Bug 34204 - rpmkeys lacks a method of obtaining the signature creation time
Summary: rpmkeys lacks a method of obtaining the signature creation time
Status: NEW
Alias: None
Product: Sisyphus
Classification: Development
Component: rpm (show other bugs)
Version: unstable
Hardware: all Linux
: P3 enhancement
Assignee: placeholder@altlinux.org
QA Contact: qa-sisyphus
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-11-16 08:20 MSK by Dmitry V. Levin
Modified: 2017-11-20 19:40 MSK (History)
7 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dmitry V. Levin 2017-11-16 08:20:08 MSK 
Old good rpm-4.0.4 used to have the following feature:

$ rpmsign -K --define '__gpg_verify_cmd %__gpg --batch --no-verbose --verify --status-fd=1 %__signature_filename %__plaintext_filename' \
vitmp-1.0-alt4.qa1.src.rpm | \
sed -n 's/^\[GNUPG:\] VALIDSIG [[:xdigit:]]\+ [^ ]\+ \([[:digit:]]\+\) .*/\1/p'
1366322522

An analogue is needed in the brand new rpm suite to implement SOURCE_DATE_EPOCH forwarding from signed srpm packages to hasher.
Comment 1 Dmitry V. Levin 2017-11-20 19:40:29 MSK 
Looks like we can follow a simpler route and just use buildtime of signed srpm packages to implement SOURCE_DATE_EPOCH support.