Add gpg key verification
Open
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 42
Description
(From @zhill comments on related issues) Report on gpg key and/or source record of each package to help verify actual package source. The objective is to identify rpms installed from the distro vs rpms from the package maintainer directly or built by a user.
This should be applied to:
- [x] rpms https://github.com/anchore/syft/pull/3179
- [ ] deb/dpkg
Contributor guide
Research direction
Start by reviewing the objective in this issue and the existing RPM work referenced by pull request #3179. Trace how Syft represents package source and verification metadata, then determine what equivalent report is needed for deb/dpkg packages; done means those packages identify their GPG key and/or source record.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100