I am installing Fedora 14 and I am wondering if
- the Fedora packages are cryptographically signed
- package signatures are checked by the installer by default
- package signatures are checked by yum when installing additional packages or doing upgrades
The packages are cryptographically signed, and the yum package installer does check those signatures when you add packages after the fact. The initial installer, however, does not check package signatures. This is a difficult problem, because: how to you verify that the cryptographic signatures you have on your install media are good when you don't, by definition, trust that install media?
See this Fedora bugzilla entry for history and details. This is the oldest bug still open in Red Hat's database, and it's so old that it's only three digits. (New bugs are now numbered well into the six hundred thousands.)
But, the entire install DVD is checksummed, and you can verify that that's good externally before starting your install against checksum files which are cryptographically signed. So, if you're very concerned (and in this day and age, it's good to be), do a non-network install after verifying the ISO you download against the GPG key from the official Fedora Project web site.
So to answer your three questions: yes, sort of, and yes.
According to the Fedora Documenation:
Further, according to the Yum Documentation:
On a freshly installed Fedora 14 system, the
Indicating that this feature of yum is enabled by default.
Thus it seems that the answers to (1) and (3) are "Yes". I believe the answer to (2) is more complicated.
Both the DVD and the Live CD have the ability to verify the entire disk. If you are concerned with the integrity of your install media, you can use this built-in functionality (see the documentation). If you are more concerned with security, you may want to verify the ISO before burning, using the method provided here:
(See this question for tips on how to get the checksum for already burnt CD.)
UPDATED: If you install using the Live CD, I believe that the live image is being copied directly to your disk, thus the packages aren't being installed by the package manager and their signatures aren't being checked. If you install using a Network Install or the full DVD, the GPG signatures still aren't checked. See mattdm's answer.