In https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/RWILIHQJEKIQM5LAH7UJ7KMRPZEXCKQL/ @kevin wrote "no longer shipped packages have their signed packages removed after a while to save space"

What is performing that action?

koji prune-signed-copies run via cronjob typically. Anyway, it is removing only signed copies (from signed directoty) not signatures themselves (they are still in sigcache) and can be reconstructed via write-signed-rpms. Neither it deletes signature info from database. deleteRPMSign call completely destroys the signature.

Thanks for explaining this. I think we could improve the --help docs to explain the differences between prune-signed-copies and remove-sig.

As far as making this API optional, it's going to make QE more difficult if we add another hub configurable. Users will probably always toggle it "on", too and then forget about it. As a compromise, PR #3026 adds warnings to the RPC docs and CLI so users don't casually see the command in --help and try to run this without thinking about it.

PR 3076

Commit b2bd367b fixes this issue

Commit 246bad05 fixes this issue

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/3018

Please continue any further discussion there.