I think we're going to need to extend the check in get_header_field to ensure that we do not try to decode this binary field. Currently, we only omit decoding for fields starting with "SIG".

Guessing we want to add endswith("HEADER") to the check.

I think we're going to need to extend the check in get_header_field to ensure that we do not try to decode this binary field. Currently, we only omit decoding for fields starting with "SIG".

Guessing we want to add endswith("HEADER") to the check.

Right. I just amended the patch adding that change.

get_sighdr_key is missing RPM_SIGTAG_RSA variant. We can also add DSA variant to cover all https://docs.fedoraproject.org/en-US/Fedora_Draft_Documentation/0.1/html/RPM_Guide/ch-package-structure.html#id623000 variants.

I have added the get_sighdr_key part, and DSA variants.
I will update this PR in the next day or so with a DSA-based test.

I tested this PR today.

• Client was python3-koji-1.25.1-1.fc34
• Hub was koji-hub-1.25.1-1.el8 from EPEL

On my Fedora 34 client (rpm-4.16.1.3-1.fc34), I signed a test bash RPM without --rpmv3:

rpmsign --define "_gpg_name Ken Dreyer" --addsign bash-5.0.17-2.fc32.x86_64.rpm

Note to anyone else testing this, you can verify that this RPM uses the newest signature formats because SIGGPG and SIGPGP are "(none)", and RSAHEADER is the only one with a value.

rpm -q --qf '%{NAME} %{SIGGPG:pgpsig} %{SIGPGP:pgpsig} %{RSAHEADER:pgpsig}\n' -p bash-5.0.17-2.fc32.x86_64.rpm
bash (none) (none) RSA/SHA256, Tue 10 Aug 2021 03:59:55 PM EDT, Key ID 478a947f782096ac

I imported the signed RPM using my patched koji client:

kojidev import-sig bash-5.0.17-2.fc32.x86_64.rpm
Importing signature [key 782096ac] from bash-5.0.17-2.fc32.x86_64.rpm...
Writing signed copy

Without the patch, Koji treats this RPM as unsigned.

After Koji wrote the signed copies, I composed the signed build successfully with Pungi.

One more place is in get_sighdr_key

@puiterwijk Would you mind adding that small fix? ^ (or I can do it in separate PR).

typo s/GIT/get/

typo s/GET/get/

@tkopecek has continued this PR in #3012