koji

#3682 importRPM doesn't create unsigned sig record for signed packages
Closed: Dropped by tkopecek. Opened by tkopecek.

Closed: Dropped
Reopen Issue

Confusing title, so:
if koji normally builds package, it will import its rpms in the end. importRPM will strip the sighdr which is treated as sigkey ''. Later after importing signatures new records are created. Other use case is direct rpm import. In such case (with signed rpm) it will strip the sighdr with signed content but it will not create unsigned sighdr record. This creates inconsistent db situation visible now via getRPMChecksums. There are few options to handle that:
1) I don't think there is any usecase for storing unsigned sighdrs. We can delete them from the db and update importRPM to not add these. In this case it would be worth to update getRPMChecksums to provide this field every time.
2) If we want to have them - provide script to recompute missing ones and update importRPM to add also '' record in case of signed rpm. getRPMChecksums should be updated here also in case someone don't run the script.

@mikem which idea you would like to choose? I spoke with @tkopecek and he is thinking about point 2. Or do you have any other idea?

Metadata Update from @jcupova:
- Custom field Size adjusted to None

Can we clarify more about the "inconsistent db situation" and what problems this causes?

I don't think there is any usecase for storing unsigned sighdrs.

We save them because they cannot be replicated otherwise.

In the typical case where the primary rpm copy is unsigned, I suppose we'll never need the detached signature because we'll never touch that primary copy.

At the moment, the only time this would really matter is if a signed copy were imported first and then later an unsigned copy was imported. In you suggestion, Koji would refuse/ignore and so would never be able to record an unsigned copy.

Note that regardless of whether we store detached sighdrs, we will still have unsigned rpms and so we will still need to be able to report their checksums.

If we want to have them - provide script to recompute missing ones

Note that rpm --delsign will generally not recreate an identical sighdr to the one that was created at build time, nor is there a guarantee that --delsign will behave in a bitwise identical manner over time or across rpm versions.

My inclination is that there must be a third option not yet listed.

Of course, option is to ignore it and leave it on users. Maybe there is some additional value in knowing that '' key is not present?

When we take an option to ignore it and leave it on users, do we want to print some warn, that unsigned copy is missing? For example in getRPMChecksums call?

Can we clarify more what the actual problem is? How is the current situation for clients a problem?

Is it simply that "not all rpms have an unsigned checksum?" I.e. that getRPMChecksums will sometimes not include values for the the unsigned rpm?

I don't think clients should assume that data will be present any more than they assume any other signature. The same basic behavior has been in queryRPMSigs and writeSignedRPM without issue.

With koji, I think we should generally stick to reporting the facts as they are given. In the case of concern, koji has never seen an unsigned copy of the rpm, so it does not report one.

Metadata Update from @tkopecek:
- Issue close_status updated to: Dropped
- Issue status updated to: Closed (was: Open)

ok, agreed

Metadata Update from @tkopecek:
- Issue set to the milestone: None (was: 1.33)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/3682

Please continue any further discussion there.
Metadata
None
None
None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.