Skip to content

go/signing-ticket: fix RPM signature verification for RPM 6.0.1 - #374

Merged
prestist merged 1 commit into
coreos:mainfrom
prestist:fix-rpm-signing-verification
Sep 1, 2026
Merged

prestist merged 1 commit into
coreos:mainfrom
prestist:fix-rpm-signing-verification

Conversation

@prestist

@prestist prestist commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

rpm -Kv returns non-zero when the public key isn't in the local RPM database (NOKEY), which causes the script to exit early under set -e -o pipefail before the grep check runs. Capture the output and check for the key ID directly instead.

@prestist

prestist commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

@tlbueno
tlbueno self-requested a review September 1, 2026 15:45

@tlbueno tlbueno left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

rpm -Kv returns non-zero when the public key is not in the local RPM
database (NOKEY), causing set -e -o pipefail to abort before the grep
check could run. Capture the output while ignoring the exit code and
explicitly verify the expected key ID is present in the output.
@prestist
prestist force-pushed the fix-rpm-signing-verification branch from d72ac32 to 0d51f4c Compare September 1, 2026 15:48
@prestist
prestist merged commit df9b3bf into coreos:main Sep 1, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants