[Rpm-maint] [rpm-software-management/rpm] Document rpmkeys output and the overall verify policy in some detail (PR #4170)

[Panu Matilainen]

@pmatilai commented on this pull request.



> @@ -79,19 +80,87 @@ See *rpm-common*(8) for the options common to all *rpm* executables.
 	configured keystore backend.
 	This can be used to convert from one key storage to another.
 
+# VERIFICATION POLICY
+To deal with three generations of package formats and as many decades of
+cryptographic algorithms and differing system policies, the RPM package
+verification is a complicated system with many moving parts.
+
+RPM packages contain multiple individual _verifiables_ that cover different
+parts of the package: header, payload or both, using different cryptographic
+algorithms. There are two _classes_ of verifiables: digests and signatures,
+and a verification result is calculated independently for each, based on
+the results from the individual verifiables.
+For a per-class pass, passing verifiables of that class to cover

Tweaked this somewhat, using pass/fail more consistently and such. Not entirely happy with it still, but hopefully at least a bit better :sweat_smile: 

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4170?email_source=notifications&email_token=ADLPZUZ63A3APRE5NO2RKBD4TYXIDA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMBUHE2DOMZYGQ22M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOS6XA4S7OJSXM2LFO5PW433UNFTGSY3BORUW63TTL5RWY2LDNM#discussion_r3026943921
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4170/review/4049473845 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260402/8268d5e0/attachment.htm>