On 5/31/19 6:57 AM, Martin Kolman wrote:
I guess we can't just switch what the signature refers to as
there are other tools
that do this kind of verification on the compressed data, not just delta-RPM, right ?
So maybe, could we attach a second signature computed on the uncompressed payload ?
Delta-RPM could then use that to verify the reconstructed package & would be crazy
fast,
as the slow XZ compression will no longer be needed to be performed client-side to
verify
the signature.
It's not deltarpm that needs the signature. It just puts the package
together. It's rpm that checks the signature.