On Tue, Jan 26, 2021 at 3:44 PM Matthew Miller <mattdm@fedoraproject.org> wrote:
>
> On Tue, Jan 26, 2021 at 10:44:05AM -0800, Kevin Fenzi wrote:
> > * Try and change the storage format of the signatures to not take up
> > tons of room. I guess this would be in ima tools and sigul?
>
> Is this an immediate issue given that it only affects systems where the
> plugin is enabled?
>
Yes. This is breaking *everything*. Regardless of whether the plugin
is installed, RPM now thinks the generated packages are invalid and
cannot do anything with them. This has also broken package builds on
COPR and the openSUSE Build Service.
>
> > * Get rpm updated at least in all Fedora's / active RHEL's to be able to
> > handle rpms with the signatures. I don't know how likely this is for
> > rhel7, but 8 and fedora 32 should hopefully not be hard.
>
> Very unlikely with where RHEL 7 is in its maintenance lifecycle.
>
If we ever want this feature, you will probably want to get the fix
backported, since parsing RPMs containing this data is broken.
Very unlikely in RHEL 7. Take that to mean that you cannot count on it and if it happens it's a bonus. 8 is doable.
The concern over impacts to older RHEL releases is appreciated for sure, but I am not sure that's a deal breaker for this feature. I'd rather see it go through Fedora to get exactly the kind of feedback that is being given here rather than have this show up in a future RHEL release first. Let's try to avoid doing things backwards if we can.
josh