Good point. For that matter the only way to sign rpms in koji is to upload (only) the signature header.

So it seems we're already at option 3

On Tue, Feb 21, 2023 at 3:02 PM Kevin Fenzi <> wrote:
On Tue, Feb 21, 2023 at 02:52:49PM -0500, Michael McLean wrote:
> Koji instances have control over how they run prune-signed-copies. It is
> possible to not run it at all
> The only difference between a signed copy and the original is the signature
> header, which is kept under the sigcache dir even when a signed copy is
> deleted. Signed copies can be recreated with a call to writeSignedRPM,
> which simply splices the requested header in to make the copy.
> When I was first informed about the IMA signing plan, I was told that the
> ima signatures were all in the signature header. If this is not the case,
> then the whole process is deeply flawed.

I think they have to be... because the way our signing works, sigul
signs the rpms and imports the signatures into koji, then asks koji to
write out the signed rpm.

So, the information has to be there, there's no where else it would have
come from.

koji-devel mailing list --
To unsubscribe send an email to
Fedora Code of Conduct:
List Guidelines:
List Archives:
Do not reply to spam, report it: