@dmnks commented on this pull request.
> -
- if (flags & RPMSIGN_FLAG_FSVERITY) {
- if (includeVeritySignatures(fd, &sigh, &h))
- goto exit;
+ /* Add file signatures (if requested and not a source rpm) */
+ if (!headerIsSource(h)) {
+ if (flags & RPMSIGN_FLAG_IMA) {
+ if (includeFileSignatures(&sigh, &h))
+ goto exit;
+ }
+ if (flags & RPMSIGN_FLAG_FSVERITY) {
+ if (includeVeritySignatures(fd, &sigh, &h))
+ goto exit;
+ }
+ } else if (flags & (RPMSIGN_FLAG_IMA | RPMSIGN_FLAG_FSVERITY)) {
+ rpmlog(RPMLOG_WARNING,
Indeed, my initial thought was "but you still want to sign the source rpm
normally, even if file sigs aren't applied". But then, you should just drop
`--signfiles` to achieve that. So yup, will fix.
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/3470#discussion_r1858546317
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/pull/3470/review/2461546...@github.com>_______________________________________________
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
https://lists.rpm.org/mailman/listinfo/rpm-maint
