[Rpm-maint] [rpm-software-management/rpm] Tests for behavior of importing keys disabled in crypto policies (PR #4197)

[Jakub Jelen]

This is follow-up from #4116 where  we tested how untrusted signatures are handled (https://github.com/rpm-software-management/rpm-sequoia/pull/105). This is a respective test change related to rpm-software-management/rpm-sequoia/pull/109, which changed how `PubKeyLint` handles legacy algorithms.

Though, there are still some unanswered questions as it looks like the RPM behavior can be improved in some cases:
 * Importing certificate bundle with allowed and non-allowed key still exits with non-zero exit code. RHEL 10 has both classic and PQC keys in one file. This might be an issue for DNF.
 * Verifying RSA signatures that are disabled in crypto policies and where we miss the key from rpmdb still looks like returning NOKEY instead of NONTRUSTED error. This sounds like rpm-sequoia issue though. I will have to investigate this further.
You can view, comment on, or merge this pull request online at:

  https://github.com/rpm-software-management/rpm/pull/4197

-- Commit Summary --

  * tests: Verify importing untrusted certificate fails differently
  * tests: Pull new rpm-sequoia to build image
  * TMP: Pull rpm-sequoia from updates-testing
  * Test importing cert bundle works + missing disable key reports success

-- File Changes --

    M tests/Dockerfile.fedora (2)
    M tests/rpmapi.at (23)
    M tests/rpmsigdig.at (47)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/4197.patchhttps://github.com/rpm-software-management/rpm/pull/4197.diff
-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4197
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4197 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260429/11a89526/attachment.htm>