Karanbir Singh - Thinkability

You can also just sign *.rpm

What about "rpm --resign *.rpm" ?

sure, you can do a rpm --resign *.rpm; but obviously that only works if all your rpms are in the same directory. Most repo layouts seperate the packages into subdir's based in arch. Depending on how many packages there are and what processing is being done per arch/dir; you could be there for a while waiting for the next time you need to enter your key pass phrase.

I'm using a similar approach (but with the explicit path {stable,testing}/5/{SRPMS,i386,x86_64}/*.rpm) The problem is that already signed packages get "touched" even if rpm --sign says that they were already signed with the same key.
So they get transferred by rsync as well afterwards even if that would not be needed.
I wish I could find a better approach or that rpm would leave already signed packaged untouched.

Mathieu,

I tend to not run the --addsign / --resign in the repo itself. As the first step, packages are downloaded from the buildsystem and put into an empty repo ( so there is nothing else except for the newly built packages ). Then run the rpm --addsign and do any tests ( like making sure the multilib stuff is in place ), before moving these packages with an rsync into the production repo. Once there, generate the metadata with createrepo.

- KB

Actually the public repo is on a separate server, but it is a sync of a repo on the build server which is in turn used during the build. So update of the public repo happen only for a batch of packages when everything is ok with a given set of builds.

But I think that we somehow need to add the intermediate step that you describe. It doesn't feel right to run --resign on everything each time (and it takes unnecessary time).

Do you have a simple way to check for multilib issues?

Thanks for the tips!

What about eval `gpg-agent --daemon` ? :)

As a sort of an almost-off-topic comment, I've fallen in love with the $() syntax to replace the backtick syntax:

rpm --resign $(find . -name *.rpm)

It nests really nicely, too.

For easier tracking, I use subfolders in my repository (for mrepo source) separating subgroups of packages. After mrepo is done with them, subdirectories are gone, everything is one repo directory, but this really helps separating and quickly finding packages.

Files in subfolders where not shown by "find . -name *.rpm", so I used following instead:

rpmsign --resign `find . | grep .rpm`