From c3ad836aed0d8a7d23c2e44a5eaa3009d08525e3 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Tue, 27 Oct 2026 00:51:13 +0800 Subject: [PATCH] Accept full RPM fingerprints in release finalization Signed-off-by: Feng Ruohang --- .github/workflows/finalize-release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/finalize-release.yml b/.github/workflows/finalize-release.yml index 5f4950ed3..8ea28aafa 100644 --- a/.github/workflows/finalize-release.yml +++ b/.github/workflows/finalize-release.yml @@ -148,7 +148,9 @@ jobs: for rpm_file in finalize/packages/*.rpm; do signature_output="$(sudo rpmkeys --checksig --verbose "${rpm_file}")" printf '%s\n' "${signature_output}" - if ! printf '%s\n' "${signature_output}" | tr '[:upper:]' '[:lower:]' | grep -q "key id ${key_id}: ok"; then + normalized_signature="$(printf '%s\n' "${signature_output}" | tr '[:upper:]' '[:lower:]')" + full_fingerprint="$(printf '%s' "${expected_fingerprint}" | tr '[:upper:]' '[:lower:]')" + if ! printf '%s\n' "${normalized_signature}" | grep -Eq "key id ${key_id}: ok|key fingerprint: ${full_fingerprint}: ok"; then echo "Signature verification failed for ${rpm_file}" >&2 exit 1 fi