Skip to content

Feature: rpm multiple signatures#253

Merged
guillermodotn merged 3 commits into
release-engineering:developmentfrom
guillermodotn:feature/rpm-multiple-signatures
May 21, 2026
Merged

Feature: rpm multiple signatures#253
guillermodotn merged 3 commits into
release-engineering:developmentfrom
guillermodotn:feature/rpm-multiple-signatures

Conversation

@guillermodotn
Copy link
Copy Markdown
Contributor

Summary

  • Add optional sigkeys field to v2.0 RPM entries for packages with multiple signatures (RPM v6).
  • sigkey is preserved as-is for backward compat. sigkey is auto-included in sigkeys when both are provided.
  • Values are validated as hex strings and normalized to lowercase.
  • Add Rpms.get_sigkeys() public API.
  • v1.x format is unchanged.

Addresses #206

Assisted-by: Claude Opus <noreply@anthropic.com>
Assisted-by: Claude Opus <noreply@anthropic.com>
Copy link
Copy Markdown
Contributor

@lubomir lubomir left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly the changes look good to me, but I have two design concerns.

What is the difference between sigkeys being [] and None? They feel similar in meaning, and IMO we should decide on one and standardize on it. If callers can rely on sigkeys always being a list, it might make life easier for them.

The second is about migration to this new implementation. Ideally, I think v2 productmd should only support the list case of sigkeys in API. The code for prepending the single key to the list doesn't seem very useful to me.

Assisted-by: Claude Opus <noreply@anthropic.com>
@guillermodotn
Copy link
Copy Markdown
Contributor Author

Changes

  • sigkeys is always a list, defaults to [].
  • sigkey is derived from sigkeys[0] when sigkeys is provided. Derivation happens at add() time only. Direct mutation of the entry dict afterwards won't update sigkey.

@guillermodotn guillermodotn requested a review from lubomir May 19, 2026 15:26
@guillermodotn guillermodotn merged commit 4dc7095 into release-engineering:development May 21, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants