[Rpm-maint] [rpm-software-management/rpm] RPMTAG_OPENPGP returns legacy non-header signatures via "extension" code (Issue #4137)

[Daniel Alley]

dralley created an issue (rpm-software-management/rpm#4137)

**Describe the bug**

`RPMTAG_OPENPGP` is documented to return header-only signatures. 

When used with the `HEADERGET_EXT` flag, the extension code for the handling of this tag returns legacy header + payloads in the mix.  

The commit message suggests this was intentional (https://github.com/rpm-software-management/rpm/commit/bea8f4557819449e6aec948dae192d71fe49d526), but it does not conform to the documented behavior of that tag.  It makes usage challenging, because you cannot trust that these signatures can be verified against the header bytes range.

**To Reproduce**
Steps to reproduce the behavior:
1.  Take a package which contains V4 (RSAHEADER/DSAHEADER) and V3 signatures (SIGPGP/SIGGPG)
2.  Call `headerGet(RPMTAG_OPENPGP)` with `HEADERGET_EXT` flags enabled
3.  Observe that >1 signatures are present


**Expected behavior**

Fetching from the `RPMTAG_OPENPGP` should return only header-only signatures as documented - disincluding legacy signatures.  `SIGPGP` / `SIGGPG` signatures should be ignored.

**Environment**
 - OS / Distribution: F43
 - Version: rpm 6.0.1


-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/4137
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/issues/4137 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260306/bc430435/attachment-0001.htm>