From 71eb790f4e44adf8ed9168bc681376b8377918ec Mon Sep 17 00:00:00 2001 From: Richard Phibel Date: Aug 17 2023 10:02:52 +0000 Subject: Merge remote-tracking branch 'gitlab/c9s' into c9s-sig-hyperscale --- diff --git a/0001-Macroize-find-debuginfo-script-location.patch b/0001-Macroize-find-debuginfo-script-location.patch new file mode 100644 index 0000000..4cc4459 --- /dev/null +++ b/0001-Macroize-find-debuginfo-script-location.patch @@ -0,0 +1,51 @@ +From 1a2554da434548e916240796fe7ca9689c5771fe Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Thu, 27 May 2021 13:58:58 +0300 +Subject: [PATCH] Macroize find-debuginfo script location + +Makes it easier to handle varying paths, mainly in preparation for the +next step. + +(cherry picked from commit ce48167f37af59b6366083fb78a314f7931c0c6b) +--- + configure.ac | 1 + + macros.in | 4 +++- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/configure.ac b/configure.ac +index 39f9a0e5b..35b4dff4c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -113,6 +113,7 @@ AC_PATH_PROG(__NM, nm, /usr/bin/nm, $MYPATH) + AC_PATH_PROG(__OBJCOPY, objcopy, /usr/bin/objcopy, $MYPATH) + AC_PATH_PROG(__OBJDUMP, objdump, /usr/bin/objdump, $MYPATH) + AC_PATH_PROG(__STRIP, strip, /usr/bin/strip, $MYPATH) ++AC_PATH_PROG(__FIND_DEBUGINFO, find-debuginfo, /usr/bin/find-debuginfo, $MYPATH) + + AC_PATH_PROG(__GIT, git, /usr/bin/git, $MYPATH) + AC_PATH_PROG(__HG, hg, /usr/bin/hg, $MYPATH) +diff --git a/macros.in b/macros.in +index 24b124702..2bcf07ef8 100644 +--- a/macros.in ++++ b/macros.in +@@ -80,6 +80,8 @@ + %__remsh %{__rsh} + %__strip @__STRIP@ + ++%__find_debuginfo @__FIND_DEBUGINFO@ ++ + #============================================================================== + # Conditional build stuff. + +@@ -149,7 +151,7 @@ + # _find_debuginfo_vendor_opts to pass options to the script. + # + %__debug_install_post \ +- %{_rpmconfigdir}/find-debuginfo.sh \\\ ++ %{__find_debuginfo} \\\ + %{?_smp_build_ncpus:-j%{_smp_build_ncpus}} \\\ + %{?_missing_build_ids_terminate_build:--strict-build-id} \\\ + %{?_no_recompute_build_ids:-n} \\\ +-- +2.41.0 + diff --git a/rpm-4.16.1.3-IMA-without-xattr.patch b/rpm-4.16.1.3-IMA-without-xattr.patch new file mode 100644 index 0000000..665a232 --- /dev/null +++ b/rpm-4.16.1.3-IMA-without-xattr.patch @@ -0,0 +1,41 @@ +Based on + +From 7db2efa95d859cebda2b095ffdffac42812bd6d9 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 22 Feb 2022 16:57:00 +0000 +Subject: [PATCH] ima: Install on filesystems without xattr support without + failing + +If an RPM contains IMA signed digests and rpm-plugin-ima is installed, +then any attempt to install to a filesystem that doesn't support +extended attributes will cause the RPM installation to fail. + +This can be seen, for example, if installing a file /boot, which is +usually a vFAT filesystem. + +The rpm-plugin for selinux fixed this some time back, and that same +logic can be applied to IMA too - where, if a failure to set an extended +attribute results in an errno that is set to EOPNOTSUPP, then this +should not cause a complete failure, but should instead just be logged +at a debug level. + +Signed-off-by: Darren Kenny + +--- rpm-4.16.1.3/plugins/ima.c.orig 2023-05-02 18:19:25.095992859 +0200 ++++ rpm-4.16.1.3/plugins/ima.c 2023-05-02 18:21:46.032941008 +0200 +@@ -69,10 +69,13 @@ + fsig = rpmfiFSignature(fi, &len); + if (fsig && (check_zero_hdr(fsig, len) == 0)) { + if (lsetxattr(path, XATTR_NAME_IMA, fsig, len, 0) < 0) { +- rpmlog(RPMLOG_ERR, ++ int is_err = errno != EOPNOTSUPP; ++ rpmlog(is_err?RPMLOG_ERR:RPMLOG_DEBUG, + "ima: could not apply signature on '%s': %s\n", + path, strerror(errno)); +- rc = RPMRC_FAIL; ++ if (is_err) { ++ rc = RPMRC_FAIL; ++ } + } + } + diff --git a/rpm-4.16.1.3-external-debugedit.patch b/rpm-4.16.1.3-external-debugedit.patch new file mode 100644 index 0000000..b5bf2f5 --- /dev/null +++ b/rpm-4.16.1.3-external-debugedit.patch @@ -0,0 +1,11 @@ +--- rpm-4.16.1.3/tests/Makefile.am.orig 2023-05-03 12:44:36.287582896 +0200 ++++ rpm-4.16.1.3/tests/Makefile.am 2023-05-03 12:46:34.182938006 +0200 +@@ -170,7 +170,7 @@ + for d in dev etc magic tmp var; do if [ ! -d testing/$${d} ]; then mkdir testing/$${d}; fi; done + for node in urandom stdin stderr stdout null full; do ln -s /dev/$${node} testing/dev/$${node}; done + for cf in hosts resolv.conf passwd shadow group gshadow mtab ; do [ -f /etc/$${cf} ] && ln -s /etc/$${cf} testing/etc/$${cf}; done +- for prog in gzip cat patch tar sh ln chmod rm mkdir uname grep sed find file ionice mktemp nice cut sort diff touch install wc coreutils xargs; do p=`which $${prog}`; if [ "$${p}" != "" ]; then ln -s $${p} testing/$(bindir)/; fi; done ++ for prog in gzip cat patch tar sh ln chmod rm mkdir uname grep sed find file ionice mktemp nice cut sort diff touch install wc coreutils xargs debugedit find-debuginfo find-debuginfo.sh ; do p=`which $${prog}`; if [ "$${p}" != "" ]; then ln -s $${p} testing/$(bindir)/; fi; done + for d in /proc /sys /selinux /etc/selinux; do if [ -d $${d} ]; then ln -s $${d} testing/$${d}; fi; done + (cd testing/magic && file -C) + chmod -R u-w testing/ diff --git a/rpm.spec b/rpm.spec index da9b1bd..f699003 100644 --- a/rpm.spec +++ b/rpm.spec @@ -42,7 +42,7 @@ %global rpmver 4.16.1.3 #global snapver rc1 -%global rel 22.5 +%global rel 25.1 %global sover 9 %global srcver %{rpmver}%{?snapver:-%{snapver}} @@ -108,12 +108,14 @@ Patch121: rpm-4.16.1.3-rpm2archive-nocompression.patch Patch122: rpm-4.16.1.3-Support-long-languages-names-for-QT.patch Patch123: rpm-4.14.3-rpm2archive-parse-popt-options.patch Patch124: rpm-4.14.3-rpm2archive-Don-t-print-usage.patch +Patch125: rpm-4.16.1.3-IMA-without-xattr.patch # These are not yet upstream Patch906: rpm-4.7.1-geode-i686.patch # Probably to be upstreamed in slightly different form Patch907: rpm-4.15.x-ldflags.patch Patch908: 0001-Give-warning-on-not-supported-hash-for-RSA-keys.patch +Patch909: rpm-4.16.1.3-external-debugedit.patch # Not yet (all) upstream, debugedit DWARF5 # https://code.wildebeest.org/git/user/mjw/rpm/log/?h=gcc-dwarf5-4.16.1.2 @@ -127,8 +129,9 @@ Patch916: 0006-debugedit-Handle-DWARF-5-debug_line-and-debug_line_s.patch # Downstream-only patches Patch1000: rpm-4.16.1.3-hashtab-use-after-free-fix.patch Patch1001: rpm-4.16.1.3-find_debuginfo_vendor_opts.patch +Patch1002: 0001-Macroize-find-debuginfo-script-location.patch %if %{with zstd} -Patch1002: rpm-4.16.1.3-backport-multithreaded-zstd.patch +Patch1003: rpm-4.16.1.3-backport-multithreaded-zstd.patch %endif # fsverity support @@ -211,7 +214,7 @@ BuildRequires: libdb-devel %endif %if %{with check} -BuildRequires: fakechroot gnupg2 +BuildRequires: fakechroot gnupg2 debugedit %endif # XXX generally assumed to be installed but make it explicit as rpm @@ -341,6 +344,7 @@ Suggests: gdb-minimal # "just work" while allowing for alternatives, depend on a virtual # provide, typically coming from redhat-rpm-config. Requires: system-rpm-config +Requires: debugedit %description build The rpm-build package contains the scripts and executable programs @@ -539,6 +543,19 @@ pushd python %py3_install popd +cat > $RPM_BUILD_ROOT/%{rpmhome}/debugedit << END +#!/bin/sh +/usr/bin/debugedit "\$@" +END +cat > $RPM_BUILD_ROOT/%{rpmhome}/sepdebugcrcfix << END +#!/bin/sh +/usr/bin/sepdebugcrcfix "\$@" +END +cat > $RPM_BUILD_ROOT/%{rpmhome}/find-debuginfo.sh << END +#!/bin/sh +/usr/bin/find-debuginfo.sh "\$@" +END + mkdir -p $RPM_BUILD_ROOT%{_unitdir} install -m 644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir} install -m 644 %{SOURCE20} $RPM_BUILD_ROOT/%{_unitdir} @@ -777,12 +794,27 @@ fi %doc doc/librpm/html/* %changelog +* Thu Aug 17 2023 Richard Phibel - 4.16.1.3-25.1 +- Merge upstream changes for Hyperscale + * Fri Aug 11 2023 Richard Phibel - 4.16.1.3-22.5 - Fix issue for transaction with transcoded and non-transcoded packages +* Fri Jun 30 2023 Florian Festi - 4.16.1.3-25 +- Followup on #2166383 +- Add compat scripts calling external find-debug, sepdebugcrcfix and debugedit +- Add %%__find_debuginfo macro + * Mon May 22 2023 Richard Phibel - 4.16.1.3-22.4 - Fix stack overflow in rpm2extents and various memory leaks +* Thu May 04 2023 Florian Festi - 4.16.1.3-24 +- Use external find-debug and debugedit (#2166383) + +* Wed May 03 2023 Florian Festi - 4.16.1.3-23 +- Don't error out on IMA signatures on files not supporting them + (#2157835, #2157836) + * Sat Feb 11 2023 Davide Cavalca - 4.16.1.3-22.3 - Drop our selinux policy as it's been subsumed by the main one