mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 04:26:25 +00:00
Daniel Hilst
25dfc3957a
Adds a real gate on the BUILT per-target repo, using packages-manifest.conf as the single source of truth, layered so the decision is pure and unit-tested: - MockBuildUtils::verify_repo_packages(\%expected,\%present) -- pure completeness (MISSING / VERSION vs the manifest pins); verify_repo_signature(\%expected,\%observed) -- pure signature identity (UNSIGNED / WRONGKEY). Both unit-tested (happy+sad). - mockbuild-all.pl does the IO and calls both from one sub, verify_target_repo: reads the manifest, enumerates the repo via rpm_version, resolves --gpg-key-name to a primary-key fingerprint and extracts repomd.xml.asc's actual signer (VALIDSIG), then merges the two pure results and dies listing every problem. - Runs AUTOMATICALLY at the end of deploy_target (after sign+index), replacing the old assert_required_deps + inline version-pin loop with one consolidated gate; suppressible with --no-verify-repo. Also a standalone build-free '--verify-repo=<repo>' mode (manifest from repo_root, gpg from --gpg-key-name/--gpg-home; target derived from the rh<N>/<arch> path or --target). prove t/mockbuild-all.t: 68/68 (was 50). gpg round-trip smoke-tested: right key -> OK, wrong key -> WRONGKEY, missing .asc -> UNSIGNED. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>