Introduce GPG Key Support for Pulp RPM Remote Creation

[VrindaMarwah]

As I can see currently, Pulp RPM remote creation does not provide an option to manage GPG keys required for validating RPM repository metadata and packages. This limitation makes it difficult to enforce secure package verification.

Requirement:
When creating an RPM remote using pulp rpm remote create, user can specify a GPG key and enforce GPG signature verification during repository sync. Clear error reporting when GPG validation fails.

[dralley]

Hello, this is a valid feature request, but we do have similar ones already open, could you please add any details to these existing requests which you feel are missing?

#2258
#2285

Also, could you expand a bit on your specific needs and why the standard client-side signature verification enforced by DNF etc. falls short for your particular workflow? It just helps to understand how "worth it" this would be to add.

[dralley]

@VrindaMarwah ^

[dralley]

@VrindaMarwah ^^

[VrindaMarwah]

Hi @dralley – expanding on our requirement:

We want to enforce package integrity and authenticity whenever an upstream RPM repository is synced into Pulp.
What this means is that if any upstream RPM repository is configured and synced into Pulp, we should ensure that:

• GPG signature verification is enabled
• Packages are validated against a trusted GPG public key
• Unsigned or improperly signed RPMs are rejected
• Sync does not proceed silently without verification

Why this is important
When syncing from an upstream source, we are effectively trusting external content.

Expected Behavior in Pulp
For every RPM remote used in a sync:

• A gpgkey (or equivalent configuration) must be provided.
• Signature verification should be enabled (gpgcheck=1 equivalent behavior).
• Sync should fail if:
  - The key is missing
  - The signature is invalid
  - The package is unsigned (if policy requires strict signing)