I dont think we need the remaining part of this file as we dont sign atomic or coreos for centos stream

I dont think we need the remaining part of this file as we dont sign atomic or coreos for centos stream

It's definitely not needed from a practical point of view--since the methods just spew debug messages and don't do anything useful. I kept them there since they're present in the parent BaseSigningHelper class (from robosignatory) and decorated with @abc.abstractmethod--for which the documentation suggests that all abstract methods need to be overridden in order to instantiate a derived object. However, a quick test shows that doesn't seem to be the case. I'd still prefer to leave them there as placeholders if you don't object.

I just added a commit with additional unit tests.

I also just noticed I left my earlier commit history in a horribly ugly state. @mohanboddu, @bstinson, do you mind if I squash my earlier commits and provide a better commit message?

Please change the name of this method as its confusing as there is one with same name in driver.py

Please change the name of this method as its confusing as there is one with same name in driver.py

Thanks for the suggestion. I too care of that--along with doing some other function/variable renaming to avoid confusion and adding some documentation.

We don't have passphrase files, we'll want to tweak the configuration to take a keytab instead. The keytab should be passed to the koji command line tools and to rpm-sign itself

Here's where we'd add --keytab=<keytab_from_configuration> and --principal=<kerberos_principal_from_configuration> options

After we do the regular rpm-signing we need to extract the IMA headers and build another rpm-sign invocation rpm-sign --key=<ima_keyname_from_calligrabot_config> --imasign <path_to_extracted_headers>

Thanks for the review. My most recent commit should address your first two points. I still need to address dealing with the IMA headers.

@bstinson, I think I have the IMA signing in pretty good shape now.
Also, please give me the chance to squash some of my earlier commits--or at least clean up the commit messages--before you consider merging this. (I'm leaving them alone at the moment so incremental review is possible.)

There's actually a separate file containing the signatures and the digests together, we want something like ima_presigned_path=imadigest + '.signed'

:thumbsup: