[dtg01100]

Closes #617.

Pin declared RPM GPG keys to [repositories.gpgkeys]. Reject unpinned keys in ordinary repositories and named partial or disabled DNF overrides. Reject wildcard key replacement before override shortcuts and propagate pins to both runtime override directories. Key URL paths remain exact, including trailing slashes.

Stacked on #623 for the static/pre-commit fixes; retarget to main after #623 merges. #527 is already merged. Detailed authenticity policy is preserved in a linked skill reference.

Validation: full just check and pre-commit passed on ae0fdd3. Regression tests cover partial, disabled and wildcard key substitutions. Installed-guest checks are in the pending isolated VM run: https://github.com/projectbluefin/utah/actions/runs/37568822950 .

[hivecommons-hive]

style

• scripts/verify-rpm-contract.py:717-718 — in the enabled branch, repo_gpgkey_pin_errors runs for every section, not just allowlisted ones (unlike repo_pin_errors at L715, which is under elif section_name in allowed_repos). A non-allowlisted section with gpgkey= therefore emits a second, false diagnostic: Allowlisted repository 'evil' is enabled in f.repo with gpgkey=…; the manifest declares no pinned key… alongside the correct Unapproved repository 'evil' error (reproduced at head). Fails closed, so not a gate hole, but the message states the opposite of the truth. Gate L717 on section_name in allowed_repos (the disabled branch at L689-697 already does).
• scripts/verify-rpm-contract.py:97-109 and :548-556 — docstrings contain garbled prose ("whitespace-trimmed, trailing-whitespace sensitive only where libdnf5 would be…"; "(https://, issue #617)"). Worth a tidy since these explain the pin semantics.
• tests/test_verify_rpm_contract.py — test name test_repo_gpgkey_pin_errors_passes_when_every_sever_keys_is_pinned typo (sever).

No findings from: correctness, security, intent-alignment, docs-currency.

Confidence: 3/5 (needs attention) — 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed at head 7c23810. Ran tests/test_verify_rpm_contract.py (175 passed) and verify-rpm-contract.py --check packages/bluefin.toml packages/utah.toml (valid).

intent-alignment

• (low) packages/utah.toml:585 pins https://packages.redhat.com/api/pulp-content/public-hummingbird/x86_64/RPM-GPG-KEY-redhat-release-2 as a second approved key for public-hummingbird-x86_64-rpms. The PR body says packages/hummingbird.repo declares "the file path and the Hummingbird-published URL", but packages/hummingbird.repo:17 declares only gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release-2, no other file in the tree references that URL, and it returns HTTP 404 today. The entry approves a key location nothing uses and nothing serves; suggest dropping it (and the "both spellings are pinned" comment at packages/utah.toml:579-581) so the pin set stays exactly what the shipped .repo files declare.

docs-currency

• (low) docs/skills/package-contract.md:141-143 says utah-packages "is exempt" from the gpgkey pin. Code has no exemption: scripts/verify-rpm-contract.py:552-563 rejects any gpgkey= on an allowlisted id without a [repositories.gpgkeys] entry, so a drop-in adding gpgkey= to utah-packages fails (correctly). Reword to "has no entry because its .repo declares no gpgkey=; any gpgkey= added to it is rejected", matching the accurate wording at packages/utah.toml:575-577.

No findings from: correctness, security, style.

Confidence: 3/5 (needs attention) — 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read at head 930ff97.

docs-currency

• docs/skills/package-contract.md:168-169 — "the shipped [repositories.gpgkeys] pins the key URL each publishes" refers to the two signature-check exceptions (utah-packages, nvidia-container-toolkit), but utah-packages has no pin (as the same paragraph says at L145 and packages/utah.toml:572-574). Only NVIDIA's URL is pinned; the sentence contradicts itself.

intent-alignment

• PR body says the Hummingbird pin covers "file path and the Hummingbird-published URL"; packages/utah.toml:583 pins only file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release-2. The diff is tighter than the description (good) — body should be corrected so the record matches.

style

• scripts/verify-rpm-contract.py:528-534 split_gpgkeys is byte-identical to split_baseurls (L524-525); alias or reuse rather than duplicate.

No findings from: correctness, security.

Confidence: 3/5 (needs attention) — 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

docs-currency

• docs/skills/package-contract.md:168-170 says "Only nvidia-container-toolkit has a [repositories.gpgkeys] pin", but the manifest this PR ships pins two repos: packages/utah.toml:583 (public-hummingbird-x86_64-rpms → file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release-2) and :586 (nvidia-container-toolkit). The PR body gets it right; the prose contradicts the manifest it describes. Drop the "Only …" sentence or list both pins.

correctness (low, non-blocking)

• scripts/verify-rpm-contract.py:97-115 normalize_gpgkey is documented as mirroring normalize_baseurl, but omits the ${var}→$var fold at :516. A gpgkey=…/$basearch/key pin spelled ${basearch} in a .repo file would be reported as unpinned. No shipped .repo uses variables in gpgkey=, so the gate holds today; worth aligning since the two helpers are meant to share semantics.

Verified at 9fc319c: python3 scripts/verify-rpm-contract.py --check packages/bluefin.toml passes; pytest tests/test_verify_rpm_contract.py → 175 passed.

No findings from: security, intent-alignment, style.

Confidence: 3/5 (needs attention) — 1 medium finding; 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from correctness, security, intent-alignment, style, docs-currency.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read scripts/verify-rpm-contract.py at ae0fdd3 end to end, plus the four packages/*.repo files. The gate change looks correct to me and matches #617.

Verified

• [repositories.gpgkeys] in packages/utah.toml pins exactly what the shipped sections declare: packages/hummingbird.repo:17 → file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release-2, packages/nvidia-container.repo:27 → https://nvidia.github.io/libnvidia-container/gpgkey. packages/utah-packages.repo has no gpgkey=, so its absence from the table is right and a drop-in adding one is rejected. fedora-44.repo is builder-only and not allowlisted, so its key is out of scope as intended.
• check_repo_sections (:770-774) runs the key check before every continue, so a partial or enabled=0 named override that carries gpgkey= is still rejected, and a wildcard override with gpgkey= is refused outright before glob_override_errors. That matches the "checked before their early returns" note in the new reference doc.
• expected_gpgkeys reaches all three verify_repository_policy call sites (:1240 source check, :1312 on-image repos.d, :1341 override dirs) and the one check_repo_sections call (:891). Nothing is left unpinned.
• normalize_gpgkey lowercases only scheme and host and keeps the path exact, including trailing slashes — appropriate for file identities; ${basearch} → $basearch folding matches how dnf5 expands either spelling.
• Manifest validation rejects a [repositories.gpgkeys] id outside [repositories.allowed] (:1136-1143), mirroring [repositories.security].

One low-severity wording issue (repo_gpgkey_pin_errors, :584-589): for override scans the check runs on every section (is_override or section_name in allowed_repos), so a non-allowlisted override section with an unpinned gpgkey= is reported as "Allowlisted repository '…' is enabled … the manifest declares no pinned key". The rejection itself is correct; the message just mislabels the id as allowlisted (and as enabled, even when enabled=0). Worth a small tweak so the operator isn't sent to the allowlist for a repo that isn't on it.

Stacked on #623 (fix/validation-gates); retarget to main after it lands.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

docs-currency

• (low) docs/skills/package-contract.md:176-189 — the on-image override bullets still give the exhaustive rule for partial and wildcard drop-ins ("passes for any id unless it sets a proxy= or disables sslverify= or an unapproved signature check"; "a wildcard override passes only when it … sets no proxy=, and disables neither sslverify= nor any signature check"). After scripts/verify-rpm-contract.py:776-790 a partial/disabled override with gpgkey= is pinned and any wildcard override setting gpgkey= is rejected, but only the new reference (references/repository-authenticity.md:60-64) says so. Add gpgkey= to both bullets so the summary doc does not promise a pass the gate no longer gives.

No findings from: correctness, security, intent-alignment, style.

Confidence: 3/5 (needs attention) — 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hanthor]

Installed KVM evidence at b32c2b3: baseline RPM contract and all four malicious GPG-key overrides were checked in the booted system, including disabled and wildcard sections and the trailing-slash key resource. All were rejected, then the restored baseline passed. Run 37574083892 retained review-checks.json. The broader gate stopped later on a Flatpak ref formatter issue, so full VM success remains pending.

[hivecommons-hive]

Reviewed — no findings from correctness, security, intent-alignment, style, docs-currency.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive filed out-of-scope review findings as backlog issues so they do not block this PR:

• Review backlog (docs-currency): default-fonts-core-math blocker comment removed without resolution #521 — Review backlog (security): Pinned key file contents are not attested on-image (Review backlog (docs-currency): default-fonts-core-math blocker comment removed without resolution #521)

Cap: 3 backlog issue(s) per PR.