does not fetch Release.gpg file anymore

[nburro]

Binary package hint: debmirror

In debmirror_20070123ubuntu3 (jaunty), debmirror does not download the Release.gpg file as it did in debmirror_20070123ubuntu1 (hardy & intrepid) when the --ignore-release-gpg option is used. In order to actually use the mirrored repository, one has to download the Release.gpg file manually or digitally sign the Release file. Please add an option to specify whether to download the signature file or just re-add the code that did it in 20070123ubuntu1.

To reproduce:

debmirror -nosource --host=us.archive.ubuntu.com --root=ubuntu/ --method=http --verbose --progress -dist=jaunty --section=main,restricted,multiverse,universe --arch=i386 "/media/disk1/ubuntu-jaunty/" --ignore-release-gpg

[Sensiva (sensiva)]

I confirm this on Karmic amd64 too.

[Kees Cook (kees)]

The example command line says "--ignore-release-gpg", and so it's doing exactly that. :) If you leave that off (and set up the archive keys) debmirror will fetch it and check it.

[Sensiva (sensiva)]

Kees Cook, according to debmirror man pages

--ignore-release-gpg
           Don't fail if the Release.gpg file is missing.

Please revise. Thank you

[Kees Cook (kees)]

The documentation does need to be updated, that's true. Thanks for the report!

[KarlGoetz (kgoetz)]

The current documentation says this:

=item B<--ignore-release-gpg>

Don't fail if the F<Release.gpg> file is missing. If the file does exist, it
is mirrored and verified, but any errors are ignored.

Does that make it clear enough?
kk