), and slackpkg would notice this and the update would fail. But, if you keep updating the GPG key on every update and the mirror is compromised, then you would overwrite the true Slackware public key with a bogus one from the compromised mirror[1], and then slackpkg will happily install the malware onto your system (since your bogus public key now matches the bogus private key used to sign the malware). In reality slackpkg may warn about this case (the GPG key changing), but I don't know.

Long story short, you only want to run `slackpkg update gpg` one time. That gives you the public key, which is your long-term assurance for genuine downloads as you update from any Slackware mirror.

*edit* [1] This is not true on slackpkg any more, since it grabs the public key from slackware.com instead of the mirror.

1 members found this post helpful.

You could also just alias this to whatever you like, say in ~/.bashrc

2 members found this post helpful.

It was reading this entry in the man page that prompted my original post - I had unintentionally run the command twice.

So, if i understand correctly: provided that the public key was still genuine, I have not done any harm. However repeatedly running 'slackpkg update gpg' increases the risk that you will download something malicious, even if the probability of this is small.

It was careless of me to do this , but I have learnt something.

Right, the basic problem to be solved is to obtain the correct public key, so repeatedly downloading it goes against that goal (even with slim odds of getting a bogus key).

Also it looks like my info is out of date on -current and regular slackpkg. Testing with slackpkg+ currently gives the old method (key from mirror):
but with regular slackpkg:
So the thing I mentioned about pulling a bogus key from a hacked mirror is no longer true with regular slackpkg (of course the Slackware server could get hacked too, but anyways).

The point is, it only breaks anything if one or more of the GPG keys have been compromised. If you're an LQ user it's unlikely you won't have noticed that. Keys have been officially updated during my time using Slackware, so if you don't customarily do the update if you get an error don't jump to the conclusion that it's an exploit, check if the keys need to be updated.