Daniel Hilst 779403852c fix(xcat-dep): publisher keyring can reuse a directory the build did not create ...

trust_dbpath named the keyring after a hash of the staging directory and
did not create it. A directory or symlink that another user put at that
predictable name under the local root became the rpmkeys --dbpath for
the publisher key.

trust_dbpath now creates a fresh 0700 directory with tempdir under the
same root, so XCAT_DEP_TRUST_TMP still selects it. CLEANUP removes it
when the creating process exits. stage_inputs and build_native_inputs
run in that process, so the keyring stays in place for every
verify_input of the run.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-10-02 13:11:57 -03:00

..

XCAT

fix(xcat-dep): publisher keyring can reuse a directory the build did not create

2026-10-02 13:11:57 -03:00