security issue - digital software signatures are not always verified

[adrelanos]

Problem description

Digital software signatures are not always verified. This is bad for security.

Expected behaviour

Digital software signatures are always verified.

Steps to reproduce the behaviour

1. Look at https://github.com/OSInside/kiwi-descriptions/blob/master/debian/x86_64/debian-buster/config.xml
2. See:

<rpm-check-signatures>false</rpm-check-signatures>

repository_gpgcheck="false"

[Conan-Kudo]

This is an example kiwi description. You can just as easily flip those from false to true, but then you need to provide the keys to verify signatures with. For the purposes of those descriptions, it wasn't needed.

If you want examples of how you can do build images with signature verification for inputs, there are a few CentOS example descriptions that show how to do it.