[Rpm-maint] [rpm-software-management/rpm] Document rpmkeys output and the overall verify policy in some detail (PR #4170)

[Michal Domonkos]

@dmnks commented on this pull request.



> @@ -79,19 +80,102 @@ See *rpm-common*(8) for the options common to all *rpm* executables.
 	configured keystore backend.
 	This can be used to convert from one key storage to another.
 
+# VERIFICATION POLICY
+To deal with three generations of package formats and as many decades of
+cryptographic algorithms and differing system policies, the RPM package
+verification is a complicated system with many moving parts.
+
+RPM packages contain multiple individual _verifiables_ that cover different
+parts of the package: header, payload or both, using different cryptographic
+algorithms. There are two _classes_ of verifiables: digests and signatures,
+and a class-level pass/fail result is calculated independently for each,

Fixed in my fixup now, let's see...

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4170?email_source=notifications&email_token=ADLPZU7Q3TI2OBOXSQPWU6T4T2L7FA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMBVGE4TIMJSGUYKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOS6XA4S7OJSXM2LFO5PW433UNFTGSY3BORUW63TTL5RWY2LDNM#discussion_r3029221406
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4170/review/4051941250 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260402/aa6ef7ae/attachment.htm>