rpms/librepo
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS librepo-1.19.0-1.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-03-30 10:40:44 -04:00
parent a8219e7891
commit a11df7b68f
6 changed files with 131 additions and 240 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/librepo-1.14.5.tar.gz
SOURCES/librepo-1.19.0.tar.gz

2
.librepo.metadata
View File

@ -1 +1 @@
fa072a20718ae6af54a65d53b1c9686a730400bf SOURCES/librepo-1.14.5.tar.gz
28b74613ad1b84941bd3b0c6d3d8e7c7b1e3741f SOURCES/librepo-1.19.0.tar.gz

226
SOURCES/0001-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch
View File

@ -1,226 +0,0 @@
From 69e3a61e62d7b0c214e49c88a20422da4dfca238 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 12 Oct 2023 15:55:43 +0200
Subject: [PATCH] PGP: Set a default creation SELinux labels on GnuPG
directories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This is another way how to fix mismatching SELinux context on
/run/user directories without moving the directories to
/run/gnupg/user.
librepo used to precreate the directory in /run/user to make sure
a GnuPG agent executed by GPGME library places its socket there.
The directories there are normally created and removed by systemd
(logind PAM session). librepo created them for a case when a package
manager is invoked out of systemd session, before the super user logs
in. E.g. by a timer job to cache repository metadata.
A problem was when this out-of-session process was a SELinux-confined
process creating files with its own SELinux label different from a DNF
program. Then the directory was created with a SELinux label different
from the one expected by systemd and when logging out a corresponding
user, the mismatching label clashed with systemd.
This patch fixes the issue by choosing a SELinux label of those
directories to the label defined in a default SELinux file context
database.
This patch adds a new -DENABLE_SELINUX=OFF CMake option to disable the
new dependency on libselinux. A default behavior is to support SELinux
only if GPGME backend is selected with -DUSE_GPGME=ON.
https://issues.redhat.com/browse/RHEL-10720
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
CMakeLists.txt | 8 ++++++
librepo.spec | 9 +++++-
librepo/CMakeLists.txt | 4 +++
librepo/gpg.c | 64 ++++++++++++++++++++++++++++++++++++++++++
4 files changed, 84 insertions(+), 1 deletion(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index b4007e3..1a107bc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -5,6 +5,7 @@ OPTION (ENABLE_TESTS "Build test?" ON)
OPTION (ENABLE_DOCS "Build docs?" ON)
OPTION (WITH_ZCHUNK "Build with zchunk support" ON)
OPTION (ENABLE_PYTHON "Build Python bindings" ON)
+OPTION (ENABLE_SELINUX "Restore SELinux labels on GnuPG directories" ON)
INCLUDE (${CMAKE_SOURCE_DIR}/VERSION.cmake)
SET (VERSION "${LIBREPO_MAJOR}.${LIBREPO_MINOR}.${LIBREPO_PATCH}")
@@ -33,6 +34,9 @@ PKG_SEARCH_MODULE(LIBCRYPTO REQUIRED libcrypto openssl)
PKG_CHECK_MODULES(LIBXML2 libxml-2.0 REQUIRED)
FIND_PACKAGE(CURL 7.52.0 REQUIRED)
FIND_PACKAGE(Gpgme REQUIRED)
+IF (ENABLE_SELINUX)
+ PKG_CHECK_MODULES(SELINUX REQUIRED libselinux)
+ENDIF(ENABLE_SELINUX)
IF (WITH_ZCHUNK)
@@ -63,6 +67,10 @@ ENDIF (NOT CURL_FOUND)
INCLUDE_DIRECTORIES(${LIBXML2_INCLUDE_DIRS})
INCLUDE_DIRECTORIES(${CURL_INCLUDE_DIR})
#INCLUDE_DIRECTORIES(${CHECK_INCLUDE_DIR})
+IF (ENABLE_SELINUX)
+ INCLUDE_DIRECTORIES(${SELINUX_INCLUDE_DIRS})
+ ADD_DEFINITIONS(-DENABLE_SELINUX=1)
+ENDIF (ENABLE_SELINUX)
include (GNUInstallDirs)
# Python stuff
diff --git a/librepo.spec b/librepo.spec
index e8c88d8..0a5c867 100644
--- a/librepo.spec
+++ b/librepo.spec
@@ -8,6 +8,8 @@
%bcond_without zchunk
%endif
+%bcond_without selinux
+
%global dnf_conflict 2.8.8
Name: librepo
@@ -29,6 +31,9 @@ BuildRequires: libattr-devel
BuildRequires: libcurl-devel >= %{libcurl_version}
BuildRequires: pkgconfig(libxml-2.0)
BuildRequires: pkgconfig(libcrypto)
+%if %{with selinux}
+BuildRequires: pkgconfig(libselinux)
+%endif
BuildRequires: pkgconfig(openssl)
%if %{with zchunk}
BuildRequires: pkgconfig(zck) >= 0.9.11
@@ -66,7 +71,9 @@ Python 3 bindings for the librepo library.
%autosetup -p1
%build
-%cmake %{!?with_zchunk:-DWITH_ZCHUNK=OFF}
+%cmake \
+ %{!?with_zchunk:-DWITH_ZCHUNK=OFF} \
+ -DENABLE_SELINUX=%{?with_selinux:ON}%{!?with_selinux:OFF}
%cmake_build
%check
diff --git a/librepo/CMakeLists.txt b/librepo/CMakeLists.txt
index 4f00a5e..e759692 100644
--- a/librepo/CMakeLists.txt
+++ b/librepo/CMakeLists.txt
@@ -53,6 +53,10 @@ TARGET_LINK_LIBRARIES(librepo
${GPGME_VANILLA_LIBRARIES}
${GLIB2_LIBRARIES}
)
+IF (ENABLE_SELINUX)
+ TARGET_LINK_LIBRARIES(librepo ${SELINUX_LIBRARIES})
+ENDIF(ENABLE_SELINUX)
+
IF (WITH_ZCHUNK)
TARGET_LINK_LIBRARIES(librepo ${ZCHUNKLIB_LIBRARIES})
ENDIF (WITH_ZCHUNK)
diff --git a/librepo/gpg.c b/librepo/gpg.c
index a134d44..e4b6589 100644
--- a/librepo/gpg.c
+++ b/librepo/gpg.c
@@ -28,6 +28,11 @@
#include <gpgme.h>
#include <unistd.h>
+#if ENABLE_SELINUX
+#include <selinux/selinux.h>
+#include <selinux/label.h>
+#endif
+
#include "rcodes.h"
#include "util.h"
#include "gpg.h"
@@ -44,6 +49,14 @@
* Previous solution was to send the agent a "KILLAGENT" message, but that
* would cause a race condition with calling gpgme_release(), see [2], [3].
*
+ * Current solution with precreating /run/user/$UID showed problematic when
+ * this library was used out of an systemd-logind session. Then
+ * /run/user/$UID, normally maintained by systemd, was assigned a SELinux
+ * label unexpected by systemd causing errors on a user logout [4].
+ *
+ * We remedy it by choosing the label according to a default file context
+ * policy (ENABLE_SELINUX macro).
+ *
* Since the agent doesn't clean up its sockets properly, by creating this
* directory we make sure they are in a place that is not causing trouble with
* container images.
@@ -51,14 +64,65 @@
* [1] https://bugzilla.redhat.com/show_bug.cgi?id=1650266
* [2] https://bugzilla.redhat.com/show_bug.cgi?id=1769831
* [3] https://github.com/rpm-software-management/microdnf/issues/50
+ * [4] https://issues.redhat.com/browse/RHEL-10720
*/
void ensure_socket_dir_exists() {
char dirname[32];
+#if ENABLE_SELINUX
+ char *old_default_context = NULL;
+ int old_default_context_was_retrieved = 0;
+ struct selabel_handle *labeling_handle = NULL;
+
+ /* A purpose of this piece of code is to deal with applications whose
+ * security policy overrides a file context for temporary files but don't
+ * know that librepo executes GnuPG which expects a default file context. */
+ if (0 == getfscreatecon(&old_default_context)) {
+ old_default_context_was_retrieved = 1;
+ } else {
+ g_debug("Failed to retrieve a default SELinux context");
+ }
+ labeling_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0);
+ if (labeling_handle == NULL) {
+ g_debug("Failed to open a SELinux labeling handle: %s", strerror(errno));
+ }
+#endif
+
snprintf(dirname, sizeof(dirname), "/run/user/%u", getuid());
+
+#if ENABLE_SELINUX
+ if (labeling_handle != NULL) {
+ char *new_default_context = NULL;
+ if (selabel_lookup(labeling_handle, &new_default_context, dirname, 0700)) {
+ /* Here we could hard-code "system_u:object_r:user_tmp_t:s0", but
+ * that value should be really defined in default file context
+ * SELinux policy. Only log that the policy is incomplete. */
+ g_debug("Failed to look up a default SELinux label for \"%s\"", dirname);
+ } else {
+ if (setfscreatecon(new_default_context)) {
+ g_debug("Failed to set default SELinux context to \"%s\"",
+ new_default_context);
+ }
+ freecon(new_default_context);
+ }
+ }
+#endif
+
int res = mkdir(dirname, 0700);
if (res != 0 && errno != EEXIST) {
g_debug("Failed to create \"%s\": %d - %s\n", dirname, errno, strerror(errno));
}
+
+#if ENABLE_SELINUX
+ if (labeling_handle != NULL) {
+ selabel_close(labeling_handle);
+ }
+ if (old_default_context_was_retrieved) {
+ if (setfscreatecon(old_default_context)) {
+ g_debug("Failed to restore a default SELinux context");
+ }
+ }
+ freecon(old_default_context);
+#endif
}
gboolean
--
2.41.0

4
SOURCES/0002-Propagate-return-value-from-prepare_repo_download_ta.patch → SOURCES/0001-Propagate-return-value-from-prepare_repo_download_ta.patch
View File

@ -1,4 +1,4 @@
From 089eac540f395db8303e42bc9716a14851b1132c Mon Sep 17 00:00:00 2001
From 27512a789981d73158202de6a390762b2e71e4aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= <amatej@redhat.com>
Date: Mon, 9 Jun 2025 09:25:39 +0200
Subject: [PATCH] Propagate return value from `prepare_repo_download_targets`
@ -27,5 +27,5 @@ index 56bca3e..482d4d9 100644
if (!targets)
return TRUE;
--
2.49.0
2.52.0

77
SOURCES/0002-Test-importing-keys-with-prefix-and-suffix.patch Normal file
View File

@ -0,0 +1,77 @@
From 45693c2eeeb5ca863cf59b54f13bbeba35d7459a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= <amatej@redhat.com>
Date: Mon, 30 Jun 2025 11:23:49 +0200
Subject: [PATCH] Test importing keys with prefix and suffix
Test the fix from: 1be89319d30d2ea2a027d6bd06bb1b76bd682f87
---
tests/test_gpg.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)
diff --git a/tests/test_gpg.c b/tests/test_gpg.c
index 6642cc7..b865991 100644
--- a/tests/test_gpg.c
+++ b/tests/test_gpg.c
@@ -246,6 +246,51 @@ START_TEST(test_gpg_check_binary_key_import_test_export)
END_TEST
+START_TEST(test_gpg_check_import_padded)
+{
+ // Verify that lr_gpg_import_key_from_memory properly respects the key_len
+ // argument and does not read any garbage beyond the key in memory.
+
+ gboolean ret;
+ char *key_path;
+ char *tmp_home_path;
+ GError *tmp_err = NULL;
+
+ tmp_home_path = lr_gettmpdir();
+ key_path = lr_pathconcat(test_globals.testdata_dir,
+ "repo_yum_01/repodata/repomd.xml_bad.key.asc", NULL);
+ char *random_prefix_text = "The file with the key can have any text\n";
+ int prefix_len = strlen(random_prefix_text);
+ // The suffix represents arbitrary memory that is located after the key
+ char suffix_with_garbage_and_null_byte[] = {'\xf4', '\xc2', '\x7f', '\0',};
+ int suffix_len = sizeof(suffix_with_garbage_and_null_byte);
+
+ // Load the key into memory
+ gchar *contents;
+ gsize length;
+ ret = g_file_get_contents(key_path, &contents, &length, &tmp_err);
+ ck_assert_ptr_null(tmp_err);
+ ck_assert(ret);
+
+ // Wrap the loaded key with random text prefix and garbage suffix
+ gchar *padded_contents = g_malloc0(prefix_len + length + suffix_len);
+ memcpy(padded_contents, random_prefix_text, prefix_len);
+ memcpy(padded_contents + prefix_len, contents, length);
+ memcpy(padded_contents + prefix_len + length, suffix_with_garbage_and_null_byte, suffix_len);
+
+ ret = lr_gpg_import_key_from_memory(padded_contents, prefix_len + length, tmp_home_path, &tmp_err);
+ ck_assert(ret);
+ ck_assert_ptr_null(tmp_err);
+ g_free(contents);
+ g_free(padded_contents);
+
+ lr_remove_dir(tmp_home_path);
+ lr_free(key_path);
+ g_free(tmp_home_path);
+}
+END_TEST
+
+
Suite *
gpg_suite(void)
{
@@ -254,6 +299,7 @@ gpg_suite(void)
tcase_add_test(tc, test_gpg_check_signature);
tcase_add_test(tc, test_gpg_check_armored_key_import_test_export);
tcase_add_test(tc, test_gpg_check_binary_key_import_test_export);
+ tcase_add_test(tc, test_gpg_check_import_padded);
suite_add_tcase(s, tc);
return s;
}
--
2.52.0

60
SPECS/librepo.spec
View File

@ -8,33 +8,54 @@
%bcond_without zchunk
%endif
%bcond_without selinux
%if 0%{?fedora} >= 39 || 0%{?rhel} >= 10
%bcond_with use_gpgme
%bcond_with use_selinux
%else
%bcond_without use_gpgme
%bcond_without use_selinux
%endif
# Needs to match how gnupg2 is compiled
%bcond_with run_gnupg_user_socket
%bcond_with sanitizers
%if %{with use_gpgme} && %{with use_selinux}
%global need_selinux 1
%else
%global need_selinux 0
%endif
%global dnf_conflict 2.8.8
Name: librepo
Version: 1.14.5
Release: 3%{?dist}
Version: 1.19.0
Release: 1%{?dist}
Summary: Repodata downloading library
License: LGPLv2+
License: LGPL-2.1-or-later
URL: https://github.com/rpm-software-management/librepo
Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
Patch0001: 0001-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch
Patch0002: 0002-Propagate-return-value-from-prepare_repo_download_ta.patch
Patch0001: 0001-Propagate-return-value-from-prepare_repo_download_ta.patch
Patch0002: 0002-Test-importing-keys-with-prefix-and-suffix.patch
BuildRequires: cmake
BuildRequires: gcc
BuildRequires: check-devel
BuildRequires: doxygen
BuildRequires: pkgconfig(glib-2.0) >= 2.28
BuildRequires: pkgconfig(glib-2.0) >= 2.66
%if %{with use_gpgme}
BuildRequires: gpgme-devel
%else
BuildRequires: pkgconfig(rpm) >= 4.18.0
%endif
BuildRequires: libattr-devel
BuildRequires: libcurl-devel >= %{libcurl_version}
BuildRequires: pkgconfig(libxml-2.0)
BuildRequires: pkgconfig(libcrypto)
%if %{with selinux}
%if %{need_selinux}
BuildRequires: pkgconfig(libselinux)
%endif
BuildRequires: pkgconfig(openssl)
@ -43,6 +64,12 @@ BuildRequires: pkgconfig(zck) >= 0.9.11
%endif
Requires: libcurl%{?_isa} >= %{libcurl_version}
%if %{with sanitizers}
BuildRequires: libasan
BuildRequires: liblsan
BuildRequires: libubsan
%endif
%description
A library providing C and Python (libcURL like) API to downloading repository
metadata.
@ -50,6 +77,9 @@ metadata.
%package devel
Summary: Repodata downloading library
Requires: %{name}%{?_isa} = %{version}-%{release}
%if %{with zchunk}
Requires: zchunk-devel%{?_isa}
%endif
%description devel
Development files for librepo.
@ -75,8 +105,15 @@ Python 3 bindings for the librepo library.
%build
%cmake \
%{!?with_zchunk:-DWITH_ZCHUNK=OFF} \
-DENABLE_SELINUX=%{?with_selinux:ON}%{!?with_selinux:OFF}
-DWITH_ZCHUNK=%{?with_zchunk:ON}%{!?with_zchunk:OFF} \
-DUSE_GPGME=%{?with_use_gpgme:ON}%{!?with_use_gpgme:OFF} \
-DUSE_RUN_GNUPG_USER_SOCKET=%{?with_run_gnupg_user_socket:ON}%{!?with_run_gnupg_user_socket:OFF} \
-DWITH_SANITIZERS=%{?with_sanitizers:ON}%{!?with_sanitizers:OFF} \
%if %{need_selinux}
-DENABLE_SELINUX=ON
%else
-DENABLE_SELINUX=OFF
%endif
%cmake_build
%check
@ -106,6 +143,9 @@ Python 3 bindings for the librepo library.
%{python3_sitearch}/%{name}/
%changelog
* Thu Nov 27 2025 Petr Pisar <ppisar@redhat.com> - 1.19.0-1
- Rebase to 1.19.0 (RHEL-62033)
* Tue Jun 24 2025 Ales Matej <amatej@redhat.com> - 1.14.5-3
- Propagate return value from prepare_repo_download_targets (RHEL-85607)