Repository: microsoft/CBL-Mariner
File: toolkit/tools/internal/rpm/rpm.go (Go)

Code before:
	}
	for _, keyPath := range gpgKeyPaths {
		_, stderr, importErr := shell.Execute(rpmKeysProgram, "--root", rpmDbRoot, "--import", keyPath)
		if importErr != nil {
			return fmt.Errorf("failed to import GPG key (%s) into RPM database:\n%v\n%w", keyPath, stderr, importErr)
		}
	}
	return nil
}

// CheckRpmSignature validates the GPG signature of an RPM file.
// - rpmFile: path to the RPM file to validate
// - rpmDbRoot: path to a directory used as the RPM database root (must have GPG keys already imported via ImportGpgKeysToRpmDb)
// Returns an error if the RPM signature is missing or invalid.
func CheckRpmSignature(rpmFile string, rpmDbRoot string) (err error) {
	_, stderr, err := shell.Execute(rpmKeysProgram, "--root", rpmDbRoot, "--checksig", rpmFile, "-D", "%_pkgverify_level signature")
	if err != nil {
		return fmt.Errorf("RPM signature validation failed for (%s):\n%v\n%w", rpmFile, stderr, err)
	}
	return nil
}

// ValidateDirectoryRpmSignatures validates the GPG signatures of all RPM files in a directory.
// It creates an isolated RPM database, imports the provided GPG keys, and validates each RPM.
// Returns an error if any RPM has a missing or invalid signature.
func ValidateDirectoryRpmSignatures(rpmDir string, gpgKeyPaths []string) (err error) {
	logger.Log.Info("Validating GPG signatures of downloaded packages")

	// Create a temporary directory for the isolated RPM database
	rpmDbRoot, err := os.MkdirTemp("", "rpm-gpg-check-*")
	if err != nil {
		return fmt.Errorf("failed to create temporary directory for RPM database:\n%w", err)
	}
	defer os.RemoveAll(rpmDbRoot)

	// Import GPG keys once before validating all RPMs
	err = ImportGpgKeysToRpmDb(rpmDbRoot, gpgKeyPaths)
	if err != nil {
		return err
	}

	// Find all RPM files in the directory (recursively)
	var rpmFiles []string
	err = filepath.WalkDir(rpmDir, func(path string, d os.DirEntry, walkErr error) error {
		if walkErr != nil {
			return walkErr
		}
		if !d.IsDir() && filepath.Ext(path) == ".rpm" {
			rpmFiles = append(rpmFiles, path)
		}
		return nil

Review comment (suggestion):
```suggestion
func ValidateDirectoryRPMSignatures(rpmDir string, gpgKeyPaths []string) (err error) {
```

Code after:
	}
	for _, keyPath := range gpgKeyPaths {
		_, stderr, importErr := shell.Execute(rpmKeysProgram, "--root", rpmDbRoot, "--import", keyPath)
		if importErr != nil {
			return fmt.Errorf("failed to import GPG key (%s) into RPM database: %v:\n%w", keyPath, stderr, importErr)
		}
	}
	return nil
}

// checkRPMSignature validates the GPG signature of an RPM file.
// - rpmFile: path to the RPM file to validate
// - rpmDbRoot: path to a directory used as the RPM database root (must have GPG keys already imported via importGPGKeysToRpmDb)
// Returns an error if the RPM signature is missing or invalid.
func checkRPMSignature(rpmFile string, rpmDbRoot string) (err error) {
	_, stderr, err := shell.Execute(rpmKeysProgram, "--root", rpmDbRoot, "--checksig", rpmFile, "-D", "%_pkgverify_level signature")
	if err != nil {
		return fmt.Errorf("RPM signature validation failed for (%s): %v\n%w", rpmFile, stderr, err)
	}
	return nil
}

// ValidateDirectoryRPMSignatures validates the GPG signatures of all RPM files in a directory.
// It creates an isolated RPM database, imports the provided GPG keys, and validates each RPM.
// Returns an error if any RPM has a missing or invalid signature.
func ValidateDirectoryRPMSignatures(rpmDir string, gpgKeyPaths []string) (err error) {
	logger.Log.Info("Validating GPG signatures of downloaded packages")

	// Create a temporary directory for the isolated RPM database
	rpmDbRoot, err := os.MkdirTemp("", "rpm-gpg-check-*")
	if err != nil {
		return fmt.Errorf("failed to create temporary directory for RPM database:\n%w", err)
	}
	defer os.RemoveAll(rpmDbRoot)

	// Import GPG keys once before validating all RPMs
	err = importGPGKeysToRPMDb(rpmDbRoot, gpgKeyPaths)
	if err != nil {
		return err
	}

	// Find all RPM files in the directory (recursively)
	var rpmFiles []string
	err = filepath.WalkDir(rpmDir, func(path string, d os.DirEntry, walkErr error) error {
		if walkErr != nil {
			return walkErr
		}
		if !d.IsDir() && filepath.Ext(path) == ".rpm" {
			rpmFiles = append(rpmFiles, path)
		}
		return nil