From 63cc737b62672fbe1bf4396cf45ae739b8df9c23 Mon Sep 17 00:00:00 2001
From: Vladimir Dubrovin <3proxy@3proxy.ru>
Date: Fri, 21 Aug 2026 15:33:58 +0300
Subject: [PATCH] rpm signing: accept non-RSA signature headers

The release key is ed25519, so rpm stores the header signature in
DSAHEADER (EdDSA/SHA256) and RSAHEADER is empty. The verification only
looked at RSAHEADER and failed correctly signed packages.
---
 .github/workflows/build-rpm-arm64.yml  | 3 +++
 .github/workflows/build-rpm-armhf.yml  | 3 +++
 .github/workflows/build-rpm-x86-64.yml | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/build-rpm-arm64.yml b/.github/workflows/build-rpm-arm64.yml
index ae364aa..1c2ea45 100644
--- a/.github/workflows/build-rpm-arm64.yml
+++ b/.github/workflows/build-rpm-arm64.yml
@@ -111,6 +111,9 @@ jobs:
        rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
        for f in *.rpm; do
          sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
          case "$sig" in ""|"(none)")
            echo "$f is not signed"
            echo "--- rpm version ---"; rpm --version
diff --git a/.github/workflows/build-rpm-armhf.yml b/.github/workflows/build-rpm-armhf.yml
index 6fd68de..dc179bd 100644
--- a/.github/workflows/build-rpm-armhf.yml
+++ b/.github/workflows/build-rpm-armhf.yml
@@ -144,6 +144,9 @@ jobs:
        rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
        for f in *.rpm; do
          sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
          case "$sig" in ""|"(none)")
            echo "$f is not signed"
            echo "--- rpm version ---"; rpm --version
diff --git a/.github/workflows/build-rpm-x86-64.yml b/.github/workflows/build-rpm-x86-64.yml
index 2099387..eec8028 100644
--- a/.github/workflows/build-rpm-x86-64.yml
+++ b/.github/workflows/build-rpm-x86-64.yml
@@ -112,6 +112,9 @@ jobs:
        rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
        for f in *.rpm; do
          sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
          case "$sig" in ""|"(none)")
            echo "$f is not signed"
            echo "--- rpm version ---"; rpm --version