rpms/toolbox
7
0
Fork 0
Code Issues Pull Requests Releases Activity
9de99d0375
toolbox/rpminspect.yaml

17 lines
363 B
YAML
Raw Normal View History

Silence 'rpminspect --tests=annocheck' and 'rpminspect --tests=runpath' The DT_RPATH or DT_RUNPATH value of /run/host%{_libdir} that's present in %{_bindir}/toolbox is intentional [1]. [1] Upstream commit 6063eb27b9893994 https://github.com/containers/toolbox/commit/6063eb27b9893994 https://github.com/containers/toolbox/issues/821
2023-11-09 11:05:46 +00:00
# https://github.com/rpminspect/rpminspect/blob/master/data/generic.yaml
# https://github.com/rpminspect/rpminspect-data-fedora/blob/main/fedora.yaml
---
annocheck:
Silence 'rpminspect --tests=annocheck' (part 2) In recent times, 'rpminspect --tests=annocheck', run by the Fedora CI, has been failing because of the intentional DT_RPATH or DT_RUNPATH value of /run/host%{_libdir} that's present in %{_bindir}/toolbox [1]. It's not clear if they started failing again only recently due to changes in rpminspect(1), or if the previous attempt at silencing it was broken and never actually worked [2]. [1] Upstream commit 6063eb27b9893994 https://github.com/containers/toolbox/commit/6063eb27b9893994 https://github.com/containers/toolbox/issues/821 [2] Commit 12fabacd032f5c58 https://github.com/rpminspect/rpminspect/issues/1296 Resolves: RHEL-33522
2024-07-11 09:08:05 +00:00
extra_opts:
Silence 'rpminspect --tests=stack-prot' The stack-prot test [1] currently fails in Fedora and RHEL 10. On Fedora, it says: Hardened: /usr/bin/toolbox: FAIL: stack-prot test because stack protection not enabled (lto:_cgo_6f668e16310a_Cfunc_mygetgrnam_r) According to the documentation [1], the test is supposed to pass if the C compiler is GCC and it was used with the -fstack-protector-strong option. That's definitely the case, since both Fedora and RHEL 10 use GCC by default, and their default build flags (including %optflags) include -fstack-protector-strong. There's also no function called mygetgrnam() in neither Toolbx nor its chain of dependencies. Therefore, temporarily disable the stack-prot test to prevent the Fedora and RHEL CIs from failing. [1] https://sourceware.org/annobin/annobin.html/Test-stack-prot.html Resolves: RHEL-33522
2024-07-11 09:18:46 +00:00
hardened: --skip-run-path --skip-stack-prot
Silence 'rpminspect --tests=annocheck' and 'rpminspect --tests=runpath' The DT_RPATH or DT_RUNPATH value of /run/host%{_libdir} that's present in %{_bindir}/toolbox is intentional [1]. [1] Upstream commit 6063eb27b9893994 https://github.com/containers/toolbox/commit/6063eb27b9893994 https://github.com/containers/toolbox/issues/821
2023-11-09 11:05:46 +00:00
Update to 0.0.99.6 Update the compiler and linker flags for RHEL 10 by incorporating the distribution's defaults from RHEL 10.0 Beta, because RHEL 10.0 is still early in its development cycle and the defaults may be in a state of flux. Some exceptions are mentioned below. The '-z pack-relative-relocs' linker flag was left out. It's currently not supported on s390x, so using it would require architecture specific patches, which is a hassle. Support for aarch64 was recently added [1], so hopefully s390x will also be supported soon. The change to use the RPM's %{name}, %{version}, %{release} and the SOURCE_DATE_EPOCH environment variable [2], instead of /dev/urandom, to generate the build ID annotation for the toolbox(1) binary [3] was left out. It will need more work to propagate the RPM's %{name}, %{version} and %{release} to Meson. The 'rpminspect --tests=elf' test run by the downstream CI was silenced because toolbox(1) is only built with the '-z relro' linker flag, but not '-z now' [4]. Otherwise, it fails with: /usr/bin/toolbox lost full GNU_RELRO security protection Stop carrying the downstream patch for the compiler and linker flags for PPC64. The architecture was already discontinued from Fedora 29 [5], even before the patch was added [6]. It was added purely for the sake of completeness, and in the last four years since it was introduced, it hasn't been tested or used. At this point it's becoming too much of a maintenance burden, and removing it silences the %ifarch-applied-patch warning from rpmlint. Fill in some of the missing Requires for the toolbox-tests sub-package. [1] CentOS Stream redhat-rpm-config commit 3c5a6b17540b2a0b https://gitlab.com/redhat/centos-stream/rpms/redhat-rpm-config/-/commit/3c5a6b17540b2a0b https://gitlab.com/redhat/centos-stream/rpms/redhat-rpm-config/-/merge_requests/42 https://issues.redhat.com/browse/RHEL-40379 [2] https://reproducible-builds.org/docs/source-date-epoch/ [3] go-rpm-macros commit 1980932bf3a21890 https://pagure.io/go-rpm-macros/c/1980932bf3a21890 https://fedoraproject.org/wiki/Changes/ReproduciblePackageBuilds [4] Upstream commit 83f28c52e47c2d44 https://github.com/containers/toolbox/commit/83f28c52e47c2d44 https://github.com/containers/toolbox/pull/1548 [5] https://fedoraproject.org/wiki/Changes/DiscontinuePPC64 [6] Fedora toolbox commit ba60453d216a9226 https://src.fedoraproject.org/rpms/toolbox/c/ba60453d216a9226 https://src.fedoraproject.org/rpms/toolbox/pull-request/2 Resolves: RHEL-61579
2024-10-04 13:59:13 +00:00
elf:
exclude_path: /usr/bin/toolbox
Silence 'rpminspect --tests=annocheck' and 'rpminspect --tests=runpath' The DT_RPATH or DT_RUNPATH value of /run/host%{_libdir} that's present in %{_bindir}/toolbox is intentional [1]. [1] Upstream commit 6063eb27b9893994 https://github.com/containers/toolbox/commit/6063eb27b9893994 https://github.com/containers/toolbox/issues/821
2023-11-09 11:05:46 +00:00
runpath:
allowed_paths:
Silence 'rpminspect --tests=runpath' on i686
2023-11-10 15:01:17 +00:00
- /run/host/usr/lib
Silence 'rpminspect --tests=annocheck' and 'rpminspect --tests=runpath' The DT_RPATH or DT_RUNPATH value of /run/host%{_libdir} that's present in %{_bindir}/toolbox is intentional [1]. [1] Upstream commit 6063eb27b9893994 https://github.com/containers/toolbox/commit/6063eb27b9893994 https://github.com/containers/toolbox/issues/821
2023-11-09 11:05:46 +00:00
- /run/host/usr/lib64
Reference in New Issue Copy Permalink