Split out GPG validation into own check and improve it

openSUSE / obs-service-source_validator

The default source validator as used by openSUSE:Factory distribution

GNU General Public License v2.0

3 stars 25 forks source link

Closed dirkmueller closed 2 years ago

dirkmueller commented 2 years ago

The previous check had a number of flaws:

if more than one *.keyring file was in directory, it aborted validation silently
if signature was given but no *.keyring, no validation was performed.
no handling of zstd archives

This check is now enforcing that there is one and only one *.keyring if signatures are used.