Add support for multiple RPM signatures

[lubomir]

RPM v6 can store multiple signatures in the header. The metadata however can only represent a single key ID.

https://rpm.org/releases/6.0.0

[guillermodotn]

Proposed format:

sigkey stays as-is for backward compat. sigkeys is a new optional list for all signing key identifiers. Both fields are independent. Values normalized to lowercase. Defaults to [] when absent.

{
  "location": { ... },
  "sigkey": "a15b79cc",
  "sigkeys": ["a15b79cc", "1234567890abcdef1234567890abcdef12345678"],
  "category": "binary"
}

Should sigkeys be v2-only, or should we also add it to v1.x?

[lubomir]

Let's keep v1 as is, there's not much point in making changes there.

The format overall looks okay to me, though I'm not sure a list is sufficient. You can't tell just from a list what kind of signature it is. But maybe that is not necessary?

[guillermodotn]

Let's keep v1 as is, there's not much point in making changes there.

The format overall looks okay to me, though I'm not sure a list is sufficient. You can't tell just from a list what kind of signature it is. But maybe that is not necessary?

PR #253 implements this as a list of key IDs. Since keys are managed by RPM tooling, consumers should be able to look up the type of signature from their keyring.

If this needs to be extended to include the signature type, sigkeys can evolve from a list of strings to a list of objects in a backward-compatible way.