Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ci: output the hashes of all RPM packages without their signatures #62

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: output the hashes of all RPM packages without their signatures #62

wants to merge 1 commit into from

Conversation

cfm
Copy link
Member

@cfm cfm commented Feb 28, 2025

#61 proposes to have reviewers check that:

securedrop-yum-prod/.github/pull_request_template.md

Line 10 in b5e9cae

- [ ] Unsigned RPM after running `rpm --delsign` (use same version of rpmsign from the build container) on the signed RPM results in the checksum found in the build logs

I think this is worth automating just one step further, indeed a step towards automating it entirely as anticipated by freedomofpress/securedrop-builder#418, as we already do for .deb packages from their .buildinfo files.

@cfm
ci: output the hashes of all RPM packages without their signatures
2838893 
This is a step towards automating the check of pre-signature
reproducibility proposed by freedomofpress/securedrop-builder#418.
@cfm cfm requested a review from rocodes February 28, 2025 00:11
@cfm cfm mentioned this pull request Feb 28, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rocodes rocodes Awaiting requested review from rocodes

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
SecureDrop dev cycle
Status: Ready For Review
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@cfm