When I try to install software in the Gnome environment of Linux (mine is openSUSE) from a repository that I have not used before, PackageKit asks me to respond "Yes" or "Cancel" to a dialog "Software signature is required".
How can I as a user or administrator get over the discomforts of this dialog? Or, how can Gnome correct them?
I'm not merely complaining. I mean, yes, this dialog makes me want to rant about all the dialogs that say, in effect: "Would you like to daydream instead? [Y] [N]"
But I actually want to know how to decide my answer to the dialog so that I can get software that I need from repositories while using my best judgment to authorize particular repositories or not. An important advantage of using repositories is that I'll be notified of updates.
- I can only see that the dialog appears after my request to install software. I doubt that the information in the dialog proves that it relates to my request. If I conclude that the dialog appears because of my request, I may be committing the logical fallacy of post hoc ergo propter hoc.
- The facts claimed in the dialog are not attributed to a specific information source. I don't know why those are the facts that I must verify.
- I'm left to suppose that I must go check that the signature (meaning key, I suppose?) in the dialog matches the signature for the software source that I wanted. But nothing really gives me an address for that source that I can check up, or an idea of which of the many kinds of signature I'm looking for and where. The documentation page that I linked above says it's usually a GPG key. What little I know about GPG is that it's primarily used for email and that its method of providing security guarantees seems to require some subtle considerations.
- I'm not actually given a "signature". I'm given:
- a "signature URL" that is (I think) not actually a site where I can learn more;
- a "signature user identifier" that looks like an email address but does not (I think) give me a good way to check whether I want to trust communications from whoever controls that address;
- a "signature identifier" of eight hexadecimal digits which is (I think) not a cryptographic guarantee of anything.