Re: authenticating packages from PPA

["Jordan Mantha" <mantha@xxxxxxxxxx>]

On 9/15/07, Jonathan Rogers <jonner@xxxxxxxxxx> wrote:
>
> On Sat, 2007-09-15 at 14:31 -0700, Jordan Mantha wrote:
> > On 9/15/07, Jonathan Rogers <jonner@xxxxxxxxxx> wrote:
> > > This is probably a stupid question. I'd search the entire archive, but
> > > there's no easy way to do that using mailman's very basic archive. I am
> > > using someone else's PPA by adding a deb line to my sources.list. I was
> > > able to install the packages just fine, but I can't find any way to add
> > > the author's public GPG key to my apt so that it can authenticate them.
> > > Are we supposed to just use them unauthenticated?
> >
> > This was originally a "feature". This was supposed to be a way to
> > separate PPAs from the official Ubuntu archives. I think *something*
> > should be done as Ubuntu developers are already getting bugs filed
> > based on PPA packages. I expect to see a lot more in the future and I
> > suspect that a significant number of Ubuntu users may not know the
> > difference between a PPA and the Ubuntu archive, especially since
> > Launchpad is the official development tool.
> >
> > Are there any plans to do something about this issue?
>
> That seems strange to me, since one has to manually add a line to
> sources.list to use a PPA. Why are people saavy enough to find the PPA
> pages, add the apt lines, but not realize they're not using officially
> supported packages? I never got the impression that PPAs were anything
> other than personal as in the name.

Often times people just copy-n-paste stuff into their sources.list and
the may take anything with launchpad.net in the URL to be official.

-Jordan