fix: exclude legacy RPM targets from GPG signing with recent key

[patrick-stephens]

Legacy OS targets cannot handle more recent GPG keys and just trigger failures when attempting to install the package - even with --nogpgcheck or similar.

See https://serverfault.com/a/624910

RPM fails to validate signed packages, didn't understand v4 GPG signatures but didn't notice it didn't understand them, didn't understand some key sizes and types but didn't notice it didn't understand that, and also choked on subkeys!

You must force GnuPG to use v3 signatures when signing on/for RHEL / CentOS 5 or 6:

%__gpg_sign_cmd %{__gpg} \
    gpg --force-v3-sigs --digest-algo=sha1 --batch --no-verbose --no-armor \
    --passphrase-fd 3 --no-secmem-warning -u "%{_gpg_name}" \
    -sbo %{__signature_filename} %{__plaintext_filename}
because RPM doesn't check the sigversion or validate the signed package after signing it, and these distros contain GPG versions that default to v4 signatures.

You must also generate a 2048 bit signing-only RSA key with no subkeys.

A couple of relevant bugs:

[RPM seems unable to find (GPG) RSA keys for verifying signatures](https://bugzilla.redhat.com/show_bug.cgi?id=86012)

[rpm --sign with 4096bit or 2048bit RSA key creates broken signature](https://bugzilla.redhat.com/show_bug.cgi?id=436812)

---

Summary by cubic

Stop signing RPMs for legacy distros (CentOS 6–8, AlmaLinux 8, Rocky 8) to prevent install failures with newer GPG keys. Installs on these platforms now work, and supported targets remain signed.

• Bug Fixes
  • scripts/sign-packages.sh: sign all RPMs, then remove signatures from legacy targets.
  • install.sh: add INSTALL_ADDITIONAL_PARAMETERS to pass extra package manager flags (e.g., --nogpgcheck) during installation.

^{Written for commit dd80bdd. Summary will update automatically on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (all 1 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="scripts/sign-packages.sh">

<violation number="1" location="scripts/sign-packages.sh:46">
P1: The `tty` command fails with exit status 1 in non-interactive environments (like CI). With `set -e` enabled, this will cause the script to abort before signing any packages. Consider using `GPG_TTY=$(tty 2&gt;/dev/null || true)` or checking if TTY is available first.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}