In the meanwhile: if you can do so in your environment, turning on enforcing
signature checking (that _pkgverify_level thing) is very much recommended,
that's supported since 4.14.2. It's just that so many workflows are based
around the traditional no-signature behavior that changing the upstream default
is damn hard.
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/3416#issuecomment-2446937113
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/pull/3416/c2446937...@github.com>
_______________________________________________
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint
