.gitignore

@@ -1 +1,132 @@
-SOURCES/rpm-ostree-2022.10.117.g52714b51.tar.xz
+/rpm-ostree-2014.5.8.ge3264d9.tar.xz
+/rpm-ostree-2014.6.tar.xz
+/rpm-ostree-2014.6.3.g5707fa7.tar.xz
+/rpm-ostree-2014.7.tar.xz
+/rpm-ostree-2014.8.tar.xz
+/rpm-ostree-2014.100.tar.xz
+/rpm-ostree-2014.101.tar.xz
+/rpm-ostree-2014.101.5.g87a00be.tar.xz
+/rpm-ostree-2014.103.tar.xz
+/rpm-ostree-2014.104.tar.xz
+/rpm-ostree-2014.105.tar.xz
+/rpm-ostree-2014.106.tar.xz
+/rpm-ostree-2014.107.tar.xz
+/rpm-ostree-2014.109.tar.xz
+/rpm-ostree-2014.110.tar.xz
+/rpm-ostree-2014.111.tar.xz
+/rpm-ostree-2014.112.tar.xz
+/rpm-ostree-2014.113.tar.xz
+/rpm-ostree-2014.114.tar.xz
+/rpm-ostree-2015.2.tar.xz
+/rpm-ostree-2015.3.tar.xz
+/rpm-ostree-2015.4.tar.xz
+/rpm-ostree-2015.5.tar.xz
+/rpm-ostree-2015.6.tar.xz
+/rpm-ostree-2015.7.tar.xz
+/rpm-ostree-2015.8.tar.xz
+/rpm-ostree-2015.9.tar.xz
+/rpm-ostree-2015.10.tar.xz
+/rpm-ostree-2015.11.tar.xz
+/rpm-ostree-2015.11.43.ga2c052b.tar.xz
+/libhif.tar.gz
+/rpm-ostree-2016.1.tar.xz
+/rpm-ostree-2016.2.tar.xz
+/rpm-ostree-2016.3.tar.xz
+/rpm-ostree-2016.3.3.g17fb980.tar.xz
+/rpm-ostree-2016.4.tar.xz
+/rpm-ostree-2016.5.tar.xz
+/rpm-ostree-2016.6.tar.xz
+/rpm-ostree-2016.7.tar.xz
+/rpm-ostree-2016.8.tar.xz
+/rpm-ostree-2016.9.tar.xz
+/rpm-ostree-2016.10.tar.xz
+/rpm-ostree-2016.11.tar.xz
+/rpm-ostree-2016.12.tar.xz
+/rpm-ostree-2016.13.tar.xz
+/rpm-ostree-2017.1.tar.xz
+/rpm-ostree-2017.2.tar.xz
+/rpm-ostree-2017.3.tar.xz
+/rpm-ostree-2017.4.tar.xz
+/rpm-ostree-2017.5.tar.xz
+/rpm-ostree-2017.6.tar.xz
+/rpm-ostree-2017.6.67.g417a3d8.tar.xz
+/rpm-ostree-2017.7.tar.xz
+/rpm-ostree-2017.8.tar.xz
+/rpm-ostree-2017.9.tar.xz
+/rpm-ostree-2017.10.tar.xz
+/rpm-ostree-2017.11.tar.xz
+/rpm-ostree-2018.1.tar.xz
+/rpm-ostree-2018.2.tar.xz
+/rpm-ostree-2018.3.tar.xz
+/rpm-ostree-2018.4.tar.xz
+/rpm-ostree-2018.5.tar.xz
+/rpm-ostree-2018.6.tar.xz
+/rpm-ostree-2018.6.42.gda27b94b.tar.xz
+/rpm-ostree-2018.7.tar.xz
+/rpm-ostree-2018.8.tar.xz
+/rpm-ostree-2018.9.tar.xz
+/rpm-ostree-2018.10.tar.xz
+/rpm-ostree-2019.1.tar.xz
+/rpm-ostree-2019.2.tar.xz
+/rpm-ostree-2019.3.tar.xz
+/rpm-ostree-2019.3.5.g0da9f997.tar.xz
+/rpm-ostree-2019.4.tar.xz
+/rpm-ostree-2019.4.10.gc1cc0827.tar.xz
+/rpm-ostree-2019.4.15.gbbc9aa9f.tar.xz
+/rpm-ostree-2019.4.27.gb381e029.tar.xz
+/rpm-ostree-2019.4.28.g44395673.tar.xz
+/rpm-ostree-2019.4.39.g8d90d03d.tar.xz
+/rpm-ostree-2019.5.tar.xz
+/rpm-ostree-2019.5.7.gcac5aa41.tar.xz
+/rpm-ostree-2019.6.tar.xz
+/rpm-ostree-2019.6.24.gfec61ce5.tar.xz
+/rpm-ostree-2019.6.27.g3b8a1ec6.tar.xz
+/rpm-ostree-2019.7.tar.xz
+/rpm-ostree-2019.7.31.g70c38563.tar.xz
+/rpm-ostree-2020.1.tar.xz
+/rpm-ostree-2020.1.21.ge9011530.tar.xz
+/rpm-ostree-2020.1.80.g3ec5e287.tar.xz
+/rpm-ostree-2020.2.tar.xz
+/rpm-ostree-2020.3.tar.xz
+/rpm-ostree-2020.4.tar.xz
+/rpm-ostree-2020.4.15.g8b0bcd7b.tar.xz
+/rpm-ostree-2020.5.tar.xz
+/rpm-ostree-2020.6.tar.xz
+/rpm-ostree-2020.7.tar.xz
+/rpm-ostree-2020.8.tar.xz
+/rpm-ostree-2020.9.tar.xz
+/rpm-ostree-2020.10.tar.xz
+/rpm-ostree-2021.1.tar.xz
+/rpm-ostree-2021.2.tar.xz
+/rpm-ostree-2021.5.tar.xz
+/rust-openssl-770ba32702abd2b4cab80727958c27ac3043c3ec.tar.gz
+/rpm-ostree-2021.6.tar.xz
+/rpm-ostree-2021.14.tar.xz
+/rpm-ostree-2022.1.tar.xz
+/rpm-ostree-2022.2.tar.xz
+/rpm-ostree-2022.7.tar.xz
+/rpm-ostree-2022.8.tar.xz
+/rpm-ostree-2022.11.tar.xz
+/rpm-ostree-2022.12.tar.xz
+/rpm-ostree-2022.13.tar.xz
+/rpm-ostree-2022.14.tar.xz
+/rpm-ostree-2022.16.tar.xz
+/rpm-ostree-2022.18.tar.xz
+/rpm-ostree-2022.19.tar.xz
+/rpm-ostree-2023.2.tar.xz
+/rpm-ostree-2023.3.tar.xz
+/rpm-ostree-2023.4.tar.xz
+/rpm-ostree-2023.5.tar.xz
+/ostree-ext.vendor.tar.gz
+/rpm-ostree-2023.6.tar.xz
+/rpm-ostree-2023.7.tar.xz
+/rpm-ostree-2023.8.tar.xz
+/rpm-ostree-2023.11.tar.xz
+/rpm-ostree-2023.12.tar.xz
+/rpm-ostree-2024.1.tar.xz
+/rpm-ostree-2024.2.tar.xz
+/rpm-ostree-2024.3.tar.xz
+/rpm-ostree-2024.4.tar.xz
+/rpm-ostree-2024.5.tar.xz
+/rpm-ostree-2024.6.tar.xz
+/rpm-ostree-2024.7.tar.xz

.rpm-ostree.metadata

@@ -1 +0,0 @@
-43d5b34cf6b8c77fc2f17429dcc1d385c885b032 SOURCES/rpm-ostree-2022.10.117.g52714b51.tar.xz

0001-core-Fix-Coverity-WRAPPER_ESCAPE.patch

@@ -0,0 +1,33 @@
+From 96ddae1acba59cf5249dcfff1157e44b5ed69650 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Thu, 15 Aug 2024 11:41:43 -0400
+Subject: [PATCH 1/1] core: Fix Coverity WRAPPER_ESCAPE
+
+This should fix:
+
+```
+32. rpm-ostree-2024.7/src/libpriv/rpmostree-core.cxx:1786:15: use_after_free: Using internal representation of destroyed object temporary of type "std::string".
+```
+
+Signed-off-by: Colin Walters <walters@verbum.org>
+---
+ src/libpriv/rpmostree-core.cxx | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/libpriv/rpmostree-core.cxx b/src/libpriv/rpmostree-core.cxx
+index a2de7262..615e2636 100644
+--- a/src/libpriv/rpmostree-core.cxx
++++ b/src/libpriv/rpmostree-core.cxx
+@@ -1782,7 +1782,8 @@ rpmostree_context_prepare (RpmOstreeContext *self, gboolean enable_filelists,
+           auto pkg = "";
+           for (auto &pkg_str : packages)
+             {
+-              pkg = std::string (pkg_str).c_str ();
++              auto pkg_buf = std::string (pkg_str);
++              pkg = pkg_buf.c_str ();
+               char *query = strchr ((char *)pkg, '/');
+               if (query)
+                 {
+-- 
+2.46.0
+

0001-treefile-Add-ignore-devices.patch

@@ -0,0 +1,332 @@
+From aeb048ce390fcd82e568ba25c0047099b8892979 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Tue, 1 Oct 2024 17:56:38 -0400
+Subject: [PATCH 1/1] treefile: Add ignore-devices
+
+We hit another case where people are pulling a container image
+with devices in `/dev` in the tar stream; they're then trying
+to commit this to an ostree.
+
+There's much better ways to fix this:
+
+- Change the image to stop including devices as there's no reason
+  to do so
+- Switch to logically bound images instead of physically bound
+- Use the composefs backend for c/storage
+
+Eventually I may look at "quoting" generally in ostree, but
+it's fairly invasive: https://github.com/ostreedev/ostree/issues/2568
+
+In practice today, simply ignoring the files will happen to work
+for "podman run" of such images; podman will just use overlayfs
+to stitch together the `diff` directories, and doesn't try to do
+any validation of their contents today.
+(Queue the composefs integration, which *would* do that but would
+ also fix this anwyays)
+
+Signed-off-by: Colin Walters <walters@verbum.org>
+---
+ docs/treefile.md                      |  4 ++
+ rpmostree-cxxrs.cxx                   | 11 ++--
+ rpmostree-cxxrs.h                     |  5 +-
+ rust/src/composepost.rs               | 74 +++++++++++++++++++--------
+ rust/src/lib.rs                       |  2 +-
+ rust/src/treefile.rs                  |  7 +++
+ src/libpriv/rpmostree-postprocess.cxx |  2 +-
+ tests/compose/test-installroot.sh     |  8 +++
+ 8 files changed, 84 insertions(+), 29 deletions(-)
+
+diff --git a/docs/treefile.md b/docs/treefile.md
+index 9839589e..49e193d1 100644
+--- a/docs/treefile.md
++++ b/docs/treefile.md
+@@ -36,6 +36,10 @@ It supports the following parameters:
+  * `selinux`: boolean, optional: Defaults to `true`.  If `false`, then
+    no SELinux labeling will be performed on the server side.
+ 
++ * `ignore-devices`: boolean, optional: Defaults to `true`. If `true`, then
++   all character and block device files found in the target root (except overlayfs
++   whiteouts, which are automatically "quoted") will be ignored.
++
+  * `ima`: boolean, optional: Defaults to `false`.  Propagate any
+    IMA signatures in input RPMs into the final OSTree commit.
+ 
+diff --git a/rpmostree-cxxrs.cxx b/rpmostree-cxxrs.cxx
+index 649d1b7b..2a4cb12c 100644
+--- a/rpmostree-cxxrs.cxx
++++ b/rpmostree-cxxrs.cxx
+@@ -192,6 +192,8 @@ public:
+   Slice () noexcept;
+   Slice (T *, std::size_t count) noexcept;
+ 
++  template <typename C> explicit Slice (C &c) : Slice (c.data (), c.size ()) {}
++
+   Slice &operator= (const Slice<T> &) &noexcept = default;
+   Slice &operator= (Slice<T> &&) &noexcept = default;
+ 
+@@ -2206,8 +2208,8 @@ extern "C"
+       ::std::int32_t rootfs_dfd, ::rpmostreecxx::Treefile &treefile, ::rust::Str next_version,
+       bool unified_core) noexcept;
+ 
+-  ::rust::repr::PtrLen
+-  rpmostreecxx$cxxbridge1$compose_postprocess_final_pre (::std::int32_t rootfs_dfd) noexcept;
++  ::rust::repr::PtrLen rpmostreecxx$cxxbridge1$compose_postprocess_final_pre (
++      ::std::int32_t rootfs_dfd, ::rpmostreecxx::Treefile const &treefile) noexcept;
+ 
+   ::rust::repr::PtrLen rpmostreecxx$cxxbridge1$compose_postprocess_final (
+       ::std::int32_t rootfs_dfd, ::rpmostreecxx::Treefile const &treefile) noexcept;
+@@ -4011,9 +4013,10 @@ compose_postprocess (::std::int32_t rootfs_dfd, ::rpmostreecxx::Treefile &treefi
+ }
+ 
+ void
+-compose_postprocess_final_pre (::std::int32_t rootfs_dfd)
++compose_postprocess_final_pre (::std::int32_t rootfs_dfd, ::rpmostreecxx::Treefile const &treefile)
+ {
+-  ::rust::repr::PtrLen error$ = rpmostreecxx$cxxbridge1$compose_postprocess_final_pre (rootfs_dfd);
++  ::rust::repr::PtrLen error$
++      = rpmostreecxx$cxxbridge1$compose_postprocess_final_pre (rootfs_dfd, treefile);
+   if (error$.ptr)
+     {
+       throw ::rust::impl< ::rust::Error>::error (error$);
+diff --git a/rpmostree-cxxrs.h b/rpmostree-cxxrs.h
+index d38fd1db..9d62380e 100644
+--- a/rpmostree-cxxrs.h
++++ b/rpmostree-cxxrs.h
+@@ -191,6 +191,8 @@ public:
+   Slice () noexcept;
+   Slice (T *, std::size_t count) noexcept;
+ 
++  template <typename C> explicit Slice (C &c) : Slice (c.data (), c.size ()) {}
++
+   Slice &operator= (const Slice<T> &) &noexcept = default;
+   Slice &operator= (Slice<T> &&) &noexcept = default;
+ 
+@@ -1867,7 +1869,8 @@ void composepost_nsswitch_altfiles (::std::int32_t rootfs_dfd);
+ void compose_postprocess (::std::int32_t rootfs_dfd, ::rpmostreecxx::Treefile &treefile,
+                           ::rust::Str next_version, bool unified_core);
+ 
+-void compose_postprocess_final_pre (::std::int32_t rootfs_dfd);
++void compose_postprocess_final_pre (::std::int32_t rootfs_dfd,
++                                    ::rpmostreecxx::Treefile const &treefile);
+ 
+ void compose_postprocess_final (::std::int32_t rootfs_dfd,
+                                 ::rpmostreecxx::Treefile const &treefile);
+diff --git a/rust/src/composepost.rs b/rust/src/composepost.rs
+index 1a5ae869..8049d502 100644
+--- a/rust/src/composepost.rs
++++ b/rust/src/composepost.rs
+@@ -295,40 +295,69 @@ fn is_overlay_whiteout(meta: &cap_std::fs::Metadata) -> bool {
+     (meta.mode() & libc::S_IFMT) == libc::S_IFCHR && meta.rdev() == 0
+ }
+ 
+-/// Auto-synthesize embedded overlayfs whiteouts; for more information
+-/// see https://github.com/ostreedev/ostree/pull/2722/commits/0085494e350c72599fc5c0e00422885d80b3c660
+-#[context("Postprocessing embedded overlayfs")]
+-fn postprocess_embedded_ovl_whiteouts(root: &Dir) -> Result<()> {
++/// Automatically "quote" embeded overlayfs whiteouts as regular files, and
++/// if configured error out on devices or ignore them.
++/// For more on overlayfs, see https://github.com/ostreedev/ostree/pull/2722/commits/0085494e350c72599fc5c0e00422885d80b3c660
++#[context("Postprocessing devices")]
++fn postprocess_devices(root: &Dir, treefile: &Treefile) -> Result<()> {
+     const OSTREE_WHITEOUT_PREFIX: &str = ".ostree-wh.";
+-    fn recurse(root: &Dir, path: &Utf8Path) -> Result<u32> {
+-        let mut n = 0;
++    let mut n_overlay = 0u64;
++    let mut n_devices = 0u64;
++    fn recurse(
++        root: &Dir,
++        path: &Utf8Path,
++        ignore_devices: bool,
++        n_overlay: &mut u64,
++        n_devices: &mut u64,
++    ) -> Result<()> {
+         for entry in root.read_dir(path)? {
+             let entry = entry?;
+             let meta = entry.metadata()?;
+             let name = PathBuf::from(entry.file_name());
+             let name: Utf8PathBuf = name.try_into()?;
+             if meta.is_dir() {
+-                n += recurse(root, &path.join(name))?;
++                recurse(root, &path.join(name), ignore_devices, n_overlay, n_devices)?;
+                 continue;
+             }
+-            if !is_overlay_whiteout(&meta) {
++            let is_device = matches!(meta.mode() & libc::S_IFMT, libc::S_IFCHR | libc::S_IFBLK);
++            if !is_device {
+                 continue;
+-            };
++            }
+             let srcpath = path.join(&name);
+-            let targetname = format!("{OSTREE_WHITEOUT_PREFIX}{name}");
+-            let destpath = path.join(&targetname);
+-            root.remove_file(srcpath)?;
+-            root.atomic_write_with_perms(destpath, "", meta.permissions())?;
+-            n += 1;
++            if is_overlay_whiteout(&meta) {
++                let targetname = format!("{OSTREE_WHITEOUT_PREFIX}{name}");
++                let destpath = path.join(&targetname);
++                root.remove_file(srcpath)?;
++                root.atomic_write_with_perms(destpath, "", meta.permissions())?;
++                *n_overlay += 1;
++                continue;
++            }
++            if ignore_devices {
++                root.remove_file(srcpath)?;
++                *n_devices += 1;
++            } else {
++                anyhow::bail!("Unsupported device file: {srcpath}")
++            }
+         }
+-        Ok(n)
++        Ok(())
+     }
+-    let n = recurse(root, ".".into())?;
+-    if n > 0 {
+-        println!("Processed {n} embedded whiteouts");
++    recurse(
++        root,
++        ".".into(),
++        treefile.get_ignore_devices(),
++        &mut n_overlay,
++        &mut n_devices,
++    )?;
++    if n_overlay > 0 {
++        println!("Processed {n_overlay} embedded whiteouts");
+     } else {
+         println!("No embedded whiteouts found");
+     }
++    if n_devices > 0 {
++        println!("Ignored {n_devices} device files");
++    } else {
++        println!("No device files found");
++    }
+     Ok(())
+ }
+ 
+@@ -420,7 +449,7 @@ pub(crate) fn postprocess_cleanup_rpmdb(rootfs_dfd: i32) -> CxxResult<()> {
+ /// it as the bits of that function that we've chosen to implement in Rust.
+ /// It takes care of all things that are really required to use rpm-ostree
+ /// on the target host.
+-pub fn compose_postprocess_final_pre(rootfs_dfd: i32) -> CxxResult<()> {
++pub fn compose_postprocess_final_pre(rootfs_dfd: i32, treefile: &Treefile) -> CxxResult<()> {
+     let rootfs_dfd = unsafe { &crate::ffiutil::ffi_dirfd(rootfs_dfd)? };
+     // These tasks can safely run in parallel, so just for fun we do so via rayon.
+     let tasks = [
+@@ -430,7 +459,7 @@ pub fn compose_postprocess_final_pre(rootfs_dfd: i32) -> CxxResult<()> {
+     ];
+     tasks.par_iter().try_for_each(|f| f(rootfs_dfd))?;
+     // This task recursively traverses the filesystem and hence should be serial.
+-    postprocess_embedded_ovl_whiteouts(rootfs_dfd)?;
++    postprocess_devices(rootfs_dfd, treefile)?;
+     Ok(())
+ }
+ 
+@@ -1533,11 +1562,12 @@ OSTREE_VERSION='33.4'
+         // We don't actually test creating whiteout devices here as that
+         // may not work.
+         let td = cap_tempfile::tempdir(cap_std::ambient_authority())?;
++        let tf = crate::treefile::tests::new_test_tf_basic("")?;
+         // Verify no-op case
+-        postprocess_embedded_ovl_whiteouts(&td).unwrap();
++        postprocess_devices(&td, &tf).unwrap();
+         td.create("foo")?;
+         td.symlink("foo", "bar")?;
+-        postprocess_embedded_ovl_whiteouts(&td).unwrap();
++        postprocess_devices(&td, &tf).unwrap();
+         assert!(td.try_exists("foo")?);
+         assert!(td.try_exists("bar")?);
+ 
+diff --git a/rust/src/lib.rs b/rust/src/lib.rs
+index 56d8b57f..5356dc8c 100644
+--- a/rust/src/lib.rs
++++ b/rust/src/lib.rs
+@@ -299,7 +299,7 @@ pub mod ffi {
+             next_version: &str,
+             unified_core: bool,
+         ) -> Result<()>;
+-        fn compose_postprocess_final_pre(rootfs_dfd: i32) -> Result<()>;
++        fn compose_postprocess_final_pre(rootfs_dfd: i32, treefile: &Treefile) -> Result<()>;
+         fn compose_postprocess_final(rootfs_dfd: i32, treefile: &Treefile) -> Result<()>;
+         fn convert_var_to_tmpfiles_d(rootfs_dfd: i32, cancellable: &GCancellable) -> Result<()>;
+         fn rootfs_prepare_links(
+diff --git a/rust/src/treefile.rs b/rust/src/treefile.rs
+index da6c0ca7..51dfff6d 100644
+--- a/rust/src/treefile.rs
++++ b/rust/src/treefile.rs
+@@ -394,6 +394,7 @@ fn treefile_merge(dest: &mut TreeComposeConfig, src: &mut TreeComposeConfig) {
+         rojig,
+         selinux,
+         selinux_label_version,
++        ignore_devices,
+         ima,
+         gpg_key,
+         include,
+@@ -1245,6 +1246,10 @@ impl Treefile {
+         self.parsed.base.selinux.unwrap_or(true)
+     }
+ 
++    pub(crate) fn get_ignore_devices(&self) -> bool {
++        self.parsed.base.ignore_devices.unwrap_or(true)
++    }
++
+     pub(crate) fn get_selinux_label_version(&self) -> u32 {
+         self.parsed.base.selinux_label_version.unwrap_or_default()
+     }
+@@ -2414,6 +2419,8 @@ pub(crate) struct BaseComposeConfigFields {
+     #[serde(skip_serializing_if = "Option::is_none")]
+     pub(crate) selinux: Option<bool>,
+     #[serde(skip_serializing_if = "Option::is_none")]
++    pub(crate) ignore_devices: Option<bool>,
++    #[serde(skip_serializing_if = "Option::is_none")]
+     pub(crate) selinux_label_version: Option<u32>,
+     #[serde(skip_serializing_if = "Option::is_none")]
+     pub(crate) ima: Option<bool>,
+diff --git a/src/libpriv/rpmostree-postprocess.cxx b/src/libpriv/rpmostree-postprocess.cxx
+index 311de70f..c086bcdd 100644
+--- a/src/libpriv/rpmostree-postprocess.cxx
++++ b/src/libpriv/rpmostree-postprocess.cxx
+@@ -381,7 +381,7 @@ postprocess_final (int rootfs_dfd, rpmostreecxx::Treefile &treefile, gboolean un
+ 
+   auto selinux = treefile.get_selinux ();
+ 
+-  ROSCXX_TRY (compose_postprocess_final_pre (rootfs_dfd), error);
++  ROSCXX_TRY (compose_postprocess_final_pre (rootfs_dfd, treefile), error);
+ 
+   if (selinux)
+     {
+diff --git a/tests/compose/test-installroot.sh b/tests/compose/test-installroot.sh
+index 3e40f679..90a11ee3 100755
+--- a/tests/compose/test-installroot.sh
++++ b/tests/compose/test-installroot.sh
+@@ -7,6 +7,8 @@ dn=$(cd "$(dirname "$0")" && pwd)
+ 
+ # This is used to test postprocessing with treefile vs not
+ treefile_set "boot-location" '"new"'
++# On by default now:
++# treefile_set "ignore-devices" 'True'
+ 
+ # This test is a bit of a degenerative case of the supermin abstration. We need
+ # to be able to interact with the compose output directly, feed it back to
+@@ -56,6 +58,7 @@ testdate=$(date)
+ runasroot sh -xec "
+ # https://github.com/ostreedev/ostree/pull/2717/commits/e234b630f85b97e48ecf45d5aaba9b1aa64e6b54
+ mknod -m 000 ${instroot}-directcommit/usr/share/foowhiteout c 0 0
++mknod -m 000 ${instroot}-directcommit/usr/share/devzero c 1 5
+ echo \"${testdate}\" > ${instroot}-directcommit/usr/share/rpm-ostree-composetest-split.txt
+ ! test -f ${instroot}-directcommit/${integrationconf}
+ rpm-ostree compose commit --repo=${repo} ${treefile} ${instroot}-directcommit
+@@ -69,6 +72,11 @@ ostree --repo=${repo} ls ${treeref} /usr/share
+ ostree --repo=${repo} ls ${treeref} /usr/share/.ostree-wh.foowhiteout >out.txt
+ grep -Ee '^-00000' out.txt
+ 
++# And the devzero should have been ignored
++if ostree --repo=${repo} ls ${treeref} /usr/share/devzero; then
++  echo \"found devzero\" 1>&2; exit 1
++fi
++
+ ostree --repo=${repo} cat ${treeref} /usr/share/rpm-ostree-composetest-split.txt >out.txt
+ grep \"${testdate}\" out.txt
+ ostree --repo=${repo} cat ${treeref} /${integrationconf}
+-- 
+2.47.0
+

SOURCES/0001-override-Honor-install-in-container-case-too.patch

@@ -1,48 +0,0 @@
-From f340dbbfd6a3acc8b85d487a32a78c4517ace1c4 Mon Sep 17 00:00:00 2001
-From: Colin Walters <walters@verbum.org>
-Date: Wed, 7 Dec 2022 20:14:06 -0500
-Subject: [PATCH] override: Honor `--install` in container case too
-
-Closes: https://github.com/coreos/rpm-ostree/issues/4192
----
- ci/test-container.sh                    | 8 ++++++--
- src/app/rpmostree-override-builtins.cxx | 1 +
- 2 files changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/ci/test-container.sh b/ci/test-container.sh
-index be0f9549..342808e4 100755
---- a/ci/test-container.sh
-+++ b/ci/test-container.sh
-@@ -84,11 +84,15 @@ rpm-ostree override replace --experimental --from repo=fedora-coreos-pool \
- 
- rpm -q afterburn-5.2.0-4.fc36.x86_64 afterburn-dracut-5.2.0-4.fc36.x86_64
- 
--# test repo override by pkgname
--rpm-ostree override replace --experimental \
-+# test repo override by pkgname, and also test --install
-+if rpm -q strace; then
-+  echo "strace should not be installed"; exit 1
-+fi
-+rpm-ostree override replace --install strace --experimental \
-   --from repo=copr:copr.fedorainfracloud.org:group_CoreOS:continuous \
-   afterburn \
-   afterburn-dracut
-+rpm -q strace
- 
- # the continuous build's version has the git rev, prefixed with g
- rpm -q afterburn | grep g
-diff --git a/src/app/rpmostree-override-builtins.cxx b/src/app/rpmostree-override-builtins.cxx
-index 41ab56f4..0c07ff53 100644
---- a/src/app/rpmostree-override-builtins.cxx
-+++ b/src/app/rpmostree-override-builtins.cxx
-@@ -204,6 +204,7 @@ handle_override (RPMOSTreeSysroot *sysroot_proxy, RpmOstreeCommandInvocation *in
-           CXX_TRY_VAR (pkgs, rpmostreecxx::stage_container_rpm_raw_fds (fds), error);
-           treefile->add_packages_override_replace_local (pkgs);
-         }
-+      treefile->add_packages (util::rust_stringvec_from_strv (install_pkgs), true);
-       treefile->add_packages_override_remove (util::rust_stringvec_from_strv (override_remove));
-       return rpmostree_container_rebuild (*treefile, cancellable, error);
-     }
--- 
-2.41.0
-

SOURCES/0002-scripts-also-ignore-kernel-debug-modules.posttrans.patch

@@ -1,38 +0,0 @@
-From cb777d950511e29dcb822b4ccba23e43cd63e9cb Mon Sep 17 00:00:00 2001
-From: Joseph Marrero <jmarrero@redhat.com>
-Date: Fri, 4 Aug 2023 08:27:39 -0400
-Subject: [PATCH] scripts: also ignore kernel-debug-modules.posttrans
-
----
- rust/src/scripts.rs | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/rust/src/scripts.rs b/rust/src/scripts.rs
-index 1f59e390..b8ab6623 100644
---- a/rust/src/scripts.rs
-+++ b/rust/src/scripts.rs
-@@ -21,8 +21,21 @@ static IGNORED_PKG_SCRIPTS: phf::Set<&'static str> = phf_set! {
-     // XXX: we should probably change this to instead ignore based on the kernel virtual Provides
-     "kernel.posttrans",
-     "kernel-core.posttrans",
-+    "kernel-modules.posttrans",
-+    "kernel-redhat-core.posttrans",
-+    "kernel-redhat-modules.posttrans",
-     "kernel-debug-core.posttrans",
-+    "kernel-debug-modules.posttrans",
-+    "kernel-redhat-debug-core.posttrans",
-+    "kernel-redhat-debug-modules.posttrans",
-     "kernel-automotive-core.posttrans",
-+    "kernel-automotive-modules.posttrans",
-+    "kernel-automotive-debug-core.posttrans",
-+    "kernel-automotive-debug-modules.posttrans",
-+    "kernel-rt-core.posttrans",
-+    "kernel-rt-modules.posttrans",
-+    "kernel-rt-debug-core.posttrans",
-+    "kernel-rt-debug-modules.posttrans",
-     // Additionally ignore posttrans scripts for the Oracle Linux `kernel-uek` package
-     "kernel-uek.posttrans",
-     // Legacy workaround
--- 
-2.41.0
-

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}   # this is the testcase identifier, which OSCI pipeline uses

import-spec

@@ -0,0 +1,54 @@
+#!/bin/bash
+set -euo pipefail
+
+KEEP_V_R=
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -h | --help)
+            echo "Usage: $0 [--keep-v-r]" >&2
+            exit 0
+            ;;
+        --keep-v-r)
+            KEEP_V_R=1
+            ;;
+        *)
+            echo "$0: unrecognized option: $1" >&2
+            exit 1
+            ;;
+    esac
+    shift
+done
+
+main() {
+    local upstream
+    upstream=$(get_parsed_spec_field URL)
+    curl --fail-early -Lo rpm-ostree.spec.new "$upstream/raw/main/packaging/rpm-ostree.spec.in"
+    sed -ne '/%changelog/,$ p' rpm-ostree.spec >> rpm-ostree.spec.new
+
+    if [ -n "${KEEP_V_R}" ]; then
+        local version release
+        version=$(get_raw_spec_field Version)
+        release=$(get_raw_spec_field Release)
+
+        sed -ie "s/^Version:.*/Version: $version/" rpm-ostree.spec.new
+        sed -ie "s/^Release:.*/Release: $release/" rpm-ostree.spec.new
+    fi
+
+    if git diff --quiet --exit-code rpm-ostree.spec; then
+        mv rpm-ostree.spec.new rpm-ostree.spec
+        echo "Updated rpm-ostree.spec" >&2
+    else
+        echo "Refusing to overwrite dirty rpm-ostree.spec" >&2
+        echo "Updated rpm-ostree.spec.new" >&2
+    fi
+}
+
+get_parsed_spec_field() {
+    rpmspec -P rpm-ostree.spec | grep "^${1}: " | head -n1 | cut -d ' ' -f 2
+}
+
+get_raw_spec_field() {
+    grep "^${1}: " rpm-ostree.spec | head -n1 | cut -d ' ' -f 2
+}
+
+main "$@"

rpm-ostree.spec

@@ -3,27 +3,23 @@
 
 Summary: Hybrid image/package system
 Name: rpm-ostree
-Version: 2022.10.117.g52714b51
+Version: 2024.7
 Release: 3%{?dist}
 License: LGPLv2+
 URL: https://github.com/coreos/rpm-ostree
 # This tarball is generated via "cd packaging && make -f Makefile.dist-packaging dist-snapshot"
-# in the upstream git.  It also contains vendored Rust sources.  This is generated from the "rhel8" branch.
+# in the upstream git.  It also contains vendored Rust sources.
 Source0: https://github.com/coreos/rpm-ostree/releases/download/v%{version}/rpm-ostree-%{version}.tar.xz
 
-Patch0: 0001-override-Honor-install-in-container-case-too.patch
-Patch1: 0002-scripts-also-ignore-kernel-debug-modules.posttrans.patch
+Patch0: 0001-core-Fix-Coverity-WRAPPER_ESCAPE.patch
+Patch1: 0001-treefile-Add-ignore-devices.patch
 
 ExclusiveArch: %{rust_arches}
 
 BuildRequires: make
-%if 0%{?rhel} && !0%{?eln}
-BuildRequires: rust-toolset
-%else
 BuildRequires: rust-packaging
 BuildRequires: cargo
 BuildRequires: rust
-%endif
 
 # Enable ASAN + UBSAN
 %bcond_with sanitizers
@@ -37,19 +33,14 @@ BuildRequires: rust
 %bcond_with rhsm
 %endif
 
-# RHEL8 doesn't ship zchunk today.  See also the comments
-# in configure.ac around this as libdnf/librepo need to be in
-# sync, and today we bundle libdnf but not librepo.
-%if 0%{?rhel} && 0%{?rhel} <= 8
+# RHEL (8,9) doesn't ship zchunk today.  Keep this in sync
+# with libdnf: https://gitlab.com/redhat/centos-stream/rpms/libdnf/-/blob/762f631e36d1e42c63a794882269d26c156b68c1/libdnf.spec#L45
+%if 0%{?rhel}
 %bcond_with zchunk
 %else
 %bcond_without zchunk
 %endif
 
-%if 0%{?fedora} >= 34
-%define sqlite_rpmdb_default "--enable-sqlite-rpmdb-default"
-%endif
-
 # For the autofiles bits below
 BuildRequires: python3-devel
 # We always run autogen.sh
@@ -57,11 +48,10 @@ BuildRequires: autoconf automake libtool git
 # For docs
 BuildRequires: chrpath
 BuildRequires: gtk-doc
-BuildRequires: gnome-common
 BuildRequires: /usr/bin/g-ir-scanner
 # Core requirements
 # One way to check this: `objdump -p /path/to/rpm-ostree | grep LIBOSTREE` and pick the highest (though that might miss e.g. new struct members)
-BuildRequires: pkgconfig(ostree-1) >= 2020.7
+BuildRequires: pkgconfig(ostree-1) >= 2021.5
 BuildRequires: pkgconfig(polkit-gobject-1)
 BuildRequires: pkgconfig(json-glib-1.0)
 BuildRequires: pkgconfig(rpm) >= 4.14.0
@@ -85,41 +75,54 @@ BuildRequires: pkgconfig(check)
 # but duplicating to be clear)
 BuildRequires: pkgconfig(libsolv)
 
-# We need g++ for libdnf
-BuildRequires: gcc-c++
+# These are build deps which aren't strictly required in Koji/Brew builds, but
+# are required for git builds. Since they're few and tiny, we just add it here
+# to keep it part of `dnf builddep`.
+BuildRequires: jq
+
+#########################################################################
+#                         libdnf build deps                             #
+#                                                                       #
+# Copy/pasted from libdnf/libdnf.spec. Removed the irrelevant bits like #
+# valgrind, rhsm, swig, python, and sanitizer stuff.                    #
+#########################################################################
 
 
-# more libdnf build deps (see libdnf's spec for versions; maintain ordering)
-%global libsolv_version 0.7.17
-%global libmodulemd_version 2.11.2-2
-%global librepo_version 1.13.0
-%global swig_version 3.0.12
-BuildRequires:  swig >= %{swig_version}
-BuildRequires:  pkgconfig(modulemd-2.0) >= %{libmodulemd_version}
-BuildRequires:  pkgconfig(librepo) >= %{librepo_version}
+%global libsolv_version 0.7.21
+%global libmodulemd_version 2.13.0
+%global librepo_version 1.13.1
+
+BuildRequires:  cmake
+BuildRequires:  gcc
+BuildRequires:  gcc-c++
 BuildRequires:  libsolv-devel >= %{libsolv_version}
-BuildRequires:  pkgconfig(json-c)
-BuildRequires:  pkgconfig(cppunit)
-BuildRequires:  pkgconfig(sqlite3)
-BuildRequires:  pkgconfig(smartcols)
-%if %{with zchunk}
-BuildRequires:  pkgconfig(zck) >= 0.9.11
-%endif
-BuildRequires:  gpgme-devel
-%if 0%{?rhel} <= 8
-# In current Fedora, this is a dependency of gpgme-devel, but
-# not in RHEL8.  Missing this package breaks -znow.
-BuildRequires:  libassuan-devel
-%endif
+BuildRequires:  pkgconfig(librepo) >= %{librepo_version}
+BuildRequires:  pkgconfig(check)
+BuildRequires:  pkgconfig(gio-unix-2.0) >= 2.46.0
+BuildRequires:  pkgconfig(gtk-doc)
+BuildRequires:  rpm-devel >= 4.15.0
 %if %{with rhsm}
 BuildRequires:  pkgconfig(librhsm) >= 0.0.3
 %endif
+%if %{with zchunk}
+BuildRequires:  pkgconfig(zck) >= 0.9.11
+%endif
+BuildRequires:  pkgconfig(sqlite3)
+BuildRequires:  pkgconfig(json-c)
+BuildRequires:  pkgconfig(cppunit)
+BuildRequires:  pkgconfig(modulemd-2.0) >= %{libmodulemd_version}
+BuildRequires:  pkgconfig(smartcols)
+BuildRequires:  gettext
+BuildRequires:  gpgme-devel
 
-# Runtime libdnf deps
 Requires:       libmodulemd%{?_isa} >= %{libmodulemd_version}
 Requires:       libsolv%{?_isa} >= %{libsolv_version}
 Requires:       librepo%{?_isa} >= %{librepo_version}
 
+#########################################################################
+#                     end of libdnf build deps                          #
+#########################################################################
+
 # For now...see https://github.com/projectatomic/rpm-ostree/pull/637
 # and https://github.com/fedora-infra/fedmsg-atomic-composer/pull/17
 # etc.  We'll drop this dependency at some point in the future when
@@ -128,6 +131,10 @@ Requires: ostree
 Requires: bubblewrap
 Requires: fuse
 
+# For container functionality
+# https://github.com/coreos/rpm-ostree/issues/3286
+Recommends: skopeo
+
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 
 %description
@@ -153,6 +160,9 @@ The %{name}-devel package includes the header files for %{name}-libs.
 
 %prep
 %autosetup -Sgit -n %{name}-%{version}
+%if 0%{?__isa_bits} == 32
+sed -ie 's,^lto = true,lto = false,' Cargo.toml
+%endif
 
 %build
 env NOCONFIGURE=1 ./autogen.sh
@@ -207,7 +217,7 @@ $PYTHON autofiles.py > files \
   '%{_libexecdir}/rpm-ostree*' \
   '%{_libexecdir}/libostree/ext/*' \
   '%{_datadir}/polkit-1/actions/*.policy' \
-  '%{_datadir}/dbus-1/system-services' \
+  '%{_datadir}/dbus-1/system-services/*' \
   '%{_datadir}/bash-completion/completions/*'
 
 $PYTHON autofiles.py > files.lib \
@@ -222,6 +232,13 @@ $PYTHON autofiles.py > files.devel \
   '%{_datadir}/gtk-doc/html/*' \
   '%{_datadir}/gir-1.0/*-1.0.gir'
 
+%post
+# Only enable on rpm-ostree based systems and manually force unit enablement to
+# explicitly ignore presets for this security fix
+if [ -e /run/ostree-booted ]; then
+    ln -snf /usr/lib/systemd/system/rpm-ostree-fix-shadow-mode.service  /usr/lib/systemd/system/multi-user.target.wants/
+fi
+
 %files -f files
 %doc COPYING.GPL COPYING.LGPL LICENSE README.md
 
@@ -230,125 +247,357 @@ $PYTHON autofiles.py > files.devel \
 %files devel -f files.devel
 
 %changelog
-* Thu Oct 05 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2022.10.117.g52714b51-3
+* Thu Oct 17 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.7-3
+- Backport https://github.com/coreos/rpm-ostree/pull/5051
+  Resolves: #RHEL-59716
+
+* Thu Aug 15 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.7-2
+- Backport https://github.com/coreos/rpm-ostree/pull/5051
+  Resolves: #RHEL-53871
+
+* Tue Aug 09 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.7-1
+- Rebase to 2024.7
+  Resolves: #RHEL-53871
+
+* Tue May 21 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.5-1
+- Rebase to 2024.6
+  Resolves: #RHEL-29339
+
+* Mon Apr 15 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.5-1
+- Rebase to 2024.5
+  Adds fix for https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
+  Resolves: #RHEL-30415
+
+* Tue Apr 09 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.4-4
+- Backport https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
+
+* Thu Mar 21 2024 Colin Walters <walters@verbum.org> - 2024.4-3
+- Backport patch to fix https://issues.redhat.com/browse/RHEL-29559
+
+* Fri Mar 15 2024 Colin Walters <walters@verbum.org> - 2024.4-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2024.4
+  Resolves: #RHEL-29339
+
+* Sun Feb 25 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.3-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2024.3
+  Backport https://github.com/coreos/rpm-ostree/commit/fe586621e5014d14f92b913338171a02ed29e6cc
+  Resolves: #RHEL-26186
+
+* Wed Jan 24 2024 Joseph Marrero <jmarrero@fedoraproject.org> - 2024.2-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2024.2
+  Resolves: #RHEL-11294
+
+* Wed Jan 03 2024 Colin Walters <walters@verbum.org> - 2024.1-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2024.1
+  Resolves: #RHEL-11294
+
+* Mon Dec 18 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.12-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.12
+  Resolves: #RHEL-11294
+
+* Wed Dec 13 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.11-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.11
+  Resolves: #RHEL-11294
+
+* Thu Oct 05 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.8-3
 - Use python macros and devel package
-  Resolves: #RHEL-2243
+  Resolves: #RHEL-11892
 
-* Mon Aug 07 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2022.10.117.g52714b51-2
-- Backport fb97c48f3 & eae7e1d8
-  https://github.com/coreos/rpm-ostree/commit/fb97c48f3cd070c1ad559f3f43f86ad6548f6b02
-  https://github.com/coreos/rpm-ostree/commit/eae7e1d8d692b5ce6d3d6eef29abbd7512ae4682
-  Resolves: rhbz#2229804
+* Mon Oct 02 2023 Colin Walters <walters@verbum.org> - 2023.8-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.8
+  https://issues.redhat.com/browse/RHEL-11294
 
-* Sun Apr 30 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2022.10.117.g52714b51-1
-- Sync to latest rhel8 branch
-  Resolves: rhbz#2192235
+* Sat Aug 26 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.7-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.7
+  Resolves: rhbz#2234352
 
-* Thu Feb 16 2023 Colin Walters <walters@verbum.org> - 2022.10.112.g3d0ac35b-3
-- Cherry pick
-  https://github.com/coreos/rpm-ostree/pull/4311/commits/a0f1275dfbd835b704355d095e610ac1f1254f25
-  Resolves: rhbz#2170579
+* Fri Aug 25 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.6-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.6
+  Resolves: rhbz#2234352
 
-* Tue Feb 14 2023 Colin Walters <walters@verbum.org> - 2022.10.112.g3d0ac35b-2
-- Sync to latest rhel8 branch
-  Resolves: rhbz#2169429
+* Fri Jul 21 2023 Colin Walters <walters@verbum.org> - 2023.5-2
+- Backport https://github.com/coreos/rpm-ostree/pull/4510
+  Related: rhbz#2224081
 
-* Fri Oct 14 2022 Colin Walters <walters@verbum.org> - 2022.10.99.g0049dbdd-3
-- Resolves: rhbz#2134630
+* Thu Jun 22 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.5-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.5
+  Resolves: rhbz#2216811
 
-* Wed Sep 28 2022 Colin Walters <walters@verbum.org> - 2022.10.97.gade6df33-2
-- Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
-  https://github.com/coreos/rpm-ostree/commit/ac182cb920f84946bb155e9cf061db7f5f26e917
-- Resolves: rhbz#2122289
+* Tue Jun 13 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.4-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.4
+  Resolves: rhbz#2211486
 
-* Wed Aug 31 2022 Colin Walters <walters@verbum.org> - 2022.10.94.g89f58028-2
-- Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
-  https://github.com/coreos/rpm-ostree/commit/89f58028f0bea5b6fa59bdb3506078e09957ec00
-- Resolves: rhbz#2122289
-- Resolves: rhbz#2122299
+* Mon Apr 24 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.3-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.3
+  Resolves: rhbz#2189315
 
-* Tue Aug 16 2022 Colin Walters <walters@verbum.org> - 2022.10.90.g4abaf4b4-4
-- Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
-  https://github.com/coreos/rpm-ostree/commit/4abaf4b4
-  Resolves: rhbz#2118774
+* Tue Mar 07 2023 Joseph Marrero <jmarrero@fedoraproject.org> - 2023.2-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2023.2
+  Resolves: rhbz#2176213
 
-* Tue Jul 19 2022 Colin Walters <walters@verbum.org> - 2022.10.86.gd8f0c67a-3
-- Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
-  https://github.com/coreos/rpm-ostree/commit/d8f0c67a0eba32281c9f2782a286e06486a4b909
-  Resolves: rhbz#2105414
+* Tue Dec 20 2022 Colin Walters <walters@verbum.org> - 2022.19-3
+- https://github.com/coreos/rpm-ostree/releases/tag/v2022.19
+  Resolves: rhbz#2153460
 
-* Wed Jun 15 2022 Colin Walters <walters@verbum.org> - 2022.2.8.gd50a74bd-2
-- Update to latest rhel8 branch
-  https://github.com/coreos/rpm-ostree/pull/3749
-  https://github.com/coreos/rpm-ostree/pull/3751
-  Resolves: rhbz#2095528
+* Wed Dec 14 2022 Colin Walters <walters@verbum.org> - 2022.18-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2022.18
+  Resolves: rhbz#2153460
+
+* Tue Nov 22 2022 Colin Walters <walters@verbum.org> - 2022.16-2
+- Rebase to 2022.16
+  Resolves: rhbz#2144586
+
+* Thu Oct 13 2022 Joseph Marrero <jmarrero@fedoraproject.org> - 2022.14-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2022.14
+
+* Tue Sep 13 2022 Luca BRUNO <lucab@redhat.com> - 2022.13-1
+- New upstream version
+  https://github.com/coreos/rpm-ostree/releases/tag/v2022.12
+  Resolves: rhbz#2126108
+
+* Tue Jul 19 2022 Colin Walters <walters@verbum.org> - 2022.12-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2022.12
+
+* Mon Jul 11 2022 Colin Walters <walters@verbum.org> - 2022.11-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2022.11
+  Resolves: rhbz#2105405
+
+* Thu Jun 09 2022 Jonathan Lebon <jonathan@jlebon.com> - 2022.8-3
+- Backport https://github.com/coreos/rpm-ostree/pull/3721
+  Resolves: rhbz#2094085
+
+* Thu Apr 21 2022 Colin Walters <walters@verbum.org> - 2022.8-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2022.8
+  Resolves: rhbz#2077062
+  Resolves: rhbz#2023325
+
+* Mon Apr 11 2022 Colin Walters <walters@verbum.org> - 2022.7-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2022.7
 
 * Mon Feb 07 2022 Colin Walters <walters@verbum.org> - 2022.2-2
+- Rebase to 2022.2
+
+* Mon Jan 10 2022 Colin Walters <walters@verbum.org> - 2022.1-2
 - Rebase to 2022.1
+  Resolves: rhbz#2027476
 
-* Tue Jan 11 2022 Colin Walters <walters@verbum.org> - 2022.1-2
-- Rebase to 2022.1
-  Resolves: rhbz#2032594
+* Wed Dec 01 2021 Colin Walters <walters@verbum.org> - 2021.14-3
+- Drop zchunk dependency
+  Resolves: rhbz#2028167
 
-* Wed Dec 15 2021 Colin Walters <walters@verbum.org> - 2021.14-3
-- Rebase to 2021.14
-  Resolves: rhbz#2032594
+* Mon Nov 29 2021 Colin Walters <walters@verbum.org> - 2021.14-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2021.14
+  Resolves: rhbz#2027476
 
-* Fri Jun 18 2021 Luca BRUNO <lucab@redhat.com> - 2021.5-2
-- Backport _dbpath fixes, see
-  https://github.com/coreos/rpm-ostree/issues/2904
-  Resolves: rhbz#1973579
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 2021.6-2
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Tue Jun 22 2021 Colin Walters <walters@verbum.org>
+- https://github.com/coreos/rpm-ostree/releases/tag/v2021.6
+
+* Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 2021.5-3
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
+
+* Tue Jun 01 2021 Colin Walters <walters@verbum.org> - 2021.5-2
+- Support OpenSSL 3
 
 * Wed May 12 2021 Luca BRUNO <lucab@lucabruno.net> - 2021.5-1
 - New upstream version
   https://github.com/coreos/rpm-ostree/releases/tag/v2021.5
-  Resolves: rhbz#1959874
 
-* Tue Mar 30 2021 Colin Walters <walters@verbum.org> - 2020.7-4
-- Backport https://github.com/coreos/rpm-ostree/pull/2386/commits/aa8e49aaeddfc5d38651fa08f46e059655818fd1
-  Resolves: #1944760
+* Sun May 09 2021 Jeff Law <jlaw@tachyum.com> - 2021.4-4
+- Re-enable LTO
 
-* Thu Nov 05 2020 Colin Walters <walters@verbum.org> - 2020.7-2
-- Update to 2020.7
-  Resolves: #1894061
+* Wed Apr 28 2021 Colin Walters <walters@verbum.org> - 2021.4-3
+- Backport another patch for https://pagure.io/fedora-infrastructure/issue/9909
+
+* Tue Apr 27 2021 Colin Walters <walters@verbum.org> - 2021.4-2
+- Backport patch for https://pagure.io/fedora-infrastructure/issue/9909
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2021.2-3
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Mon Apr 12 2021 Jonathan Lebon <jonathan@jlebon.com> - 2021.4-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2021.4
+
+* Wed Mar 17 2021 Colin Walters <walters@verbum.org> - 2021.3-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2021.3
+
+* Wed Feb 17 2021 Colin Walters <walters@verbum.org> - 2021.2-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2021.2
+
+* Wed Feb 10 2021 Colin Walters <walters@verbum.org> - 2021.1-4
+- Backport patches from https://github.com/coreos/rpm-ostree/pull/2553
+
+* Tue Jan 26 2021 Jonathan Lebon <jonathan@jlebon.com> - 2021.1-3
+- Backport https://github.com/coreos/rpm-ostree/pull/2490 for rawhide
+
+* Tue Jan 19 15:08:59 UTC 2021 Colin Walters <walters@verbum.org> - 2021.1-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2021.1
+
+* Fri Dec 11 19:13:03 UTC 2020 Colin Walters <walters@verbum.org> - 2020.10-3
+- https://github.com/coreos/rpm-ostree/releases/tag/v2020.10
+
+* Fri Dec 11 13:42:33 UTC 2020 Colin Walters <walters@verbum.org> - 2020.9-2
+- https://github.com/coreos/rpm-ostree/releases/tag/v2020.9
+
+* Sat Nov 14 14:51:20 UTC 2020 Colin Walters <walters@verbum.org> - 2020.8-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2020.8
+
+* Mon Nov 02 2020 Luca BRUNO <lucab@lucabruno.net> - 2020.7-1
+- New upstream version
+  https://github.com/coreos/rpm-ostree/releases/tag/v2020.7
+
+* Mon Nov 02 2020 Jeff Law <law@redhat.com> - 2020.6-2
+- Fix invalid use of volatile caught by gcc-11
+
+* Fri Oct 30 16:48:43 UTC 2020 Colin Walters <walters@verbum.org> - 2020.6-1
+- https://github.com/coreos/rpm-ostree/releases/tag/v2020.6
+
+* Wed Oct 28 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 2020.5-2
+- sysroot: Fix usage of sd_journal_send on 32 bit (gh#2276)
+
+* Tue Sep 15 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.5-1
+- New upstream version
+  https://github.com/coreos/rpm-ostree/releases/tag/v2020.5
+
+* Mon Aug 17 2020 Colin Walters <walters@verbum.org> - 2020.4.15.g8b0bcd7b-2
+- Update to latest upstream git for
+  https://bugzilla.redhat.com/show_bug.cgi?id=1865397
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2020.4-2
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 
 * Wed Jul 29 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.4-1
 - New upstream version
   https://github.com/coreos/rpm-ostree/releases/tag/v2020.4
-  Resolves: #1861786
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2020.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 30 2020 Jeff Law <aw@redhat.com> - 2020.3-2
+- Disable LTO
+
+* Fri Jun 19 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.3-1
+- New upstream version
+  https://github.com/coreos/rpm-ostree/releases/tag/v2020.3
+
+* Fri May 15 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.2-3
+- Backport https://github.com/coreos/rpm-ostree/pull/2096
+  See https://github.com/coreos/fedora-coreos-tracker/issues/481
 
 * Fri May 15 2020 Colin Walters <walters@verbum.org> - 2020.2-2
 - https://github.com/coreos/rpm-ostree/releases/tag/v2020.2
-  Resolves: #1827712
 
-* Tue Mar 03 2020 Colin Walters <walters@verbum.org> - 2019.6-8
-- Backport patches for initramfs /etc
-  Resolves: #1808459
+* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 2020.1.80.g3ec5e287-2
+- Rebuild (json-c)
 
-* Thu Feb 27 2020 Colin Walters <walters@verbum.org> - 2019.6-7
-- Backport f295f543064f1a0b5833fefccd6bb203b3527623
-  Resolves: #1807487
+* Mon Apr 20 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.1.80.g3ec5e287-1
+- git master snapshot for using strict mode and lockfile-repos in FCOS:
+  https://github.com/coreos/rpm-ostree/pull/1858
+  https://github.com/coreos/rpm-ostree/pull/2058
+  https://github.com/coreos/fedora-coreos-tracker/issues/454
 
-* Thu Dec 05 2019 Jonathan Lebon <jlebon@redhat.com> - 2019.6-6
-- Backport dracut mknod patch for FIPS:
+* Fri Mar 13 2020 Colin Walters <walters@verbum.org> - 2020.1.21.ge9011530-2
+- Backport https://github.com/coreos/rpm-ostree/pull/2015
+  See https://github.com/coreos/fedora-coreos-tracker/issues/343
+
+* Thu Feb 27 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.1.21.ge9011530-1
+- git master snapshot for using base initramfs kargs in RHCOS:
+  https://github.com/coreos/rpm-ostree/pull/1998
+  https://github.com/coreos/rpm-ostree/pull/1997
+  https://bugzilla.redhat.com/show_bug.cgi?id=1806588
+
+* Wed Feb 05 2020 Jonathan Lebon <jonathan@jlebon.com> - 2020.1-1
+- New upstream version
+
+* Tue Feb 04 2020 Jonathan Lebon <jonathan@jlebon.com> - 2019.7.31.g70c38563-1
+- git master snapshot for Silverblue rawhide compose fixes
+  https://pagure.io/releng/failed-composes/issue/717
+  https://pagure.io/releng/failed-composes/issue/929
+  https://github.com/rpm-software-management/libdnf/pull/885
+
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2019.7-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jan 09 2020 Jonathan Lebon <jonathan@jlebon.com> - 2019.7-2
+- Backport patch for Silverblue composes:
+  https://pagure.io/releng/failed-composes/issue/717
+
+* Thu Dec 19 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.7-1
+- New upstream version
+
+* Sat Dec 14 2019 Jeff Law <law@redhat.com> - 2019.6.24.gfec61ce5-2
+- Fix missing #includes for gcc-10
+
+* Thu Oct 31 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.6.27.g3b8a1ec6-1
+- git master snapshot for dracut cpio cap_mknod fix:
   https://github.com/coreos/rpm-ostree/pull/1946
 
-* Thu Oct 31 2019 Jonathan Lebon <jlebon@redhat.com> - 2019.6-5
-- Backport HMAC patch for FIPS:
+* Thu Oct 31 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.6.24.gfec61ce5-1
+- git master snapshot for HMAC path fix for FIPS:
   https://github.com/coreos/rpm-ostree/pull/1934
 
-* Fri Oct 18 2019 Colin Walters <walters@verbum.org> - 2019.6-4
-- Backport zchunk patch
+* Wed Sep 25 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.6-1
+- New upstream version
 
-* Tue Oct 15 2019 Colin Walters <walters@verbum.org> - 2019.6-3
-- https://github.com/coreos/rpm-ostree/releases/tag/v20196
-- Backport zstd patch
+* Thu Aug 22 2019 Colin Walters <walters@verbum.org> - 2019.5.7.gcac5aa41-3
+- New upstream git snapshot, mainly for backporting the arch-includes conditionals
+  to aid Fedora CoreOS on s390x.
 
-* Fri May 17 2019 Jonathan Lebon <jlebon@redhat.com> - 2019.3-3
-- Rebuild for rhel-8.1.0 branch
+* Wed Jul 31 2019 Stephen Gallagher <sgallagh@redhat.com> - 2019.5-2
+- Fix libmodulemd dependencies
 
-* Fri Mar 29 2019 Colin Walters <walters@verbum.org> - 2019.3-2
-- Backport patch for pivot rebases
+* Thu Jul 25 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.5-1
+- New upstream version
+
+* Fri Jul 19 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4.39.g8d90d03d-1
+- git master snapshot for --parent and lockfile overrides
+  https://github.com/projectatomic/rpm-ostree/pull/1871
+  https://github.com/projectatomic/rpm-ostree/pull/1867
+
+* Fri Jul 12 2019 Colin Walters <walters@verbum.org> - 2019.4.28.g44395673-3
+- Update rpmostree-rust.h in sources
+
+* Fri Jul 12 2019 Colin Walters <walters@verbum.org> - 2019.4.28.g44395673-2
+- Update with git snapshot for zstd support
+
+* Wed Jul 10 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4.27.gb381e029-1
+- git master snapshot for add-commit-metadata
+  https://github.com/projectatomic/rpm-ostree/pull/1865/
+
+* Fri Jun 14 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4.15.gbbc9aa9f-1
+- git master snapshot for OSTree layers
+  https://github.com/projectatomic/rpm-ostree/pull/1830/
+
+* Mon Jun 10 22:13:22 CET 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2019.4.10.gc1cc0827-3
+- Rebuild for RPM 4.15
+
+* Mon Jun 10 15:42:05 CET 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2019.4.10.gc1cc0827-2
+- Rebuild for RPM 4.15
+
+* Thu Jun 06 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4.10.gc1cc0827-1
+- git master snapshot for lockfile
+  https://github.com/projectatomic/rpm-ostree/pull/1745/
+
+* Tue May 28 2019 Dusty Mabe <dusty@dustymabe.com> - 2019.4-3
+- Add back in ppc64le and ppc64
+
+* Thu May 23 2019 Dusty Mabe <dusty@dustymabe.com> - 2019.4-2
+- Backport patch for db diff --format=json
+
+* Tue May 21 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.4-1
+- New upstream version
+
+* Mon May 06 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.3.5.g0da9f997-2
+- Add temporary hack to avoid UTF-8 for Bodhi
+  https://pagure.io/releng/issue/8330
+
+* Tue Apr 09 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.3.5.g0da9f997-1
+- git master snapshot to test coreos-continuous tag
 
 * Wed Mar 27 2019 Jonathan Lebon <jonathan@jlebon.com> - 2019.3-1
 - New upstream version
@@ -377,9 +626,6 @@ $PYTHON autofiles.py > files.devel \
 * Sun Oct 28 2018 Jonathan Lebon <jonathan@jlebon.com> - 2018.9-1
 - New upstream version
 
-* Mon Oct 15 2018 Jonathan Lebon <jonathan@jlebon.com> - 2018.8-2
-- Add new source and patch to drop cbindgen requirement
-
 * Tue Sep 11 2018 Jonathan Lebon <jonathan@jlebon.com> - 2018.8-1
 - New upstream version
 

sources

@@ -0,0 +1 @@
+SHA512 (rpm-ostree-2024.7.tar.xz) = b74861d316929222479aa7751f6fcfe454fb9bb2ecaae3c54b25bf23140320efcc9a29e7e27ad62fd8e75e7f423bd26abbcd81d787506e83742c0455a75132e3

tests/tests.yml

@@ -0,0 +1,9 @@
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    tests:
+    - simple:
+        dir: .
+        run: "rpm-ostree --help"