mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 04:26:25 +00:00
Daniel Hilst
9480dfe780
Three review follow-ups on the repo validation gate:
1. Full EPOCH:VERSION-RELEASE validation. The gate compared only %{VERSION}, so
xCAT-genesis-base=2.* accepted a pre-2.18 (2.17.x) genesis even though
xCAT-genesis-scripts Requires >= 2:2.18.0, and it could not enforce release
floors like perl-IO-Stty >= 0.04-5. Manifest pins now also accept an EVR
constraint (>=, >, <=, <, = followed by [epoch:]version[-release]); the built
rpm's full EVR is compared with rpm's own algorithm (rpm.vercmp via the lua
binding, injected into the pure evr_cmp, which composes epoch/version/release).
genesis-base is pinned >= 2:2.18.0 and perl-IO-Stty >= 0.04-5. rpm_evr also
catches release-level stale-artifact accumulation that rpm_version (VERSION
dedup) missed.
2. RPM-native crypto verification. The per-rpm gate extracted the header signer
id but did not verify digests/signatures. It now also runs `rpmkeys --checksig`
against an isolated keyring holding only the signing key (exported from the gpg
home), so every rpm's header/payload digests AND the signature-by-this-key are
cryptographically verified; the signer-id origin check is kept alongside.
3. repo_gpgcheck. The generated xcat-dep.repo set only gpgcheck=1; add
repo_gpgcheck=1 (mirroring gpgcheck) so clients enforce the detached
repomd.xml.asc signature that sign_and_index_repo already produces.
Validated: unit tests for parse_evr/evr_constraint_ok (rpm's real vercmp; the
reviewer's 2.17.9-rejected, 0.04-4-rejected, epoch-enforced cases) + checksig
verdict; and `--verify-repo` over a real signed rh8/x86_64 cell passes
(12 packages EVR-satisfied, every rpm checksig-verified).
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>