Open DemiMarie opened 3 years ago
References I've found:
What is the latest status of this?
Robosignatory has full support now. I have a draft PR for pungi and koji support has not started.
It isn’t that difficult, but it is another thing on my to-do list. It’s all Python scripting, so it should not be too hard for someone else to help.
Qubes OS version (if applicable)
Qubes release 4.0 (R4.0)
Affected component(s) or functionality (if applicable) Fedora templates
Brief summary We should work with Fedora to get them to sign their metadata. This is likely blocked on the stabilization of DNF 5, as DNF 4 has numerous bugs regarding metadata signing.
Additional context There was an RCE in librepo that this would have mitigated. As per https://github.com/rpm-software-management/librepo/issues/231#issuecomment-787918202 the issues in DNF are unlikely to be fixed in DNF 4.
Relevant documentation you've consulted
Related, non-duplicate issues
6177 tracked signing of metadata for QubesOS.