autopatch/kernel
5
0
Fork 1
Code Issues Pull Requests Releases Activity

fix(autopatch): Removed two obsolete replace actions targeting the static %define pesign_name_0 and UKI_secureboot_name blocks tha #11

Merged
alukoshko merged 1 commits from agent-fix/a10s-20260801-021449 into a10s 2026-08-03 08:28:31 +00:00
Conversation 0 Commits 1 Files Changed 1 -34
eabdullin commented 2026-08-01 02:14:50 +00:00
Owner
Copy Link

Automated fix by autopatch agent.

Summary: Removed two obsolete replace actions targeting the static %define pesign_name_0 and UKI_secureboot_name blocks that upstream eliminated in favour of dynamic cert-name discovery.

Root cause

The upstream kernel.spec for c10s was refactored (RHEL-169468) to derive the pesign certificate name at build time rather than statically:

  • The old spec had a %define pesign_name_0 centossecureboot801 block guarded by %if 0%{?centos} / %else / arch conditionals.
  • The new spec replaces this with pesign_name_0=$(get_pesign_name %{secureboot_key_0}), resolving the cert name from the file in /usr/share/pki/sb-certs/ at build time.
  • Similarly, UKI_secureboot_name=centossecureboot804 is gone; the spec now uses pesign_name_uki_0=$(get_pesign_name %{secureboot_key_uki_0}).

Both replace actions in config.yaml targeted blocks that no longer exist, causing ActionNotAppliedError. They were dropped upstream (not moved behind an indirection), so both were removed.

The intent — that AlmaLinux uses its own secureboot certificate — is preserved: AlmaLinux's system-sb-certs package supplies the cert files, and get_pesign_name() resolves the correct AlmaLinux cert name automatically at build time. No override in the spec is needed.

Original error

Type: ActionNotAppliedError

Traceback (most recent call last):
  File "/root/autopatch-tool/src/webserv.py", line 89, in debrand_packages
    result = apply_modifications(
  File "/root/autopatch-tool/src/debranding.py", line 138, in apply_modifications
    config.apply_actions(rpms_working_dir + f"/{package}")
  File "/root/autopatch-tool/src/actions_handler.py", line 938, in apply_actions
    action.execute(Path(package_path))
  File "/root/autopatch-tool/src/actions_handler.py", line 475, in execute
    process_lines(
  File "/root/autopatch-tool/src/actions_handler.py", line 236, in process_lines
    raise ActionNotAppliedError(
actions_handler.ActionNotAppliedError: Action 'ReplaceAction' was not applied successfully: No changes made for '['%if 0%{?centos}', '%define pesign_name_0 centossecureboot801', '%else', '%ifarch x86_64 aarch64', '%define pesign_name_0 redhatsecureboot801', '%endif', '%ifarch s390x', '%define pesign_name_0 redhatsecureboot302', '%endif', '%ifarch ppc64le', '%define pesign_name_0 redhatsecureboot701', '%endif', '%endif']' in /root/autopatch-tool/src/autopatch-kernel-udbsdv_l/rpms-namespace/kernel/kernel.spec

Package: kernel | Webhook branch: c10s

Automated fix by autopatch agent. **Summary:** Removed two obsolete `replace` actions targeting the static `%define pesign_name_0` and `UKI_secureboot_name` blocks that upstream eliminated in favour of dynamic cert-name discovery. ### Root cause The upstream `kernel.spec` for c10s was refactored (RHEL-169468) to derive the pesign certificate name at build time rather than statically: - The old spec had a `%define pesign_name_0 centossecureboot801` block guarded by `%if 0%{?centos}` / `%else` / arch conditionals. - The new spec replaces this with `pesign_name_0=$(get_pesign_name %{secureboot_key_0})`, resolving the cert name from the file in `/usr/share/pki/sb-certs/` at build time. - Similarly, `UKI_secureboot_name=centossecureboot804` is gone; the spec now uses `pesign_name_uki_0=$(get_pesign_name %{secureboot_key_uki_0})`. Both `replace` actions in `config.yaml` targeted blocks that no longer exist, causing `ActionNotAppliedError`. They were **dropped upstream** (not moved behind an indirection), so both were removed. The intent — that AlmaLinux uses its own secureboot certificate — is preserved: AlmaLinux's `system-sb-certs` package supplies the cert files, and `get_pesign_name()` resolves the correct AlmaLinux cert name automatically at build time. No override in the spec is needed. ### Original error **Type:** `ActionNotAppliedError` ``` Traceback (most recent call last): File "/root/autopatch-tool/src/webserv.py", line 89, in debrand_packages result = apply_modifications( File "/root/autopatch-tool/src/debranding.py", line 138, in apply_modifications config.apply_actions(rpms_working_dir + f"/{package}") File "/root/autopatch-tool/src/actions_handler.py", line 938, in apply_actions action.execute(Path(package_path)) File "/root/autopatch-tool/src/actions_handler.py", line 475, in execute process_lines( File "/root/autopatch-tool/src/actions_handler.py", line 236, in process_lines raise ActionNotAppliedError( actions_handler.ActionNotAppliedError: Action 'ReplaceAction' was not applied successfully: No changes made for '['%if 0%{?centos}', '%define pesign_name_0 centossecureboot801', '%else', '%ifarch x86_64 aarch64', '%define pesign_name_0 redhatsecureboot801', '%endif', '%ifarch s390x', '%define pesign_name_0 redhatsecureboot302', '%endif', '%ifarch ppc64le', '%define pesign_name_0 redhatsecureboot701', '%endif', '%endif']' in /root/autopatch-tool/src/autopatch-kernel-udbsdv_l/rpms-namespace/kernel/kernel.spec ``` --- Package: `kernel` | Webhook branch: `c10s`
eabdullin added 1 commit 2026-08-01 02:14:50 +00:00 
Removed two obsolete `replace` actions targeting the static `%define pesign_name_0` and `UKI_secureboot_name` blocks that upstream eliminated in favour of dynamic cert-name discovery.
alukoshko merged commit 4ba57efffe into a10s 2026-08-03 08:28:31 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: autopatch/kernel#11
No description provided.
Delete Branch "agent-fix/a10s-20260801-021449"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?