Daniel Hilst 6f7497cceb fix(xcat-dep): repo gate must verify the NATIVE per-arch genesis; harden signature check ...

Review follow-up on the apt-repo gate:
- FALSE-PASS (concern #7610): genesis name-resolution picked xcat-genesis-base-amd64
  alphabetically for BOTH cells (both genesis debs are Architecture:all and appear in every
  arch index), so the ppc64el cell never verified its NATIVE xcat-genesis-base-ppc64el -- a
  dropped ppc genesis passed. Extract a PURE, unit-tested resolve_present_names that resolves
  the arch-suffixed genesis to THIS cell's arch only (never a different arch), with a test that
  reproduces the masked-genesis case.
- signature: reject EXPKEYSIG/REVKEYSIG/EXPSIG (expired/revoked keys emit VALIDSIG too); drop
  the short-GOODSIG-keyid fallback (could never equal the 40-hex expected fpr -> spurious WRONGKEY).
- FALSE-FAIL: the post-assembly auto-run now requires a signature only when --gpg-sign was
  actually used (an unsigned-by-choice repo no longer dies UNSIGNED); standalone --verify-repo
  keeps checking whenever a gpg key/home is configured.
- cosmetic: de-duplicate the MISSING-INDEX message.
prove t/sbuild-all.t: pure gate tests incl. the new genesis-resolution cases.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-08-12 16:43:19 -03:00

..

sbuild-all.t

fix(xcat-dep): repo gate must verify the NATIVE per-arch genesis; harden signature check

2026-08-12 16:43:19 -03:00