On Tue, Jan 26, 2021 at 3:44 PM Matthew Miller mattdm@fedoraproject.org wrote:
On Tue, Jan 26, 2021 at 10:44:05AM -0800, Kevin Fenzi wrote:
- Try and change the storage format of the signatures to not take up
tons of room. I guess this would be in ima tools and sigul?
Is this an immediate issue given that it only affects systems where the plugin is enabled?
Yes. This is breaking *everything*. Regardless of whether the plugin is installed, RPM now thinks the generated packages are invalid and cannot do anything with them. This has also broken package builds on COPR and the openSUSE Build Service.
- Get rpm updated at least in all Fedora's / active RHEL's to be able to
handle rpms with the signatures. I don't know how likely this is for rhel7, but 8 and fedora 32 should hopefully not be hard.
Very unlikely with where RHEL 7 is in its maintenance lifecycle.
If we ever want this feature, you will probably want to get the fix backported, since parsing RPMs containing this data is broken.