RPM roadmap and v6 questions

[pmatilai]

As per the roadmap announcement, please use this topic for your general RPM roadmap and v6 questions. This is not a wishlist.

[DemiMarie]

Some areas I would like to see changed (compared to the current format):

• IMA and fsverity signatures should be part of the package. Adding them to a package should create a different package. This allows these signatures to be moved from the signature header to the main header, avoiding a whole class of security problems.
• Both signature and main headers should be required to be a single contiguous region.
• Padding should be checked to be zeroed and minimum-length.
• Header tag data entries should be required to be sorted and have no duplicates. This applies to the contiguous region and to dribbles separately, so it is still possible to override an entry in the region by adding a dribble entry with the same tag.
• Entries that are currently lists of hex or base64 data should be replaced with binary data. An “array of length-prefixed binary blobs” tag might help with this.
• Size signatures should be moved to the main header, so that tools like rpmcanon don’t need to zero them out.
• Instead of there only being one payload digest, there should be an array of them, each (except for the last) covering a fixed-size chunk of the payload. This allows for RPM CoW to be implemented without creating new security risks, since each chunk can be buffered in memory before being passed to the decompression code. The array should be of type RPMTAG_BINARY, with length checked to be a multiple of the hash size.
• When reading a package, various invariants should be checked. That’s RPM package invariants? #2025.

[ignatenkobrain]

It would be great to revive and finish @ffesti 's work on generating specfile pieces so that we can simplify standardized (e.g. rust/go) packages even more (aka dynamic subpackages).

[pmatilai]

Folks, this is not a wishlist. This is for questions about the roadmap, including rpm v6 plans.

[TomasTomecek]

Could you please point us to the roadmap document?

[pmatilai]

Oh. It's in the announcement that was supposed to lead people to this thread, but of course it's possible to stumble upon this first as well. Link to the announcement added to the first post.