Ensure the negative checksum case always mutates the digest instead of sometimes reproducing the original value when it already starts with 0. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add verify_http_pgp_signature Rego builtin for HTTP sources using pgpsign with checksum-request/response flow through policy resolution. Wire sourcemeta HTTP checksum request/response conversion and add tests. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>