Daniel Hilst ef966fd95b feat(xcat-dep): arch-array cross-arch finalize; verify every rpm signature ...

Two review follow-ups:

- Cross-arch genesis matrix is now driven by a single @GENESIS_ARCHES array
  (arch -> xCAT tarch) in MockBuildUtils. finalize_xcat_dep discovers, gates, and
  N-way cross-copies over that list, so adding an arch later (aarch64, riscv64) is
  one entry there plus wiring its repo root. No behaviour change for the current
  x86_64/ppc64le pair (tests unchanged + a contract assertion on the array).

- PR #62 review #4: the repo completeness gate verified only the repomd.xml
  signature. It now ALSO verifies every binary rpm's header signature is by the
  configured signing key -- resolve the key's accepted id set (primary + subkey
  ids) and check each rpm's RSAHEADER/DSAHEADER pgpsig key id, failing on any
  unsigned or foreign-signed rpm. Runs per-target in deploy_target and per-cell
  after --finalize-xcat-dep. A signed repomd over an unsigned rpm otherwise passed
  the gate yet DNF rejects the package at install. Added pure fixtures.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-08-21 19:01:01 -03:00

..

mockbuild-all.t

feat(xcat-dep): arch-array cross-arch finalize; verify every rpm signature

2026-08-21 19:01:01 -03:00