rpms/rpm
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix: Treat x86_64_v2 as x86_64 in architecture checks

Browse Source
This commit is contained in:
Eduard Abdullin 2025-11-11 21:50:12 +00:00 committed by root
commit cd4ce3d57b
13 changed files with 5560 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

198
0001-Ensure-binary-and-source-headers-are-identified-as-s.patch Normal file
View File

@ -0,0 +1,198 @@
From eba94c7f093cdf683d7dadff1574492d03be7559 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 2 Apr 2024 13:21:00 +0300
Subject: [PATCH] Ensure binary and source headers are identified as such after
parse
The two commits improve source and binary package header detection right
after spec parse, fixing #2819 in the process. Details in commits.
Backported from commits:
8703ce740f24d7b7c443cce74fccf08df00e89c2
dc47a50c6345a25b861305d8aa8ae464098834ff
e0e43e93777701f5f2e6f7505b8e9b9e9681aee1
0320d61198537079c80087a2b174963d25893b79
Fixes: RHEL-87383
---
build/build.c | 1 +
build/files.c | 15 +--------------
build/pack.c | 2 --
build/parseSpec.c | 24 +++++++++++++++++++++++-
lib/headerutil.c | 9 ++++++++-
5 files changed, 33 insertions(+), 18 deletions(-)
diff --git a/build/build.c b/build/build.c
index f2cf98c8b..c35fd137a 100644
--- a/build/build.c
+++ b/build/build.c
@@ -393,6 +393,7 @@ static rpmRC buildSpec(rpmts ts, BTA_t buildArgs, rpmSpec spec, int what)
!(spec->flags & RPMSPEC_FORCE)) {
/* Create buildreqs package */
char *nvr = headerGetAsString(spec->packages->header, RPMTAG_NVR);
+ free(spec->sourceRpmName);
rasprintf(&spec->sourceRpmName, "%s.buildreqs.nosrc.rpm", nvr);
free(nvr);
/* free sources to not include them in the buildreqs package */
diff --git a/build/files.c b/build/files.c
index c403c806e..61f7ff10f 100644
--- a/build/files.c
+++ b/build/files.c
@@ -2661,16 +2661,6 @@ exit:
return fl.processingFailed ? RPMRC_FAIL : RPMRC_OK;
}
-static void genSourceRpmName(rpmSpec spec)
-{
- if (spec->sourceRpmName == NULL) {
- char *nvr = headerGetAsString(spec->packages->header, RPMTAG_NVR);
- rasprintf(&spec->sourceRpmName, "%s.%ssrc.rpm", nvr,
- spec->noSource ? "no" : "");
- free(nvr);
- }
-}
-
rpmRC processSourceFiles(rpmSpec spec, rpmBuildPkgFlags pkgFlags)
{
struct Source *srcPtr;
@@ -2688,7 +2678,6 @@ rpmRC processSourceFiles(rpmSpec spec, rpmBuildPkgFlags pkgFlags)
oneshot = 1;
}
- genSourceRpmName(spec);
/* Construct the file list and source entries */
argvAdd(&files, spec->specFile);
for (srcPtr = spec->sources; srcPtr != NULL; srcPtr = srcPtr->next) {
@@ -2838,6 +2827,7 @@ static rpmTagVal copyTagsFromMainDebug[] = {
RPMTAG_OS,
RPMTAG_PLATFORM,
RPMTAG_OPTFLAGS,
+ RPMTAG_SOURCERPM,
0
};
@@ -3130,7 +3120,6 @@ rpmRC processBinaryFiles(rpmSpec spec, rpmBuildPkgFlags pkgFlags,
elf_version (EV_CURRENT);
#endif
check_fileList = newStringBuf();
- genSourceRpmName(spec);
buildroot = rpmGenPath(spec->rootDir, spec->buildRoot, NULL);
if (rpmExpandNumeric("%{?_debuginfo_subpackages}")) {
@@ -3186,8 +3175,6 @@ rpmRC processBinaryFiles(rpmSpec spec, rpmBuildPkgFlags pkgFlags,
if (pkg->fileList == NULL)
continue;
- headerPutString(pkg->header, RPMTAG_SOURCERPM, spec->sourceRpmName);
-
nvr = headerGetAsString(pkg->header, RPMTAG_NVRA);
rpmlog(RPMLOG_NOTICE, _("Processing files: %s\n"), nvr);
free(nvr);
diff --git a/build/pack.c b/build/pack.c
index f7dac6d9a..9eb304642 100644
--- a/build/pack.c
+++ b/build/pack.c
@@ -796,13 +796,11 @@ rpmRC packageSources(rpmSpec spec, char **cookie)
{
Package sourcePkg = spec->sourcePackage;
rpmRC rc;
- uint32_t one = 1;
/* Add some cruft */
headerPutString(sourcePkg->header, RPMTAG_RPMVERSION, VERSION);
headerPutString(sourcePkg->header, RPMTAG_BUILDHOST, spec->buildHost);
headerPutUint32(sourcePkg->header, RPMTAG_BUILDTIME, &(spec->buildTime), 1);
- headerPutUint32(sourcePkg->header, RPMTAG_SOURCEPACKAGE, &one, 1);
/* Include spec in parsed and expanded form */
headerPutString(sourcePkg->header, RPMTAG_SPEC, getStringBuf(spec->parsed));
diff --git a/build/parseSpec.c b/build/parseSpec.c
index 3929c0a26..0ecfcb6cd 100644
--- a/build/parseSpec.c
+++ b/build/parseSpec.c
@@ -648,11 +648,13 @@ static void initSourceHeader(rpmSpec spec)
{
Package sourcePkg = spec->sourcePackage;
struct Source *srcPtr;
+ uint32_t one = 1;
if (headerIsEntry(sourcePkg->header, RPMTAG_NAME))
return;
/* Only specific tags are added to the source package header */
+ headerPutUint32(sourcePkg->header, RPMTAG_SOURCEPACKAGE, &one, 1);
headerCopyTags(spec->packages->header, sourcePkg->header, sourceTags);
/* Add the build restrictions */
@@ -694,6 +696,12 @@ static void initSourceHeader(rpmSpec spec)
}
}
}
+ if (spec->sourceRpmName == NULL) {
+ char *nvr = headerGetAsString(spec->packages->header, RPMTAG_NVR);
+ rasprintf(&spec->sourceRpmName, "%s.%ssrc.rpm", nvr,
+ spec->noSource ? "no" : "");
+ free(nvr);
+ }
/* Provide all package NEVRs that would be built */
for (Package p = spec->packages; p != NULL; p = p->next) {
@@ -1088,6 +1096,13 @@ errxit:
+static void finalizeSpec(rpmSpec spec)
+{
+ for (Package p = spec->packages; p != NULL; p = p->next) {
+ headerPutString(p->header, RPMTAG_SOURCERPM, spec->sourceRpmName);
+ }
+}
+
static rpmSpec parseSpec(const char *specFile, rpmSpecFlags flags,
const char *buildRoot, int recursing)
{
@@ -1131,7 +1146,11 @@ errxit:
rpmSpec rpmSpecParse(const char *specFile, rpmSpecFlags flags,
const char *buildRoot)
{
- return parseSpec(specFile, flags, buildRoot, 0);
+ rpmSpec spec = parseSpec(specFile, flags, buildRoot, 0);
+ if (spec) {
+ finalizeSpec(spec);
+ }
+ return spec;
}
rpmRC parseGeneratedSpecs(rpmSpec spec)
@@ -1158,5 +1177,8 @@ rpmRC parseGeneratedSpecs(rpmSpec spec)
argvFree(argv);
}
free(specPattern);
+ if (!rc) {
+ finalizeSpec(spec);
+ }
return rc;
}
diff --git a/lib/headerutil.c b/lib/headerutil.c
index fab210ff2..15aa246ef 100644
--- a/lib/headerutil.c
+++ b/lib/headerutil.c
@@ -14,7 +14,14 @@
int headerIsSource(Header h)
{
- return (!headerIsEntry(h, RPMTAG_SOURCERPM));
+ /* Positive identification of a source package */
+ if (headerIsEntry(h, RPMTAG_SOURCEPACKAGE))
+ return 1;
+ /* Positive identification of a binary package */
+ if (headerIsEntry(h, RPMTAG_SOURCERPM))
+ return 0;
+ /* Dunno, guess so (as per traditional behavior) */
+ return 1;
}
Header headerCopy(Header h)
--
2.50.1

104
0001-Make-_passwd_path-and-_group_path-lists.patch Normal file
View File

@ -0,0 +1,104 @@
From 0f3ace9f3f38e3719b83018f400d5ffa509bbd1d Mon Sep 17 00:00:00 2001
From: Florian Festi <ffesti@redhat.com>
Date: Thu, 20 Mar 2025 13:57:56 +0100
Subject: [PATCH 1/5] Make %_passwd_path and %_group_path lists
Look up multiple files if they are listes in the macros separated by
colons. This way multiple sources of user and group information can be
used.
This is needed as RPM no longer honors nsswitch as it fails for
chroots. This way one can at least configure where RPM should look for
user/group information.
Backported from commits:
eb1ee05c6d835903b3f47bc95042790e915f569e
Fixes: RHEL-78693
---
lib/rpmug.c | 21 ++++++++++++++++++++-
macros.in | 2 +-
tests/rpmverify.at | 18 ++++++++++++++++++
3 files changed, 39 insertions(+), 2 deletions(-)
diff --git a/lib/rpmug.c b/lib/rpmug.c
index 807677b2c..316e326f3 100644
--- a/lib/rpmug.c
+++ b/lib/rpmug.c
@@ -47,7 +47,7 @@ static const char *grpfile(void)
* Lookup an arbitrary field based on contents of another in a ':' delimited
* file, such as /etc/passwd or /etc/group.
*/
-static int lookup_field(const char *path, const char *val, int vcol, int rcol,
+static int lookup_field_in_file(const char *path, const char *val, int vcol, int rcol,
char **ret)
{
int rc = -1; /* assume not found */
@@ -85,6 +85,25 @@ static int lookup_field(const char *path, const char *val, int vcol, int rcol,
return rc;
}
+/*
+ * Lookup an arbitrary field based on contents of another in a ':' delimited
+ * file, such as /etc/passwd or /etc/group. Look at multiple files listed in
+ * path separated by colons
+ */
+static int lookup_field(const char *path, const char *val, int vcol, int rcol,
+ char **ret)
+{
+ ARGV_t paths = argvSplitString(path, ":", ARGV_SKIPEMPTY);
+ int rc = -1;
+ for (ARGV_t p = paths; *p; p++) {
+ rc = lookup_field_in_file(*p, val, vcol, rcol, ret);
+ if (!rc)
+ break;
+ }
+ argvFree(paths);
+ return rc;
+}
+
/* atol() with error handling, return 0/-1 on success/failure */
static int stol(const char *s, long *ret)
{
diff --git a/macros.in b/macros.in
index 7eb3d2b98..f2a28fa57 100644
--- a/macros.in
+++ b/macros.in
@@ -132,7 +132,7 @@
%_keyringpath %{_dbpath}/pubkeys/
-# Location of passwd(5) and group(5)
+# Location of passwd(5) and group(5), as : separated list
%_passwd_path /etc/passwd
%_group_path /etc/group
diff --git a/tests/rpmverify.at b/tests/rpmverify.at
index c625a1bb9..804235908 100644
--- a/tests/rpmverify.at
+++ b/tests/rpmverify.at
@@ -648,3 +648,21 @@ runroot rpm -Vv ${VERIFYOPTS} verifyfiles
],
[])
RPMTEST_CLEANUP
+
+AT_SETUP([alternative passwd location])
+AT_KEYWORDS([verify])
+RPMDB_INIT
+
+runroot rpmbuild -bb --quiet /data/SPECS/klang.spec
+runroot rpm -Uvh /build/RPMS/noarch/klang-*
+echo "klangd:x:1111:1111::/:/sbin/nologin\n" >> ${RPMTEST}/usr/lib/passwd
+echo "klangd:x:8888:" >> ${RPMTEST}/usr/lib/group
+
+RPMTEST_CHECK([
+runroot_other chown 1111:8888 /var/lib/klangd
+runroot rpm -D "_passwd_path /usr/lib/passwd:/etc/passwd" -D "_group_path /usr/lib/group:/etc/group" -V klang-server
+],
+[0],
+[],
+[])
+RPMTEST_CLEANUP
--
2.49.0

672
0001-Store-configurable-digest-s-on-packages-from-verific.patch Normal file
View File

@ -0,0 +1,672 @@
From fdf88aa9cae15bb21d533d103cb8201caafaefbc Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Wed, 9 Apr 2025 09:58:40 +0300
Subject: [PATCH] Store configurable digest(s) on packages from verification
into the rpmdb
It can be hard to reliably map packages in repositories to installed
packages because the common repodata format only stores package-level
checksums, whereas packages themselves cannot contain such a checksum
for obvious reasons. The NEVRA information is nowhere near enough to
uniquely identify a package. Technically of course, the repodata could
be extended to carry header checksums but it seems that format is next
to impossible to change, so...
Having rpm calculate and store a configurable set of hashes has the
benefit of serving as a cross-check that the package we installed was
bit-per-bit identical to what was in the repository, even after the fact.
Backported from commits:
c0d84d40a94478e94943271dcc6c1213275dcf10
cdf8ac7f07d75b941df90484684e87366e50cfe5
49844e90bc352372b31035934fa51ff438c89a00
a41a2c30cc9b0cc67d4d87c600cfdcec68751784
f08348247203105cc40679ed7aef1f0c4d1d1770
55d22df4c8d7cf703d431ff6ebaa442275129e06
Fixes: RHEL-84062
---
docs/man/rpm.8.md | 4 ++
docs/manual/tags.md | 2 +
include/rpm/rpmtag.h | 2 +
include/rpm/rpmtd.h | 1 +
lib/formats.c | 10 +++++
lib/psm.c | 21 +++++++++
lib/rpmte.c | 13 ++++++
lib/rpmte_internal.h | 3 ++
lib/transaction.c | 105 +++++++++++++++++++++++++++++++------------
macros.in | 17 +++++++
tests/CMakeLists.txt | 1 +
tests/mktree.common | 1 +
tests/prpm.py | 80 +++++++++++++++++++++++++++++++++
tests/rpmgeneral.at | 2 +
tests/rpmi.at | 1 +
tests/rpmpython2.at | 41 +++++++++++++++++
tests/rpmquery.at | 15 +++++++
tests/rpmsigdig.at | 36 +++++++++++++++
tests/rpmtests.at | 1 +
19 files changed, 328 insertions(+), 28 deletions(-)
create mode 100755 tests/prpm.py
create mode 100644 tests/rpmpython2.at
diff --git a/docs/man/rpm.8.md b/docs/man/rpm.8.md
index 8ce06cf3e..c9c4473fd 100644
--- a/docs/man/rpm.8.md
+++ b/docs/man/rpm.8.md
@@ -534,6 +534,10 @@ Alternate output formats may be requested by following the tag with
: Format file verify status.
+**:hashalgo**
+
+: Display hash algorithm name.
+
**:hex**
: Format in hexadecimal.
diff --git a/docs/manual/tags.md b/docs/manual/tags.md
index 86ddbf876..fef69ab64 100644
--- a/docs/manual/tags.md
+++ b/docs/manual/tags.md
@@ -331,6 +331,8 @@ Instprefixes | 1099 | string array
Origbasenames | 1120 | string array | Original Basenames (relocated packages only)
Origdirindexes | 1119 | int32 array | Original Dirindexes (relocated packages only)
Origdirnames | 1121 | string array | Original Dirnames (relocated packages only)
+Packagedigests | 5118 | string array | Package digests calculated during verification
+Packagedigestalgos | 5119 | int32 | Algorithms used for Packagedigests
## Source packages
diff --git a/include/rpm/rpmtag.h b/include/rpm/rpmtag.h
index dec9c9244..8da7cf518 100644
--- a/include/rpm/rpmtag.h
+++ b/include/rpm/rpmtag.h
@@ -386,6 +386,8 @@ typedef enum rpmTag_e {
RPMTAG_PREUNTRANSFLAGS = 5107, /* i */
RPMTAG_POSTUNTRANSFLAGS = 5108, /* i */
RPMTAG_SYSUSERS = 5109, /* s[] extension */
+ RPMTAG_PACKAGEDIGESTS = 5118, /* s[] */
+ RPMTAG_PACKAGEDIGESTALGOS = 5119, /* i[] */
RPMTAG_FIRSTFREE_TAG /*!< internal */
} rpmTag;
diff --git a/include/rpm/rpmtd.h b/include/rpm/rpmtd.h
index c592905fa..99dce6a83 100644
--- a/include/rpm/rpmtd.h
+++ b/include/rpm/rpmtd.h
@@ -253,6 +253,7 @@ typedef enum rpmtdFormats_e {
RPMTD_FORMAT_HUMANIEC = 21, /* human readable value, K = 1024 (int types) */
RPMTD_FORMAT_TAGNAME = 22, /* tag name (any type) */
RPMTD_FORMAT_TAGNUM = 23, /* tag number (any type) */
+ RPMTD_FORMAT_HASHALGO = 25, /* digest algorithm name (int types) */
} rpmtdFormats;
/** \ingroup rpmtd
diff --git a/lib/formats.c b/lib/formats.c
index 156812165..303c12cbb 100644
--- a/lib/formats.c
+++ b/lib/formats.c
@@ -494,6 +494,14 @@ static char *tagnumFormat(rpmtd td, char **emsg)
return num;
}
+static char *hashalgoFormat(rpmtd td, char **emsg)
+{
+ const char *alg = pgpValString(PGPVAL_HASHALGO, rpmtdGetNumber(td));
+ if (rstreqn(alg, "Unknown", 7))
+ alg = "Unknown";
+ return rstrdup(alg);
+}
+
static const struct headerFmt_s rpmHeaderFormats[] = {
{ RPMTD_FORMAT_STRING, "string",
RPM_ANY_CLASS, stringFormat },
@@ -545,6 +553,8 @@ static const struct headerFmt_s rpmHeaderFormats[] = {
RPM_ANY_CLASS, tagnameFormat },
{ RPMTD_FORMAT_TAGNUM, "tagnum",
RPM_ANY_CLASS, tagnumFormat },
+ { RPMTD_FORMAT_HASHALGO, "hashalgo",
+ RPM_NUMERIC_CLASS, hashalgoFormat },
{ -1, NULL, 0, NULL }
};
diff --git a/lib/psm.c b/lib/psm.c
index ddc339357..39261b9f4 100644
--- a/lib/psm.c
+++ b/lib/psm.c
@@ -716,9 +716,26 @@ static void markReplacedInstance(rpmts ts, rpmte te)
rpmdbFreeIterator(mi);
}
+static void mergeAux(Header auxh, Header h)
+{
+ struct rpmtd_s td;
+ HeaderIterator hi = headerInitIterator(auxh);
+ while (headerNext(hi, &td)) {
+ /* Don't allow overwriting package data from aux */
+ if (headerIsEntry(h, td.tag))
+ continue;
+ if (rpmtdCount(&td) > 0) {
+ (void) headerPut(h, &td, HEADERPUT_DEFAULT);
+ }
+ rpmtdFreeData(&td);
+ }
+ headerFreeIterator(hi);
+}
+
static rpmRC dbAdd(rpmts ts, rpmte te)
{
Header h = rpmteHeader(te);
+ Header auxh = rpmteHeaderAux(te, 0);
rpm_time_t installTime = rpmtsGetTime(ts, 1);
rpmfs fs = rpmteGetFileStates(te);
rpm_count_t fc = rpmfsFC(fs);
@@ -735,6 +752,9 @@ static rpmRC dbAdd(rpmts ts, rpmte te)
headerPutUint32(h, RPMTAG_INSTALLTIME, &installTime, 1);
headerPutUint32(h, RPMTAG_INSTALLCOLOR, &tscolor, 1);
+ if (auxh)
+ mergeAux(auxh, h);
+
(void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DBADD), 0);
rc = (rpmdbAdd(rpmtsGetRdb(ts), h) == 0) ? RPMRC_OK : RPMRC_FAIL;
(void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DBADD), 0);
@@ -744,6 +764,7 @@ static rpmRC dbAdd(rpmts ts, rpmte te)
packageHashAddEntry(ts->members->installedPackages,
headerGetInstance(h), te);
}
+ headerFree(auxh);
headerFree(h);
return rc;
}
diff --git a/lib/rpmte.c b/lib/rpmte.c
index d31152a43..657b4e11d 100644
--- a/lib/rpmte.c
+++ b/lib/rpmte.c
@@ -32,6 +32,7 @@ struct rpmte_s {
void *userdata; /*!< Application private user data. */
Header h; /*!< Package header. */
+ Header auxh; /*!< Auxiliary data (from install) */
char * NEVR; /*!< Package name-version-release. */
char * NEVRA; /*!< Package name-version-release.arch. */
char * name; /*!< Name: */
@@ -252,6 +253,7 @@ rpmte rpmteFree(rpmte te)
fdFree(te->fd);
rpmfilesFree(te->files);
headerFree(te->h);
+ headerFree(te->auxh);
rpmfsFree(te->fs);
rpmpsFree(te->probs);
rpmteCleanDS(te);
@@ -279,6 +281,17 @@ rpmte rpmteNew(rpmts ts, Header h, rpmElementType type, fnpyKey key,
return p;
}
+Header rpmteHeaderAux(rpmte te, int init)
+{
+ Header auxh = NULL;
+ if (te != NULL) {
+ if (te->auxh == NULL && init == 1)
+ te->auxh = headerNew();
+ auxh = headerLink(te->auxh);
+ }
+ return auxh;
+}
+
unsigned int rpmteDBInstance(rpmte te)
{
return (te != NULL ? te->db_instance : 0);
diff --git a/lib/rpmte_internal.h b/lib/rpmte_internal.h
index 99b548fcc..e616c0561 100644
--- a/lib/rpmte_internal.h
+++ b/lib/rpmte_internal.h
@@ -101,6 +101,9 @@ rpmfs rpmteGetFileStates(rpmte te);
RPM_GNUC_INTERNAL
void rpmteSetVerified(rpmte te, int verified);
+RPM_GNUC_INTERNAL
+Header rpmteHeaderAux(rpmte te, int init);
+
/** \ingroup rpmte
* Retrieve size in bytes of package header.
* @param te transaction element
diff --git a/lib/transaction.c b/lib/transaction.c
index 70d2587ac..b828fe395 100644
--- a/lib/transaction.c
+++ b/lib/transaction.c
@@ -35,6 +35,7 @@
#include "rpmlock.h"
#include "rpmds_internal.h"
#include "rpmfi_internal.h" /* only internal apis */
+#include "rpmio_internal.h"
#include "rpmte_internal.h" /* only internal apis */
#include "rpmts_internal.h"
#include "rpmvs.h"
@@ -1265,6 +1266,81 @@ static int vfyCb(struct rpmsinfo_s *sinfo, void *cbdata)
return (sinfo->rc == 0);
}
+static ARGI_t initPkgDigests(FD_t fd)
+{
+ ARGI_t ids = NULL;
+ char *digests = rpmExpand("%{?_pkgverify_digests}", NULL);
+ ARGV_t vals = argvSplitString(digests, ":", 0);
+
+ for (ARGV_t v = vals; v && *v; v++) {
+ uint32_t alg = atoi(*v);
+ if (alg) {
+ /* Try to ensure unique ids for the digests */
+ uint32_t id = (RPMTAG_PACKAGEDIGESTS << 16) | alg;
+ fdInitDigestID(fd, alg, id, 0);
+ argiAdd(&ids, -1, id);
+ }
+ }
+
+ argvFree(vals);
+ free(digests);
+ return ids;
+}
+
+static void finiPkgDigests(FD_t fd, ARGI_t ids, Header auxh)
+{
+ for (int i = 0; i < argiCount(ids); i++) {
+ char *pkgdig = NULL;
+ uint32_t id = argiData(ids)[i];
+ fdFiniDigest(fd, id, (void **)&pkgdig, NULL, 1);
+ if (pkgdig) {
+ uint32_t alg = 0xffff & id;
+ headerPutString(auxh, RPMTAG_PACKAGEDIGESTS, pkgdig);
+ headerPutUint32(auxh, RPMTAG_PACKAGEDIGESTALGOS, &alg, 1);
+ free(pkgdig);
+ }
+ }
+ argiFree(ids);
+}
+
+static int verifyPackage(rpmts ts, rpmte p, struct rpmvs_s *vs, int vfylevel)
+{
+ struct vfydata_s vd = {
+ .msg = NULL,
+ .type = { -1, -1, -1, },
+ .vfylevel = vfylevel,
+ };
+ int verified = 0;
+ rpmRC prc = RPMRC_FAIL;
+ Header auxh = rpmteHeaderAux(p, 1);
+
+ FD_t fd = rpmtsNotify(ts, p, RPMCALLBACK_INST_OPEN_FILE, 0, 0);
+ if (fd != NULL) {
+ ARGI_t ids = initPkgDigests(fd);
+ prc = rpmpkgRead(vs, fd, NULL, NULL, &vd.msg);
+ int test = rpmtsFlags(ts) & RPMTRANS_FLAG_TEST;
+ finiPkgDigests(fd, ids, (test || prc) ? NULL : auxh);
+ rpmtsNotify(ts, p, RPMCALLBACK_INST_CLOSE_FILE, 0, 0);
+ }
+
+ if (prc == RPMRC_OK)
+ prc = rpmvsVerify(vs, RPMSIG_VERIFIABLE_TYPE, vfyCb, &vd);
+
+ /* Record verify result */
+ if (vd.type[RPMSIG_SIGNATURE_TYPE] == RPMRC_OK)
+ verified |= RPMSIG_SIGNATURE_TYPE;
+ if (vd.type[RPMSIG_DIGEST_TYPE] == RPMRC_OK)
+ verified |= RPMSIG_DIGEST_TYPE;
+ rpmteSetVerified(p, verified);
+
+ if (prc)
+ rpmteAddProblem(p, RPMPROB_VERIFY, NULL, vd.msg, 0);
+
+ vd.msg = _free(vd.msg);
+ headerFree(auxh);
+ return prc;
+}
+
static int verifyPackageFiles(rpmts ts, rpm_loff_t total)
{
int rc = 0;
@@ -1282,35 +1358,8 @@ static int verifyPackageFiles(rpmts ts, rpm_loff_t total)
pi = rpmtsiInit(ts);
while ((p = rpmtsiNext(pi, TR_ADDED))) {
struct rpmvs_s *vs = rpmvsCreate(vfylevel, vsflags, keyring);
- struct vfydata_s vd = {
- .msg = NULL,
- .type = { -1, -1, -1, },
- .vfylevel = vfylevel,
- };
- int verified = 0;
- rpmRC prc = RPMRC_FAIL;
-
rpmtsNotify(ts, p, RPMCALLBACK_VERIFY_PROGRESS, oc++, total);
- FD_t fd = rpmtsNotify(ts, p, RPMCALLBACK_INST_OPEN_FILE, 0, 0);
- if (fd != NULL) {
- prc = rpmpkgRead(vs, fd, NULL, NULL, &vd.msg);
- rpmtsNotify(ts, p, RPMCALLBACK_INST_CLOSE_FILE, 0, 0);
- }
-
- if (prc == RPMRC_OK)
- prc = rpmvsVerify(vs, RPMSIG_VERIFIABLE_TYPE, vfyCb, &vd);
-
- /* Record verify result */
- if (vd.type[RPMSIG_SIGNATURE_TYPE] == RPMRC_OK)
- verified |= RPMSIG_SIGNATURE_TYPE;
- if (vd.type[RPMSIG_DIGEST_TYPE] == RPMRC_OK)
- verified |= RPMSIG_DIGEST_TYPE;
- rpmteSetVerified(p, verified);
-
- if (prc)
- rpmteAddProblem(p, RPMPROB_VERIFY, NULL, vd.msg, 0);
-
- vd.msg = _free(vd.msg);
+ verifyPackage(ts, p, vs, vfylevel);
rpmvsFree(vs);
}
rpmtsNotify(ts, NULL, RPMCALLBACK_VERIFY_STOP, total, total);
diff --git a/macros.in b/macros.in
index f2a28fa57..8240e9613 100644
--- a/macros.in
+++ b/macros.in
@@ -679,6 +679,23 @@ Supplements: (%{name} = %{version}-%{release} and langpacks-%{1})\
# Disabler flags for package verification (similar to vsflags)
%_pkgverify_flags 0x0
+# A colon separated list of hash algorithms to calculate digests on the entire
+# package files during verification. The calculated digests are stored in the
+# Packagedigests tag of packages in the rpmdb, and the corresponding algorithms
+# in in the Packagedigestalgos tag. No package digests are calculated or stored
+# if --noverify is used during package installation.
+#
+# The following hash algorithms are known to rpm, but availability can vary
+# depending how rpm and it's underlying libraries have been built:
+#
+# 1 MD5 (obsolete)
+# 2 SHA1 (obsolete)
+# 8 SHA256
+# 9 SHA384
+# 10 SHA512
+#
+%_pkgverify_digests 8:10
+
# Minimize writes during transactions (at the cost of more reads) to
# conserve eg SSD disks (EXPERIMENTAL).
# 1 enable
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 8e3a6f3c5..6f26a8fa8 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -42,6 +42,7 @@ set(TESTSUITE_AT
rpmreplace.at
rpmmacro.at
rpmpython.at
+ rpmpython2.at
rpmdepmatch.at
rpmscript.at
rpmsigdig.at
diff --git a/tests/mktree.common b/tests/mktree.common
index 80c359f7e..e6ecfca87 100644
--- a/tests/mktree.common
+++ b/tests/mktree.common
@@ -19,6 +19,7 @@ make_install()
mkdir -p $DESTDIR/$script_dir
cp rpmtests atlocal mktree.common $DESTDIR/$script_dir/
cp @CMAKE_CURRENT_SOURCE_DIR@/rpmtests.sh $DESTDIR/$script_dir/
+ cp @CMAKE_CURRENT_SOURCE_DIR@/prpm.py $DESTDIR/@CMAKE_INSTALL_BINDIR@
mkdir -p $DESTDIR/build
ln -sf ../data/SOURCES $DESTDIR/build/
diff --git a/tests/prpm.py b/tests/prpm.py
new file mode 100755
index 000000000..b11297675
--- /dev/null
+++ b/tests/prpm.py
@@ -0,0 +1,80 @@
+#!/usr/bin/python3
+
+import rpm
+import argparse
+
+class transCb:
+ fds = {}
+
+ def __call__(self, what, amount, total, key, data):
+ if what == rpm.RPMCALLBACK_INST_OPEN_FILE:
+ f = open(key, 'rb')
+ self.fds[key] = f
+ return f.fileno()
+ elif what == rpm.RPMCALLBACK_INST_CLOSE_FILE:
+ del self.fds[key]
+
+def doprobs(ts):
+ for p in ts.problems():
+ print(p)
+
+def runts(ts):
+ probs = ts.run(transCb(), "")
+ if probs:
+ doprobs(ts)
+ return 1
+ return 0
+
+if __name__ == '__main__':
+ parser = argparse.ArgumentParser()
+ parser.add_argument('-i', '--install', nargs='+', default=[])
+ parser.add_argument('-u', '--upgrade', nargs='+', default=[])
+ parser.add_argument('-e', '--erase', nargs='+', default=[])
+ parser.add_argument('-r', '--reinstall', nargs='+', default=[])
+ parser.add_argument('-R', '--restore', nargs='+', default=[])
+ parser.add_argument('--root', default='/', action='store')
+ parser.add_argument('-n', '--dry-run', action='store_true')
+ parser.add_argument('--nosignature', action='store_true')
+ parser.add_argument('--nodeps', action='store_true')
+ parser.add_argument('--noorder', action='store_true')
+ parser.add_argument('-v', '--verbose', action='store_true')
+ args = parser.parse_args()
+
+ ts = rpm.ts(args.root)
+ ovflags = ts.setVSFlags(ts.getVSFlags() | rpm.RPMVSF_MASK_NOSIGNATURES)
+ for arg in args.install:
+ ts.addInstall(arg, arg, 'i')
+ for arg in args.upgrade:
+ ts.addInstall(arg, arg, 'u')
+ for arg in args.reinstall:
+ ts.addReinstall(arg, arg)
+ for arg in args.restore:
+ ts.addRestore(arg, arg)
+ for arg in args.erase:
+ ts.addErase(arg)
+ ts.setVSFlags(ovflags)
+
+ if args.nosignature:
+ ts.setVfyLevel(rpm.RPMSIG_DIGEST_TYPE)
+
+ if not args.noorder:
+ ts.order()
+
+ if not args.nodeps:
+ rc = ts.check()
+ if rc:
+ doprobs(ts)
+ exit(rc)
+
+ oflags = ts.setFlags(rpm.RPMTRANS_FLAG_TEST)
+ if args.verbose:
+ print("Testing")
+ rc = runts(ts)
+ ts.setFlags(oflags)
+
+ if rc == 0 and not args.dry_run:
+ if args.verbose:
+ print("Committing")
+ rc = runts(ts)
+
+ exit(rc)
diff --git a/tests/rpmgeneral.at b/tests/rpmgeneral.at
index 1951d2f9f..a1342eff8 100644
--- a/tests/rpmgeneral.at
+++ b/tests/rpmgeneral.at
@@ -199,6 +199,8 @@ ORIGDIRNAMES
ORIGFILENAMES
OS
P
+PACKAGEDIGESTALGOS
+PACKAGEDIGESTS
PACKAGER
PATCH
PATCHESFLAGS
diff --git a/tests/rpmi.at b/tests/rpmi.at
index 2a571184e..87eb4fbf9 100644
--- a/tests/rpmi.at
+++ b/tests/rpmi.at
@@ -44,6 +44,7 @@ runroot rpm -U --ignorearch --ignoreos --nodeps \
[0],
[],
[])
+
RPMTEST_CLEANUP
AT_SETUP([rpm -U <manifest glob fallback>])
diff --git a/tests/rpmpython2.at b/tests/rpmpython2.at
new file mode 100644
index 000000000..fe6315a43
--- /dev/null
+++ b/tests/rpmpython2.at
@@ -0,0 +1,41 @@
+
+AT_SETUP([prpm install])
+AT_KEYWORDS([install python])
+AT_SKIP_IF([$PYTHON_DISABLED])
+RPMDB_INIT
+
+RPMTEST_CHECK([
+runroot_other prpm.py --nodeps --nosignature \
+ -i /data/RPMS/hello-2.0-1.x86_64.rpm
+],
+[0],
+[],
+[])
+
+RPMTEST_CHECK([[
+runroot rpm -qa --qf "[%{packagedigestalgos:hashalgo} %{packagedigests}\n]"
+]],
+[0],
+[SHA256 e05a5191e214b1f05ae2448ebe493e55c6313ab68eaf040b83baa80e25f15d54
+SHA512 5e0a11bf9c4f353b9197446d722e66cc322030e164929356e3fb669201597be77f3a44b4bd6f4fddf8746768809b43dae28f4fad1de315ef42a78e130847eb05
+],
+[])
+
+RPMTEST_CHECK([
+runroot_other prpm.py --nodeps --nosignature \
+ -i /data/RPMS/hlinktest-1.0-1.noarch.rpm \
+ -e hello
+],
+[0],
+[],
+[])
+
+RPMTEST_CHECK([
+runroot rpm -qa
+],
+[0],
+[hlinktest-1.0-1.noarch
+],
+[])
+
+RPMTEST_CLEANUP
diff --git a/tests/rpmquery.at b/tests/rpmquery.at
index 8263fe9ba..7d604ad6e 100644
--- a/tests/rpmquery.at
+++ b/tests/rpmquery.at
@@ -420,6 +420,21 @@ runroot rpm \
])
RPMTEST_CLEANUP
+AT_SETUP([hashalgo extension])
+AT_KEYWORDS([query digest])
+RPMTEST_CHECK([
+rpm -q \
+ --qf "%{filedigestalgo:hashalgo}\n" \
+ --qf "%{longsize:hashalgo}\n" \
+ "${RPMTEST}"/data/RPMS/hello-2.0-1.x86_64.rpm
+],
+[0],
+[SHA256
+Unknown
+],
+[])
+RPMTEST_CLEANUP
+
# ------------------------------
AT_SETUP([integer array perms format query])
AT_KEYWORDS([query])
diff --git a/tests/rpmsigdig.at b/tests/rpmsigdig.at
index a9c55a654..9111befe0 100644
--- a/tests/rpmsigdig.at
+++ b/tests/rpmsigdig.at
@@ -1192,3 +1192,39 @@ rpm -qp --qf "[%{filenames}:%{filesignatures}\n]" hello-2.0-1.x86_64-badima.rpm
],
[])
RPMTEST_CLEANUP
+
+AT_SETUP([package verification digest])
+AT_KEYWORDS([install digest verify])
+
+RPMTEST_CHECK([
+RPMDB_INIT
+runroot rpm -U \
+ --define "_pkgverify_digests aa:bb:zz" \
+ --ignorearch --ignoreos --nodeps --nosignature --justdb \
+ /data/RPMS/hello-2.0-1.{i686,x86_64}.rpm
+
+runroot rpm -qa --qf "[[%{packagedigestalgos} %{packagedigests}\n]]" | sort -n
+],
+[0],
+[],
+[])
+
+RPMTEST_CHECK([
+RPMDB_INIT
+runroot rpm -U \
+ --define "_pkgverify_digests 2:8:12345:10" \
+ --ignorearch --ignoreos --nodeps --nosignature --justdb \
+ /data/RPMS/hello-2.0-1.{i686,x86_64}.rpm
+
+runroot rpm -qa --qf "[[%{packagedigestalgos:hashalgo} %{packagedigests}\n]]" | sort -n
+],
+[0],
+[SHA1 70d8bfc198823acdec9b3d793770e12ead6ae047
+SHA1 7299fad790a49e571a7ec4d60bef5d51597085fa
+SHA256 3328b90a578d18dba45abc584395795115c6c024abd561ce533ec175619925ff
+SHA256 e05a5191e214b1f05ae2448ebe493e55c6313ab68eaf040b83baa80e25f15d54
+SHA512 4db194ba2cb8b5e5cbb6f8d0dc1ec50be15cb20cdefa74b2b14a74032789b7411f4365dc4e69c7e3e37882f549d5f6e91b863eb51629e6ab72438e54b8eeedf5
+SHA512 5e0a11bf9c4f353b9197446d722e66cc322030e164929356e3fb669201597be77f3a44b4bd6f4fddf8746768809b43dae28f4fad1de315ef42a78e130847eb05
+],
+[])
+RPMTEST_CLEANUP
diff --git a/tests/rpmtests.at b/tests/rpmtests.at
index d675452e4..4fbc70fc6 100644
--- a/tests/rpmtests.at
+++ b/tests/rpmtests.at
@@ -4,6 +4,7 @@ m4_include([rpmvercmp.at])
m4_include([rpmmacro.at])
m4_include([rpmdevel.at])
m4_include([rpmpython.at])
+m4_include([rpmpython2.at])
m4_include([rpmdepmatch.at])
m4_include([rpmquery.at])
m4_include([rpmspec.at])
--
2.49.0
diff -up rpm-4.19.1.1/docs/man/rpm.8.orig rpm-4.19.1.1/docs/man/rpm.8
--- rpm-4.19.1.1/docs/man/rpm.8.orig 2025-04-24 14:18:03.652976012 +0200
+++ rpm-4.19.1.1/docs/man/rpm.8 2025-04-24 14:18:22.279864710 +0200
@@ -479,6 +479,9 @@ Format file state.
\f[B]:fstatus\f[R]
Format file verify status.
.TP
+\f[B]:hashalgo\f[R]
+Display hash algorithm name.
+.TP
\f[B]:hex\f[R]
Format in hexadecimal.
.TP

163
0002-Add-support-for-spec-local-file-attributes-and-gener.patch Normal file
View File

@ -0,0 +1,163 @@
From 75122bd6421526f41ad784036f63a022e9aca4b5 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Thu, 15 Feb 2024 09:26:38 +0200
Subject: [PATCH 2/2] Add support for spec local file attributes and generators
Allow declaring file attributes from the spec via %_local_file_attrs
macro. This allows enabling file attributes and their dependency
generators even if they are only shipped in the package itself and are
not yet installed.
The names need to be separated by colons (:).
Co-authored-by: Florian Festi <ffesti@redhat.com>
Backported from commits:
d3b7b0e3280dbc66bd39cd851af32f16fd863f1b
c167ef8bdaecdd2e306ec896c919607ba9cceb6f
Fixes: RHEL-84057
---
build/rpmfc.c | 32 +++++++++++++----
docs/manual/dependency_generators.md | 10 ++++++
tests/rpmbuild.at | 52 ++++++++++++++++++++++++++++
3 files changed, 88 insertions(+), 6 deletions(-)
diff --git a/build/rpmfc.c b/build/rpmfc.c
index 4b67a9bae..fb07f6626 100644
--- a/build/rpmfc.c
+++ b/build/rpmfc.c
@@ -1124,20 +1124,40 @@ static int initAttrs(rpmfc fc)
ARGV_t files = NULL;
char * attrPath = rpmExpand("%{_fileattrsdir}/*.attr", NULL);
int nattrs = 0;
+ ARGV_t all_attrs = NULL;
- /* Discover known attributes from pathnames + initialize them */
+ /* Discover known attributes from pathnames */
if (rpmGlob(attrPath, NULL, &files) == 0) {
- nattrs = argvCount(files);
- fc->atypes = xcalloc(nattrs + 1, sizeof(*fc->atypes));
- for (int i = 0; i < nattrs; i++) {
+ int nfiles = argvCount(files);
+ for (int i = 0; i < nfiles; i++) {
char *bn = basename(files[i]);
bn[strlen(bn)-strlen(".attr")] = '\0';
- fc->atypes[i] = rpmfcAttrNew(bn);
+ argvAdd(&all_attrs, bn);
}
- fc->atypes[nattrs] = NULL;
argvFree(files);
}
+
+ /* Get file attributes from _local_file_attrs macro */
+ char * local_attr_names = rpmExpand("%{?_local_file_attrs}", NULL);
+ ARGV_t local_attrs = argvSplitString(local_attr_names, ":", ARGV_SKIPEMPTY);
+ int nlocals = argvCount(local_attrs);
+ for (int i = 0; i < nlocals; i++) {
+ argvAddUniq(&all_attrs, local_attrs[i]);
+ }
+
+ /* Initialize attr objects */
+ nattrs = argvCount(all_attrs);
+ fc->atypes = xcalloc(nattrs + 1, sizeof(*fc->atypes));
+
+ for (int i = 0; i < nattrs; i++) {
+ fc->atypes[i] = rpmfcAttrNew(all_attrs[i]);
+ }
+ fc->atypes[nattrs] = NULL;
+
free(attrPath);
+ free(local_attr_names);
+ argvFree(local_attrs);
+ argvFree(all_attrs);
return nattrs;
}
diff --git a/docs/manual/dependency_generators.md b/docs/manual/dependency_generators.md
index 5538bb4c7..0f851fc50 100644
--- a/docs/manual/dependency_generators.md
+++ b/docs/manual/dependency_generators.md
@@ -116,6 +116,16 @@ shelling out to execute a script that calls `basename`:
%__foo_provides() %{basename:%{1}}
```
+## Using File Attributes in their own Package
+
+Normally file attributes and their dependency generators are shipped in separate packages that need to be installed before the package making use of them can be build.
+
+Since rpm 4.20 the names of file attributes from the package itself can be put into the *_local_file_attrs* macro separated by colons (:). The macros that normally go into the *\*.attr* files still need to be defined (the dependency generators typically pointing to some Source files or some files in the install root).
+
+This mechanism can be used for both file attributes the package ships to be installed but also for file attributes that are used during the own building process only.
+
+For the former packagers need to be aware that a previus version of the package might be installed on the system the package is build on. Thus the Spec file must set all macros used in the past and undefine the ones not longer being used.
+
## Tweaking Dependency Generators
Technically, all aspects of file attributes and the generator helpers they use can be overridden from spec by (re)defining the related macros, but packagers should generally avoid this, as the attributes and their names are subject to change, depending on rpm version and which packages are present during build. Unwanted dependencies can be filtered with a separate set of macros which are intended primarily for use in spec files:
diff --git a/tests/rpmbuild.at b/tests/rpmbuild.at
index ad7c40600..5bd8ee402 100644
--- a/tests/rpmbuild.at
+++ b/tests/rpmbuild.at
@@ -913,6 +913,58 @@ runroot rpm -qp --requires /build/RPMS/noarch/shebang-0.1-1.noarch.rpm|grep -v ^
[])
RPMTEST_CLEANUP
+AT_SETUP([Local dependency generator])
+AT_KEYWORDS([build])
+RPMTEST_CHECK([
+RPMDB_INIT
+
+runroot rpmbuild -bb --quiet \
+ --define '_local_file_attrs my_test_attr' \
+ --define '__my_test_attr_provides() foo(%{basename:%{1}})' \
+ --define '__my_test_attr_path .*' \
+ /data/SPECS/shebang.spec
+runroot rpm -qp --provides /build/RPMS/noarch/shebang-0.1-1.noarch.rpm|grep -v ^rpmlib
+],
+[0],
+[foo(shebang)
+shebang = 0.1-1
+],
+[])
+
+RPMTEST_CHECK([
+RPMDB_INIT
+
+runroot rpmbuild -bb --quiet \
+ --define '_local_file_attrs script' \
+ --define '__script_provides() foobar(%{basename:%{1}})' \
+ /data/SPECS/shebang.spec
+runroot rpm -qp --provides /build/RPMS/noarch/shebang-0.1-1.noarch.rpm|grep -v ^rpmlib
+],
+[0],
+[foobar(shebang)
+shebang = 0.1-1
+],
+[])
+
+RPMTEST_CHECK([
+RPMDB_INIT
+
+runroot rpmbuild -bb --quiet \
+ --define '_local_file_attrs my_test_attr:script' \
+ --define '__my_test_attr_provides() foo(%{basename:%{1}})' \
+ --define '__my_test_attr_path .*' \
+ --define '__script_provides() foobar(%{basename:%{1}})' \
+ /data/SPECS/shebang.spec
+runroot rpm -qp --provides /build/RPMS/noarch/shebang-0.1-1.noarch.rpm|grep -v ^rpmlib
+],
+[0],
+[foo(shebang)
+foobar(shebang)
+shebang = 0.1-1
+],
+[])
+RPMTEST_CLEANUP
+
AT_SETUP([elf dependencies])
AT_KEYWORDS([build])
RPMDB_INIT
--
2.49.0

32
0002-Fix-memory-leak-in-rpmspec-shell.patch Normal file
View File

@ -0,0 +1,32 @@
From 891a625246a19abd5aecfa534b630f2e7d15c8d5 Mon Sep 17 00:00:00 2001
From: Michal Domonkos <mdomonko@redhat.com>
Date: Thu, 17 Apr 2025 13:04:50 +0200
Subject: [PATCH 2/5] Fix memory leak in rpmspec --shell
The history(3) library allocates its own copy of the line string passed
to add_history() so we need to free it ourselves.
Found by Coverity.
(cherry picked from commit 96fe0562712227c1764f2bae27f1b138dda7e032)
Fixes: RHEL-55284
---
tools/rpmspec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/rpmspec.c b/tools/rpmspec.c
index cf58de80e..2bf95684e 100644
--- a/tools/rpmspec.c
+++ b/tools/rpmspec.c
@@ -74,6 +74,7 @@ static int doShell(rpmSpec spec)
free(exp);
if (*line)
add_history(line);
+ free(line);
}
return 0;
}
--
2.49.0

37
0003-Fix-memory-leak-in-runGPG.patch Normal file
View File

@ -0,0 +1,37 @@
From 0f1731d648ff37d06bf711c84459b254047b23e0 Mon Sep 17 00:00:00 2001
From: Michal Domonkos <mdomonko@redhat.com>
Date: Tue, 22 Apr 2025 14:04:31 +0200
Subject: [PATCH 3/5] Fix memory leak in runGPG()
Downstream only patch, upstream no longer uses gpg_path here after
commit 7f2c7136af575ba4854e579f3df547051a2eecfc.
Fixes: RHEL-82284
---
sign/rpmgensig.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 576e77f7d..f0b4dc891 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -237,7 +237,7 @@ static int runGPG(sigTarget sigt, const char *sigfile)
int using_gpg = (strstr(out, "GnuPG") != NULL);
if (using_gpg) {
const char *tty = ttyname(STDIN_FILENO);
- const char *gpg_path = NULL;
+ char *gpg_path = NULL;
if (!getenv("GPG_TTY") && (!tty || setenv("GPG_TTY", tty, 0)))
rpmlog(RPMLOG_WARNING, _("Could not set GPG_TTY to stdin: %m\n"));
@@ -245,6 +245,7 @@ static int runGPG(sigTarget sigt, const char *sigfile)
gpg_path = rpmExpand("%{?_gpg_path}", NULL);
if (gpg_path && *gpg_path != '\0')
(void) setenv("GNUPGHOME", gpg_path, 1);
+ free(gpg_path);
}
free(out);
--
2.49.0

115
0004-Talk-about-rpmsign-in-the-rpmsign-man-page.patch Normal file
View File

@ -0,0 +1,115 @@
From 9bb13c129ebd399645d173e51a5819bb9969e7c2 Mon Sep 17 00:00:00 2001
From: Florian Festi <ffesti@redhat.com>
Date: Wed, 12 Jun 2024 15:46:12 +0200
Subject: [PATCH 4/5] Talk about rpmsign in the rpmsign man page
In the past handling signatures was done by the rpm / rpmbuild binaries
directly. When this functionality was split into rpmsign the man page
was not adjusted accoringly. This is the long overdue update.
(cherry picked from commit 8e1f55c7004e8c1a7d9140ab2dd9456a7ace3e77)
Fixes: RHEL-73173
---
docs/man/rpmsign.8.md | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/docs/man/rpmsign.8.md b/docs/man/rpmsign.8.md
index 04d6855e7..339e28451 100644
--- a/docs/man/rpmsign.8.md
+++ b/docs/man/rpmsign.8.md
@@ -15,12 +15,12 @@ SYNOPSIS
SIGNING PACKAGES:
-----------------
-**rpm** **\--addsign\|\--resign** \[**rpmsign-options**\] *PACKAGE\_FILE
+**rpmsign** **\--addsign\|\--resign** \[**rpmsign-options**\] *PACKAGE\_FILE
\...*
-**rpm** **\--delsign** *PACKAGE\_FILE \...*
+**rpmsign** **\--delsign** *PACKAGE\_FILE \...*
-**rpm** **\--delfilesign** *PACKAGE\_FILE \...*
+**rpmsign** **\--delfilesign** *PACKAGE\_FILE \...*
rpmsign-options
---------------
@@ -35,14 +35,14 @@ new signatures for each package *PACKAGE\_FILE* given, replacing any
existing signatures. There are two options for historical reasons, there
is no difference in behavior currently.
-To create a signature rpm needs to verify the package\'s checksum. As a
+To create a signature rpmsign needs to verify the package\'s checksum. As a
result packages with a MD5/SHA1 checksums cannot be signed in FIPS mode.
-**rpm** **\--delsign** *PACKAGE\_FILE \...*
+**rpmsign** **\--delsign** *PACKAGE\_FILE \...*
Delete all signatures from each package *PACKAGE\_FILE* given.
-**rpm** **\--delfilesign** *PACKAGE\_FILE \...*
+**rpmsign** **\--delfilesign** *PACKAGE\_FILE \...*
Delete all IMA and fsverity file signatures from each package
*PACKAGE\_FILE* given.
@@ -54,7 +54,7 @@ SIGN OPTIONS
: Force RPM V3 header+payload signature addition. These are expensive
and redundant baggage on packages where a separate payload digest
- exists (packages built with rpm \>= 4.14). Rpm will automatically
+ exists (packages built with rpm \>= 4.14). Rpmsign will automatically
detect the need for V3 signatures, but this option can be used to
force their creation if the packages must be fully signature
verifiable with rpm \< 4.14 or other interoperability reasons.
--
2.49.0
diff -up rpm-4.19.1.1/docs/man/rpmsign.8.orig rpm-4.19.1.1/docs/man/rpmsign.8
--- rpm-4.19.1.1/docs/man/rpmsign.8.orig 2025-04-24 12:35:05.722684233 +0200
+++ rpm-4.19.1.1/docs/man/rpmsign.8 2025-04-24 12:42:46.963922808 +0200
@@ -22,12 +22,12 @@ rpmsign - RPM Package Signing
.SH SYNOPSIS
.SS SIGNING PACKAGES:
.PP
-\f[B]rpm\f[R] \f[B]--addsign|--resign\f[R] [\f[B]rpmsign-options\f[R]]
-\f[I]PACKAGE_FILE ...\f[R]
+\f[B]rpmsign\f[R] \f[B]--addsign|--resign\f[R]
+[\f[B]rpmsign-options\f[R]] \f[I]PACKAGE_FILE ...\f[R]
.PP
-\f[B]rpm\f[R] \f[B]--delsign\f[R] \f[I]PACKAGE_FILE ...\f[R]
+\f[B]rpmsign\f[R] \f[B]--delsign\f[R] \f[I]PACKAGE_FILE ...\f[R]
.PP
-\f[B]rpm\f[R] \f[B]--delfilesign\f[R] \f[I]PACKAGE_FILE ...\f[R]
+\f[B]rpmsign\f[R] \f[B]--delfilesign\f[R] \f[I]PACKAGE_FILE ...\f[R]
.SS rpmsign-options
.PP
[\f[B]--rpmv3\f[R]] [\f[B]--fskpath \f[R]\f[I]KEY\f[R]]
@@ -40,15 +40,16 @@ replacing any existing signatures.
There are two options for historical reasons, there is no difference in
behavior currently.
.PP
-To create a signature rpm needs to verify the package\[aq]s checksum.
+To create a signature rpmsign needs to verify the package\[aq]s
+checksum.
As a result packages with a MD5/SHA1 checksums cannot be signed in FIPS
mode.
.PP
-\f[B]rpm\f[R] \f[B]--delsign\f[R] \f[I]PACKAGE_FILE ...\f[R]
+\f[B]rpmsign\f[R] \f[B]--delsign\f[R] \f[I]PACKAGE_FILE ...\f[R]
.PP
Delete all signatures from each package \f[I]PACKAGE_FILE\f[R] given.
.PP
-\f[B]rpm\f[R] \f[B]--delfilesign\f[R] \f[I]PACKAGE_FILE ...\f[R]
+\f[B]rpmsign\f[R] \f[B]--delfilesign\f[R] \f[I]PACKAGE_FILE ...\f[R]
.PP
Delete all IMA and fsverity file signatures from each package
\f[I]PACKAGE_FILE\f[R] given.
@@ -58,7 +59,7 @@ Delete all IMA and fsverity file signatu
Force RPM V3 header+payload signature addition.
These are expensive and redundant baggage on packages where a separate
payload digest exists (packages built with rpm >= 4.14).
-Rpm will automatically detect the need for V3 signatures, but this
+Rpmsign will automatically detect the need for V3 signatures, but this
option can be used to force their creation if the packages must be fully
signature verifiable with rpm < 4.14 or other interoperability reasons.
.TP

120
0005-Revert-Drop-redundant-argument-from-rpmcliTransactio.patch Normal file
View File

@ -0,0 +1,120 @@
From d09149df374b0faad1d58843369b461a35ec286b Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Wed, 16 Apr 2025 12:16:41 +0300
Subject: [PATCH 5/5] Revert "Drop redundant argument from rpmcliTransaction()"
This reverts commit 99f8997082637889e6ef08c7893d583cfaea2f04.
The transaction does know the number of elements alright, but updates
are tracked as two elements so the exit code on a failed update of one
package becomes 2 which seems wrong. Just revert the change, it wasn't
a big cleanup anyhow, the alternative of filtering out update-related
erasures from the transaction would only be more code.
--restore was added in the meanwhile so a plain revert doesn't suffice.
In the case of --restore the number of elements is always simply the
elements in transaction so we can just use rpmtsNElements() for that.
Backported from commits:
c1b33879a7284cf311fa68d88f8df54b00a207ac
7931850da430c6187c3557a0dbecf753bb5be490
Fixes: RHEL-87384
---
lib/rpminstall.c | 10 +++++-----
tests/data/SPECS/deptest.spec | 4 +++-
tests/rpmdeps.at | 14 ++++++++++++++
3 files changed, 22 insertions(+), 6 deletions(-)
diff --git a/lib/rpminstall.c b/lib/rpminstall.c
index 4c49507db..c7510dabb 100644
--- a/lib/rpminstall.c
+++ b/lib/rpminstall.c
@@ -252,10 +252,10 @@ struct rpmEIU {
rpmRC rpmrc;
};
-static int rpmcliTransaction(rpmts ts, struct rpmInstallArguments_s * ia)
+static int rpmcliTransaction(rpmts ts, struct rpmInstallArguments_s * ia,
+ int numPackages)
{
rpmps ps;
- int numPackages = rpmtsNElements(ts);
int rc = 0;
int stop = 0;
@@ -650,7 +650,7 @@ restart:
if (eiu->numFailed) goto exit;
if (eiu->numRPMS) {
- int rc = rpmcliTransaction(ts, ia);
+ int rc = rpmcliTransaction(ts, ia, eiu->numPkgs);
if (rc < 0)
eiu->numFailed += eiu->numRPMS;
else if (rc > 0)
@@ -756,7 +756,7 @@ int rpmErase(rpmts ts, struct rpmInstallArguments_s * ia, ARGV_const_t argv)
free(qfmt);
if (numFailed) goto exit;
- numFailed = rpmcliTransaction(ts, ia);
+ numFailed = rpmcliTransaction(ts, ia, numPackages);
exit:
rpmtsEmpty(ts);
rpmtsSetVSFlags(ts, ovsflags);
@@ -784,7 +784,7 @@ int rpmRestore(rpmts ts, struct rpmInstallArguments_s * ia, ARGV_const_t argv)
rc = rpmcliArgIter(ts, qva, argv);
if (rc == 0) {
- rc = rpmcliTransaction(ts, ia);
+ rc = rpmcliTransaction(ts, ia, rpmtsNElements(ts));
}
rpmtsEmpty(ts);
diff --git a/tests/data/SPECS/deptest.spec b/tests/data/SPECS/deptest.spec
index 164571a40..5a1ecdc55 100644
--- a/tests/data/SPECS/deptest.spec
+++ b/tests/data/SPECS/deptest.spec
@@ -1,5 +1,7 @@
+%{?!ver:%define ver 1.0}
+
Name: deptest-%{pkg}
-Version: 1.0
+Version: %{ver}
Release: 1
Summary: Testing dependency behavior
diff --git a/tests/rpmdeps.at b/tests/rpmdeps.at
index f839a5fad..fac541325 100644
--- a/tests/rpmdeps.at
+++ b/tests/rpmdeps.at
@@ -17,6 +17,11 @@ runroot rpmbuild --quiet -bb \
--define "reqs deptest-one" \
/data/SPECS/deptest.spec
+runroot rpmbuild --quiet -bb \
+ --define "pkg two" \
+ --define "ver 2.0" \
+ --define "reqs deptest-one deptest-not" \
+ /data/SPECS/deptest.spec
# missing dependency
RPMTEST_CHECK([
RPMDB_INIT
@@ -38,6 +43,15 @@ runroot rpm -U /build/RPMS/noarch/deptest-one-1.0-1.noarch.rpm /build/RPMS/noarc
[0],
[],
[])
+
+RPMTEST_CHECK([
+runroot rpm -U /build/RPMS/noarch/deptest-two-2.0-1.noarch.rpm
+],
+[1],
+[],
+[error: Failed dependencies:
+ deptest-not is needed by deptest-two-2.0-1.noarch
+])
RPMTEST_CLEANUP
# ------------------------------
--
2.49.0

2157
rpm-4.19.x-multisig.patch Normal file
View File

File diff suppressed because it is too large Load Diff

668
rpm-4.19.x-pqc-algo.patch Normal file
View File

@ -0,0 +1,668 @@
From 9eac03ec09efca60810ea2b655f0f25edc86890b Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 3 Dec 2024 10:44:46 +0200
Subject: [PATCH 1/8] Add support for SHA3-256 and SHA3-512
Sequoia doesn't yet support SHA3 so we need to skip it in the default
CI tests. Tests verified locally with libgrypt and openssl builds.
Fixes: #3436
(backported from commit 9344367edf654fb41a136793b68cea9abb892fb9)
---
include/rpm/rpmcrypto.h | 11 +++++++----
include/rpm/rpmpgp.h | 11 +++++++----
macros.in | 2 ++
rpmio/digest_libgcrypt.c | 8 ++++++++
rpmio/digest_openssl.c | 6 ++++++
5 files changed, 30 insertions(+), 8 deletions(-)
diff --git a/include/rpm/rpmcrypto.h b/include/rpm/rpmcrypto.h
index 69d329f37..d8e31a222 100644
--- a/include/rpm/rpmcrypto.h
+++ b/include/rpm/rpmcrypto.h
@@ -23,10 +23,13 @@ typedef enum rpmHashAlgo_e {
RPM_HASH_MD2 = 5, /*!< MD2 */
RPM_HASH_TIGER192 = 6, /*!< TIGER192 */
RPM_HASH_HAVAL_5_160 = 7, /*!< HAVAL-5-160 */
- RPM_HASH_SHA256 = 8, /*!< SHA256 */
- RPM_HASH_SHA384 = 9, /*!< SHA384 */
- RPM_HASH_SHA512 = 10, /*!< SHA512 */
- RPM_HASH_SHA224 = 11, /*!< SHA224 */
+ RPM_HASH_SHA256 = 8, /*!< SHA2-256 */
+ RPM_HASH_SHA384 = 9, /*!< SHA2-384 */
+ RPM_HASH_SHA512 = 10, /*!< SHA2-512 */
+ RPM_HASH_SHA224 = 11, /*!< SHA2-224 */
+ RPM_HASH_SHA3_256 = 12, /*!< SHA3-256 */
+ /*!< reserved */
+ RPM_HASH_SHA3_512 = 14, /*!< SHA3-512 */
} rpmHashAlgo;
/** \ingroup rpmcrypto
diff --git a/include/rpm/rpmpgp.h b/include/rpm/rpmpgp.h
index a7eecbebf..1f356f412 100644
--- a/include/rpm/rpmpgp.h
+++ b/include/rpm/rpmpgp.h
@@ -266,10 +266,13 @@ typedef enum pgpHashAlgo_e {
PGPHASHALGO_MD2 = 5, /*!< MD2 */
PGPHASHALGO_TIGER192 = 6, /*!< TIGER192 */
PGPHASHALGO_HAVAL_5_160 = 7, /*!< HAVAL-5-160 */
- PGPHASHALGO_SHA256 = 8, /*!< SHA256 */
- PGPHASHALGO_SHA384 = 9, /*!< SHA384 */
- PGPHASHALGO_SHA512 = 10, /*!< SHA512 */
- PGPHASHALGO_SHA224 = 11, /*!< SHA224 */
+ PGPHASHALGO_SHA256 = 8, /*!< SHA2-256 */
+ PGPHASHALGO_SHA384 = 9, /*!< SHA2-384 */
+ PGPHASHALGO_SHA512 = 10, /*!< SHA2-512 */
+ PGPHASHALGO_SHA224 = 11, /*!< SHA2-224 */
+ PGPHASHALGO_SHA3_256 = 12, /*!< SHA3-256 */
+ /*!< 13 reserved */
+ PGPHASHALGO_SHA3_512 = 14, /*!< SHA3-256 */
} pgpHashAlgo;
/** \ingroup rpmpgp
diff --git a/macros.in b/macros.in
index 8240e9613..5534f1ed7 100644
--- a/macros.in
+++ b/macros.in
@@ -391,6 +391,8 @@ Supplements: (%{name} = %{version}-%{release} and langpacks-%{1})\
# 8 SHA256 (default)
# 9 SHA384
# 10 SHA512
+# 12 SHA3-256
+# 14 SHA3-512
#
%_source_filedigest_algorithm 8
%_binary_filedigest_algorithm 8
diff --git a/rpmio/digest_libgcrypt.c b/rpmio/digest_libgcrypt.c
index 1e815416d..07103cf18 100644
--- a/rpmio/digest_libgcrypt.c
+++ b/rpmio/digest_libgcrypt.c
@@ -46,6 +46,10 @@ size_t rpmDigestLength(int hashalgo)
return 48;
case RPM_HASH_SHA512:
return 64;
+ case RPM_HASH_SHA3_256:
+ return 32;
+ case RPM_HASH_SHA3_512:
+ return 64;
default:
return 0;
}
@@ -66,6 +70,10 @@ static int hashalgo2gcryalgo(int hashalgo)
return GCRY_MD_SHA384;
case RPM_HASH_SHA512:
return GCRY_MD_SHA512;
+ case RPM_HASH_SHA3_256:
+ return GCRY_MD_SHA3_256;
+ case RPM_HASH_SHA3_512:
+ return GCRY_MD_SHA3_512;
default:
return 0;
}
diff --git a/rpmio/digest_openssl.c b/rpmio/digest_openssl.c
index f8b12df93..8867441d0 100644
--- a/rpmio/digest_openssl.c
+++ b/rpmio/digest_openssl.c
@@ -72,6 +72,12 @@ static const EVP_MD *getEVPMD(int hashalgo)
case RPM_HASH_SHA224:
return EVP_sha224();
+ case RPM_HASH_SHA3_256:
+ return EVP_sha3_256();
+
+ case RPM_HASH_SHA3_512:
+ return EVP_sha3_512();
+
default:
return EVP_md_null();
}
--
2.50.1
From 3b172765d35ebab9333665daade71aba72a267d2 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 11 Mar 2025 17:16:19 +0200
Subject: [PATCH 2/8] Fix OpenPGP packet (tag 17) name & description
PGPTAG_PHOTOID is some early PGP-era legacy name for it, RFC-4880
already calls it "User attribute packet".
(cherry picked from commit e07341097f0b8361712fe3aafb59ac1f3e7af25d)
---
include/rpm/rpmpgp.h | 4 +++-
rpmio/rpmpgpval.h | 2 +-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/include/rpm/rpmpgp.h b/include/rpm/rpmpgp.h
index 1f356f412..6d07d0a17 100644
--- a/include/rpm/rpmpgp.h
+++ b/include/rpm/rpmpgp.h
@@ -62,7 +62,7 @@ typedef enum pgpTag_e {
PGPTAG_USER_ID = 13, /*!< User ID */
PGPTAG_PUBLIC_SUBKEY = 14, /*!< Public Subkey */
PGPTAG_COMMENT_OLD = 16, /*!< Comment (from OpenPGP draft) */
- PGPTAG_PHOTOID = 17, /*!< PGP's photo ID */
+ PGPTAG_USER_ATTRIBUTE = 17, /*!< User Attribute packet */
PGPTAG_ENCRYPTED_MDC = 18, /*!< Integrity protected encrypted data */
PGPTAG_MDC = 19, /*!< Manipulaion detection code packet */
PGPTAG_PRIVATE_60 = 60, /*!< Private or Experimental Values */
@@ -71,6 +71,8 @@ typedef enum pgpTag_e {
PGPTAG_CONTROL = 63 /*!< Control (GPG) */
} pgpTag;
+#define PGPTAG_PHOTOID PGPTAG_USER_ATTRIBUTE /* legacy name */
+
/** \ingroup rpmpgp
* 5.1. Public-Key Encrypted Session Key Packets (Tag 1)
*
diff --git a/rpmio/rpmpgpval.h b/rpmio/rpmpgpval.h
index ad8ed08e2..037db075e 100644
--- a/rpmio/rpmpgpval.h
+++ b/rpmio/rpmpgpval.h
@@ -140,7 +140,7 @@ static struct pgpValTbl_s const pgpTagTbl[] = {
{ PGPTAG_USER_ID, "User ID" },
{ PGPTAG_PUBLIC_SUBKEY, "Public Subkey" },
{ PGPTAG_COMMENT_OLD, "Comment (from OpenPGP draft)" },
- { PGPTAG_PHOTOID, "PGP's photo ID" },
+ { PGPTAG_USER_ATTRIBUTE, "User Attribute" },
{ PGPTAG_ENCRYPTED_MDC, "Integrity protected encrypted data" },
{ PGPTAG_MDC, "Manipulaion detection code packet" },
{ PGPTAG_PRIVATE_60, "Private #60" },
--
2.50.1
From e2bd1fbdaee9533ccee20a901fa11adf21155e82 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 11 Mar 2025 14:57:57 +0200
Subject: [PATCH 3/8] Add new tag and algorithm ID's and descriptions from
RFC-9580
While most of the details are handled by rpm-sequoia, rpm needs to know
at least the algorithm id's. Add the other tags while at it, it's not
much anyhow.
Also add the SHA3 description texts that were missing from
9344367edf654fb41a136793b68cea9abb892fb9
There's no way to test this stuff at this point though, we need to
wait until sequoia-pgp 2.0 and a compatible rpm-sequoia. OTOH some
implementations might need these symbols in place.
Fixes: #3631
(backported from commit c2f760188421351f5ac38ec6e18c3eb4daf2e750)
---
include/rpm/rpmpgp.h | 15 +++++++++++++--
rpmio/rpmpgpval.h | 13 +++++++++++++
2 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/include/rpm/rpmpgp.h b/include/rpm/rpmpgp.h
index 6d07d0a17..92f10e11d 100644
--- a/include/rpm/rpmpgp.h
+++ b/include/rpm/rpmpgp.h
@@ -65,6 +65,7 @@ typedef enum pgpTag_e {
PGPTAG_USER_ATTRIBUTE = 17, /*!< User Attribute packet */
PGPTAG_ENCRYPTED_MDC = 18, /*!< Integrity protected encrypted data */
PGPTAG_MDC = 19, /*!< Manipulaion detection code packet */
+ PGPTAG_PADDING = 21, /*!< Padding packet */
PGPTAG_PRIVATE_60 = 60, /*!< Private or Experimental Values */
PGPTAG_COMMENT = 61, /*!< Comment */
PGPTAG_PRIVATE_62 = 62, /*!< Private or Experimental Values */
@@ -137,7 +138,8 @@ typedef enum pgpSigType_e {
PGPSIGTYPE_KEY_REVOKE = 0x20, /*!< Key revocation */
PGPSIGTYPE_SUBKEY_REVOKE = 0x28, /*!< Subkey revocation */
PGPSIGTYPE_CERT_REVOKE = 0x30, /*!< Certification revocation */
- PGPSIGTYPE_TIMESTAMP = 0x40 /*!< Timestamp */
+ PGPSIGTYPE_TIMESTAMP = 0x40, /*!< Timestamp */
+ PGPSIGTYPE_THIRD_PARTY = 0x50, /*!< Third-Party Confirmation */
} pgpSigType;
/** \ingroup rpmpgp
@@ -174,7 +176,11 @@ typedef enum pgpPubkeyAlgo_e {
PGPPUBKEYALGO_ECDSA = 19, /*!< ECDSA */
PGPPUBKEYALGO_ELGAMAL = 20, /*!< Elgamal */
PGPPUBKEYALGO_DH = 21, /*!< Diffie-Hellman (X9.42) */
- PGPPUBKEYALGO_EDDSA = 22 /*!< EdDSA */
+ PGPPUBKEYALGO_EDDSA = 22, /*!< EdDSA */
+ PGPPUBKEYALGO_X25519 = 25, /*!< X25519 */
+ PGPPUBKEYALGO_X448 = 26, /*!< X448 */
+ PGPPUBKEYALGO_ED25519 = 27, /*!< Ed25519 */
+ PGPPUBKEYALGO_ED448 = 28, /*!< Ed448 */
} pgpPubkeyAlgo;
/** \ingroup rpmpgp
@@ -213,6 +219,9 @@ typedef enum pgpSymkeyAlgo_e {
PGPSYMKEYALGO_AES_192 = 8, /*!< AES(192-bit key) */
PGPSYMKEYALGO_AES_256 = 9, /*!< AES(256-bit key) */
PGPSYMKEYALGO_TWOFISH = 10, /*!< TWOFISH(256-bit key) */
+ PGPSYMKEYALGO_CAMELLIA_128 = 11, /*!< Camellia with 128-bit */
+ PGPSYMKEYALGO_CAMELLIA_192 = 12, /*!< Camellia with 192-bit */
+ PGPSYMKEYALGO_CAMELLIA_256 = 13, /*!< Camellia with 256-bit */
PGPSYMKEYALGO_NOENCRYPT = 110 /*!< no encryption */
} pgpSymkeyAlgo;
@@ -445,6 +454,8 @@ typedef enum pgpSubType_e {
PGPSUBTYPE_REVOKE_REASON = 29, /*!< reason for revocation */
PGPSUBTYPE_FEATURES = 30, /*!< feature flags (gpg) */
PGPSUBTYPE_EMBEDDED_SIG = 32, /*!< embedded signature (gpg) */
+ PGPSUBTYPE_INTREC_FINGERPRINT= 35, /*!< intended recipient fingerprint */
+ PGPSUBTYPE_PFERER_AEAD = 39, /*!< preferred AEAD ciphercuites */
PGPSUBTYPE_INTERNAL_100 = 100, /*!< internal or user-defined */
PGPSUBTYPE_INTERNAL_101 = 101, /*!< internal or user-defined */
diff --git a/rpmio/rpmpgpval.h b/rpmio/rpmpgpval.h
index 037db075e..2b139c2f3 100644
--- a/rpmio/rpmpgpval.h
+++ b/rpmio/rpmpgpval.h
@@ -25,6 +25,7 @@ static struct pgpValTbl_s const pgpSigTypeTbl[] = {
{ PGPSIGTYPE_SUBKEY_REVOKE, "Subkey revocation signature" },
{ PGPSIGTYPE_CERT_REVOKE, "Certification revocation signature" },
{ PGPSIGTYPE_TIMESTAMP, "Timestamp signature" },
+ { PGPSIGTYPE_THIRD_PARTY, "Third-Party Confirmation signature" },
{ -1, "Unknown signature type" },
};
@@ -39,6 +40,10 @@ static struct pgpValTbl_s const pgpPubkeyTbl[] = {
{ PGPPUBKEYALGO_ELGAMAL, "Elgamal" },
{ PGPPUBKEYALGO_DH, "Diffie-Hellman (X9.42)" },
{ PGPPUBKEYALGO_EDDSA, "EdDSA" },
+ { PGPPUBKEYALGO_X25519, "X25519" },
+ { PGPPUBKEYALGO_X448, "X448" },
+ { PGPPUBKEYALGO_ED25519, "Ed25519" },
+ { PGPPUBKEYALGO_ED448, "Ed448" },
{ -1, "Unknown public key algorithm" },
};
@@ -54,6 +59,9 @@ static struct pgpValTbl_s const pgpSymkeyTbl[] = {
{ PGPSYMKEYALGO_AES_192, "AES(192-bit key)" },
{ PGPSYMKEYALGO_AES_256, "AES(256-bit key)" },
{ PGPSYMKEYALGO_TWOFISH, "TWOFISH(256-bit key)" },
+ { PGPSYMKEYALGO_CAMELLIA_128,"Camellia(128-bit key)" },
+ { PGPSYMKEYALGO_CAMELLIA_192,"Camellia(192-bit key)" },
+ { PGPSYMKEYALGO_CAMELLIA_256,"Camellia(256-bit key)" },
{ PGPSYMKEYALGO_NOENCRYPT, "no encryption" },
{ -1, "Unknown symmetric key algorithm" },
};
@@ -77,6 +85,8 @@ static struct pgpValTbl_s const pgpHashTbl[] = {
{ PGPHASHALGO_SHA384, "SHA384" },
{ PGPHASHALGO_SHA512, "SHA512" },
{ PGPHASHALGO_SHA224, "SHA224" },
+ { PGPHASHALGO_SHA3_256, "SHA3-256" },
+ { PGPHASHALGO_SHA3_512, "SHA3-512" },
{ -1, "Unknown hash algorithm" },
};
@@ -109,6 +119,8 @@ static struct pgpValTbl_s const pgpSubTypeTbl[] = {
{ PGPSUBTYPE_REVOKE_REASON, "reason for revocation" },
{ PGPSUBTYPE_FEATURES, "features" },
{ PGPSUBTYPE_EMBEDDED_SIG, "embedded signature" },
+ { PGPSUBTYPE_INTREC_FINGERPRINT,"intended recipient fingerprint" },
+ { PGPSUBTYPE_PFERER_AEAD, "preferred AEAD ciphersuites" },
{ PGPSUBTYPE_INTERNAL_100, "internal subpkt type 100" },
{ PGPSUBTYPE_INTERNAL_101, "internal subpkt type 101" },
@@ -143,6 +155,7 @@ static struct pgpValTbl_s const pgpTagTbl[] = {
{ PGPTAG_USER_ATTRIBUTE, "User Attribute" },
{ PGPTAG_ENCRYPTED_MDC, "Integrity protected encrypted data" },
{ PGPTAG_MDC, "Manipulaion detection code packet" },
+ { PGPTAG_PADDING, "Padding" },
{ PGPTAG_PRIVATE_60, "Private #60" },
{ PGPTAG_COMMENT, "Comment" },
{ PGPTAG_PRIVATE_62, "Private #62" },
--
2.50.1
From 31fbcaebaac0ad4e3b863813833156d4e4d4b470 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Wed, 25 Jun 2025 13:32:49 +0300
Subject: [PATCH 4/8] Add algorithm ID's for PQC public key algorithms from the
current draft
PQC in OpenPGP is still just a draft [*], but these have been assigned and
unchanged since November 2024. If they change, the worst that can happen is
we show an incorrect string as the algorithm identification, rpm doesn't
use them in any other way. In the meanwhile, this lets us get meaningful
output when testing PQC stuff.
[*] https://github.com/openpgp-pqc/draft-openpgp-pqc/blob/main/draft-ietf-openpgp-pqc.md
Fixes: #3632
(cherry picked from commit 2659fb1fbcea28b703116e7de6a211729869cba6)
---
include/rpm/rpmpgp.h | 7 +++++++
rpmio/rpmpgpval.h | 7 +++++++
2 files changed, 14 insertions(+)
diff --git a/include/rpm/rpmpgp.h b/include/rpm/rpmpgp.h
index 92f10e11d..052fdb54a 100644
--- a/include/rpm/rpmpgp.h
+++ b/include/rpm/rpmpgp.h
@@ -181,6 +181,13 @@ typedef enum pgpPubkeyAlgo_e {
PGPPUBKEYALGO_X448 = 26, /*!< X448 */
PGPPUBKEYALGO_ED25519 = 27, /*!< Ed25519 */
PGPPUBKEYALGO_ED448 = 28, /*!< Ed448 */
+ PGPPUBKEYALGO_ML_DSA65_ED25519 = 30, /*!< ML-DSA-65+Ed25519 */
+ PGPPUBKEYALGO_ML_DSA87_ED448 = 31, /*!< ML-DSA-87+Ed448 */
+ PGPPUBKEYALGO_SLH_DSA_SHAKE_128S = 32, /*!< SLH-DSA-SHAKE-128s */
+ PGPPUBKEYALGO_SLH_DSA_SHAKE_128F = 33, /*!< SLH-DSA-SHAKE-128f */
+ PGPPUBKEYALGO_SLH_DSA_SHAKE_256S = 34, /*!< SLH-DSA-SHAKE-256s */
+ PGPPUBKEYALGO_ML_KEM768_X25519 = 35, /*!< ML-KEM-768+X25519 */
+ PGPPUBKEYALGO_ML_KEM1024_X448 = 36, /*!< ML-KEM-1024+X448 */
} pgpPubkeyAlgo;
/** \ingroup rpmpgp
diff --git a/rpmio/rpmpgpval.h b/rpmio/rpmpgpval.h
index 2b139c2f3..1f9429851 100644
--- a/rpmio/rpmpgpval.h
+++ b/rpmio/rpmpgpval.h
@@ -44,6 +44,13 @@ static struct pgpValTbl_s const pgpPubkeyTbl[] = {
{ PGPPUBKEYALGO_X448, "X448" },
{ PGPPUBKEYALGO_ED25519, "Ed25519" },
{ PGPPUBKEYALGO_ED448, "Ed448" },
+ { PGPPUBKEYALGO_ML_DSA65_ED25519, "ML-DSA-65+Ed25519" },
+ { PGPPUBKEYALGO_ML_DSA87_ED448, "ML-DSA-87+Ed448" },
+ { PGPPUBKEYALGO_SLH_DSA_SHAKE_128S, "SLH-DSA-SHAKE-128s" },
+ { PGPPUBKEYALGO_SLH_DSA_SHAKE_128F, "SLH-DSA-SHAKE-128f" },
+ { PGPPUBKEYALGO_SLH_DSA_SHAKE_256S, "SLH-DSA-SHAKE-256s" },
+ { PGPPUBKEYALGO_ML_KEM768_X25519, "ML-KEM-768+X25519" },
+ { PGPPUBKEYALGO_ML_KEM1024_X448, "ML-KEM-1024+X448" },
{ -1, "Unknown public key algorithm" },
};
--
2.50.1
From c4d7e3f95800af8a8765df542804b8481b540253 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 1 Jul 2025 11:48:12 +0300
Subject: [PATCH 5/8] Support updating individual IDs in a digest bundle
Up to now, rpm digest bundles have only needed to support data from a
single stream - just covering different ranges and algorithms. But
OpenPGP v6 signature salt is a random per-signature thing that we need
to feed into the digest before the actual data, so we need to be able to
update each ID in a bundle individually too.
Luckily this is easy to do. Add a small test-program to exercise it,
we can't yet actually use it for testing a real-world V6 scenario
anyway.
Fixes: #3845
(backported from commit 28e4f05c71202b2614619e9d9a51af9443014f34)
---
include/rpm/rpmcrypto.h | 11 +++++++++++
rpmio/digest.c | 13 +++++++++++++
2 files changed, 24 insertions(+)
diff --git a/include/rpm/rpmcrypto.h b/include/rpm/rpmcrypto.h
index d8e31a222..e9ab646fc 100644
--- a/include/rpm/rpmcrypto.h
+++ b/include/rpm/rpmcrypto.h
@@ -144,6 +144,17 @@ int rpmDigestBundleAddID(rpmDigestBundle bundle, int algo, int id,
*/
int rpmDigestBundleUpdate(rpmDigestBundle bundle, const void *data, size_t len);
+/** \ingroup rpmcrypto
+ * Update context of an individual ID within bundle with next plain text buffer.
+ * @param bundle digest bundle
+ * @param id id of digest (arbitrary, must be > 0)
+ * @param data next data buffer
+ * @param len no. bytes of data
+ * @return 0 on success
+ */
+int rpmDigestBundleUpdateID(rpmDigestBundle bundle, int id,
+ const void *data, size_t len);
+
/** \ingroup rpmcrypto
* Return digest from a bundle and destroy context, see rpmDigestFinal().
*
diff --git a/rpmio/digest.c b/rpmio/digest.c
index e60d171d7..ed1f318fa 100644
--- a/rpmio/digest.c
+++ b/rpmio/digest.c
@@ -91,6 +91,19 @@ int rpmDigestBundleUpdate(rpmDigestBundle bundle, const void *data, size_t len)
return rc;
}
+int rpmDigestBundleUpdateID(rpmDigestBundle bundle, int id,
+ const void *data, size_t len)
+{
+ int rc = -1;
+ int ix = -1;
+
+ if (bundle && data && len > 0 && id > 0) {
+ ix = findID(bundle, id);
+ if (ix >= 0)
+ rc = rpmDigestUpdate(bundle->digests[ix], data, len);
+ }
+ return rc;
+}
int rpmDigestBundleFinal(rpmDigestBundle bundle, int id,
void ** datap, size_t * lenp, int asAscii)
{
--
2.50.1
From db4704ea3b47f5e38ad1606a8c3cfe27059b084f Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 1 Jul 2025 12:15:03 +0300
Subject: [PATCH 6/8] Support OpenPGP v6 signature pre-salting
OpenPGP v6 signature salt is a random per-signature thing that we need
to feed into the digest before the actual data. For that we need
rpm-sequoia support, the first version to have it is 1.9.0.
The tests for this are already written, just need to be adjusted a bit
and uncommented, so do that. Kudos to Jakub for covering this part via
PR #3844 (squashed into this commit)!
Co-authored-by: Jakub Jelen <jjelen@redhat.com>
Fixes: #3846
(backported from commit c36c717f41683953b9c23e447a8df0d0ac7c845c)
---
INSTALL | 2 +-
include/rpm/rpmpgp.h | 2 ++
lib/rpmvs.c | 14 ++++++++++++--
rpmio/CMakeLists.txt | 2 +-
rpmio/rpmpgp_sequoia.c | 3 +++
5 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/INSTALL b/INSTALL
index 0a86822b0..82c91d5b0 100644
--- a/INSTALL
+++ b/INSTALL
@@ -28,7 +28,7 @@ The source for the file utility + library is available from
You will need a cryptographic library to support digests and
signatures. This depends on the OpenPGP parser used: the default is
-rpm-sequoia library (>= 1.3.0 required), which is available from
+rpm-sequoia library (>= 1.9.0 required), which is available from
https://github.com/rpm-software-management/rpm-sequoia
Use of rpm-sequoia is strongly recommended. Most importantly, the internal
diff --git a/include/rpm/rpmpgp.h b/include/rpm/rpmpgp.h
index 052fdb54a..1076eecbd 100644
--- a/include/rpm/rpmpgp.h
+++ b/include/rpm/rpmpgp.h
@@ -1205,6 +1205,8 @@ int pgpDigParamsVersion(pgpDigParams digp);
*/
uint32_t pgpDigParamsCreationTime(pgpDigParams digp);
+int pgpDigParamsSalt(pgpDigParams digp, const uint8_t **datap, size_t *lenp);
+
/** \ingroup rpmpgp
* Destroy parsed OpenPGP packet parameter(s).
* @param digp parameter container
diff --git a/lib/rpmvs.c b/lib/rpmvs.c
index e22051a92..3d6227330 100644
--- a/lib/rpmvs.c
+++ b/lib/rpmvs.c
@@ -424,8 +424,18 @@ void rpmvsInitRange(struct rpmvs_s *sis, int range)
for (int i = 0; i < sis->nsigs; i++) {
struct rpmsinfo_s *sinfo = &sis->sigs[i];
if (sinfo->range & range) {
- if (sinfo->rc == RPMRC_OK)
- rpmDigestBundleAddID(sis->bundle, sinfo->hashalgo, sinfo->id, 0);
+ if (sinfo->rc != RPMRC_OK)
+ continue;
+
+ rpmDigestBundleAddID(sis->bundle, sinfo->hashalgo, sinfo->id, 0);
+ /* OpenPGP v6 signatures need a grain of salt to go */
+ if (sinfo->sig) {
+ const uint8_t *salt = NULL;
+ size_t slen = 0;
+ if (pgpDigParamsSalt(sinfo->sig, &salt, &slen) == 0 && salt) {
+ rpmDigestBundleUpdateID(sis->bundle, sinfo->id, salt, slen);
+ }
+ }
}
}
}
diff --git a/rpmio/CMakeLists.txt b/rpmio/CMakeLists.txt
index aec48966c..1017b2e09 100644
--- a/rpmio/CMakeLists.txt
+++ b/rpmio/CMakeLists.txt
@@ -15,7 +15,7 @@ target_include_directories(librpmio PRIVATE
if (WITH_SEQUOIA)
- pkg_check_modules(RPMSEQUOIA REQUIRED IMPORTED_TARGET rpm-sequoia>=1.8.0)
+ pkg_check_modules(RPMSEQUOIA REQUIRED IMPORTED_TARGET rpm-sequoia>=1.9.0)
target_sources(librpmio PRIVATE rpmpgp_sequoia.c)
target_link_libraries(librpmio PRIVATE PkgConfig::RPMSEQUOIA)
else()
diff --git a/rpmio/rpmpgp_sequoia.c b/rpmio/rpmpgp_sequoia.c
index d0b673953..07b7bbffe 100644
--- a/rpmio/rpmpgp_sequoia.c
+++ b/rpmio/rpmpgp_sequoia.c
@@ -33,6 +33,9 @@ W(const uint8_t *, pgpDigParamsSignID, (pgpDigParams digp), (digp))
W(const char *, pgpDigParamsUserID, (pgpDigParams digp), (digp))
W(int, pgpDigParamsVersion, (pgpDigParams digp), (digp))
W(uint32_t, pgpDigParamsCreationTime, (pgpDigParams digp), (digp))
+W(int, pgpDigParamsSalt,
+ (pgpDigParams digp, const uint8_t **datap, size_t *lenp),
+ (digp, datap, lenp))
W(rpmRC, pgpVerifySignature,
(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx),
(key, sig, hashctx))
--
2.50.1
From c47dc0c4604a20ede996e93650ba9290c26d9909 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Fri, 4 Apr 2025 16:59:41 +0200
Subject: [PATCH 7/8] Return -1 from fdSize() for non-regular files
I noticed that importing a key from a pipe did not work:
$ cat /tmp/key | rpmkeys --import -
error: -: import read failed(0).
While importing from a regular file on stdin worked:
$ < /tmp/key rpmkeys --import -
The cause was fdSize() returning 0 for a pipe descriptor.
rpmcliImportPubkeys() calls rpmioSlurp() which calls fdSize() like
this:
size = fdSize(fd);
blen = (size >= 0 ? size : blenmax);
if (blen) {
/* read from the descriptor */
}
As a result, rpmioSlurp() concluded that the "file" was empty and
rpmcliImportPubkeys() reported an error:
iorc = rpmioSlurp(fn, &buf, &blen);
if (iorc || buf == NULL || blen < 64) {
rpmlog(RPMLOG_ERR, _("%s: import read failed(%d).\n"), fn, iorc);
This patch changes fdSize() to return an error for non-regular files.
This is in line with fstat(3) manual:
st_size
This field gives the size of the file (if it is
a regular file or a symbolic link) in bytes. The size
of a symbolic link is the length of the pathname it
contains, without a terminating null byte.
Returning an error on unsupported descriptors was pretty common before
commit 852398f8c6dcb4ad5ed0310e49e7d342a262be91
("Lose unnecessary url type checking from fdSize()").
(cherry picked from commit 063427c5f72e1cb50a61cb0973be127a00e93c2c)
---
rpmio/rpmio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rpmio/rpmio.c b/rpmio/rpmio.c
index 6069274a7..a8fdd00b9 100644
--- a/rpmio/rpmio.c
+++ b/rpmio/rpmio.c
@@ -248,7 +248,7 @@ off_t fdSize(FD_t fd)
struct stat sb;
off_t rc = -1;
- if (fd != NULL && fstat(Fileno(fd), &sb) == 0)
+ if (fd != NULL && fstat(Fileno(fd), &sb) == 0 && S_ISREG(sb.st_mode))
rc = sb.st_size;
return rc;
}
--
2.50.1
From 70de5d8eb66925a59dafaf53fdef2a5dc8afa860 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Fri, 4 Apr 2025 17:32:05 +0200
Subject: [PATCH 8/8] Handle fdSize() failure in rpmSign()
This mistake existed before "Return -1 from fdSize() for non-regular
files" commit. The computed offsets could reach negative values.
(cherry picked from commit 0ecca60d56f163d591a97e9f216573d3c3d5ef7f)
---
sign/rpmgensig.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index a96bf7ed0..4596b5116 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -647,6 +647,7 @@ static int rpmSign(const char *rpm, int deleting, int flags)
int res = -1; /* assume failure */
rpmRC rc;
struct rpmtd_s utd;
+ off_t fileSize;
off_t headerStart;
off_t sigStart;
struct sigTarget_s sigt_v3;
@@ -734,11 +735,16 @@ static int rpmSign(const char *rpm, int deleting, int flags)
} else if (deleting) { /* Nuke all the signature tags. */
deleteSigs(sigh);
} else {
+ fileSize = fdSize(fd);
+ if (fileSize < 0) {
+ rpmlog(RPMLOG_ERR, _("Could not get a file size of %s\n"), rpm);
+ goto exit;
+ }
/* Signature target containing header + payload */
sigt_v3.fd = fd;
sigt_v3.start = headerStart;
sigt_v3.fileName = rpm;
- sigt_v3.size = fdSize(fd) - headerStart;
+ sigt_v3.size = fileSize - headerStart;
/* Signature target containing only header */
sigt_v4 = sigt_v3;
--
2.50.1

767
rpm-4.19.x-pqc-fixes.patch Normal file
View File

@ -0,0 +1,767 @@
From 44cd08d16596a5d615ff2dadfbaca577133a7161 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 5 Aug 2025 13:22:36 +0300
Subject: [PATCH 01/10] Only ever call pgpDigParamsSalt() on signatures
Ensure the verification item is a signature before calling
pgpDigParamsSalt(). Otherwise we can end up calling it with the
character array of a digest instead, which may not end well.
The test relies on debug output from rpm-sequoia so it's a bit feeble,
but it's the best we can do here.
Should've been in c36c717f41683953b9c23e447a8df0d0ac7c845c.
(cherry picked from commit 5fdfafed00161d538831f329d475a5753e22a197)
---
lib/rpmvs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/rpmvs.c b/lib/rpmvs.c
index 3d6227330..afc5fdffb 100644
--- a/lib/rpmvs.c
+++ b/lib/rpmvs.c
@@ -429,7 +429,7 @@ void rpmvsInitRange(struct rpmvs_s *sis, int range)
rpmDigestBundleAddID(sis->bundle, sinfo->hashalgo, sinfo->id, 0);
/* OpenPGP v6 signatures need a grain of salt to go */
- if (sinfo->sig) {
+ if (sinfo->type == RPMSIG_SIGNATURE_TYPE && sinfo->sig) {
const uint8_t *salt = NULL;
size_t slen = 0;
if (pgpDigParamsSalt(sinfo->sig, &salt, &slen) == 0 && salt) {
--
2.51.0
From 51885f969f75b16f921a8d8a9f1d0cee810a5c5d Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Wed, 6 Aug 2025 12:37:02 +0300
Subject: [PATCH 02/10] Fix alternatives mechanism unintentionally kicking in
for signatures
Rpm assumes verifiables to be alternative to each other if they share the
same disabler. This happened to be true when the feature was initially
added but no longer holds now that multiple signature support was added.
The alternatives system only applies to digests, so add that missing
conditional.
The tests are added in the next commit.
Fixes: #3872
(cherry picked from commit d4092051a884f4e98f8d4831d61b9bdee4f4fd11)
---
lib/rpmvs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/rpmvs.c b/lib/rpmvs.c
index afc5fdffb..b8e69955a 100644
--- a/lib/rpmvs.c
+++ b/lib/rpmvs.c
@@ -544,8 +544,8 @@ int rpmvsVerify(struct rpmvs_s *sis, int type,
int strength = (sinfo->type | sinfo->strength);
int required = 0;
- /* Ignore failure if an alternative exists and verifies ok */
- if (sinfo->rc == RPMRC_FAIL) {
+ /* Ignore a digest failure if an alternative exists and verifies ok */
+ if (sinfo->type == RPMSIG_DIGEST_TYPE && sinfo->rc == RPMRC_FAIL) {
const struct rpmsinfo_s * alt = getAlt(sis, sinfo);
if (alt && alt->rc == RPMRC_OK)
sinfo->rc = RPMRC_NOTFOUND;
--
2.51.0
From 539ed2d7514781908accab119ee18ba870059747 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 12 Aug 2025 13:31:00 +0300
Subject: [PATCH 03/10] Fix regression on signature size reservation not being
used
The signature reservation adjustment is one of those whack-a-mole bugs
where fixes keep making new bugs appear: the signature reservation was
broken by 1847fd6bea41f96ca545e744ee9ecc2896f6378a which came from
be950eabb84a88e5773e096435c37b92e3d47ebb which came from
5c279fb149a44a1bc4d19e11c3c01942732b8486 and so on.
This seemingly simple thing is pretty tricksy, especially when needing
to deal with 3rd party signed packages that don't always follow our
expectations. What 1847fd6bea41f96ca545e744ee9ecc2896f6378a got wrong
is that the header size before unloadImmutableRegion() will include the the
region index and data entries, totalling 32 bytes, whereas the other
calculations are lacking it. And without adjusting for it, the
difference either causes the mechanism not to work or corrupted
packages. It also made a mess of the sanity check.
Always take the signature size before the grabbing the immutable region,
just adjust for the region entry size difference. This handles the
misplaced IMA signatures in #3469 and other similar quirks with minimum fuss.
Simplify the reservation adjustment: the diff is for the reservation
size. If it's negative, the reservation needs to shrink, if positive
then it needs to grow. This is easier to follow than substracting
negative numbers to grow it. And now we just need to check that the
shrink operation doesn't wrap around, otherwise the math takes care of
itself. Famous last words.
Adjust the post-addsign rpmdump values to match the expected
behavior rather than the broken one.
Fixes: #3768
(backported from commit d4e22da91994be7ef4da8183682f33cb3e1173b1)
---
sign/rpmgensig.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 98090521b..5613e5683 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -723,7 +723,8 @@ static int rpmSign(const char *rpm, int deleting, int flags)
flags &= ~(RPMSIGN_FLAG_RPMV4|RPMSIGN_FLAG_RPMV3);
}
- origSigSize = headerSizeof(sigh, HEADER_MAGIC_YES);
+ /* Adjust for the region index entry + data getting stripped: 32 bytes */
+ origSigSize = headerSizeof(sigh, HEADER_MAGIC_YES) - 32;
unloadImmutableRegion(&sigh, RPMTAG_HEADERSIGNATURES);
if (flags & RPMSIGN_FLAG_IMA) {
@@ -776,17 +777,16 @@ static int rpmSign(const char *rpm, int deleting, int flags)
/* Adjust reserved size for added/removed signatures */
if (headerGet(sigh, reserveTag, &utd, HEADERGET_MINMEM)) {
unsigned newSize = headerSizeof(sigh, HEADER_MAGIC_YES);
- int diff = newSize - origSigSize;
- /* diff can be zero if nothing was added or removed */
- if (diff) {
- utd.count -= diff;
- if (utd.count > 0 && newSize + utd.count <= origSigSize) {
- char *zeros = xcalloc(utd.count, sizeof(*zeros));
- utd.data = zeros;
- headerMod(sigh, &utd);
- insSig = 1;
- free(zeros);
- }
+ int diff = origSigSize - newSize;
+
+ /* The header doesn't support zero-sized data */
+ if ((diff < 0 && abs(diff) < utd.count) || diff > 0) {
+ utd.count += diff;
+ char *zeros = xcalloc(utd.count, sizeof(*zeros));
+ utd.data = zeros;
+ headerMod(sigh, &utd);
+ free(zeros);
+ insSig = 1;
}
}
--
2.51.0
From 042f35d2947b2dc30ea66c934a685a7e942ae856 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Wed, 20 Aug 2025 10:14:46 +0300
Subject: [PATCH 04/10] Refactor the signing code to allow decisions where we
need them
Having sanity checks in makeSigTag() made sense when we only had one set
of restrictions but now it was only getting in the way, we need to have
the parsed signature at hand when making decisions about it. Refactor to
return the raw signature packet from makeGPGSignature() and move the
sanity checks to putSignature() where we then have all the necessary
data to make the decisions we need.
Shame on me for missing the point in commit
ad114b0174c26fa101ce9bbf82930b2c2e421a09 and introducing the tag hack
instead of doing the right thing. As it often happens, the right thing
isn't really any more complicated than the "I'll just kludge around this
for now" hack.
Allegely no functional changes here, this is just prepwork for #3851.
(backported from commit 9f92bbc3be5b52c180240d432b1bd78c1360e0c5)
---
sign/rpmgensig.c | 132 +++++++++++++++++++++++------------------------
1 file changed, 65 insertions(+), 67 deletions(-)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 5613e5683..224524017 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -128,45 +128,6 @@ exit:
return rc;
}
-/* Wrap a raw signature in an rpmtd and sanity check, return NULL on fail */
-static rpmtd makeSigTag(uint8_t *pkt, size_t pktlen)
-{
- pgpDigParams sigp = NULL;
- rpmtd sigtd = NULL;
- unsigned int hash_algo;
- int ver;
-
- if (pgpPrtParams(pkt, pktlen, PGPTAG_SIGNATURE, &sigp)) {
- rpmlog(RPMLOG_ERR, _("Unsupported OpenPGP signature\n"));
- goto exit;
- }
-
- hash_algo = pgpDigParamsAlgo(sigp, PGPVAL_HASHALGO);
- if (rpmDigestLength(hash_algo) == 0) {
- rpmlog(RPMLOG_ERR, _("Unsupported OpenPGP hash algorithm %u\n"), hash_algo);
- goto exit;
- }
-
- ver = pgpDigParamsVersion(sigp);
- if (ver < 4) {
- rpmlog(RPMLOG_WARNING, _("Deprecated OpenPGP signature version %d\n"),
- ver);
- }
-
- /* Looks sane, create the tag data */
- sigtd = rpmtdNew();
- sigtd->flags |= RPMTD_ALLOCED;
- sigtd->count = pktlen;
- sigtd->data = memcpy(xmalloc(pktlen), pkt, pktlen);;
- sigtd->type = RPM_BIN_TYPE;
- /* Hack: the actual tag gets decided in putSignature() based on this */
- sigtd->tag = pgpDigParamsAlgo(sigp, PGPVAL_PUBKEYALGO);
-
-exit:
- pgpDigParamsFree(sigp);
- return sigtd;
-}
-
static char ** signCmd(const char *sigfile)
{
int argc = 0;
@@ -297,13 +258,13 @@ exit_nowait:
}
/* Generate an OpenPGP signature(s) for a target */
-static rpmtd makeGPGSignature(sigTarget sigt)
+static int makeGPGSignature(sigTarget sigt, uint8_t **pktp, size_t *lenp)
{
char * sigfile = rstrscat(NULL, sigt->fileName, ".sig", NULL);
struct stat st;
uint8_t * pkt = NULL;
size_t pktlen = 0;
- rpmtd sigtd = NULL;
+ int rc = -1;
if (runGPG(sigt, sigfile))
goto exit;
@@ -320,7 +281,6 @@ static rpmtd makeGPGSignature(sigTarget sigt)
{ FD_t fd;
- int rc = 0;
fd = Fopen(sigfile, "r.ufdio");
if (fd != NULL && !Ferror(fd)) {
rc = Fread(pkt, sizeof(*pkt), pktlen, fd);
@@ -328,20 +288,22 @@ static rpmtd makeGPGSignature(sigTarget sigt)
}
if (rc != pktlen) {
rpmlog(RPMLOG_ERR, _("unable to read the signature\n"));
+ pkt = _free(pkt);
goto exit;
}
}
rpmlog(RPMLOG_DEBUG, "Got %zd bytes of OpenPGP sig\n", pktlen);
- /* Parse the signature, change signature tag as appropriate. */
- sigtd = makeSigTag(pkt, pktlen);
+ *pktp = pkt;
+ *lenp = pktlen;
+ rc = 0;
+
exit:
(void) unlink(sigfile);
free(sigfile);
- free(pkt);
- return sigtd;
+ return rc;
}
static void deleteSigs(Header sigh)
@@ -405,13 +367,34 @@ static int haveSignature(rpmtd sigtd, Header sigh)
return rc;
}
-static int putSignature(Header sigh, rpmtd sigtd, int multisig, int ishdr,
- rpmSignFlags flags)
+static int putSignature(Header sigh, uint8_t *pkt, size_t pktlen,
+ int multisig, int ishdr, rpmSignFlags flags)
{
int rc = -1;
+ unsigned int hash_algo = 0;
+ int ver = 0;
+ pgpDigParams sigp = NULL;
+
+ if (pgpPrtParams(pkt, pktlen, PGPTAG_SIGNATURE, &sigp)) {
+ rpmlog(RPMLOG_ERR, _("Unsupported OpenPGP signature\n"));
+ goto exit;
+ }
+
+ hash_algo = pgpDigParamsAlgo(sigp, PGPVAL_HASHALGO);
+ if (rpmDigestLength(hash_algo) == 0) {
+ rpmlog(RPMLOG_ERR, _("Unsupported OpenPGP hash algorithm %u\n"),
+ hash_algo);
+ goto exit;
+ }
+
+ ver = pgpDigParamsVersion(sigp);
+ if (ver < 4) {
+ rpmlog(RPMLOG_WARNING, _("Deprecated OpenPGP signature version %d\n"),
+ ver);
+ }
if (multisig) {
- char *b64 = rpmBase64Encode(sigtd->data, sigtd->count, 0);
+ char *b64 = rpmBase64Encode(pkt, pktlen, 0);
char **arr = (char **)xmalloc(1 * sizeof(*arr));
arr[0] = b64;
@@ -431,7 +414,7 @@ static int putSignature(Header sigh, rpmtd sigtd, int multisig, int ishdr,
}
rpmtdFreeData(&mtd);
} else {
- unsigned int pubkey_algo = sigtd->tag;
+ unsigned int pubkey_algo = pgpDigParamsAlgo(sigp, PGPVAL_PUBKEYALGO);
uint32_t sigtag = 0;
switch (pubkey_algo) {
case PGPPUBKEYALGO_DSA:
@@ -446,9 +429,18 @@ static int putSignature(Header sigh, rpmtd sigtd, int multisig, int ishdr,
break;
}
- if (sigtag) {
- sigtd->tag = sigtag;
- if (haveSignature(sigtd, sigh)) {
+ if (sigtag && ver <= 4) {
+ struct rpmtd_s sigtd = {
+ .tag = sigtag,
+ .type = RPM_BIN_TYPE,
+ .count = (uint32_t)pktlen,
+ .data = pkt,
+ .flags = 0,
+ .ix = -1,
+ .size = 0,
+ };
+
+ if (haveSignature(&sigtd, sigh)) {
rc = 1;
} else {
/* Only one legacy signature is allowed */
@@ -456,22 +448,27 @@ static int putSignature(Header sigh, rpmtd sigtd, int multisig, int ishdr,
/* Preserve historical behavior */
deleteSigs(sigh);
else
- headerDel(sigh, sigtd->tag);
- rc = (headerPut(sigh, sigtd, HEADERPUT_DEFAULT) == 0) ? -1 : 0;
+ headerDel(sigh, sigtd.tag);
+ rc = (headerPut(sigh, &sigtd, HEADERPUT_DEFAULT) == 0) ? -1 : 0;
}
- sigtd->tag = pubkey_algo;
} else {
/* If we did a v6 signature, we can ignore the error here */
if (flags & RPMSIGN_FLAG_RPMV6) {
rc = 0;
- } else {
+ goto exit;
+ }
+
+ if (sigtag == 0) {
rpmlog(RPMLOG_ERR,
- _("Unsupported OpenPGP pubkey algorithm %u for rpm v3/v4 signatures\n"),
- pubkey_algo);
+ _("Unsupported OpenPGP pubkey algorithm %u for rpm v3/v4 signatures\n"),
+ pubkey_algo);
+ goto exit;
}
}
}
+exit:
+ pgpDigParamsFree(sigp);
return rc;
}
@@ -485,38 +482,39 @@ static int addSignature(Header sigh, rpmSignFlags flags,
sigTarget sigt_v3, sigTarget sigt_v4)
{
int rc = -1;
- rpmtd sigtd = NULL;
+ uint8_t *pkt = NULL;
+ size_t pktlen = 0;
/* Make a header signature */
- if ((sigtd = makeGPGSignature(sigt_v4)) == NULL)
+ if (makeGPGSignature(sigt_v4, &pkt, &pktlen))
goto exit;
/* Add a v6 signature if requested */
if (flags & RPMSIGN_FLAG_RPMV6)
- if ((rc = putSignature(sigh, sigtd, 1, 1, flags)))
+ if ((rc = putSignature(sigh, pkt, pktlen, 1, 1, flags)))
goto exit;
/* Add a v4 signature if requested */
if (flags & RPMSIGN_FLAG_RPMV4) {
- if ((rc = putSignature(sigh, sigtd, 0, 1, flags)))
+ if ((rc = putSignature(sigh, pkt, pktlen, 0, 1, flags)))
goto exit;
/* Only consider v3 signature if also adding v4 */
if (flags & RPMSIGN_FLAG_RPMV3) {
- rpmtdFree(sigtd);
+ pkt = _free(pkt);
/* Assume the same signature test holds for v3 signature too */
- if ((sigtd = makeGPGSignature(sigt_v3)) == NULL)
+ if (makeGPGSignature(sigt_v3, &pkt, &pktlen))
goto exit;
- if ((rc = putSignature(sigh, sigtd, 0, 0, flags)))
+ if ((rc = putSignature(sigh, pkt, pktlen, 0, 0, flags)))
goto exit;
}
}
rc = 0;
exit:
- rpmtdFree(sigtd);
+ free(pkt);
return rc;
}
--
2.51.0
From e5d0855cf4c1a3e6581dd3594b76862e791a6736 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Wed, 20 Aug 2025 10:20:48 +0300
Subject: [PATCH 05/10] Fix rpmsign possibly copying a OpenPGP v6 signature
into legacy tag
With the refactor from the previous commit, this is becomes an utterly
trivial matter of, gasp, checking the signature version when inserting
a legacy signature tag.
Fixes: #3851
(backported from commit f323d5572fcb2734a3bf5a1e564bc73f542c237a)
---
sign/rpmgensig.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 224524017..2fbbedacf 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -464,6 +464,12 @@ static int putSignature(Header sigh, uint8_t *pkt, size_t pktlen,
pubkey_algo);
goto exit;
}
+ if (ver > 4) {
+ rpmlog(RPMLOG_ERR,
+ ("Unsupported OpenPGP version %u for rpm v3/v4 signatures\n"),
+ ver);
+ goto exit;
+ }
}
}
--
2.51.0
From 7c1e89ad67d941f7bd35c26143155332379e7827 Mon Sep 17 00:00:00 2001
From: Michal Domonkos <mdomonko@redhat.com>
Date: Thu, 21 Aug 2025 14:54:39 +0200
Subject: [PATCH 06/10] Revert "Fix --addsign not replacing existing V4
signature"
This reverts commit 4c3f4fa2c1c514aa05a15c0756495c1b762e5f17.
---
docs/man/rpmsign.8.md | 2 --
sign/rpmgensig.c | 6 ------
tools/rpmsign.c | 2 +-
3 files changed, 1 insertion(+), 9 deletions(-)
diff --git a/docs/man/rpmsign.8.md b/docs/man/rpmsign.8.md
index a4b98ce38..d6deebec2 100644
--- a/docs/man/rpmsign.8.md
+++ b/docs/man/rpmsign.8.md
@@ -33,8 +33,6 @@ DESCRIPTION
**rpmsign** **\--addsign** generates and inserts a new OpenPGP signature
for each *PACKAGE\_FILE* given unless a signature with identical
parameters already exists, in which case no action is taken.
-When signing a V4 package, and **\--rpmv6** is not used, any existing
-signatures are replaced, as if **\--resign** was used instead.
Arbitrary number of V6 signatures can be added.
**rpmsign** **\--resign** generates and inserts a new OpenPGP signature
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 2fbbedacf..1856b529f 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -443,12 +443,6 @@ static int putSignature(Header sigh, uint8_t *pkt, size_t pktlen,
if (haveSignature(&sigtd, sigh)) {
rc = 1;
} else {
- /* Only one legacy signature is allowed */
- if (ishdr && !(flags & RPMSIGN_FLAG_RPMV6))
- /* Preserve historical behavior */
- deleteSigs(sigh);
- else
- headerDel(sigh, sigtd.tag);
rc = (headerPut(sigh, &sigtd, HEADERPUT_DEFAULT) == 0) ? -1 : 0;
}
} else {
diff --git a/tools/rpmsign.c b/tools/rpmsign.c
index 41bb89175..4bfec11cd 100644
--- a/tools/rpmsign.c
+++ b/tools/rpmsign.c
@@ -34,7 +34,7 @@ static struct poptOption signOptsTable[] = {
{ "addsign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_ADDSIGN,
N_("sign package(s)"), NULL },
{ "resign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_RESIGN,
- N_("sign package(s), replacing any existing signatures"), NULL },
+ N_("sign package(s) (identical to --addsign)"), NULL },
{ "delsign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELSIGN,
N_("delete package signatures"), NULL },
#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
--
2.51.0
From 6490a7183dc4851c3b228c3e46119d2ef5085442 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Wed, 26 Mar 2025 10:43:37 +0200
Subject: [PATCH 07/10] Fix --addsign/--resign help text to match new behavior
This should've been in 5630cf4bcbaae85d1b53e7a57ba6c7ed86b62e7d.
Related: #3385
(cherry picked from commit 8580b386ca7d00a2625417a0f1c7ada398cccc00)
---
tools/rpmsign.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/rpmsign.c b/tools/rpmsign.c
index 4bfec11cd..724ff546b 100644
--- a/tools/rpmsign.c
+++ b/tools/rpmsign.c
@@ -32,9 +32,9 @@ static struct rpmSignArgs sargs = {NULL, 0, 0};
static struct poptOption signOptsTable[] = {
{ "addsign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_ADDSIGN,
- N_("sign package(s)"), NULL },
+ N_("sign package(s), adding a new signature"), NULL },
{ "resign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_RESIGN,
- N_("sign package(s) (identical to --addsign)"), NULL },
+ N_("resign package(s), deleting any previous signatures"), NULL },
{ "delsign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELSIGN,
N_("delete package signatures"), NULL },
#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
--
2.51.0
From 5f0eb56faad3597ac914a622a861e776e27dd663 Mon Sep 17 00:00:00 2001
From: Michal Domonkos <mdomonko@redhat.com>
Date: Wed, 13 Aug 2025 14:13:12 +0200
Subject: [PATCH 08/10] Fix rpmsign possibly adding multiple legacy tags
Commit 5630cf4bcbaae85d1b53e7a57ba6c7ed86b62e7d fixed the semantics of
--addsign to never delete signatures, just add. This worked implicitly
for v6 signatures but was only partially handled for legacy (v4 or v3)
signatures, which can be added in the following ways:
1. Signing a v4 package without --rpmv6 (native signature)
2. Signing a v4 package with --rpmv6 (compat signature)
3. Signing a v6 package with --rpmv4 (compat signature)
The commit prevented the addition of multiple legacy signatures in the
second case but still allowed any number of them otherwise. Since the
legacy tags aren't arrays, we would end up just duplicating them.
Fix this by moving the haveLegacySig() check to putSignature() so that
we catch all legacy signature additions. Doing it here also allows us to
preserve the identical signature warning, which in turn makes it easier
to backport this patch to the RPM 4.x series where this can't regress.
Since v3 signatures are added after v4 in addSignature(), do check for
the correct tags in haveLegacySig() now, otherwise we would always skip
the former. This also fixes the case where --rpmv3 would have no effect
when combined with --rpmv6 on a package that already has a v4 signature.
See the updated tests for the exact behavior that's changed or fixed.
Fixes: 3878
(backported from commit 0632d9120a571a8b384b845e94bff6a438f6fd17)
---
sign/rpmgensig.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 1856b529f..8753c1b7f 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -367,6 +367,12 @@ static int haveSignature(rpmtd sigtd, Header sigh)
return rc;
}
+static int haveLegacySig(Header sigh, int ishdr)
+{
+ return headerIsEntry(sigh, ishdr ? RPMSIGTAG_RSA : RPMSIGTAG_PGP) ||
+ headerIsEntry(sigh, ishdr ? RPMSIGTAG_DSA : RPMSIGTAG_GPG);
+}
+
static int putSignature(Header sigh, uint8_t *pkt, size_t pktlen,
int multisig, int ishdr, rpmSignFlags flags)
{
@@ -441,7 +447,9 @@ static int putSignature(Header sigh, uint8_t *pkt, size_t pktlen,
};
if (haveSignature(&sigtd, sigh)) {
- rc = 1;
+ rc = (flags & RPMSIGN_FLAG_RPMV6) ? 0 : 1;
+ } else if (haveLegacySig(sigh, ishdr)) {
+ rc = 0;
} else {
rc = (headerPut(sigh, &sigtd, HEADERPUT_DEFAULT) == 0) ? -1 : 0;
}
@@ -472,12 +480,6 @@ exit:
return rc;
}
-static int haveLegacySig(Header sigh)
-{
- return headerIsEntry(sigh, RPMSIGTAG_RSA) ||
- headerIsEntry(sigh, RPMSIGTAG_DSA);
-}
-
static int addSignature(Header sigh, rpmSignFlags flags,
sigTarget sigt_v3, sigTarget sigt_v4)
{
@@ -716,9 +718,6 @@ static int rpmSign(const char *rpm, int deleting, int flags)
} else {
flags |= RPMSIGN_FLAG_RPMV4;
reserveTag = RPMSIGTAG_RESERVEDSPACE;
- /* Ensure only one legacy signature is added if adding v6 signatures */
- if ((flags & RPMSIGN_FLAG_RPMV6) && haveLegacySig(sigh))
- flags &= ~(RPMSIGN_FLAG_RPMV4|RPMSIGN_FLAG_RPMV3);
}
/* Adjust for the region index entry + data getting stripped: 32 bytes */
--
2.51.0
From e2216cae4f9abe9ea44c18142282bb07d5a89996 Mon Sep 17 00:00:00 2001
From: Michal Domonkos <mdomonko@redhat.com>
Date: Wed, 13 Aug 2025 16:36:04 +0200
Subject: [PATCH 09/10] Fail when adding a legacy signature and one exists
Instead of silently skipping, bail out with an error message when adding
a native, legacy signature to a v4 package that already has one. This is
more user-friendly and avoids nasty surprises since --addsign previously
[*] always replaced existing signatures.
[*] Before commit 5630cf4bcbaae85d1b53e7a57ba6c7ed86b62e7d
(backported from commit 5986d5f1186221676befc46d1bd97c096df1a1cf)
---
sign/rpmgensig.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 8753c1b7f..24183452a 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -449,7 +449,7 @@ static int putSignature(Header sigh, uint8_t *pkt, size_t pktlen,
if (haveSignature(&sigtd, sigh)) {
rc = (flags & RPMSIGN_FLAG_RPMV6) ? 0 : 1;
} else if (haveLegacySig(sigh, ishdr)) {
- rc = 0;
+ rc = (flags & RPMSIGN_FLAG_RPMV6) ? 0 : 2;
} else {
rc = (headerPut(sigh, &sigtd, HEADERPUT_DEFAULT) == 0) ? -1 : 0;
}
@@ -766,6 +766,13 @@ static int rpmSign(const char *rpm, int deleting, int flags)
/* Identical signature is not an error */
res = 0;
}
+ if (res == 2) {
+ rpmlog(RPMLOG_ERR,
+ _("%s already contains a legacy signature\n"),
+ rpm);
+ /* Existing signature is an error */
+ res = -1;
+ }
goto exit;
}
res = -1;
--
2.51.0
From 3e2a93df7f08cbee286730e6fc58d784da2c5034 Mon Sep 17 00:00:00 2001
From: Michal Domonkos <mdomonko@redhat.com>
Date: Mon, 25 Aug 2025 14:26:42 +0200
Subject: [PATCH 10/10] Refactor legacy signature presence checks
No functional change, just makes the logic (perhaps) a bit more obvious.
The goto isn't necessary right now but makes the new if block consistent
with the other similar ones.
(cherry picked from commit b015dcce484706a92ff639985f003138e5dfd494)
---
sign/rpmgensig.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
index 24183452a..33c9510e0 100644
--- a/sign/rpmgensig.c
+++ b/sign/rpmgensig.c
@@ -447,12 +447,18 @@ static int putSignature(Header sigh, uint8_t *pkt, size_t pktlen,
};
if (haveSignature(&sigtd, sigh)) {
- rc = (flags & RPMSIGN_FLAG_RPMV6) ? 0 : 1;
+ rc = 1;
} else if (haveLegacySig(sigh, ishdr)) {
- rc = (flags & RPMSIGN_FLAG_RPMV6) ? 0 : 2;
+ rc = 2;
} else {
rc = (headerPut(sigh, &sigtd, HEADERPUT_DEFAULT) == 0) ? -1 : 0;
}
+
+ /* Legacy signatures are best-effort in v6 mode */
+ if ((flags & RPMSIGN_FLAG_RPMV6) && rc > 0) {
+ rc = 0;
+ goto exit;
+ }
} else {
/* If we did a v6 signature, we can ignore the error here */
if (flags & RPMSIGN_FLAG_RPMV6) {
--
2.51.0
diff -up rpm-4.19.1.1/docs/man/rpmsign.8.orig rpm-4.19.1.1/docs/man/rpmsign.8
--- rpm-4.19.1.1/docs/man/rpmsign.8.orig 2025-08-26 09:33:51.043737142 +0200
+++ rpm-4.19.1.1/docs/man/rpmsign.8 2025-08-26 09:34:08.721970618 +0200
@@ -19,9 +19,6 @@ rpmsign \- RPM Package Signing
OpenPGP signature for each \f[I]PACKAGE_FILE\f[R] given unless a
signature with identical parameters already exists, in which case no
action is taken.
-When signing a V4 package, and \f[B]\-\-rpmv6\f[R] is not used, any
-existing signatures are replaced, as if \f[B]\-\-resign\f[R] was used
-instead.
Arbitrary number of V6 signatures can be added.
.PP
\f[B]rpmsign\f[R] \f[B]\-\-resign\f[R] generates and inserts a new

466
rpm-4.19.x-rpmkeys-add-list-erase.patch Normal file
View File

@ -0,0 +1,466 @@
From aa48e52daf219c224648528053ec41c358930f16 Mon Sep 17 00:00:00 2001
From: Florian Festi <ffesti@redhat.com>
Date: Wed, 21 Feb 2024 08:25:27 +0100
Subject: [PATCH 1/5] Add --list and --delete to rpmkeys
This is a bit of a hack as it manipulates the parsed cli parameters to
to the "right thing" and then calls rpmcliQuery and rpmErase.
(cherry picked from commit 1dc7e76fa51bca54f0eb75660ab6e68216289eb6)
---
docs/man/rpmkeys.8.md | 18 +++++++++++++++---
tools/rpmkeys.c | 40 ++++++++++++++++++++++++++++++++++------
2 files changed, 49 insertions(+), 9 deletions(-)
diff --git a/docs/man/rpmkeys.8.md b/docs/man/rpmkeys.8.md
index 9ea0a2079..cbc619001 100644
--- a/docs/man/rpmkeys.8.md
+++ b/docs/man/rpmkeys.8.md
@@ -12,15 +12,19 @@ rpmkeys - RPM Keyring
SYNOPSIS
========
-**rpmkeys** {**\--import\|\--checksig**}
+**rpmkeys** {**\--list\|\--import\|\--delete\|\--checksig**}
DESCRIPTION
===========
The general forms of rpm digital signature commands are
+**rpmkeys** **\--list** \[*KEYHASH \...*\]
+
**rpmkeys** **\--import** *PUBKEY \...*
+**rpmkeys** **\--delete** *KEYHASH \...*
+
**rpmkeys** {**-K\|\--checksig**} *PACKAGE\_FILE \...*
The **\--checksig** option checks all the digests and signatures
@@ -37,13 +41,21 @@ example, all currently imported public keys can be displayed by:
**rpm -qa gpg-pubkey\***
-Details about a specific public key, when imported, can be displayed by
+A more convenient way to display them is
+
+**rpmkeys** **\--list**
+
+More details about a specific public key, when imported, can be displayed by
querying. Here\'s information about the Red Hat GPG/DSA key:
**rpm -qi gpg-pubkey-db42a60e**
Finally, public keys can be erased after importing just like packages.
-Here\'s how to remove the Red Hat GPG/DSA key
+Here\'s how to remove the Red Hat GPG/DSA key:
+
+**rpmkeys** **\--delete db42a60e**
+
+Or alternatively:
**rpm -e gpg-pubkey-db42a60e**
diff --git a/tools/rpmkeys.c b/tools/rpmkeys.c
index afaffe501..adb65735c 100644
--- a/tools/rpmkeys.c
+++ b/tools/rpmkeys.c
@@ -2,6 +2,7 @@
#include <popt.h>
#include <rpm/rpmcli.h>
+#include <rpm/rpmstring.h>
#include "cliutils.h"
#include "debug.h"
@@ -22,12 +23,10 @@ static struct poptOption keyOptsTable[] = {
N_("import an armored public key"), NULL },
{ "test", '\0', POPT_ARG_NONE, &test, 0,
N_("don't import, but tell if it would work or not"), NULL },
-#if 0
- { "delete-key", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
+ { "delete", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
+ N_("delete keys from RPM keyring"), NULL },
+ { "list", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_LISTKEY,
N_("list keys from RPM keyring"), NULL },
- { "list-keys", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_LISTKEY,
- N_("list keys from RPM keyring"), NULL },
-#endif
POPT_TABLEEND
};
@@ -42,6 +41,21 @@ static struct poptOption optionsTable[] = {
POPT_TABLEEND
};
+static ARGV_t gpgkeyargs(ARGV_const_t args) {
+ ARGV_t gpgargs = NULL;
+ for (char * const * arg = args; *arg; arg++) {
+ if (strncmp(*arg, "gpg-pubkey-", 11)) {
+ char * gpgarg = NULL;
+ rstrscat(&gpgarg, "gpg-pubkey-", *arg, NULL);
+ argvAdd(&gpgargs, gpgarg);
+ free(gpgarg);
+ } else {
+ argvAdd(&gpgargs, *arg);
+ }
+ }
+ return gpgargs;
+}
+
int main(int argc, char *argv[])
{
int ec = EXIT_FAILURE;
@@ -73,9 +87,23 @@ int main(int argc, char *argv[])
rpmtsSetFlags(ts, (rpmtsFlags(ts)|RPMTRANS_FLAG_TEST));
ec = rpmcliImportPubkeys(ts, args);
break;
- /* XXX TODO: actually implement these... */
case MODE_DELKEY:
+ struct rpmInstallArguments_s * ia = &rpmIArgs;
+ ARGV_t gpgargs = gpgkeyargs(args);
+ ec = rpmErase(ts, ia, gpgargs);
+ argvFree(gpgargs);
+ break;
case MODE_LISTKEY:
+ ARGV_t query = NULL;
+ if (args != NULL) {
+ query = gpgkeyargs(args);
+ } else {
+ argvAdd(&query, "gpg-pubkey");
+ }
+ QVA_t qva = &rpmQVKArgs;
+ rstrcat(&qva->qva_queryFormat, "%{version}-%{release}: %{summary}\n");
+ ec = rpmcliQuery(ts, &rpmQVKArgs, (ARGV_const_t) query);
+ query = argvFree(query);
break;
default:
argerror(_("only one major mode may be specified"));
--
2.50.1
From a04cbdf459b75e326ad9a3e78cabd2980c5c410e Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 15 Oct 2024 09:28:36 +0300
Subject: [PATCH 2/5] Having no keys imported is not an error
...any more than "ls" in an empty directory is.
Resolves: 3556
Co-authored-by: Florian Festi <ffesti@redhat.com>
(backported from commit d666883624c5f2905c0bc70112895c33605ca264)
---
tools/rpmkeys.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/rpmkeys.c b/tools/rpmkeys.c
index adb65735c..d2c2644e2 100644
--- a/tools/rpmkeys.c
+++ b/tools/rpmkeys.c
@@ -95,12 +95,13 @@ int main(int argc, char *argv[])
break;
case MODE_LISTKEY:
ARGV_t query = NULL;
+ QVA_t qva = &rpmQVKArgs;
if (args != NULL) {
query = gpgkeyargs(args);
} else {
+ qva->qva_source |= RPMQV_ALL;
argvAdd(&query, "gpg-pubkey");
}
- QVA_t qva = &rpmQVKArgs;
rstrcat(&qva->qva_queryFormat, "%{version}-%{release}: %{summary}\n");
ec = rpmcliQuery(ts, &rpmQVKArgs, (ARGV_const_t) query);
query = argvFree(query);
--
2.50.1
From cd0cf8fbdde64656b851ad6056f0c40e18c90a46 Mon Sep 17 00:00:00 2001
From: Florian Festi <ffesti@redhat.com>
Date: Fri, 15 Nov 2024 13:15:58 +0100
Subject: [PATCH 3/5] Add short CLI commands to rpmkeys
Switch to short versions in the test suite at a few places.
Resolves: #3435
(backported from commit 35cfb7de9842dbec35adcb9ad9a632df49f35102)
---
docs/man/rpmkeys.8.md | 6 +++---
tools/rpmkeys.c | 8 ++++----
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/docs/man/rpmkeys.8.md b/docs/man/rpmkeys.8.md
index cbc619001..77bce49a9 100644
--- a/docs/man/rpmkeys.8.md
+++ b/docs/man/rpmkeys.8.md
@@ -19,11 +19,11 @@ DESCRIPTION
The general forms of rpm digital signature commands are
-**rpmkeys** **\--list** \[*KEYHASH \...*\]
+**rpmkeys** {**-l\|\--list**} \[*KEYHASH \...*\]
-**rpmkeys** **\--import** *PUBKEY \...*
+**rpmkeys** {**-i\|\--import**} *PUBKEY \...*
-**rpmkeys** **\--delete** *KEYHASH \...*
+**rpmkeys** {**-d\|\--delete**} *KEYHASH \...*
**rpmkeys** {**-K\|\--checksig**} *PACKAGE\_FILE \...*
diff --git a/tools/rpmkeys.c b/tools/rpmkeys.c
index d2c2644e2..79bb3e236 100644
--- a/tools/rpmkeys.c
+++ b/tools/rpmkeys.c
@@ -19,13 +19,13 @@ static int test = 0;
static struct poptOption keyOptsTable[] = {
{ "checksig", 'K', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_CHECKSIG,
N_("verify package signature(s)"), NULL },
- { "import", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_IMPORTKEY,
+ { "import", 'i', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_IMPORTKEY,
N_("import an armored public key"), NULL },
- { "test", '\0', POPT_ARG_NONE, &test, 0,
+ { "test", 't', POPT_ARG_NONE, &test, 0,
N_("don't import, but tell if it would work or not"), NULL },
- { "delete", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
+ { "delete", 'd', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
N_("delete keys from RPM keyring"), NULL },
- { "list", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_LISTKEY,
+ { "list", 'l', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_LISTKEY,
N_("list keys from RPM keyring"), NULL },
POPT_TABLEEND
};
--
2.50.1
From 8b344dfe14eda275e85f3acece93f98f5cab1e37 Mon Sep 17 00:00:00 2001
From: Florian Festi <ffesti@redhat.com>
Date: Fri, 15 Nov 2024 14:03:36 +0100
Subject: [PATCH 4/5] Rename rpmkeys --delete to rpmkeys --erase
Keep in line with the command names in rpm itself.
Keep --delete functional for compatibility reasons but remove it from
the docs.
Related: #3435
(backported from commit abb6ab1c43a946eb36a36227e39918580390a8e4)
---
docs/man/rpmkeys.8.md | 4 ++--
tools/rpmkeys.c | 7 +++++--
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/docs/man/rpmkeys.8.md b/docs/man/rpmkeys.8.md
index 77bce49a9..393845e62 100644
--- a/docs/man/rpmkeys.8.md
+++ b/docs/man/rpmkeys.8.md
@@ -12,7 +12,7 @@ rpmkeys - RPM Keyring
SYNOPSIS
========
-**rpmkeys** {**\--list\|\--import\|\--delete\|\--checksig**}
+**rpmkeys** {**\--list\|\--import\|\--erase\|\--checksig**}
DESCRIPTION
===========
@@ -23,7 +23,7 @@ The general forms of rpm digital signature commands are
**rpmkeys** {**-i\|\--import**} *PUBKEY \...*
-**rpmkeys** {**-d\|\--delete**} *KEYHASH \...*
+**rpmkeys** {**-e\|\--erase**} *KEYHASH \...*
**rpmkeys** {**-K\|\--checksig**} *PACKAGE\_FILE \...*
diff --git a/tools/rpmkeys.c b/tools/rpmkeys.c
index 79bb3e236..77eaa703f 100644
--- a/tools/rpmkeys.c
+++ b/tools/rpmkeys.c
@@ -23,8 +23,11 @@ static struct poptOption keyOptsTable[] = {
N_("import an armored public key"), NULL },
{ "test", 't', POPT_ARG_NONE, &test, 0,
N_("don't import, but tell if it would work or not"), NULL },
- { "delete", 'd', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
- N_("delete keys from RPM keyring"), NULL },
+ { "delete", 'd', (POPT_ARG_VAL|POPT_ARGFLAG_OR|POPT_ARGFLAG_DOC_HIDDEN),
+ &mode, MODE_DELKEY,
+ N_("Erase keys from RPM keyring"), NULL },
+ { "erase", 'e', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
+ N_("Erase keys from RPM keyring"), NULL },
{ "list", 'l', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_LISTKEY,
N_("list keys from RPM keyring"), NULL },
POPT_TABLEEND
--
2.50.1
From 2cd7d8d91d3c8bb7bf800bc7982ee2f5926d5c15 Mon Sep 17 00:00:00 2001
From: Florian Festi <ffesti@redhat.com>
Date: Fri, 15 Nov 2024 19:22:07 +0100
Subject: [PATCH 5/5] Don't delete delete
(backported from commit 4c99a010b23fd3832025d9cd2a5481a81f5c3353)
---
docs/man/rpmkeys.8.md | 4 ++--
tools/rpmkeys.c | 3 +--
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/docs/man/rpmkeys.8.md b/docs/man/rpmkeys.8.md
index 393845e62..afa470b6f 100644
--- a/docs/man/rpmkeys.8.md
+++ b/docs/man/rpmkeys.8.md
@@ -12,7 +12,7 @@ rpmkeys - RPM Keyring
SYNOPSIS
========
-**rpmkeys** {**\--list\|\--import\|\--erase\|\--checksig**}
+**rpmkeys** {**\--list\|\--import\|\--erase\|\--delete\|\--checksig**}
DESCRIPTION
===========
@@ -23,7 +23,7 @@ The general forms of rpm digital signature commands are
**rpmkeys** {**-i\|\--import**} *PUBKEY \...*
-**rpmkeys** {**-e\|\--erase**} *KEYHASH \...*
+**rpmkeys** {**-e\|\--erase\|-d\|\--delete**} *KEYHASH \...*
**rpmkeys** {**-K\|\--checksig**} *PACKAGE\_FILE \...*
diff --git a/tools/rpmkeys.c b/tools/rpmkeys.c
index 77eaa703f..f425a8648 100644
--- a/tools/rpmkeys.c
+++ b/tools/rpmkeys.c
@@ -23,8 +23,7 @@ static struct poptOption keyOptsTable[] = {
N_("import an armored public key"), NULL },
{ "test", 't', POPT_ARG_NONE, &test, 0,
N_("don't import, but tell if it would work or not"), NULL },
- { "delete", 'd', (POPT_ARG_VAL|POPT_ARGFLAG_OR|POPT_ARGFLAG_DOC_HIDDEN),
- &mode, MODE_DELKEY,
+ { "delete", 'd', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
N_("Erase keys from RPM keyring"), NULL },
{ "erase", 'e', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELKEY,
N_("Erase keys from RPM keyring"), NULL },
--
2.50.1
diff -up rpm-4.19.1.1/docs/man/rpmkeys.8.orig rpm-4.19.1.1/docs/man/rpmkeys.8
--- rpm-4.19.1.1/docs/man/rpmkeys.8.orig 2025-07-24 16:37:03.969960189 +0200
+++ rpm-4.19.1.1/docs/man/rpmkeys.8 2025-07-24 16:37:28.946868811 +0200
@@ -1,79 +1,73 @@
-.\" Automatically generated by Pandoc 3.1.3
+.\" Automatically generated by Pandoc 3.1.11.1
.\"
-.\" Define V font for inline verbatim, using C font in formats
-.\" that render this, and otherwise B font.
-.ie "\f[CB]x\f[]"x" \{\
-. ftr V B
-. ftr VI BI
-. ftr VB B
-. ftr VBI BI
-.\}
-.el \{\
-. ftr V CR
-. ftr VI CI
-. ftr VB CB
-. ftr VBI CBI
-.\}
.TH "RPMKEYS" "8" "29 October 2010" "" ""
-.hy
.SH NAME
-.PP
-rpmkeys - RPM Keyring
+rpmkeys \- RPM Keyring
.SH SYNOPSIS
-.PP
-\f[B]rpmkeys\f[R] {\f[B]--import|--checksig\f[R]}
+\f[B]rpmkeys\f[R]
+{\f[B]\-\-list|\-\-import|\-\-erase|\-\-delete|\-\-checksig\f[R]}
.SH DESCRIPTION
-.PP
The general forms of rpm digital signature commands are
.PP
-\f[B]rpmkeys\f[R] \f[B]--import\f[R] \f[I]PUBKEY ...\f[R]
+\f[B]rpmkeys\f[R] {\f[B]\-l|\-\-list\f[R]} [\f[I]KEYHASH ...\f[R]]
+.PP
+\f[B]rpmkeys\f[R] {\f[B]\-i|\-\-import\f[R]} \f[I]PUBKEY ...\f[R]
+.PP
+\f[B]rpmkeys\f[R] {\f[B]\-e|\-\-erase|\-d|\-\-delete\f[R]} \f[I]KEYHASH
+\&...\f[R]
.PP
-\f[B]rpmkeys\f[R] {\f[B]-K|--checksig\f[R]} \f[I]PACKAGE_FILE ...\f[R]
+\f[B]rpmkeys\f[R] {\f[B]\-K|\-\-checksig\f[R]} \f[I]PACKAGE_FILE
+\&...\f[R]
.PP
-The \f[B]--checksig\f[R] option checks all the digests and signatures
+The \f[B]\-\-checksig\f[R] option checks all the digests and signatures
contained in \f[I]PACKAGE_FILE\f[R] to ensure the integrity and origin
of the package.
Note that signatures are now verified whenever a package is read, and
-\f[B]--checksig\f[R] is useful to verify all of the digests and
+\f[B]\-\-checksig\f[R] is useful to verify all of the digests and
signatures associated with a package.
.PP
Digital signatures cannot be verified without a public key.
An ASCII armored public key can be added to the \f[B]rpm\f[R] database
-using \f[B]--import\f[R].
+using \f[B]\-\-import\f[R].
An imported public key is carried in a header, and key ring management
is performed exactly like package management.
For example, all currently imported public keys can be displayed by:
.PP
-\f[B]rpm -qa gpg-pubkey*\f[R]
+\f[B]rpm \-qa gpg\-pubkey*\f[R]
.PP
-Details about a specific public key, when imported, can be displayed by
-querying.
+A more convenient way to display them is
+.PP
+\f[B]rpmkeys\f[R] \f[B]\-\-list\f[R]
+.PP
+More details about a specific public key, when imported, can be
+displayed by querying.
Here\[aq]s information about the Red Hat GPG/DSA key:
.PP
-\f[B]rpm -qi gpg-pubkey-db42a60e\f[R]
+\f[B]rpm \-qi gpg\-pubkey\-db42a60e\f[R]
.PP
Finally, public keys can be erased after importing just like packages.
-Here\[aq]s how to remove the Red Hat GPG/DSA key
+Here\[aq]s how to remove the Red Hat GPG/DSA key:
.PP
-\f[B]rpm -e gpg-pubkey-db42a60e\f[R]
-.SH SEE ALSO
+\f[B]rpmkeys\f[R] \f[B]\-\-delete db42a60e\f[R]
.PP
+Or alternatively:
+.PP
+\f[B]rpm \-e gpg\-pubkey\-db42a60e\f[R]
+.SH SEE ALSO
\f[B]popt\f[R](3), \f[B]rpm\f[R](8), \f[B]rpmdb\f[R](8),
\f[B]rpmsign\f[R](8), \f[B]rpm2cpio\f[R](8), \f[B]rpmbuild\f[R](8),
\f[B]rpmspec\f[R](8)
.PP
-\f[B]rpmkeys --help\f[R] - as rpm supports customizing the options via
-popt aliases it\[aq]s impossible to guarantee that what\[aq]s described
-in the manual matches what\[aq]s available.
+\f[B]rpmkeys \-\-help\f[R] \- as rpm supports customizing the options
+via popt aliases it\[aq]s impossible to guarantee that what\[aq]s
+described in the manual matches what\[aq]s available.
.PP
\f[B]http://www.rpm.org/ <URL:http://www.rpm.org/>\f[R]
.SH AUTHORS
.IP
-.nf
-\f[C]
+.EX
Marc Ewing <marc\[at]redhat.com>
Jeff Johnson <jbj\[at]redhat.com>
Erik Troan <ewt\[at]redhat.com>
Panu Matilainen <pmatilai\[at]redhat.com>
-\f[R]
-.fi
+.EE

65
rpm.spec
View File

@ -27,7 +27,7 @@
%global rpmver 4.19.1.1
#global snapver rc1
%global baserelease 12
%global baserelease 20
%global sover 10
%global srcver %{rpmver}%{?snapver:-%{snapver}}
@ -100,7 +100,7 @@ BuildRequires: doxygen
%if %{with sequoia}
%global crypto sequoia
BuildRequires: rpm-sequoia-devel >= 1.4.0
BuildRequires: rpm-sequoia-devel >= 1.9.0
%else
%global crypto openssl
BuildRequires: openssl-devel
@ -156,6 +156,22 @@ rpm-4.18.90-weak-user-group.patch
0002-Fix-regression-on-build-id-generation-from-compresse.patch
0003-Fix-root-relocation-regression.patch
0001-Make-_passwd_path-and-_group_path-lists.patch
0002-Fix-memory-leak-in-rpmspec-shell.patch
0003-Fix-memory-leak-in-runGPG.patch
0004-Talk-about-rpmsign-in-the-rpmsign-man-page.patch
0005-Revert-Drop-redundant-argument-from-rpmcliTransactio.patch
0001-Store-configurable-digest-s-on-packages-from-verific.patch
0001-Ensure-binary-and-source-headers-are-identified-as-s.patch
0002-Add-support-for-spec-local-file-attributes-and-gener.patch
rpm-4.19.x-rpmkeys-add-list-erase.patch
# PQC readiness
rpm-4.19.x-multisig.patch
rpm-4.19.x-pqc-algo.patch
rpm-4.19.x-pqc-fixes.patch
# These are not yet upstream
rpm-4.7.1-geode-i686.patch
@ -172,7 +188,7 @@ License: GPL-2.0-or-later OR LGPL-2.1-or-later
Requires(meta): %{name} = %{version}-%{release}
%if %{with sequoia}
# >= 1.4.0 required for pgpVerifySignature2() and pgpPrtParams2()
Requires: rpm-sequoia%{_isa} >= 1.4.0
Requires: rpm-sequoia%{_isa} >= 1.9.0
# Most systems should have a central package operations log
Recommends: rpm-plugin-audit
%endif
@ -385,6 +401,7 @@ cmake \
%{?with_libimaevm:-DWITH_IMAEVM=ON} \
%{!?with_libarchive:-DWITH_ARCHIVE=OFF} \
%{!?with_check:-DENABLE_TESTSUITE=OFF} \
%{?with_sequoia:-DWITH_SEQUOIA=ON} \
%{!?with_sequoia:-DWITH_INTERNAL_OPENPGP=ON} \
%{!?with_sequoia:-DWITH_OPENSSL=ON } \
-DRPM_VENDOR=redhat \
@ -444,6 +461,8 @@ rm $RPM_BUILD_ROOT/%{_defaultdocdir}/rpm/README.md
# Signing macros for Sequoia
install -m 644 %{SOURCE30} $RPM_BUILD_ROOT/%{_defaultdocdir}/rpm/
rm $RPM_BUILD_ROOT/%{rpmhome}/rpmdump
%pre
# Symlink all rpmdb files to the new location if we're still using /var/lib/rpm
if [ -d /var/lib/rpm ]; then
@ -487,7 +506,9 @@ fi
%attr(0644, root, root) %ghost /usr/lib/sysimage/rpm/.*.lock
%{_bindir}/rpm
%if %{with libarchive}
%{_bindir}/rpm2archive
%endif
%{_bindir}/rpm2cpio
%{_bindir}/rpmdb
%{_bindir}/rpmkeys
@ -498,7 +519,9 @@ fi
%{_mandir}/man8/rpm.8*
%{_mandir}/man8/rpmdb.8*
%{_mandir}/man8/rpmkeys.8*
%if %{with libarchive}
%{_mandir}/man8/rpm2archive.8*
%endif
%{_mandir}/man8/rpm2cpio.8*
%{_mandir}/man8/rpm-misc.8*
%{_mandir}/man8/rpmsort.8*
@ -638,9 +661,43 @@ fi
%doc %{_defaultdocdir}/rpm/API/
%changelog
* Wed May 14 2025 Eduard Abdullin <eabdullin@almalinux.org> - 4.19.1.1-12.alma.1
* Tue Nov 11 2025 Eduard Abdullin <eabdullin@almalinux.org> - 4.19.1.1-20.alma.1
- Fix: Treat x86_64_v2 as x86_64 in architecture checks
* Tue Aug 26 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-20
- Fix rpmsign(8) man page (RHEL-109221)
* Mon Aug 25 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-19
- Additional PQC-related fixes (RHEL-109221)
* Thu Jul 24 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-18
- Add support for multiple OpenPGP signatures per package (RHEL-100571)
- Add support for OpenPGP v6 signature pre-salting (RHEL-100571)
- Add support for PQC algorithms from RFC-9580 (RHEL-100571)
- Add --list and --erase commands to rpmkeys(8) (RHEL-105421)
- Fix regression on dynamic subpackage RPMTAG_SOURCERPM missing (RHEL-102023)
* Wed Jun 11 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-17
- Bump release for another rebuild
* Wed Jun 11 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-16
- Fix regression on subpackage debuginfo RPMTAG_SOURCERPM missing (RHEL-87383)
* Thu May 29 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-15
- Add support for spec local file attributes and generators (RHEL-84057)
- Ensure binary and source headers are identified as such (RHEL-87383)
* Thu Apr 24 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-14
- Store configurable digest(s) on packages in rpmdb (RHEL-84062)
- Fix command references in rpmsign(8) man page, take II (RHEL-73173)
* Tue Apr 22 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-13
- Make %%_passwd_path and %%_group_path into lists (RHEL-78693)
- Fix memory leak in rpmspec --shell (RHEL-55284)
- Fix memory leak in rpmsign (RHEL-82284)
- Fix command references in rpmsign(8) man page (RHEL-73173)
- Fix exit code regression on update failure (RHEL-87384)
* Fri Feb 07 2025 Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-12
- Rebuild for ima-evm-utils 1.6 soname bump (RHEL-65378)