Introduces a proper handle expired GPG signatures - GPGME backend

[fhbash]

This change only affects the gpgme implementation of signature verification.
The rpm implementation (gpg_rpm.c) is not modified as it already rejects expired keys during import.

Changes:

• Implements proper detection and handling of expired GPG keys and signatures in the gpgme backend (gpg_gpgme.c)
• Adds support for key rotation: if data is signed with multiple keys and at least one valid, non-expired signature exists, verification succeeds
• Only fails verification if ALL signatures are either invalid or expired
• Provides clear error messages distinguishing between expired keys and expired signatures
• Adds test case to verify expired signature rejection

type: enhancement
resolves partially: #207

Which this PR not resolve: checking using RPM backend
Why: current rpm api doesn't provide an api to check multiple sign/key, RPM team already have and ticket for that and currently not merged, for more details, see: https://issues.redhat.com/browse/RHEL-112394

I created new issue to deal with rpm backend as soons the change on rpm is deployed. Here it is the ticket: #356

Signed-off-by: Fellipe Henrique [email protected]

[ppisar]

First, librepo has two implementation for key verification: gpgme and rpm. You have only edited gpgme. Probably because rpm rejects expired keys on import. Then the commit message should explicitly describe that this change is only about gpme implementation.

Then I don't think that returning a failure on any expired key is correct: You link to tickets which aim for a better support for key rotation. I.e. if the data are signed with multiple keys and some of them are expired, but at least one is alive, and its signature is valid, you should return success.

Then I would recommend to place the test data at lease one directory up. Why did you place expired_test directory into to tests/test_data/repo_yum_01/repodata? Your new test and the test data have no relation to tests/test_data/repo_yum_01 content.

Also please run git show --check and remove the trailing white spaces.

[ppisar]

Regarding the test failures ("Expired signature should be rejected" test failed), it could be caused by not implementing the check in the rpm implementation. That one is used since Fedora 39.

[ppisar]

Your tests pass with gpgme backend, but fail with RPM one. That needs to be fixed before merging.

Another problem is that RPM backend requires all nonexpired keys/signatures to be valid. While your current gpgme backend requires at least one. I don't find this dichotomy good.

[fhbash]

/packit test

[ppisar]

/packit copr-build