rpmkeys: --checksig should require valid signatures

[DemiMarie]

rpmkeys --checksig exists specifically to verify the signatures on a
package. Therefore, it should imply --define=_pkgverify_level all and
--define=_pkgverify_flags 0x0. The current behavior is both
counterintuitive and dangerous.

The RPM testsuite relies heavily on controlling the package verification
level via --define=_pkgverify_level $lvl. Therefore, add two new
flags: --no-require-digests and --allow-unsigned. These are
equivalent to --nodigests and --nosignatures, respectively, except
that they only change whether digests (resp. signatures) are required,
not whether they are checked at all. Additionally, update the testsuite
to use the new flags and expect the new NOTFOUND lines. This accounts
for most of the changes.

[DemiMarie]

Pinging @dmach @Conan-Kudo as per private discussion.

[Conan-Kudo]

While this generally looks good, we probably want to have tests that verify positive cases with accepted signatures. Admittedly, I'm not sure how that would be wired in...

[DemiMarie]

While this generally looks good, we probably want to have tests that verify positive cases with accepted signatures. Admittedly, I'm not sure how that would be wired in...

We already have such tests, and this change does not break them.

[Conan-Kudo]

Ah, okay.

[pmatilai]

NAK, this is getting even more confusing.

I totally agree --checksig is far from ideal, but there are LOTS of legacy twists associated with it all. I opened #1631 to track it - the main issue to me is that it's ambiguous - and it needs to be properly though over, taking all the legacy crap, FIPS mode, usability and user expectations into account.

[DemiMarie]

NAK, this is getting even more confusing.

I totally agree --checksig is far from ideal, but there are LOTS of legacy twists associated with it all. I opened #1631 to track it - the main issue to me is that it's ambiguous - and it needs to be properly though over, taking all the legacy crap, FIPS mode, usability and user expectations into account.

From my perspective, what is most important is getting --checksig to match what users expect now, and to do so as quickly as possible. The current behavior makes who knows how many downstream programs and scripts vulnerable.