From 6dc3e26ab669a8b44e79b905d0cf0526633c4e3d Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 19 May 2026 20:15:12 -0400 Subject: [PATCH] import UBI librepo-1.19.0-1.el9 --- .gitignore | 2 +- .librepo.metadata | 2 +- ...t-creation-SELinux-labels-on-GnuPG-d.patch | 226 ------------------ ...value-from-prepare_repo_download_ta.patch} | 4 +- ...mporting-keys-with-prefix-and-suffix.patch | 77 ++++++ SPECS/librepo.spec | 60 ++++- 6 files changed, 131 insertions(+), 240 deletions(-) delete mode 100644 SOURCES/0001-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch rename SOURCES/{0002-Propagate-return-value-from-prepare_repo_download_ta.patch => 0001-Propagate-return-value-from-prepare_repo_download_ta.patch} (92%) create mode 100644 SOURCES/0002-Test-importing-keys-with-prefix-and-suffix.patch diff --git a/.gitignore b/.gitignore index 423e399..d704205 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/librepo-1.14.5.tar.gz +SOURCES/librepo-1.19.0.tar.gz diff --git a/.librepo.metadata b/.librepo.metadata index 1f91c92..dc318e6 100644 --- a/.librepo.metadata +++ b/.librepo.metadata @@ -1 +1 @@ -fa072a20718ae6af54a65d53b1c9686a730400bf SOURCES/librepo-1.14.5.tar.gz +28b74613ad1b84941bd3b0c6d3d8e7c7b1e3741f SOURCES/librepo-1.19.0.tar.gz diff --git a/SOURCES/0001-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch b/SOURCES/0001-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch deleted file mode 100644 index d9bf66c..0000000 --- a/SOURCES/0001-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch +++ /dev/null @@ -1,226 +0,0 @@ -From 69e3a61e62d7b0c214e49c88a20422da4dfca238 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= -Date: Thu, 12 Oct 2023 15:55:43 +0200 -Subject: [PATCH] PGP: Set a default creation SELinux labels on GnuPG - directories -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This is another way how to fix mismatching SELinux context on -/run/user directories without moving the directories to -/run/gnupg/user. - -librepo used to precreate the directory in /run/user to make sure -a GnuPG agent executed by GPGME library places its socket there. - -The directories there are normally created and removed by systemd -(logind PAM session). librepo created them for a case when a package -manager is invoked out of systemd session, before the super user logs -in. E.g. by a timer job to cache repository metadata. - -A problem was when this out-of-session process was a SELinux-confined -process creating files with its own SELinux label different from a DNF -program. Then the directory was created with a SELinux label different -from the one expected by systemd and when logging out a corresponding -user, the mismatching label clashed with systemd. - -This patch fixes the issue by choosing a SELinux label of those -directories to the label defined in a default SELinux file context -database. - -This patch adds a new -DENABLE_SELINUX=OFF CMake option to disable the -new dependency on libselinux. A default behavior is to support SELinux -only if GPGME backend is selected with -DUSE_GPGME=ON. - -https://issues.redhat.com/browse/RHEL-10720 -Signed-off-by: Petr Písař ---- - CMakeLists.txt | 8 ++++++ - librepo.spec | 9 +++++- - librepo/CMakeLists.txt | 4 +++ - librepo/gpg.c | 64 ++++++++++++++++++++++++++++++++++++++++++ - 4 files changed, 84 insertions(+), 1 deletion(-) - -diff --git a/CMakeLists.txt b/CMakeLists.txt -index b4007e3..1a107bc 100644 ---- a/CMakeLists.txt -+++ b/CMakeLists.txt -@@ -5,6 +5,7 @@ OPTION (ENABLE_TESTS "Build test?" ON) - OPTION (ENABLE_DOCS "Build docs?" ON) - OPTION (WITH_ZCHUNK "Build with zchunk support" ON) - OPTION (ENABLE_PYTHON "Build Python bindings" ON) -+OPTION (ENABLE_SELINUX "Restore SELinux labels on GnuPG directories" ON) - - INCLUDE (${CMAKE_SOURCE_DIR}/VERSION.cmake) - SET (VERSION "${LIBREPO_MAJOR}.${LIBREPO_MINOR}.${LIBREPO_PATCH}") -@@ -33,6 +34,9 @@ PKG_SEARCH_MODULE(LIBCRYPTO REQUIRED libcrypto openssl) - PKG_CHECK_MODULES(LIBXML2 libxml-2.0 REQUIRED) - FIND_PACKAGE(CURL 7.52.0 REQUIRED) - FIND_PACKAGE(Gpgme REQUIRED) -+IF (ENABLE_SELINUX) -+ PKG_CHECK_MODULES(SELINUX REQUIRED libselinux) -+ENDIF(ENABLE_SELINUX) - - - IF (WITH_ZCHUNK) -@@ -63,6 +67,10 @@ ENDIF (NOT CURL_FOUND) - INCLUDE_DIRECTORIES(${LIBXML2_INCLUDE_DIRS}) - INCLUDE_DIRECTORIES(${CURL_INCLUDE_DIR}) - #INCLUDE_DIRECTORIES(${CHECK_INCLUDE_DIR}) -+IF (ENABLE_SELINUX) -+ INCLUDE_DIRECTORIES(${SELINUX_INCLUDE_DIRS}) -+ ADD_DEFINITIONS(-DENABLE_SELINUX=1) -+ENDIF (ENABLE_SELINUX) - - include (GNUInstallDirs) - # Python stuff -diff --git a/librepo.spec b/librepo.spec -index e8c88d8..0a5c867 100644 ---- a/librepo.spec -+++ b/librepo.spec -@@ -8,6 +8,8 @@ - %bcond_without zchunk - %endif - -+%bcond_without selinux -+ - %global dnf_conflict 2.8.8 - - Name: librepo -@@ -29,6 +31,9 @@ BuildRequires: libattr-devel - BuildRequires: libcurl-devel >= %{libcurl_version} - BuildRequires: pkgconfig(libxml-2.0) - BuildRequires: pkgconfig(libcrypto) -+%if %{with selinux} -+BuildRequires: pkgconfig(libselinux) -+%endif - BuildRequires: pkgconfig(openssl) - %if %{with zchunk} - BuildRequires: pkgconfig(zck) >= 0.9.11 -@@ -66,7 +71,9 @@ Python 3 bindings for the librepo library. - %autosetup -p1 - - %build --%cmake %{!?with_zchunk:-DWITH_ZCHUNK=OFF} -+%cmake \ -+ %{!?with_zchunk:-DWITH_ZCHUNK=OFF} \ -+ -DENABLE_SELINUX=%{?with_selinux:ON}%{!?with_selinux:OFF} - %cmake_build - - %check -diff --git a/librepo/CMakeLists.txt b/librepo/CMakeLists.txt -index 4f00a5e..e759692 100644 ---- a/librepo/CMakeLists.txt -+++ b/librepo/CMakeLists.txt -@@ -53,6 +53,10 @@ TARGET_LINK_LIBRARIES(librepo - ${GPGME_VANILLA_LIBRARIES} - ${GLIB2_LIBRARIES} - ) -+IF (ENABLE_SELINUX) -+ TARGET_LINK_LIBRARIES(librepo ${SELINUX_LIBRARIES}) -+ENDIF(ENABLE_SELINUX) -+ - IF (WITH_ZCHUNK) - TARGET_LINK_LIBRARIES(librepo ${ZCHUNKLIB_LIBRARIES}) - ENDIF (WITH_ZCHUNK) -diff --git a/librepo/gpg.c b/librepo/gpg.c -index a134d44..e4b6589 100644 ---- a/librepo/gpg.c -+++ b/librepo/gpg.c -@@ -28,6 +28,11 @@ - #include - #include - -+#if ENABLE_SELINUX -+#include -+#include -+#endif -+ - #include "rcodes.h" - #include "util.h" - #include "gpg.h" -@@ -44,6 +49,14 @@ - * Previous solution was to send the agent a "KILLAGENT" message, but that - * would cause a race condition with calling gpgme_release(), see [2], [3]. - * -+ * Current solution with precreating /run/user/$UID showed problematic when -+ * this library was used out of an systemd-logind session. Then -+ * /run/user/$UID, normally maintained by systemd, was assigned a SELinux -+ * label unexpected by systemd causing errors on a user logout [4]. -+ * -+ * We remedy it by choosing the label according to a default file context -+ * policy (ENABLE_SELINUX macro). -+ * - * Since the agent doesn't clean up its sockets properly, by creating this - * directory we make sure they are in a place that is not causing trouble with - * container images. -@@ -51,14 +64,65 @@ - * [1] https://bugzilla.redhat.com/show_bug.cgi?id=1650266 - * [2] https://bugzilla.redhat.com/show_bug.cgi?id=1769831 - * [3] https://github.com/rpm-software-management/microdnf/issues/50 -+ * [4] https://issues.redhat.com/browse/RHEL-10720 - */ - void ensure_socket_dir_exists() { - char dirname[32]; -+#if ENABLE_SELINUX -+ char *old_default_context = NULL; -+ int old_default_context_was_retrieved = 0; -+ struct selabel_handle *labeling_handle = NULL; -+ -+ /* A purpose of this piece of code is to deal with applications whose -+ * security policy overrides a file context for temporary files but don't -+ * know that librepo executes GnuPG which expects a default file context. */ -+ if (0 == getfscreatecon(&old_default_context)) { -+ old_default_context_was_retrieved = 1; -+ } else { -+ g_debug("Failed to retrieve a default SELinux context"); -+ } -+ labeling_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0); -+ if (labeling_handle == NULL) { -+ g_debug("Failed to open a SELinux labeling handle: %s", strerror(errno)); -+ } -+#endif -+ - snprintf(dirname, sizeof(dirname), "/run/user/%u", getuid()); -+ -+#if ENABLE_SELINUX -+ if (labeling_handle != NULL) { -+ char *new_default_context = NULL; -+ if (selabel_lookup(labeling_handle, &new_default_context, dirname, 0700)) { -+ /* Here we could hard-code "system_u:object_r:user_tmp_t:s0", but -+ * that value should be really defined in default file context -+ * SELinux policy. Only log that the policy is incomplete. */ -+ g_debug("Failed to look up a default SELinux label for \"%s\"", dirname); -+ } else { -+ if (setfscreatecon(new_default_context)) { -+ g_debug("Failed to set default SELinux context to \"%s\"", -+ new_default_context); -+ } -+ freecon(new_default_context); -+ } -+ } -+#endif -+ - int res = mkdir(dirname, 0700); - if (res != 0 && errno != EEXIST) { - g_debug("Failed to create \"%s\": %d - %s\n", dirname, errno, strerror(errno)); - } -+ -+#if ENABLE_SELINUX -+ if (labeling_handle != NULL) { -+ selabel_close(labeling_handle); -+ } -+ if (old_default_context_was_retrieved) { -+ if (setfscreatecon(old_default_context)) { -+ g_debug("Failed to restore a default SELinux context"); -+ } -+ } -+ freecon(old_default_context); -+#endif - } - - gboolean --- -2.41.0 - diff --git a/SOURCES/0002-Propagate-return-value-from-prepare_repo_download_ta.patch b/SOURCES/0001-Propagate-return-value-from-prepare_repo_download_ta.patch similarity index 92% rename from SOURCES/0002-Propagate-return-value-from-prepare_repo_download_ta.patch rename to SOURCES/0001-Propagate-return-value-from-prepare_repo_download_ta.patch index fcdd178..974b000 100644 --- a/SOURCES/0002-Propagate-return-value-from-prepare_repo_download_ta.patch +++ b/SOURCES/0001-Propagate-return-value-from-prepare_repo_download_ta.patch @@ -1,4 +1,4 @@ -From 089eac540f395db8303e42bc9716a14851b1132c Mon Sep 17 00:00:00 2001 +From 27512a789981d73158202de6a390762b2e71e4aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= Date: Mon, 9 Jun 2025 09:25:39 +0200 Subject: [PATCH] Propagate return value from `prepare_repo_download_targets` @@ -27,5 +27,5 @@ index 56bca3e..482d4d9 100644 if (!targets) return TRUE; -- -2.49.0 +2.52.0 diff --git a/SOURCES/0002-Test-importing-keys-with-prefix-and-suffix.patch b/SOURCES/0002-Test-importing-keys-with-prefix-and-suffix.patch new file mode 100644 index 0000000..266314a --- /dev/null +++ b/SOURCES/0002-Test-importing-keys-with-prefix-and-suffix.patch @@ -0,0 +1,77 @@ +From 45693c2eeeb5ca863cf59b54f13bbeba35d7459a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= +Date: Mon, 30 Jun 2025 11:23:49 +0200 +Subject: [PATCH] Test importing keys with prefix and suffix + +Test the fix from: 1be89319d30d2ea2a027d6bd06bb1b76bd682f87 +--- + tests/test_gpg.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 46 insertions(+) + +diff --git a/tests/test_gpg.c b/tests/test_gpg.c +index 6642cc7..b865991 100644 +--- a/tests/test_gpg.c ++++ b/tests/test_gpg.c +@@ -246,6 +246,51 @@ START_TEST(test_gpg_check_binary_key_import_test_export) + END_TEST + + ++START_TEST(test_gpg_check_import_padded) ++{ ++ // Verify that lr_gpg_import_key_from_memory properly respects the key_len ++ // argument and does not read any garbage beyond the key in memory. ++ ++ gboolean ret; ++ char *key_path; ++ char *tmp_home_path; ++ GError *tmp_err = NULL; ++ ++ tmp_home_path = lr_gettmpdir(); ++ key_path = lr_pathconcat(test_globals.testdata_dir, ++ "repo_yum_01/repodata/repomd.xml_bad.key.asc", NULL); ++ char *random_prefix_text = "The file with the key can have any text\n"; ++ int prefix_len = strlen(random_prefix_text); ++ // The suffix represents arbitrary memory that is located after the key ++ char suffix_with_garbage_and_null_byte[] = {'\xf4', '\xc2', '\x7f', '\0',}; ++ int suffix_len = sizeof(suffix_with_garbage_and_null_byte); ++ ++ // Load the key into memory ++ gchar *contents; ++ gsize length; ++ ret = g_file_get_contents(key_path, &contents, &length, &tmp_err); ++ ck_assert_ptr_null(tmp_err); ++ ck_assert(ret); ++ ++ // Wrap the loaded key with random text prefix and garbage suffix ++ gchar *padded_contents = g_malloc0(prefix_len + length + suffix_len); ++ memcpy(padded_contents, random_prefix_text, prefix_len); ++ memcpy(padded_contents + prefix_len, contents, length); ++ memcpy(padded_contents + prefix_len + length, suffix_with_garbage_and_null_byte, suffix_len); ++ ++ ret = lr_gpg_import_key_from_memory(padded_contents, prefix_len + length, tmp_home_path, &tmp_err); ++ ck_assert(ret); ++ ck_assert_ptr_null(tmp_err); ++ g_free(contents); ++ g_free(padded_contents); ++ ++ lr_remove_dir(tmp_home_path); ++ lr_free(key_path); ++ g_free(tmp_home_path); ++} ++END_TEST ++ ++ + Suite * + gpg_suite(void) + { +@@ -254,6 +299,7 @@ gpg_suite(void) + tcase_add_test(tc, test_gpg_check_signature); + tcase_add_test(tc, test_gpg_check_armored_key_import_test_export); + tcase_add_test(tc, test_gpg_check_binary_key_import_test_export); ++ tcase_add_test(tc, test_gpg_check_import_padded); + suite_add_tcase(s, tc); + return s; + } +-- +2.52.0 + diff --git a/SPECS/librepo.spec b/SPECS/librepo.spec index 444195c..4470ac5 100644 --- a/SPECS/librepo.spec +++ b/SPECS/librepo.spec @@ -8,33 +8,54 @@ %bcond_without zchunk %endif -%bcond_without selinux +%if 0%{?fedora} >= 39 || 0%{?rhel} >= 10 +%bcond_with use_gpgme +%bcond_with use_selinux +%else +%bcond_without use_gpgme +%bcond_without use_selinux +%endif + +# Needs to match how gnupg2 is compiled +%bcond_with run_gnupg_user_socket + +%bcond_with sanitizers + +%if %{with use_gpgme} && %{with use_selinux} +%global need_selinux 1 +%else +%global need_selinux 0 +%endif %global dnf_conflict 2.8.8 Name: librepo -Version: 1.14.5 -Release: 3%{?dist} +Version: 1.19.0 +Release: 1%{?dist} Summary: Repodata downloading library -License: LGPLv2+ +License: LGPL-2.1-or-later URL: https://github.com/rpm-software-management/librepo Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz -Patch0001: 0001-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch -Patch0002: 0002-Propagate-return-value-from-prepare_repo_download_ta.patch +Patch0001: 0001-Propagate-return-value-from-prepare_repo_download_ta.patch +Patch0002: 0002-Test-importing-keys-with-prefix-and-suffix.patch BuildRequires: cmake BuildRequires: gcc BuildRequires: check-devel BuildRequires: doxygen -BuildRequires: pkgconfig(glib-2.0) >= 2.28 +BuildRequires: pkgconfig(glib-2.0) >= 2.66 +%if %{with use_gpgme} BuildRequires: gpgme-devel +%else +BuildRequires: pkgconfig(rpm) >= 4.18.0 +%endif BuildRequires: libattr-devel BuildRequires: libcurl-devel >= %{libcurl_version} BuildRequires: pkgconfig(libxml-2.0) BuildRequires: pkgconfig(libcrypto) -%if %{with selinux} +%if %{need_selinux} BuildRequires: pkgconfig(libselinux) %endif BuildRequires: pkgconfig(openssl) @@ -43,6 +64,12 @@ BuildRequires: pkgconfig(zck) >= 0.9.11 %endif Requires: libcurl%{?_isa} >= %{libcurl_version} +%if %{with sanitizers} +BuildRequires: libasan +BuildRequires: liblsan +BuildRequires: libubsan +%endif + %description A library providing C and Python (libcURL like) API to downloading repository metadata. @@ -50,6 +77,9 @@ metadata. %package devel Summary: Repodata downloading library Requires: %{name}%{?_isa} = %{version}-%{release} +%if %{with zchunk} +Requires: zchunk-devel%{?_isa} +%endif %description devel Development files for librepo. @@ -75,8 +105,15 @@ Python 3 bindings for the librepo library. %build %cmake \ - %{!?with_zchunk:-DWITH_ZCHUNK=OFF} \ - -DENABLE_SELINUX=%{?with_selinux:ON}%{!?with_selinux:OFF} + -DWITH_ZCHUNK=%{?with_zchunk:ON}%{!?with_zchunk:OFF} \ + -DUSE_GPGME=%{?with_use_gpgme:ON}%{!?with_use_gpgme:OFF} \ + -DUSE_RUN_GNUPG_USER_SOCKET=%{?with_run_gnupg_user_socket:ON}%{!?with_run_gnupg_user_socket:OFF} \ + -DWITH_SANITIZERS=%{?with_sanitizers:ON}%{!?with_sanitizers:OFF} \ +%if %{need_selinux} + -DENABLE_SELINUX=ON +%else + -DENABLE_SELINUX=OFF +%endif %cmake_build %check @@ -106,6 +143,9 @@ Python 3 bindings for the librepo library. %{python3_sitearch}/%{name}/ %changelog +* Thu Nov 27 2025 Petr Pisar - 1.19.0-1 +- Rebase to 1.19.0 (RHEL-62033) + * Tue Jun 24 2025 Ales Matej - 1.14.5-3 - Propagate return value from prepare_repo_download_targets (RHEL-85607)