SUSE repository lacks the repomd.xml.key

[sjvudp]

Describe the bug

The repository at https://packages.icinga.com/SUSE/12.4/release/ lacks the repomd.xml.key used to check the authentic repomd.xml.asc (and in turn repomd.xml).

To Reproduce

See https://packages.icinga.com/SUSE/12.4/release/repodata/

Expected behavior

The repository should be built in a standard way, maybe following https://www.suse.com/c/creating-yum-repository-and-publishing-it-smt/

Screenshots

...

Your Environment

Last seen 2020-03-25.

Additional context

While getting the sign key, I found that it's rather difficult to verify the key's fingerprint. Also, security-wise using a self-signed GPG key is a poor decision. Probably that key from 2013 should be replaced anyway as it's still using SHA-1 as hash.

For an example of a better management of the keys being used, see https://www.qubes-os.org/security/verifying-signatures/ maybe.

[Al2Klimov]

Hello @htriem!

Any news from your side?

Best,
AK

[htriem]

All of our RPM repos lack the mentioned key.
Still, that's something we have to have a look at in our packaging overhaul.