On 10/19/26 11:28 AM, Simon de Vlieger wrote:
On Mon, Oct 19, 2026, at 10:22 AM, Panu Matilainen via devel wrote:
AFAICT, neither pungi or kiwi should be affected.
Note that `image-builder` is also used in infrastructure and it *does*
inspect RPM metadata to explicitly report back to `koji` (and to generate SBOMs
in various formats and such) instead of relying on `koji` to look into the
buildroot cache.
Specifically its implementation is here:
https://github.com/osbuild/osbuild/blob/main/stages/org.osbuild.rpm#L53-L116
From a previous read I did I don't think v6 will affect anything there, but
we should probably take a closer look and test with some v6 RPMs.
Yeah, the required metadata in that code is not affected.
So assuming whatever processes that does not make any assumptions on the
optional tags, we can say it's compatible.
Unrelated to v6 compatibility, but I spot SIGPGP and SIGGPG being
collected as optional data. Those are RPM v3 signatures, which are
pretty much extinct nowadays.
What it really should collect is DSAHEADER and RSAHEADER for RPM v4
signatures. And for versions that support it, the OPENPGP array tag,
which when queried through --qf, will contain the other signatures as well.
- Panu -
Ciao, Simon
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
