diff --git a/.gitignore b/.gitignore index bae7e06..01199f3 100644 --- a/.gitignore +++ b/.gitignore @@ -133,3 +133,4 @@ /osbuild-183.tar.gz /osbuild-187.tar.gz /osbuild-189.tar.gz +/osbuild-190.tar.gz diff --git a/2521.patch b/2521.patch deleted file mode 100644 index 3e9eb41..0000000 --- a/2521.patch +++ /dev/null @@ -1,38 +0,0 @@ -From ff25071323d621ed8599eee28239fbb6ea405815 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Anna=20V=C3=ADtov=C3=A1?= -Date: Mon, 10 Aug 2026 15:52:05 +0200 -Subject: [PATCH 2/2] test: ignore gpg-pubkey header digests in metadata - -The test in test_rpm compare org.osbuild.rpm metadata against a -fixture. This includes metadata of gpg-pubkey that are created when the -stage runs rpmkeys --import. - -Headers of "normal" RPMs remain independent of the CI environment, and -they are saved in already pre-built .rpm. On the other hand, gpg-pubkey -is a pseudo-package, and its sha1/sha256/sha3_256 header values seem to -be dependent on the host rpm version even though the key remains -the same. - -This commit removes sha checksum comparisons for gpg-pubkey rpm -package in ./test/run/test_stages.py ---- - test/run/test_stages.py | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/test/run/test_stages.py b/test/run/test_stages.py -index a1dad5cb6..51cc8b9b4 100644 ---- a/test/run/test_stages.py -+++ b/test/run/test_stages.py -@@ -261,6 +261,12 @@ def run_stage_diff_test(self, test_dir: str): - self.assertEqual(test_pkg["name"], got_pkg["name"]) - if test_pkg["name"] != "gpg-pubkey": - continue -+ -+ # header checksums of gpg-pubkey might depend on the host rpm version, let's remove them too -+ for key in ("sha1header", "sha256header", "sha3_256header"): -+ test_pkg.pop(key, None) -+ got_pkg.pop(key, None) -+ - if len(test_pkg["version"]) == len(got_pkg["version"]): - continue - diff --git a/2526.patch b/2526.patch deleted file mode 100644 index 6ba7af9..0000000 --- a/2526.patch +++ /dev/null @@ -1,139 +0,0 @@ -From c952b4ba1395f4102eb42bd1f341678d6d4c9428 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Anna=20V=C3=ADtov=C3=A1?= -Date: Fri, 7 Aug 2026 17:21:54 +0200 -Subject: [PATCH] stage/rpm: query only supported metadata tags - -Create an intersection of optional package metadata tags with `rpm ---querytags` which shows available querytags for a buildroot. Using -unsupported querytags does not trigger `exit 1`, and only makes the -stdout of the command empty. This commit introduces checking for -available querytags first. - -Relevant: HMS-11174 ---- - stages/org.osbuild.rpm | 59 ++++++++++++++++++++++++++++++----------- - stages/test/test_rpm.py | 30 +++++++++++++++++++-- - 2 files changed, 72 insertions(+), 17 deletions(-) - -diff --git a/stages/org.osbuild.rpm b/stages/org.osbuild.rpm -index 46b9eefca..51b33df12 100755 ---- a/stages/org.osbuild.rpm -+++ b/stages/org.osbuild.rpm -@@ -50,22 +50,51 @@ from osbuild.util.runners import create_machine_id_if_needed - OSTREE_BOOTED_MARKER = "run/ostree-booted" - - --def generate_package_metadata(tree, rpm_args): -- query = r"""\{ -- "name": "%{NAME}", -- "version": "%{VERSION}", -- "release": "%{RELEASE}", -- "epoch": %|EPOCH?{"%{EPOCH}"}:{null}|, -- "arch": %|ARCH?{"%{ARCH}"}:{null}|, -- "sigmd5": %|SIGMD5?{"%{SIGMD5}"}:{null}|, -- "sha1header": %|SHA1HEADER?{"%{SHA1HEADER}"}:{null}|, -- "sha256header": %|SHA256HEADER?{"%{SHA256HEADER}"}:{null}|, -- "sha3_256header": %|SHA3_256HEADER?{"%{SHA3_256HEADER}"}:{null}|, -- "sigpgp": %|SIGPGP?{"%{SIGPGP}"}:{null}|, -- "siggpg": %|SIGGPG?{"%{SIGGPG}"}:{null}| -- \}, -- """ -+PACKAGE_METADATA_REQUIRED = ( -+ ("name", "NAME"), -+ ("version", "VERSION"), -+ ("release", "RELEASE"), -+) -+ -+PACKAGE_METADATA_OPTIONAL = ( -+ ("epoch", "EPOCH"), -+ ("arch", "ARCH"), -+ ("sigmd5", "SIGMD5"), -+ ("sha1header", "SHA1HEADER"), -+ ("sha256header", "SHA256HEADER"), -+ ("sha3_256header", "SHA3_256HEADER"), -+ ("sigpgp", "SIGPGP"), -+ ("siggpg", "SIGGPG"), -+) -+ -+ -+def rpm_querytags(): -+ """Returns tags supported by rpm on the buildroot.""" -+ res = subprocess.run(["rpm", "--querytags"], -+ stdout=subprocess.PIPE, -+ check=True, encoding="utf8") -+ return set(res.stdout.split()) -+ -+ -+def package_metadata_query_format(available): -+ """Build an rpm --qf string for package metadata.""" -+ fields = [] - -+ for key, tag in PACKAGE_METADATA_REQUIRED: -+ fields.append(f' "{key}": "%{{{tag}}}"') -+ -+ for key, tag in PACKAGE_METADATA_OPTIONAL: -+ if tag in available: -+ fields.append(f' "{key}": %|{tag}?{{"%{{{tag}}}"}}:{{null}}|') -+ else: -+ fields.append(f' "{key}": null') -+ -+ return "\\{\n" + ",\n".join(fields) + "\n \\},\n " -+ -+ -+def generate_package_metadata(tree, rpm_args): -+ """Collect installed package metadata via rpm -qa.""" -+ query = package_metadata_query_format(rpm_querytags()) - cmd = [ - "rpm", - *rpm_args, -diff --git a/stages/test/test_rpm.py b/stages/test/test_rpm.py -index aceb6e324..ee19cbcc8 100644 ---- a/stages/test/test_rpm.py -+++ b/stages/test/test_rpm.py -@@ -47,6 +47,29 @@ def test_import_gpg_keys(mock_run, tmp_path, stage_module, ignore_failures): - assert mock_run.call_args[1] == {"check": not ignore_failures} - - -+ALL_RPM_TAGS = { -+ "NAME", "VERSION", "RELEASE", "EPOCH", "ARCH", "SIGMD5", -+ "SHA1HEADER", "SHA256HEADER", "SHA3_256HEADER", "SIGPGP", "SIGGPG", -+} -+ -+ -+def test_package_metadata_query_format_all_tags(stage_module): -+ qf = stage_module.package_metadata_query_format(ALL_RPM_TAGS) -+ assert qf.startswith("\\{\n") -+ assert qf.endswith("\\},\n ") -+ assert '"name": "%{NAME}"' in qf -+ assert '%|SHA3_256HEADER?{"%{SHA3_256HEADER}"}:{null}|' in qf -+ assert '"sha3_256header": null' not in qf -+ -+ -+def test_package_metadata_query_format_unsupported_tags(stage_module): -+ available = ALL_RPM_TAGS - {"SHA3_256HEADER"} -+ qf = stage_module.package_metadata_query_format(available) -+ assert '"sha3_256header": null' in qf -+ assert "SHA3_256HEADER" not in qf -+ assert '%|SHA256HEADER?{"%{SHA256HEADER}"}:{null}|' in qf -+ -+ - @pytest.mark.parametrize("rpm_output,expected_packages", [ - # all optional fields present - ( -@@ -166,11 +189,14 @@ def test_import_gpg_keys(mock_run, tmp_path, stage_module, ignore_failures): - ]) - @mock.patch("subprocess.run") - def test_generate_package_metadata(mock_run, tmp_path, stage_module, rpm_output, expected_packages): -- mock_run.return_value = mock.Mock(stdout=rpm_output) -+ mock_run.side_effect = [ -+ mock.Mock(stdout="\n".join(sorted(ALL_RPM_TAGS))), -+ mock.Mock(stdout=rpm_output), -+ ] - tree = str(tmp_path / "tree") - result = stage_module.generate_package_metadata(tree, []) - assert result["packages"] == expected_packages -- cmd = mock_run.call_args[0][0] -+ cmd = mock_run.call_args_list[1][0][0] - assert cmd[0] == "rpm" - assert "--root" in cmd - assert "-qa" in cmd diff --git a/osbuild.spec b/osbuild.spec index b8111a7..b3a239c 100644 --- a/osbuild.spec +++ b/osbuild.spec @@ -1,7 +1,7 @@ %global forgeurl https://github.com/osbuild/osbuild %global selinuxtype targeted -Version: 189 +Version: 190 %global osbuild_initrd_version 0.1 %forgemeta @@ -20,14 +20,6 @@ Source0: %{forgesource} Source1: https://github.com/osbuild/initrd/releases/download/%{osbuild_initrd_version}/osbuild-initrd-%{osbuild_initrd_version}.tar.gz Summary: A build system for OS images -# Fix rpm headers on older RPM versions -# https://github.com/osbuild/osbuild/pull/2526 -Patch: 2526.patch - -# Header checksums of gpg-pubkey might depend on the host RPM version -# https://patch-diff.githubusercontent.com/raw/osbuild/osbuild/pull/2521 -Patch: 2521.patch - # There is no golang support for i686 on centos and RHEL %if 0%{?rhel} || 0%{?centos} ExcludeArch: i686 @@ -496,6 +488,9 @@ fi %endif %changelog +* Wed Aug 12 2026 imagebuilder-bot - 190-1 +- New upstream release + * Thu Jul 30 2026 imagebuilder-bot - 189-1 - New upstream release diff --git a/sources b/sources index f14cd4c..f07be7d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (osbuild-189.tar.gz) = 95d102aa0e7e8fb5f191617067e2f1864dba6a236c3cd5cc29960c632c9a15dab4517de5d4a6d518d11794dd753a086de87a3480774aa9f29a5d4e61dc4c96d8 +SHA512 (osbuild-190.tar.gz) = 7f680c597520bef1df3287407670da8b48339d0076dc6e8717a93be501f33d770a06c1baf3c35c559f146f4a548cdafc973eed71769ca0b2a33d3d77e0a3ae00 SHA512 (osbuild-initrd-0.1.tar.gz) = af8fd6b3b84f4f0ffca9847d8cef49322d75a03fc60743c8bf697a21df019666778e826bc0a8e9f5faca59151bf91f12d65d2a5e820ca9d0bd840ff92d33054a