Post
🔐 Looks harmless at first, I hope there's not a more sinister motive behind this.
｢ In practice, this means users won’t be able to install unsigned RPMs unless they explicitly override the verification process with the --nosignature flag or a corresponding API call ｣
https://linuxiac.com/fedora-plans-to-block-unsigned-rpm-packages-by-default/
I think it's good to have packages signed and for the user to be aware that they are installing an unsigned package if they are. Most developers are already signing their packages and everyone should if they are distributing for others to use.
As long as it can be any key, and not Fedora's key, it's fine and even desirable imo.
A space for Bonfire maintainers and contributors to communicate
