Correct way to upload a rpm record

[TommyLike]

Question

Since the rpm package format is supported in rekor as pluggable types, does anyone knows what is the correct way to upload a signed package record to rekor server? I found there is a file type parameter in the CLI but it does not work as expected.

➜  try git:(main) ✗ rekor-cli upload --rekor_server http://127.0.0.1:3000  --public-key <path-to-public-key> --artifact simple.rpm  --type rpm:0.0.1
error: error retrieving external entities: Package signature not found

[lkatalin]

I am running into this same problem.

[haydentherapper]

What version of rpm is the package? We use https://pkg.go.dev/github.com/cavaliercoder/go-rpm, which is a bit dated unfortunately.

[lkatalin]

The test rpm I am trying is Version 5.17.5.2543. Dug in a little bit to the go-rpm library but not sure what versions it supports... I updated to the newest rekor-cli release 1.3.6 but am still getting the error.