Re: [Rpm-maint] [rpm-software-management/rpm] rpmsign broken: error: sign_hash failed (Issue #3214)

2024-08-12 Thread Panu Matilainen
Closed #3214 as completed. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issues/3214#event-13842505490 You are receiving this because you are subscribed to this thread. Message ID: ___ Rpm-maint m

Re: [Rpm-maint] [rpm-software-management/rpm] rpmsign broken: error: sign_hash failed (Issue #3214)

2024-08-12 Thread Panu Matilainen
This looks more like a regression in ima-evm-tools while deprecating the sign_hash() function we use than anything in rpm, when the related code in rpm hasn't changed at all. Issues should be investigated at least enough to confirm them before moving upstream. Closing this one, if I'm wrong we

[Rpm-maint] [rpm-software-management/rpm] RFE: add a test for IMA signing (Issue #3237)

2024-08-12 Thread Panu Matilainen
IMA is actually used by distros now, we should cover it in our tests. Testing the IMA plugin may be undoable in a container, but at least we should test that signing works. We can probably base on these, they're GPL v2.1: https://github.com/RedHat-SP-Security/keylime-tests/blob/main/functional/in

Re: [Rpm-maint] [rpm-software-management/rpm] RFE: add a test(s) for IMA signing (Issue #3237)

2024-08-12 Thread Michal Domonkos
Indeed, I'm just not sure if this is doable in containers. But maybe there's a way (finding out will be part of this ticket). -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issues/3237#issuecomment-2283276313 You are receiving this because yo

Re: [Rpm-maint] [rpm-software-management/rpm] RFE: add a test(s) for IMA signing (Issue #3237)

2024-08-12 Thread Panu Matilainen
As the description says: we may not be able to the the plugin (ie installation), but signing doesn't require any fancy kernel stuff. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issues/3237#issuecomment-2283284617 You are receiving this bec

Re: [Rpm-maint] [rpm-software-management/rpm] RFE: add a test(s) for IMA signing (Issue #3237)

2024-08-12 Thread Michal Domonkos
Ah, right. Time for a coffee here :smile: -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issues/3237#issuecomment-2283300156 You are receiving this because you are subscribed to this thread. Message ID: __

Re: [Rpm-maint] [rpm-software-management/rpm] %prep working directory different when using --build-in-place in Fedora 40 vs Fedora Rawhide (Issue #3208)

2024-08-12 Thread Panu Matilainen
Relative _foodir for the build stuff was never supported by rpm, it just happened to work in various cases in the past (see #3128, we're considering on making it explicit). The new intermediate build directory in >= 4.20 just means it happens to work for far fewer cases. I tend to agree that th

Re: [Rpm-maint] [rpm-software-management/rpm] --build-in-place and --noprep cannot be used at the same time (Issue #3216)

2024-08-12 Thread Panu Matilainen
It's related alright, but not the same. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issues/3216#issuecomment-2283531109 You are receiving this because you are subscribed to this thread. Message ID: _

Re: [Rpm-maint] [rpm-software-management/rpm] %prep working directory different when using --build-in-place in Fedora 40 vs Fedora Rawhide (Issue #3208)

2024-08-12 Thread Daan De Meyer
> Relative _foodir for the build stuff was never supported by rpm, it just > happened to work in various cases in the past (see > https://github.com/rpm-software-management/rpm/issues/3128, we're considering > on making it explicit). The new intermediate build directory in >= 4.20 just > means

Re: [Rpm-maint] [rpm-software-management/rpm] Add an alternative, enhanceable form of rpm.execute() with io redirect capabilities (PR #3236)

2024-08-12 Thread Miro Hrončok
@hroncok commented on this pull request. > + execute({table} [, stdout [, stderr]]) + +Execute an external command (rpm >= 4.20) +This is an alternative form of rpm.execute() that takes the command and any +arguments as a single Lua table. + +Standard output and/or error can be optionally re

Re: [Rpm-maint] [rpm-software-management/rpm] Add an alternative, enhanceable form of rpm.execute() with io redirect capabilities (PR #3236)

2024-08-12 Thread Panu Matilainen
@pmatilai commented on this pull request. > + execute({table} [, stdout [, stderr]]) + +Execute an external command (rpm >= 4.20) +This is an alternative form of rpm.execute() that takes the command and any +arguments as a single Lua table. + +Standard output and/or error can be optionally r

[Rpm-maint] [rpm-software-management/rpm] Fix rpm.execute() exit code reporting (PR #3238)

2024-08-12 Thread Panu Matilainen
The status returned by waitpid() is not a simple integer, one needs the various W* macros to examine it. You can view, comment on, or merge this pull request online at: https://github.com/rpm-software-management/rpm/pull/3238 -- Commit Summary -- * Fix rpm.execute() exit code reporting --

Re: [Rpm-maint] [rpm-software-management/rpm] Fix rpm.execute() exit code reporting (PR #3238)

2024-08-12 Thread Panu Matilainen
Closed #3238. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3238#event-13848763825 You are receiving this because you are subscribed to this thread. Message ID: ___ Rpm-maint mailing list Rpm

[Rpm-maint] [rpm-software-management/rpm] Don't let plugins fail due to read-only fs (PR #3239)

2024-08-12 Thread Michal Domonkos
Read-only file systems fall into the same category as unsupported ones (i.e. writing the desired file metadata to them is meaningless) so handle those gracefully in the plugin hooks, too. This is useful e.g. when preparing a system for IMA by reinstalling the desired packages with the IMA plugi

[Rpm-maint] [rpm-software-management/rpm] Fix memory leak in rpmsign (PR #3240)

2024-08-12 Thread Michal Domonkos
Found by Coverity. Fixes: RHEL-37564 You can view, comment on, or merge this pull request online at: https://github.com/rpm-software-management/rpm/pull/3240 -- Commit Summary -- * Fix memory leak in rpmsign -- File Changes -- M tools/rpmsign.c (1) -- Patch Links -- https://github.c

Re: [Rpm-maint] [rpm-software-management/rpm] Add an alternative, enhanceable form of rpm.execute() with io redirect capabilities (PR #3236)

2024-08-12 Thread Miro Hrončok
@hroncok commented on this pull request. > + execute({table} [, stdout [, stderr]]) + +Execute an external command (rpm >= 4.20) +This is an alternative form of rpm.execute() that takes the command and any +arguments as a single Lua table. + +Standard output and/or error can be optionally re

Re: [Rpm-maint] [rpm-software-management/rpm] Add an alternative, enhanceable form of rpm.execute() with io redirect capabilities (PR #3236)

2024-08-12 Thread Miro Hrončok
@hroncok commented on this pull request. > + execute({table} [, stdout [, stderr]]) + +Execute an external command (rpm >= 4.20) +This is an alternative form of rpm.execute() that takes the command and any +arguments as a single Lua table. + +Standard output and/or error can be optionally re

Re: [Rpm-maint] [rpm-software-management/rpm] Don't let plugins fail due to read-only fs (PR #3239)

2024-08-12 Thread Michal Domonkos
One scenario just came to mind: 1. You mount a directory (as read-only) over another directory that's owned by an installed package 2. The plugin skips the directory silently 3. You unmount the directory 4. The original directory does not have the file attributes applied (!) Maybe we should make

Re: [Rpm-maint] [rpm-software-management/rpm] Add an alternative, enhanceable form of rpm.execute() with io redirect capabilities (PR #3236)

2024-08-12 Thread Panu Matilainen
@pmatilai commented on this pull request. > + execute({table} [, stdout [, stderr]]) + +Execute an external command (rpm >= 4.20) +This is an alternative form of rpm.execute() that takes the command and any +arguments as a single Lua table. + +Standard output and/or error can be optionally r

Re: [Rpm-maint] [rpm-software-management/rpm] Fix memory leak in rpmsign (PR #3240)

2024-08-12 Thread Panu Matilainen
Another leak that simply would not be there with a native C++ string... -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3240#issuecomment-2285444606 You are receiving this because you are subscribed to this thread. Message ID: ___

Re: [Rpm-maint] [rpm-software-management/rpm] Fix memory leak in rpmsign (PR #3240)

2024-08-12 Thread Panu Matilainen
Merged #3240 into master. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3240#event-13858367288 You are receiving this because you are subscribed to this thread. Message ID: ___ Rpm-maint mail

Re: [Rpm-maint] [rpm-software-management/rpm] Don't let plugins fail due to read-only fs (PR #3239)

2024-08-12 Thread Panu Matilainen
These should probably be handled the same as fsm does (see commit 09d554da62ce84823849138a55a2ba0e72dd17f0): if there's an error applying, skip if the attributes match, otherwise it's an error. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/