Daniel Hilst 25dfc3957a feat(build): manifest-driven repo completeness + signature gate, auto-run after build ...

Adds a real gate on the BUILT per-target repo, using packages-manifest.conf as the
single source of truth, layered so the decision is pure and unit-tested:

- MockBuildUtils::verify_repo_packages(\%expected,\%present) -- pure completeness
  (MISSING / VERSION vs the manifest pins); verify_repo_signature(\%expected,\%observed)
  -- pure signature identity (UNSIGNED / WRONGKEY). Both unit-tested (happy+sad).
- mockbuild-all.pl does the IO and calls both from one sub, verify_target_repo:
  reads the manifest, enumerates the repo via rpm_version, resolves --gpg-key-name to a
  primary-key fingerprint and extracts repomd.xml.asc's actual signer (VALIDSIG), then
  merges the two pure results and dies listing every problem.
- Runs AUTOMATICALLY at the end of deploy_target (after sign+index), replacing the old
  assert_required_deps + inline version-pin loop with one consolidated gate; suppressible
  with --no-verify-repo. Also a standalone build-free '--verify-repo=<repo>' mode (manifest
  from repo_root, gpg from --gpg-key-name/--gpg-home; target derived from the rh<N>/<arch>
  path or --target).

prove t/mockbuild-all.t: 68/68 (was 50). gpg round-trip smoke-tested: right key -> OK,
wrong key -> WRONGKEY, missing .asc -> UNSIGNED.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-08-12 15:29:02 -03:00

..

mockbuild-all.t

feat(build): manifest-driven repo completeness + signature gate, auto-run after build

2026-08-12 15:29:02 -03:00