DNF5 indirectly requires gpgme thru librepo.
We use for GPG verification RPM API but additionally to that we need some features from GPG me
We verify RPMs and repository metadata
RPMs workflow
No planned changes in comparison to DNF4
Check RPM using GPG key from RPMDB, if it failed import new key and try again
Repository metadata workflow
We can improve user experience by using imported keys from RPM DB
Check metadata using GPG key from local user specific per repository location, if it failed check metadata using GPG key from rpm DB , if it failed import new key to local user specific location and try again with that source.
The question is whether gpg keys should be shared for all repositories in single key ring or whether they should live in specific directory like they do now.
DNF5 indirectly requires gpgme thru librepo.
We use for GPG verification RPM API but additionally to that we need some features from GPG me
We verify RPMs and repository metadata
RPMs workflow
No planned changes in comparison to DNF4
Check RPM using GPG key from RPMDB, if it failed import new key and try again
Repository metadata workflow
We can improve user experience by using imported keys from RPM DB
Check metadata using GPG key from local user specific per repository location, if it failed check metadata using GPG key from rpm DB , if it failed import new key to local user specific location and try again with that source.
The question is whether gpg keys should be shared for all repositories in single key ring or whether they should live in specific directory like they do now.