When I'm using the Linux software PackageKit, I get confused about what specific items of information I will need in order to decide whether to authorize software installation from a new software source.
I'm using Gnome in openSUSE. I think the question would be just the same for other systems that have PackageKit, such as KDE in Fedora.
Each time that I do this, I wonder:
- What opinions do I need to form?
- What values do I need to know in order to form my opinions?
- How do I determine that those values are correct and consistent?
Several times I have elected to install software from a repository that wasn't previously configured in Linux. A repository can give me advantages including notifications of updates and better integration with my distribution and environment.
Soon after I choose to install the new software, often by pushing a 1-click install button on the software.opensuse.org web site, the PackageKit "Software signature is required" dialog appears. It displays the following items of information. Each of them seems to relate to something that I may need, but they each present a bit of a puzzle as well.
- Repository name. This is often one word. I think it is not always exactly the same text as what I would see listed at software.opensuse.org, or wherever I last saw mention of the repository. Anyway I'm not sure where PackageKit gets this name and on what basis I can believe it's correct.
- Signature URL. I don't know what to do with it. I suspect it's the ID of some resource, not actually a site where I can learn more.
- Signature user identifier. I don't know what to do with this, either. It looks like an email address. I don't know whether it represents the person I should trust, the person I should contact with concerns, the address at which I should contact that person, etc.
- Signature identifier, eight hexadecimal digits. It's not quite clear from the dialog or its documentation, but I gather that it's actually just a few digits of a GPG key that in full would have 40 hexadecimal digits.
There has been criticism of the "Software signature is required" dialog. That's not exactly what I'm looking for. If needed, I could avoid PackageKit for this task and use YaST or zypper, just as PackageKit users on other systems could use apt, dpkg, rpm, or yum. I would still want to know what information is necessary, whether it's the information that PackageKit presents or any other information.