Verifying RPMs signatures and digests

baude / image-scanner

[Deprecated] Vulnerability scanner for containers and images

GNU Lesser General Public License v2.1

14 stars 8 forks source link

Verifying RPMs signatures and digests #82

Open simon3z opened 9 years ago

simon3z commented 9 years ago

At the moment the _get_rpms(self) method contains:

def _get_rpms(self):
    ...
    ts.setVSFlags((rpm._RPMVSF_NOSIGNATURES|rpm._RPMVSF_NODIGESTS))
    ...

@baude I think we should plan to support verification of signatures and digests. Is there a technical limitation that is preventing us to enable it at the moment?