[Rpm-maint] [rpm-software-management/rpm] Add support for multiple signatures per package, aka v6 signatures (PR #3439)

[Daniel Alley]

@dralley commented on this pull request.



> +    trySigTag(h, RPMTAG_SIGPGP, &sigs);
+    trySigTag(h, RPMTAG_SIGGPG, &sigs);

OK, so, this behavior is actually documented, just under the extensions section of tags.md.  I suppose in that sense it can't be considered a bug.

However, I do have to say that this is quite annoying.

How are you supposed to tell whether a signature in `RPMTAG_OPENPGP` is header-only or not?  How do you consistently verify them?  Per the commit message, it doesn't seem like this actually simplifies anything, it just means that the  case where you want to actually verify them (not just list them) gets more complicated.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/3439#discussion_r2898110069
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/3439/review/3906294604 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260306/59d08a69/attachment.htm>