richardphibel / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
Richard Phibel ca8a44
From: Richard Phibel <richardphibel@meta.com>
Richard Phibel ca8a44
Richard Phibel ca8a44
Subject: RPM with Copy on Write: add deny list mechanism
Richard Phibel ca8a44
Richard Phibel ca8a44
commit 3431550e6c92ba4bc6d091cb244f70c158dfbbaa
Richard Phibel ca8a44
Author: Richard Phibel <richardphibel@meta.com>
Richard Phibel ca8a44
Date:   Wed Oct 19 23:05:17 2022 +0200
Richard Phibel ca8a44
Richard Phibel ca8a44
    RPM with Copy on Write: add deny list mechanism
Richard Phibel ca8a44
    
Richard Phibel ca8a44
    A couple of issues were encountered when using RPM CoW for some
Richard Phibel ca8a44
    packages. This change adds a deny list mechanism to disable RPM CoW for
Richard Phibel ca8a44
    specific packages.
Richard Phibel ca8a44
Richard Phibel ca8a44
Signed-off-by: Richard Phibel <richardphibel@meta.com>
Richard Phibel ca8a44
Richard Phibel ca8a44
diff --git a/build/pack.c b/build/pack.c
Richard Phibel ca8a44
index 8d6f74935ebb8a4d65aa2bcb666825a99162be9c..e2f05b6412d3e0d814a1160a0dcdfad5c323a8f8 100644
Richard Phibel ca8a44
--- a/build/pack.c
Richard Phibel ca8a44
+++ b/build/pack.c
Richard Phibel ca8a44
@@ -493,7 +493,7 @@ static rpmRC writeRPM(Package pkg, unsigned char ** pkgidp,
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
     /* Write the lead section into the package. */
Richard Phibel ca8a44
-    if (rpmLeadWrite(fd, pkg->header)) {
Richard Phibel ca8a44
+    if (rpmLeadWriteFromHeader(fd, pkg->header)) {
Richard Phibel ca8a44
 	rpmlog(RPMLOG_ERR, _("Unable to write package: %s\n"), Fstrerror(fd));
Richard Phibel ca8a44
 	goto exit;
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
diff --git a/lib/package.c b/lib/package.c
Richard Phibel ca8a44
index 90bd0d8a719353e8965c140b40e2dceef80a2ed1..fd41abbf6b4df07afa2caf1c47d9724765ee84e8 100644
Richard Phibel ca8a44
--- a/lib/package.c
Richard Phibel ca8a44
+++ b/lib/package.c
Richard Phibel ca8a44
@@ -412,11 +412,7 @@ rpmRC rpmReadPackageRaw(FD_t fd, Header * sigp, Header * hdrp)
Richard Phibel ca8a44
     Header h = NULL;
Richard Phibel ca8a44
     Header sigh = NULL;
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    rpmRC rc = rpmLeadRead(fd, &msg;;
Richard Phibel ca8a44
-    if (rc != RPMRC_OK)
Richard Phibel ca8a44
-	goto exit;
Richard Phibel ca8a44
-
Richard Phibel ca8a44
-    rc = hdrblobRead(fd, 1, 0, RPMTAG_HEADERSIGNATURES, sigblob, &msg;;
Richard Phibel ca8a44
+    rpmRC rc = hdrblobRead(fd, 1, 0, RPMTAG_HEADERSIGNATURES, sigblob, &msg;;
Richard Phibel ca8a44
     if (rc != RPMRC_OK)
Richard Phibel ca8a44
 	goto exit;
Richard Phibel ca8a44
 
Richard Phibel ca8a44
diff --git a/lib/rpmlead.c b/lib/rpmlead.c
Richard Phibel ca8a44
index 45b1c6f8edacb65549ba8d321de8f6ce8cef4503..82105122724a8efb071aecefdb278ef96ea5e70d 100644
Richard Phibel ca8a44
--- a/lib/rpmlead.c
Richard Phibel ca8a44
+++ b/lib/rpmlead.c
Richard Phibel ca8a44
@@ -24,24 +24,6 @@ static unsigned char const lead_magic[] = {
Richard Phibel ca8a44
     RPMLEAD_MAGIC0, RPMLEAD_MAGIC1, RPMLEAD_MAGIC2, RPMLEAD_MAGIC3
Richard Phibel ca8a44
 };
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-/** \ingroup lead
Richard Phibel ca8a44
- * The lead data structure.
Richard Phibel ca8a44
- * The lead needs to be 8 byte aligned.
Richard Phibel ca8a44
- * @deprecated The lead (except for signature_type) is legacy.
Richard Phibel ca8a44
- * @todo Don't use any information from lead.
Richard Phibel ca8a44
- */
Richard Phibel ca8a44
-struct rpmlead_s {
Richard Phibel ca8a44
-    unsigned char magic[4];
Richard Phibel ca8a44
-    unsigned char major;
Richard Phibel ca8a44
-    unsigned char minor;
Richard Phibel ca8a44
-    short type;
Richard Phibel ca8a44
-    short archnum;
Richard Phibel ca8a44
-    char name[66];
Richard Phibel ca8a44
-    short osnum;
Richard Phibel ca8a44
-    short signature_type;       /*!< Signature header type (RPMSIG_HEADERSIG) */
Richard Phibel ca8a44
-    char reserved[16];      /*!< Pad to 96 bytes -- 8 byte aligned! */
Richard Phibel ca8a44
-};
Richard Phibel ca8a44
-
Richard Phibel ca8a44
 static int rpmLeadFromHeader(Header h, struct rpmlead_s *l)
Richard Phibel ca8a44
 {
Richard Phibel ca8a44
     if (h != NULL) {
Richard Phibel ca8a44
@@ -70,13 +52,23 @@ static int rpmLeadFromHeader(Header h, struct rpmlead_s *l)
Richard Phibel ca8a44
 }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
 /* The lead needs to be 8 byte aligned */
Richard Phibel ca8a44
-rpmRC rpmLeadWrite(FD_t fd, Header h)
Richard Phibel ca8a44
+rpmRC rpmLeadWriteFromHeader(FD_t fd, Header h)
Richard Phibel ca8a44
 {
Richard Phibel ca8a44
     rpmRC rc = RPMRC_FAIL;
Richard Phibel ca8a44
     struct rpmlead_s l;
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    if (rpmLeadFromHeader(h, &l)) {
Richard Phibel ca8a44
-	
Richard Phibel ca8a44
+    if (rpmLeadFromHeader(h, &l)) {	
Richard Phibel ca8a44
+	rc = rpmLeadWrite(fd, l);
Richard Phibel ca8a44
+    }
Richard Phibel ca8a44
+
Richard Phibel ca8a44
+    return rc;
Richard Phibel ca8a44
+}
Richard Phibel ca8a44
+
Richard Phibel ca8a44
+/* The lead needs to be 8 byte aligned */
Richard Phibel ca8a44
+rpmRC rpmLeadWrite(FD_t fd, struct rpmlead_s l)
Richard Phibel ca8a44
+{
Richard Phibel ca8a44
+    rpmRC rc = RPMRC_FAIL;
Richard Phibel ca8a44
+
Richard Phibel ca8a44
 	l.type = htons(l.type);
Richard Phibel ca8a44
 	l.archnum = htons(l.archnum);
Richard Phibel ca8a44
 	l.osnum = htons(l.osnum);
Richard Phibel ca8a44
@@ -84,7 +76,6 @@ rpmRC rpmLeadWrite(FD_t fd, Header h)
Richard Phibel ca8a44
 	    
Richard Phibel ca8a44
 	if (Fwrite(&l, 1, sizeof(l), fd) == sizeof(l))
Richard Phibel ca8a44
 	    rc = RPMRC_OK;
Richard Phibel ca8a44
-    }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
     return rc;
Richard Phibel ca8a44
 }
Richard Phibel ca8a44
@@ -107,6 +98,11 @@ static rpmRC rpmLeadCheck(struct rpmlead_s *lead, char **msg)
Richard Phibel ca8a44
 }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
 rpmRC rpmLeadRead(FD_t fd, char **emsg)
Richard Phibel ca8a44
+{
Richard Phibel ca8a44
+    return rpmLeadReadAndReturn(fd, emsg, NULL);
Richard Phibel ca8a44
+}
Richard Phibel ca8a44
+
Richard Phibel ca8a44
+rpmRC rpmLeadReadAndReturn(FD_t fd, char **emsg, struct rpmlead_s * ret)
Richard Phibel ca8a44
 {
Richard Phibel ca8a44
     rpmRC rc = RPMRC_OK;
Richard Phibel ca8a44
     struct rpmlead_s l;
Richard Phibel ca8a44
@@ -136,5 +132,8 @@ rpmRC rpmLeadRead(FD_t fd, char **emsg)
Richard Phibel ca8a44
 	    free(err);
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
+	if (ret)
Richard Phibel ca8a44
+		*ret = l;
Richard Phibel ca8a44
+
Richard Phibel ca8a44
     return rc;
Richard Phibel ca8a44
 }
Richard Phibel ca8a44
diff --git a/lib/rpmlead.h b/lib/rpmlead.h
Richard Phibel ca8a44
index 9d86a8d73b3250d3c306b3a3ac4a33486e6920ec..8a592abc1d0e69822f438c4c7b248cce1cb5ee72 100644
Richard Phibel ca8a44
--- a/lib/rpmlead.h
Richard Phibel ca8a44
+++ b/lib/rpmlead.h
Richard Phibel ca8a44
@@ -19,13 +19,39 @@ extern "C" {
Richard Phibel ca8a44
 
Richard Phibel ca8a44
 #define RPMLEAD_SIZE 96         /*!< Don't rely on sizeof(struct) */
Richard Phibel ca8a44
 
Richard Phibel ca8a44
+/** \ingroup lead
Richard Phibel ca8a44
+ * The lead data structure.
Richard Phibel ca8a44
+ * The lead needs to be 8 byte aligned.
Richard Phibel ca8a44
+ * @deprecated The lead (except for signature_type) is legacy.
Richard Phibel ca8a44
+ * @todo Don't use any information from lead.
Richard Phibel ca8a44
+ */
Richard Phibel ca8a44
+struct rpmlead_s {
Richard Phibel ca8a44
+    unsigned char magic[4];
Richard Phibel ca8a44
+    unsigned char major;
Richard Phibel ca8a44
+    unsigned char minor;
Richard Phibel ca8a44
+    short type;
Richard Phibel ca8a44
+    short archnum;
Richard Phibel ca8a44
+    char name[66];
Richard Phibel ca8a44
+    short osnum;
Richard Phibel ca8a44
+    short signature_type;       /*!< Signature header type (RPMSIG_HEADERSIG) */
Richard Phibel ca8a44
+    char reserved[16];      /*!< Pad to 96 bytes -- 8 byte aligned! */
Richard Phibel ca8a44
+};
Richard Phibel ca8a44
+
Richard Phibel ca8a44
 /** \ingroup lead
Richard Phibel ca8a44
  * Write lead to file handle.
Richard Phibel ca8a44
  * @param fd		file handle
Richard Phibel ca8a44
  * @param h		package header
Richard Phibel ca8a44
  * @return		RPMRC_OK on success, RPMRC_FAIL on error
Richard Phibel ca8a44
  */
Richard Phibel ca8a44
-rpmRC rpmLeadWrite(FD_t fd, Header h);
Richard Phibel ca8a44
+rpmRC rpmLeadWriteFromHeader(FD_t fd, Header h);
Richard Phibel ca8a44
+
Richard Phibel ca8a44
+/** \ingroup lead
Richard Phibel ca8a44
+ * Write lead to file handle.
Richard Phibel ca8a44
+ * @param fd		file handle
Richard Phibel ca8a44
+ * @param l		lead
Richard Phibel ca8a44
+ * @return		RPMRC_OK on success, RPMRC_FAIL on error
Richard Phibel ca8a44
+ */
Richard Phibel ca8a44
+rpmRC rpmLeadWrite(FD_t fd, struct rpmlead_s l);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
 /** \ingroup lead
Richard Phibel ca8a44
  * Read lead from file handle.
Richard Phibel ca8a44
@@ -35,6 +61,15 @@ rpmRC rpmLeadWrite(FD_t fd, Header h);
Richard Phibel ca8a44
  */
Richard Phibel ca8a44
 rpmRC rpmLeadRead(FD_t fd, char **emsg);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
+/** \ingroup lead
Richard Phibel ca8a44
+ * Read lead from file handle and return it.
Richard Phibel ca8a44
+ * @param fd		file handle
Richard Phibel ca8a44
+ * @param[out] emsg		failure message on error (malloced)
Richard Phibel ca8a44
+ * @param[out] ret		address of lead
Richard Phibel ca8a44
+ * @return		RPMRC_OK on success, RPMRC_FAIL/RPMRC_NOTFOUND on error
Richard Phibel ca8a44
+ */
Richard Phibel ca8a44
+rpmRC rpmLeadReadAndReturn(FD_t fd, char **emsg, struct rpmlead_s * ret);
Richard Phibel ca8a44
+
Richard Phibel ca8a44
 #ifdef __cplusplus
Richard Phibel ca8a44
 }
Richard Phibel ca8a44
 #endif
Richard Phibel ca8a44
diff --git a/rpm2extents.c b/rpm2extents.c
Richard Phibel ca8a44
index 7dd5128decb03781411bd714339b3b6e9b805842..702d3765d76faf618992ca112011d2312d7fcdcc 100644
Richard Phibel ca8a44
--- a/rpm2extents.c
Richard Phibel ca8a44
+++ b/rpm2extents.c
Richard Phibel ca8a44
@@ -134,6 +134,28 @@ exit:
Richard Phibel ca8a44
     return rc;
Richard Phibel ca8a44
 }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
+/**
Richard Phibel ca8a44
+ * Check if package is in deny list.
Richard Phibel ca8a44
+ * @param package_name	package name
Richard Phibel ca8a44
+ * @return 		true if package is in deny list
Richard Phibel ca8a44
+ */
Richard Phibel ca8a44
+static inline int isInDenyList(char * package_name)
Richard Phibel ca8a44
+{
Richard Phibel ca8a44
+    int is_in_deny_list = 0;
Richard Phibel ca8a44
+    if (package_name) {
Richard Phibel ca8a44
+	char *e_denylist = getenv("LIBREPO_TRANSCODE_RPMS_DENYLIST");
Richard Phibel ca8a44
+	char *denytlist_item = strtok(e_denylist, ",");
Richard Phibel ca8a44
+	while (denytlist_item) {
Richard Phibel ca8a44
+	    if (strstr(package_name, denytlist_item)) {
Richard Phibel ca8a44
+		is_in_deny_list = 1;
Richard Phibel ca8a44
+		break;
Richard Phibel ca8a44
+	    }
Richard Phibel ca8a44
+	    denytlist_item = strtok(NULL, ",");
Richard Phibel ca8a44
+	}
Richard Phibel ca8a44
+    }
Richard Phibel ca8a44
+	return is_in_deny_list;
Richard Phibel ca8a44
+}
Richard Phibel ca8a44
+
Richard Phibel ca8a44
 static rpmRC FDWriteSignaturesValidation(FD_t fdo, int rpmvsrc, char *msg) {
Richard Phibel ca8a44
     size_t len;
Richard Phibel ca8a44
     rpmRC rc = RPMRC_FAIL;
Richard Phibel ca8a44
@@ -239,15 +261,41 @@ static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)
Richard Phibel ca8a44
     uint32_t offset_ix = 0;
Richard Phibel ca8a44
     size_t len;
Richard Phibel ca8a44
     int next = 0;
Richard Phibel ca8a44
+	struct rpmlead_s l;
Richard Phibel ca8a44
+    rpmfiles files = NULL;
Richard Phibel ca8a44
+    rpmfi fi = NULL;
Richard Phibel ca8a44
+    char *msg = NULL;
Richard Phibel ca8a44
 
Richard Phibel ca8a44
     fdo = fdDup(STDOUT_FILENO);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
+    rc = rpmLeadReadAndReturn(fdi, &msg, &l);
Richard Phibel ca8a44
+    if (rc != RPMRC_OK)
Richard Phibel ca8a44
+	goto exit;
Richard Phibel ca8a44
+
Richard Phibel ca8a44
+    /* Skip conversion if package is in deny list */
Richard Phibel ca8a44
+    if (isInDenyList(l.name)) {
Richard Phibel ca8a44
+	if (rpmLeadWrite(fdo, l)) {
Richard Phibel ca8a44
+		fprintf(stderr, _("Unable to write package lead: %s\n"),
Richard Phibel ca8a44
+		Fstrerror(fdo));
Richard Phibel ca8a44
+	    rc = RPMRC_FAIL;
Richard Phibel ca8a44
+	    goto exit;
Richard Phibel ca8a44
+	}
Richard Phibel ca8a44
+
Richard Phibel ca8a44
+	ssize_t fdilength = ufdCopy(fdi, fdo);
Richard Phibel ca8a44
+	if (fdilength == -1) {
Richard Phibel ca8a44
+	    fprintf(stderr, _("process_package cat failed\n"));
Richard Phibel ca8a44
+	    rc = RPMRC_FAIL;
Richard Phibel ca8a44
+	    goto exit;
Richard Phibel ca8a44
+	}
Richard Phibel ca8a44
+
Richard Phibel ca8a44
+	goto exit;
Richard Phibel ca8a44
+    } else {
Richard Phibel ca8a44
     if (rpmReadPackageRaw(fdi, &sigh, &h)) {
Richard Phibel ca8a44
 	rpmlog(RPMLOG_ERR, _("Error reading package\n"));
Richard Phibel ca8a44
 	exit(EXIT_FAILURE);
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    if (rpmLeadWrite(fdo, h))
Richard Phibel ca8a44
+    if (rpmLeadWriteFromHeader(fdo, h))
Richard Phibel ca8a44
     {
Richard Phibel ca8a44
 	rpmlog(RPMLOG_ERR, _("Unable to write package lead: %s\n"),
Richard Phibel ca8a44
 		Fstrerror(fdo));
Richard Phibel ca8a44
@@ -264,38 +312,41 @@ static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)
Richard Phibel ca8a44
 	exit(EXIT_FAILURE);
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    /* Retrieve payload size and compression type. */
Richard Phibel ca8a44
-    {
Richard Phibel ca8a44
-	const char *compr = headerGetString(h, RPMTAG_PAYLOADCOMPRESSOR);
Richard Phibel ca8a44
-	rpmio_flags = rstrscat(NULL, "r.", compr ? compr : "gzip", NULL);
Richard Phibel ca8a44
-    }
Richard Phibel ca8a44
+	/* Retrieve payload size and compression type. */
Richard Phibel ca8a44
+	{
Richard Phibel ca8a44
+	    const char *compr =
Richard Phibel ca8a44
+		headerGetString(h, RPMTAG_PAYLOADCOMPRESSOR);
Richard Phibel ca8a44
+	    rpmio_flags =
Richard Phibel ca8a44
+		rstrscat(NULL, "r.", compr ? compr : "gzip", NULL);
Richard Phibel ca8a44
+	}
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    gzdi = Fdopen(fdi, rpmio_flags);	/* XXX gzdi == fdi */
Richard Phibel ca8a44
-    free(rpmio_flags);
Richard Phibel ca8a44
+	gzdi = Fdopen(fdi, rpmio_flags);	/* XXX gzdi == fdi */
Richard Phibel ca8a44
+	free(rpmio_flags);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
     if (gzdi == NULL) {
Richard Phibel ca8a44
 	rpmlog(RPMLOG_ERR, _("cannot re-open payload: %s\n"), Fstrerror(gzdi));
Richard Phibel ca8a44
 	exit(EXIT_FAILURE);
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    rpmfiles files = rpmfilesNew(NULL, h, 0, RPMFI_KEEPHEADER);
Richard Phibel ca8a44
-    rpmfi fi = rpmfiNewArchiveReader(gzdi, files,
Richard Phibel ca8a44
-				     RPMFI_ITER_READ_ARCHIVE_CONTENT_FIRST);
Richard Phibel ca8a44
+	files = rpmfilesNew(NULL, h, 0, RPMFI_KEEPHEADER);
Richard Phibel ca8a44
+	fi = rpmfiNewArchiveReader(gzdi, files,
Richard Phibel ca8a44
+				   RPMFI_ITER_READ_ARCHIVE_CONTENT_FIRST);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    /* this is encoded in the file format, so needs to be fixed size (for
Richard Phibel ca8a44
-     * now?)
Richard Phibel ca8a44
-     */
Richard Phibel ca8a44
-    diglen = (uint32_t)rpmDigestLength(rpmfiDigestAlgo(fi));
Richard Phibel ca8a44
-    digestSet ds = digestSetCreate(rpmfiFC(fi), digestSetHash, digestSetCmp,
Richard Phibel ca8a44
-				   NULL);
Richard Phibel ca8a44
-    struct digestoffset offsets[rpmfiFC(fi)];
Richard Phibel ca8a44
-    pos = RPMLEAD_SIZE + headerSizeof(sigh, HEADER_MAGIC_YES);
Richard Phibel ca8a44
+	/* this is encoded in the file format, so needs to be fixed size (for
Richard Phibel ca8a44
+	 * now?)
Richard Phibel ca8a44
+	 */
Richard Phibel ca8a44
+	diglen = (uint32_t) rpmDigestLength(rpmfiDigestAlgo(fi));
Richard Phibel ca8a44
+	digestSet ds =
Richard Phibel ca8a44
+	    digestSetCreate(rpmfiFC(fi), digestSetHash, digestSetCmp,
Richard Phibel ca8a44
+			    NULL);
Richard Phibel ca8a44
+	struct digestoffset offsets[rpmfiFC(fi)];
Richard Phibel ca8a44
+	pos = RPMLEAD_SIZE + headerSizeof(sigh, HEADER_MAGIC_YES);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    /* main headers are aligned to 8 byte boundry */
Richard Phibel ca8a44
-    pos += pad_to(pos, 8);
Richard Phibel ca8a44
-    pos += headerSizeof(h, HEADER_MAGIC_YES);
Richard Phibel ca8a44
+	/* main headers are aligned to 8 byte boundry */
Richard Phibel ca8a44
+	pos += pad_to(pos, 8);
Richard Phibel ca8a44
+	pos += headerSizeof(h, HEADER_MAGIC_YES);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    zeros = xcalloc(fundamental_block_size, 1);
Richard Phibel ca8a44
+	zeros = xcalloc(fundamental_block_size, 1);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
     while (next >= 0) {
Richard Phibel ca8a44
 	next = rpmfiNext(fi);
Richard Phibel ca8a44
@@ -342,8 +393,8 @@ static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
     Fclose(gzdi);	/* XXX gzdi == fdi */
Richard Phibel ca8a44
 
Richard Phibel ca8a44
-    qsort(offsets, (size_t)offset_ix, sizeof(struct digestoffset),
Richard Phibel ca8a44
-	  digestoffsetCmp);
Richard Phibel ca8a44
+	qsort(offsets, (size_t) offset_ix, sizeof(struct digestoffset),
Richard Phibel ca8a44
+	      digestoffsetCmp);
Richard Phibel ca8a44
 
Richard Phibel ca8a44
     validation_pos = pos;
Richard Phibel ca8a44
     ssize_t validation_len = ufdCopy(validationi, fdo);
Richard Phibel ca8a44
@@ -412,6 +463,7 @@ static rpmRC process_package(FD_t fdi, FD_t digestori, FD_t validationi)
Richard Phibel ca8a44
 	rc = RPMRC_FAIL;
Richard Phibel ca8a44
 	goto exit;
Richard Phibel ca8a44
     }
Richard Phibel ca8a44
+	}
Richard Phibel ca8a44
 
Richard Phibel ca8a44
 exit:
Richard Phibel ca8a44
     rpmfilesFree(files);
Richard Phibel ca8a44
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
Richard Phibel ca8a44
index b4897f1de444080c8dc6c4913b5f33de20796822..d54e254ff41a0441d04fbcf27f26e4809f563b79 100644
Richard Phibel ca8a44
--- a/sign/rpmgensig.c
Richard Phibel ca8a44
+++ b/sign/rpmgensig.c
Richard Phibel ca8a44
@@ -672,7 +672,7 @@ static int rpmSign(const char *rpm, int deleting, int flags)
Richard Phibel ca8a44
 	}
Richard Phibel ca8a44
 
Richard Phibel ca8a44
 	/* Write the lead/signature of the output rpm */
Richard Phibel ca8a44
-	rc = rpmLeadWrite(ofd, h);
Richard Phibel ca8a44
+	rc = rpmLeadWriteFromHeader(ofd, h);
Richard Phibel ca8a44
 	if (rc != RPMRC_OK) {
Richard Phibel ca8a44
 	    rpmlog(RPMLOG_ERR, _("%s: writeLead failed: %s\n"), trpm,
Richard Phibel ca8a44
 		Fstrerror(ofd));
Richard Phibel ca8a44
diff --git a/tests/rpm2extents.at b/tests/rpm2extents.at
Richard Phibel ca8a44
index 5135c9cf83d9e75e9d9bc0b84186ab10cc0cbcac..c9c79c5acd22b86704460f295712ce7ab5ee3259 100644
Richard Phibel ca8a44
--- a/tests/rpm2extents.at
Richard Phibel ca8a44
+++ b/tests/rpm2extents.at
Richard Phibel ca8a44
@@ -95,6 +95,17 @@ runroot rpmkeys -Kv /tmp/hello-2.0-1.x86_64-signed.rpm; echo $?
Richard Phibel ca8a44
 [])
Richard Phibel ca8a44
 AT_CLEANUP
Richard Phibel ca8a44
 
Richard Phibel ca8a44
+# check that package in denylist is not transcoded
Richard Phibel ca8a44
+AT_SETUP([rpm2extents denylist])
Richard Phibel ca8a44
+AT_KEYWORDS([rpm2extents])
Richard Phibel ca8a44
+AT_CHECK([
Richard Phibel ca8a44
+export LIBREPO_TRANSCODE_RPMS_DENYLIST="vim,hello,cowsay"
Richard Phibel ca8a44
+runroot_other cat /data/RPMS/hello-2.0-1.x86_64.rpm | runroot_other rpm2extents SHA256 | runroot_other cmp /data/RPMS/hello-2.0-1.x86_64.rpm -],
Richard Phibel ca8a44
+[0],
Richard Phibel ca8a44
+[],
Richard Phibel ca8a44
+[ignore])
Richard Phibel ca8a44
+AT_CLEANUP
Richard Phibel ca8a44
+
Richard Phibel ca8a44
 AT_SETUP([rpm2extents install package])
Richard Phibel ca8a44
 AT_KEYWORDS([rpm2extents reflink])
Richard Phibel ca8a44
 AT_SKIP_IF([$REFLINK_DISABLED])