libdnf
libdnf copied to clipboard
Require that deltarpms be v3 and signed
v3 deltarpms can be signed, and libdnf should verify the signature before passing them to drpm. The payload digest will be wrong, but that is okay since the header+payload signature can still be validated. This means that header+payload signatures will be required for deltarpms.
I am really sorry but I do not know what we can do with it or what plans are for deltarpm in future. We believe that verification will be not easy and we would prefer if a library or deltarpm will do it for us.
@j-mracek deltarpm does not have any signature verification functionality. Verification can be handled by librpm itself, as with normal RPMs.