Clair does not ignore gpg-pubkey in rpm databases

gpg-pubkey is not an actual package, but rather a gpg public key used for rpm verification. It is just stored in the rpm database.

The example below shows this entry in the DB only has a name and version, and no other useful attributes:

[root@ae5eb32cd93d /]# rpm -qa gpg-pubkey --queryformat="%{name}\n%{evr}\n%{ARCH}\n%{RPMTAG_MODULARITYLABEL}\n[%{FILENAMES}\n].\n\n"
gpg-pubkey
d4082792-5b32db75
(none)
(none)
.


gpg-pubkey
fd431d51-4ae0493b
(none)
(none)
.