[rpms/systemd] rawhide: split out import-keys.pgp

[Simon de Vlieger <cmdr@supakeen.com>]

            A new commit has been pushed.

            Repo   : rpms/systemd
            Branch : rawhide
            Commit : addc21f137eaac1a28b816759f49b95fae5affb9
            Author : Simon de Vlieger <cmdr@supakeen.com>
            Date   : 2026-09-16T15:44:32+02:00
            Stats  : +20/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/systemd/c/addc21f137eaac1a28b816759f49b95fae5affb9?branch=rawhide

            Log:
            split out import-keys.pgp

`systemd` ships an `import-keys.pgp` in `/usr/lib/systemd` which is
owned by `systemd-container`. For downstream distributions (remixes)
that want to ship their own keys they *have* to ship in `/etc` [1].

Split out that specific file into a separate package and Recommends it
so that it can be fully excluded (no default keys shipped) and it's easy
for downstream distributions to have their own keys package by using
Provides/Conflicts in their own packages.

[1]: https://github.com/teamsbc/distribution/issues/48

Signed-off-by: Simon de Vlieger <cmdr@supakeen.com>

---
diff --git a/split-files.py b/split-files.py
index 52fa5c1..96e6371 100644
--- a/split-files.py
+++ b/split-files.py
@@ -70,6 +70,7 @@ outputs = {suffix: open(f'.file-list-{suffix}', 'w')
                    'sysusers',
                    'devel',
                    'container',
+                   'import-keys',
                    'networkd',
                    'networkd-defaults',
                    'oomd-defaults',
@@ -154,6 +155,9 @@ for file in files(buildroot):
     ''', n, re.X):
         o = outputs['sysusers']
 
+    elif re.search(r'import-pubring', n):
+        o = outputs['import-keys']
+
     elif re.search(r'''mymachines|
                        machinectl|
                        mount.ddi|
@@ -164,7 +168,6 @@ for file in files(buildroot):
                        systemd\.nspawn|
                        systemd-vmspawn|
                        systemd-dissect|
-                       import-pubring|
                        systemd-machined|
                        systemd-import|
                        systemd-export|

diff --git a/systemd.spec b/systemd.spec
index 408a2ce..c1d3a26 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -634,6 +634,17 @@ This package contains the signed version.
 %endif
 %endif
 
+%package import-keys
+Summary:        GPG keys for verifying systemd image imports
+BuildArch:      noarch
+License:        LGPL-2.1-or-later
+# self-obsoletes after package split
+Obsoletes:      systemd-container < 262~rc3-2
+
+%description import-keys
+GPG keyring used by systemd-importd to verify signatures of downloaded
+container and virtual machine images.
+
 %package container
 # Name is the same as in Debian
 Summary: Tools for containers and VMs
@@ -641,12 +652,15 @@ Requires:       systemd%{_isa} = %{version}-%{release}
 Requires(post):   systemd%{_isa} = %{version}-%{release}
 Requires(preun):  systemd%{_isa} = %{version}-%{release}
 Requires(postun): systemd%{_isa} = %{version}-%{release}
+Recommends:     systemd-import-keys = %{noarch_requires_version}
 # For systemd-vmspawn which uses qemu:
 Recommends:     qemu-kvm-core
 %if 0%{?fedora}
 Recommends:     qemu-device-display-virtio-gpu
 Recommends:     qemu-device-display-virtio-vga
 %endif
+# self-obsoletes after package split
+Obsoletes:      systemd-container < 262~rc3-2
 
 # Bias the system towards libcurl-minimal if nothing pulls in full libcurl (#1997040)
 Suggests:       libcurl-minimal
@@ -1587,6 +1601,8 @@ fi
 %endif
 %endif
 
+%files import-keys -f .file-list-import-keys
+
 %files container -f .file-list-container
 %ghost %dir %attr(0700,-,-) /var/lib/machines