Fix API to return NOTTRUSTED for disabled algos

Related: RHEL-112700
Ignore signatures made by unknown or disabled algo
2026-02-05 13:42:30 +01:00 · 2026-02-02 13:45:07 +01:00
40 changed files with 1225 additions and 3 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -0,0 +1 @@
+1
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/rpm-4.19.1.1.tar.bz2
+/rpm-4.19.1.1.tar.bz2
--- a/.pqrpm.metadata
+++ b/.pqrpm.metadata
@ -1 +0,0 @@
-5ff9a545a18cd7183854b7ec6de675969fd9b1ec SOURCES/rpm-4.19.1.1.tar.bz2
--- a/SOURCES/0001-Ensure-binary-and-source-headers-are-identified-as-s.patch
+++ b/SOURCES/0001-Ensure-binary-and-source-headers-are-identified-as-s.patch
--- a/SOURCES/0001-Extend-RPM-version-output-with-PQC-edition.patch
+++ b/SOURCES/0001-Extend-RPM-version-output-with-PQC-edition.patch
--- a/SOURCES/0001-Fix-memory-leak-in-rpmsign.patch
+++ b/SOURCES/0001-Fix-memory-leak-in-rpmsign.patch
--- a/SOURCES/0001-Fix-possible-package-corruption-on-delsign-resign-ad.patch
+++ b/SOURCES/0001-Fix-possible-package-corruption-on-delsign-resign-ad.patch
--- a/SOURCES/0001-Fix-potential-use-of-uninitialized-pgp-struct.patch
+++ b/SOURCES/0001-Fix-potential-use-of-uninitialized-pgp-struct.patch
--- a/SOURCES/0001-Fix-potential-use-of-uninitialized-pipe-array.patch
+++ b/SOURCES/0001-Fix-potential-use-of-uninitialized-pipe-array.patch
--- a/SOURCES/0001-Make-_passwd_path-and-_group_path-lists.patch
+++ b/SOURCES/0001-Make-_passwd_path-and-_group_path-lists.patch
--- a/SOURCES/0001-Refactor-sign-command-expand-and-parse-out-of-runGPG.patch
+++ b/SOURCES/0001-Refactor-sign-command-expand-and-parse-out-of-runGPG.patch
--- a/SOURCES/0001-Report-unsafe-symlinks-during-installation-as-a-spec.patch
+++ b/SOURCES/0001-Report-unsafe-symlinks-during-installation-as-a-spec.patch
--- a/SOURCES/0001-Store-configurable-digest-s-on-packages-from-verific.patch
+++ b/SOURCES/0001-Store-configurable-digest-s-on-packages-from-verific.patch
--- a/SOURCES/0002-Add-support-for-spec-local-file-attributes-and-gener.patch
+++ b/SOURCES/0002-Add-support-for-spec-local-file-attributes-and-gener.patch
--- a/SOURCES/0002-Eliminate-hardcoded-GPG-references-from-user-visible.patch
+++ b/SOURCES/0002-Eliminate-hardcoded-GPG-references-from-user-visible.patch
--- a/SOURCES/0002-Fix-FA_TOUCH-ed-files-getting-removed-on-failed-upda.patch
+++ b/SOURCES/0002-Fix-FA_TOUCH-ed-files-getting-removed-on-failed-upda.patch
--- a/SOURCES/0002-Fix-memory-leak-in-rpmspec-shell.patch
+++ b/SOURCES/0002-Fix-memory-leak-in-rpmspec-shell.patch
--- a/SOURCES/0002-Fix-regression-on-build-id-generation-from-compresse.patch
+++ b/SOURCES/0002-Fix-regression-on-build-id-generation-from-compresse.patch
--- a/SOURCES/0003-Declare-signCmd-static.patch
+++ b/SOURCES/0003-Declare-signCmd-static.patch
--- a/SOURCES/0003-Fix-memory-leak-in-runGPG.patch
+++ b/SOURCES/0003-Fix-memory-leak-in-runGPG.patch
--- a/SOURCES/0003-Fix-root-relocation-regression.patch
+++ b/SOURCES/0003-Fix-root-relocation-regression.patch
--- a/SOURCES/0004-Talk-about-rpmsign-in-the-rpmsign-man-page.patch
+++ b/SOURCES/0004-Talk-about-rpmsign-in-the-rpmsign-man-page.patch
--- a/SOURCES/0005-Revert-Drop-redundant-argument-from-rpmcliTransactio.patch
+++ b/SOURCES/0005-Revert-Drop-redundant-argument-from-rpmcliTransactio.patch
--- a/ci.fmf
+++ b/ci.fmf
@ -0,0 +1 @@
+resultsdb-testcase: separate
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/internal/CI-Tier-1.functional}
--- a/SOURCES/macros.rpmsign-sequoia
+++ b/SOURCES/macros.rpmsign-sequoia
--- a/plans/internal/CI-Tier-1.fmf
+++ b/plans/internal/CI-Tier-1.fmf
@ -0,0 +1,12 @@
+summary: Internal CI-Tier-1 tests plan
+discover:
+  - name: rpm
+    how: fmf
+    filter: 'tag: CI-Tier-1 & component: pqrpm'
+    url: https://pkgs.devel.redhat.com/git/tests/rpm
+execute:
+    how: tmt
+adjust:
+    enabled: false
+    when: distro == centos-stream or distro == fedora
+
--- a/SPECS/pqrpm.spec
+++ b/SPECS/pqrpm.spec
@ -13,7 +13,7 @@

 %global rpmver 4.19.1.1
 #global snapver rc1
-%global baserelease 4
+%global baserelease 6
 %global sover 10

 %global srcver %{rpmver}%{?snapver:-%{snapver}}
@ -101,6 +101,8 @@ rpm-4.19.x-multisig.patch
 rpm-4.19.x-pqc-algo.patch
 rpm-4.19.x-pqc-fixes.patch

+rpm-4.19.x-multisig-verify-fixes.patch
+
 # These are not yet upstream
 rpm-4.7.1-geode-i686.patch

@ -282,6 +284,12 @@ install -m 644 %{SOURCE30} $RPM_BUILD_ROOT/%{_defaultdocdir}/rpm/
 %doc %{_defaultdocdir}/rpm/macros.rpmsign-sequoia

 %changelog
+* Thu Feb 05 2026 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-6
+- Fix key import API to return NOTTRUSTED for disabled algorithms (RHEL-112700)
+
+* Mon Feb 02 2026 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-5
+- Ignore signatures made by unknown or disabled algorithms (RHEL-112700)
+
 * Tue Aug 26 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-4
 - Fix rpmsign(8) man page (RHEL-109233)

--- a/SOURCES/rpm-4.17.x-rpm_dbpath.patch
+++ b/SOURCES/rpm-4.17.x-rpm_dbpath.patch
--- a/SOURCES/rpm-4.18.90-weak-user-group.patch
+++ b/SOURCES/rpm-4.18.90-weak-user-group.patch
--- a/SOURCES/rpm-4.18.92-disable-sysusers.patch
+++ b/SOURCES/rpm-4.18.92-disable-sysusers.patch
--- a/SOURCES/rpm-4.18.x-siteconfig.patch
+++ b/SOURCES/rpm-4.18.x-siteconfig.patch
--- a/rpm-4.19.x-multisig-verify-fixes.patch
+++ b/rpm-4.19.x-multisig-verify-fixes.patch
--- a/SOURCES/rpm-4.19.x-multisig.patch
+++ b/SOURCES/rpm-4.19.x-multisig.patch
--- a/SOURCES/rpm-4.19.x-pqc-algo.patch
+++ b/SOURCES/rpm-4.19.x-pqc-algo.patch
--- a/SOURCES/rpm-4.19.x-pqc-fixes.patch
+++ b/SOURCES/rpm-4.19.x-pqc-fixes.patch
--- a/SOURCES/rpm-4.19.x-rpmkeys-add-list-erase.patch
+++ b/SOURCES/rpm-4.19.x-rpmkeys-add-list-erase.patch
--- a/SOURCES/rpm-4.7.1-geode-i686.patch
+++ b/SOURCES/rpm-4.7.1-geode-i686.patch
--- a/SOURCES/rpm-4.9.90-no-man-dirs.patch
+++ b/SOURCES/rpm-4.9.90-no-man-dirs.patch
--- a/1
+++ b/1
@ -0,0 +1 @@
+SHA512 (rpm-4.19.1.1.tar.bz2) = 3364c453c29903c144a3680ceca7a17426eb085c288b6313fb7e857a42a5e0a965f623882e0f58e633f8b8770e839d9df9f7653d99c73759af5c89d0a981908d
Author	SHA1	Message	Date
Michal Domonkos	7166385785	Fix API to return NOTTRUSTED for disabled algos Related: RHEL-112700	2026-02-05 13:42:30 +01:00
Michal Domonkos	e5132318d1	Ignore signatures made by unknown or disabled algo Resolves: RHEL-112700	2026-02-02 13:45:07 +01:00
				`@ -1 +0,0 @@`
				`5ff9a545a18cd7183854b7ec6de675969fd9b1ec SOURCES/rpm-4.19.1.1.tar.bz2`
				`@ -0,0 +1 @@`
				`SHA512 (rpm-4.19.1.1.tar.bz2) = 3364c453c29903c144a3680ceca7a17426eb085c288b6313fb7e857a42a5e0a965f623882e0f58e633f8b8770e839d9df9f7653d99c73759af5c89d0a981908d`