On Tue, Feb 21, 2023 at 02:52:49PM -0500, Michael McLean wrote:
Koji instances have control over how they run prune-signed-copies. It
is
possible to not run it at all
The only difference between a signed copy and the original is the signature
header, which is kept under the sigcache dir even when a signed copy is
deleted. Signed copies can be recreated with a call to writeSignedRPM,
which simply splices the requested header in to make the copy.
When I was first informed about the IMA signing plan, I was told that the
ima signatures were all in the signature header. If this is not the case,
then the whole process is deeply flawed.
I think they have to be... because the way our signing works, sigul
signs the rpms and imports the signatures into koji, then asks koji to
write out the signed rpm.
So, the information has to be there, there's no where else it would have
come from.
kevin