Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: expose rpm signature information #3179

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

ralphbean
Copy link
Contributor

This helps with more confident identification of an rpm.

In theory, two rpms can be built that have the same purl string, and otherwise look identical in syft's output, but the PGP information would distinguish them as signed either by different keys, or signed at different times.

In practice, this usually makes no difference since rpms tend to have unique name/version/release strings. This gives increased confidence about the identity of the rpm found in the db.

@github-actions github-actions bot added the json-schema Changes the json schema label Aug 30, 2024
@ralphbean ralphbean marked this pull request as draft August 30, 2024 19:25
@ralphbean
Copy link
Contributor Author

I still need to get some signature information into the tests before this is ready for review.

This helps with more confident identification of an rpm.

In theory, two rpms can be built that have the same purl string, and
otherwise look identical in syft's output, but the PGP information
would distinguish them as signed either by different keys, or signed at
different times.

In practice, this usually makes no difference since rpms tend to have
unique name/version/release strings. This just gives increased
confidence about the identity of the rpm found in the db.

Signed-off-by: Ralph Bean <[email protected]>
@ralphbean
Copy link
Contributor Author

(I spent some time trying to get the test suite working locally on main branch, but have so far failed. Just FYI, I'm not totally ignoring this.)

@wagoodman
Copy link
Contributor

no problem @ralphbean -- shout out if there is something we can do to help!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
json-schema Changes the json schema
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants