Skip to content

Verify RPM signatures with release key - #14

Merged
daredoole merged 1 commit into
mainfrom
agent/release-signature-verify-fix
Jul 29, 2026
Merged

Verify RPM signatures with release key#14
daredoole merged 1 commit into
mainfrom
agent/release-signature-verify-fix

Conversation

@daredoole

Copy link
Copy Markdown
Owner

Summary

  • export the release public key before RPM verification
  • import that public key into the ephemeral Fedora container RPM database
  • require both binary RPM and source RPM signature checks to pass

Verification

Reproduced in Fedora 44 with the dedicated release key: both artifacts report digests signatures OK. Temporary test key material was removed after verification.

@daredoole
daredoole marked this pull request as ready for review July 29, 2026 17:11
@daredoole
daredoole merged commit a66369b into main Jul 29, 2026
6 checks passed
@daredoole
daredoole deleted the agent/release-signature-verify-fix branch July 29, 2026 17:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant