[Triumf-linux-managers] Re: More unsigned java rpms

[Kelvin Raywood]

Thanks for posting this Konstantin.

In case it wasn't obvious from his post, these instructions are not 
necessary for those that have installed SL 4.5 or later from a TRIUMF 
kickstart CD, or if you have shoehorned your system into using the 
TRIUMF rpms and installed the triumf-java rpm.  If you're not sure, do

     rpm -qa triumf-java-\*

If you get no reponse and you have jdk installed, then you have the 
problem described by Konstantin.

Some may be alarmed by the "--no-deps" option that Konstantin has for 
installing triumf-java-1.5.0* .  All the TRIUMF rpms that I build are 
done with a script that automatically adds triumf-release as a 
dependency.  The triumf-java-1.5.0-sun rpms are the special case of not 
actually needing triumf-release so --no-deps is fine in this case.  The 
rpm triumf-java-1.5.0-sun does not add any files, but provides triggers 
that ensure that the symbolic-link for the web-browser plugin is 
correct.  On systems with both 32 and 64-bit versions of firefox or 
mozilla-seamonkey, it keeps the 64-bit version disabled so that flash 
and java plugins work.

An alternate way to install the triumf-java rpms and ensure that you get 
continued security updates is to install the "triumf-release" rpm and 
then the triumf-java rpms.  Here is a script that does this including 
checking the signatures of the new packages.

Note, before running this script, remove the jdk and 
java-1.5.0-sun-compat rpms with:

     yum erase jdk java-1.5.0-sun-compat


Kel Raywood
TRIUMF Network and Computing Services

# !/bin/bash

# Import TRIUMF RPM gpg-key
TRIUMF_RPM_KEY=/triumfcs/mirror/triumf/kickstart/RPM-GPG-KEY-triumf-core
if ! echo "817a73e3378b17f827227d2ca86edb77  $TRIUMF_RPM_KEY" \
      | md5sum --check ; then
     echo "FATAL ERROR, The TRIUMF signing key is corrupt."
     echo "-- Please contact TRIUMF Computing Services immediately --"
     exit 1
fi
rpm --import $TRIUMF_RPM_KEY

# Install the triumf-release package - it does not matter which release
# or architecture we pick as triumf-release is the same for all of them

RELEASE_RPM=/triumfcs/mirror/triumf/kickstart/4.6/i386/RPMS/triumf-release-1.3-1.noarch.rpm
if ! rpm --checksig /tmp/$RELEASE_RPM ; then
     echo "FATAL ERROR, $RELEASE_RPM failed signature check."
     echo "-- Please contact TRIUMF Computing Services immediately --"
     exit 1
fi

yum -y install triumf-java-1.5.0-sun