I am trying to create a CI pipeline that downloads a certain RPM version from releases.
There doesn't seem to be a way to verify the downloaded RPM. From the drone.yml file I can see that there is a signing process for the RPM packages, but a public key isn't mentioned anywhere.
There is a checksum file available for every release, but we cannot verify whether these hashes are generated by a trusted instance. For this we would need a signed signature file as well.
I am trying to create a CI pipeline that downloads a certain RPM version from releases. There doesn't seem to be a way to verify the downloaded RPM. From the
drone.yml
file I can see that there is a signing process for the RPM packages, but a public key isn't mentioned anywhere.There is a checksum file available for every release, but we cannot verify whether these hashes are generated by a trusted instance. For this we would need a signed signature file as well.
Perhaps I'm missing something.