Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package openSUSE-build-key for
openSUSE:Leap:16.0 checked in at 2026-07-19 20:04:23
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Leap:16.0/openSUSE-build-key (Old)
and /work/SRC/openSUSE:Leap:16.0/.openSUSE-build-key.new.24530 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openSUSE-build-key"
Sun Jul 19 20:04:23 2026 rev:17 rq: version:1.0
Changes:
--------
--- /work/SRC/openSUSE:Leap:16.0/openSUSE-build-key/openSUSE-build-key.changes
2026-05-29 13:25:39.796431012 +0200
+++
/work/SRC/openSUSE:Leap:16.0/.openSUSE-build-key.new.24530/openSUSE-build-key.changes
2026-07-19 20:04:24.862255025 +0200
@@ -1,0 +2,23 @@
+Fri Jul 17 14:48:47 UTC 2026 - Marcus Meissner <[email protected]>
+
+- make gpg-pubkey-287a0027-682477e3.asc use the same content as
+ the one from Packagehub-release.
+
+-------------------------------------------------------------------
+Wed Jul 8 08:45:23 UTC 2026 - Dominique Leuenberger <[email protected]>
+
+- Update key for zSystems (managed by OBS, expires 2026-12-06)
+ - replace gpg-pubkey-f6ab3975-62e9e6fb.asc
+ - by gpg-pubkey-f6ab3975-66f622c2.asc
+
+-------------------------------------------------------------------
+Tue Jun 23 14:34:49 UTC 2026 - Marcus Meissner <[email protected]>
+
+- do not include the projects _pubkey if we have it already.
+
+-------------------------------------------------------------------
+Mon Jun 22 09:52:22 UTC 2026 - Marcus Meissner <[email protected]>
+
+- use the modification time for key2rpname
+
+-------------------------------------------------------------------
@@ -5,0 +29,21 @@
+
+-------------------------------------------------------------------
+Tue Apr 28 12:07:13 UTC 2026 - Max Lin <[email protected]>
+
+- adjust suse_version condition for the Backports key
+
+-------------------------------------------------------------------
+Tue Mar 17 14:02:29 UTC 2026 - Marcus Meissner <[email protected]>
+
+- move the pqkeys out of gnupg, its not gpg style.
+
+-------------------------------------------------------------------
+Thu Mar 12 15:16:40 UTC 2026 - Marcus Meissner <[email protected]>
+
+- add the openSUSE post quantum key in /usr/lib/rpm/pqkeys/
+
+-------------------------------------------------------------------
+Fri Jan 16 13:43:53 UTC 2026 - Thorsten Kukuk <[email protected]>
+
+- import-openSUSE-build-key: implement importing all keys from
+ /usr/lib/rpm/gnupg/keys
New:
----
gpg-pubkey-f6ab3975-66f622c2.asc
openSUSE-mldsa-key.pem
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ openSUSE-build-key.spec ++++++
--- /var/tmp/diff_new_pack.7jadmL/_old 2026-07-19 20:04:25.322270439 +0200
+++ /var/tmp/diff_new_pack.7jadmL/_new 2026-07-19 20:04:25.326270572 +0200
@@ -1,7 +1,7 @@
#
# spec file for package openSUSE-build-key
#
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -18,6 +18,7 @@
%define keydir %{_prefix}/lib/rpm/gnupg/keys/
+%define pqkeydir %{_prefix}/lib/rpm/pqkeys/
%define containerkeydir %{_datadir}/container-keys/
%define pemcontainerkeydir /%{_datadir}/pki/containers/
@@ -52,7 +53,7 @@
Source3: gpg-pubkey-697ba1e5-5c755904.asc
# zSystems
-Source5: gpg-pubkey-f6ab3975-62e9e6fb.asc
+Source5: gpg-pubkey-f6ab3975-66f622c2.asc
# PowerPC
Source6: gpg-pubkey-8ede3e07-5c755f3a.asc
@@ -90,6 +91,9 @@
# 2024 SUSE Linux Enterprise 15 SP6 RSA 4096 bit reserve key
Source19: gpg-pubkey-d588dc46-63c939db.asc
+# ML-DSA PQC key for openSUSE
+Source30: openSUSE-mldsa-key.pem
+
Source98: security_at_suse_de.asc
# Auto Import handling via systemd timer + service.
@@ -98,6 +102,7 @@
Source102: %name-import.service
Source103: %name-import.timer
+
BuildRequires: gpg
Conflicts: suse-build-key
Provides: build-key = %{version}
@@ -131,7 +136,7 @@
%install
mkdir -p %{buildroot}%{keydir}
for i in %{SOURCE20} %{SOURCE10} %{SOURCE2} \
-%if 0%{?is_opensuse} && 0%{?suse_version} == 1600
+%if 0%{?is_opensuse} && (0%{?suse_version} >= 1600 && 0%{?suse_version} < 1699)
%{SOURCE9} \
%endif
%ifarch riscv64
@@ -161,13 +166,19 @@
install -c -m 644 %{SOURCE14}
%{buildroot}%{pemcontainerkeydir}/suse-container-key.pem
install -c -m 644 %{SOURCE11}
%{buildroot}%{pemcontainerkeydir}/suse-container-key-old.pem
install -c -m 644 %{SOURCE12}
%{buildroot}%{pemcontainerkeydir}/opensuse-container-key-2023.pem
+
+# Include pubkey only if we do not have it yet.
if [ -e "%_sourcedir/_pubkey" ]; then
name="$(sh %{SOURCE0} %_sourcedir/_pubkey).asc"
- if [ ! -e "%_sourcedir/$name" ]; then
+ idname=`echo $name|sed -e 's/-[^-]*$//;'`
+ if [ ! -e %_sourcedir/$idname*.asc ]; then
install -D -m 644 %_sourcedir/_pubkey %{buildroot}%keydir/"$name"
fi
fi
+mkdir -p %{buildroot}%{pqkeydir}/
+install -c -m 644 %{SOURCE30} %{buildroot}%{pqkeydir}/opensuse-mldsa-key.pem
+
mkdir -p $RPM_BUILD_ROOT/usr/sbin/
mkdir -p $RPM_BUILD_ROOT/var/lib/%name
install -m 755 %{SOURCE101} $RPM_BUILD_ROOT/usr/sbin/import-%name
@@ -194,10 +205,12 @@
%doc security_at_suse_de.asc
%attr(755,root,root) %dir %{_prefix}/lib/rpm/gnupg
%attr(755,root,root) %dir %{keydir}
+%attr(755,root,root) %dir %{pqkeydir}
%attr(755,root,root) %dir %{containerkeydir}
%attr(755,root,root) %dir %{_datadir}/pki/
%attr(755,root,root) %dir %{pemcontainerkeydir}
%{keydir}/gpg-pubkey-*.asc
+%{pqkeydir}/*.pem
%{containerkeydir}/opensuse-container-key.asc
%{containerkeydir}/suse-container-key.asc
%{containerkeydir}/suse-container-key-old.asc
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.7jadmL/_old 2026-07-19 20:04:25.370272047 +0200
+++ /var/tmp/diff_new_pack.7jadmL/_new 2026-07-19 20:04:25.374272181 +0200
@@ -1,7 +1,7 @@
-mtime: 1779959185
-commit: 1cc8392887407301c20980741aea18d726df1f2ae4c4ca5600ef300cf54f17cf
+mtime: 1784299882
+commit: 899296e28e3ad35b62a2a04646d422d95684bdde375c84b95ec80d24bf26a0a2
url: https://src.opensuse.org/pool/openSUSE-build-key
-revision: 1cc8392887407301c20980741aea18d726df1f2ae4c4ca5600ef300cf54f17cf
+revision: 899296e28e3ad35b62a2a04646d422d95684bdde375c84b95ec80d24bf26a0a2
trackingbranch: Leap-16.0
projectscmsync: https://src.opensuse.org/openSUSE/Leap
++++++ build.specials.obscpio ++++++
--- old/.gitignore 2026-05-28 11:06:25.000000000 +0200
+++ new/.gitignore 2026-07-17 16:51:22.000000000 +0200
@@ -1 +1,4 @@
-.osc
+*.obscpio
+*.osc
+_build.*
+.pbuild
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-07-17 16:51:22.000000000 +0200
@@ -0,0 +1,4 @@
+*.obscpio
+*.osc
+_build.*
+.pbuild
++++++ gpg-pubkey-287a0027-682477e3.asc ++++++
--- /var/tmp/diff_new_pack.7jadmL/_old 2026-07-19 20:04:25.602279821 +0200
+++ /var/tmp/diff_new_pack.7jadmL/_new 2026-07-19 20:04:25.606279955 +0200
@@ -1,9 +1,3 @@
-Type : GPG public key
-User ID : openSUSE Backports for SUSE Linux 16
<[email protected]>
-Algorithm : rsa
-Key size : 4096
-Expires : 2036-04-26 13:00:51
-Fingerprint : bf3f 9a67 d3a2 ff98 a73f 5e07 488c 583d 287a 0027
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGgkd+MBEADj3FRif7LGWekuuPsJQ2JLm3cCA8OksKH74lkS9X2BWdbxlO3c
++++++ import-openSUSE-build-key ++++++
--- /var/tmp/diff_new_pack.7jadmL/_old 2026-07-19 20:04:25.702283172 +0200
+++ /var/tmp/diff_new_pack.7jadmL/_new 2026-07-19 20:04:25.702283172 +0200
@@ -1,34 +1,36 @@
-#!/bin/bash
-#
+#!/bin/sh
+
triggerfile=/var/lib/openSUSE-build-key/imported
# if zypp is running we will get into lock conflicts, and zypper might die
# unexpectedly.
if [ -s /run/zypp.pid ]; then
- exit 0
+ echo "Aborted, zypper is running"
+ exit 0
fi
# first remove trigger file
rm -f $triggerfile
# The import might fail if something has locked the RPM database. in that case
we retry again on next boot or so.
-
-
-# Example here is from SLES, but we can use it for openSUSE when needed:
-
-# Upcoming SLES 15 4096 bit RSA key
-#if test -f /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc; then
-# rpm -q gpg-pubkey-3fa1d6ce > /dev/null ||
-# rpm --import
/usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc || touch $triggerfile
-#fi
-#if test -f /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc; then
-# rpm -q gpg-pubkey-d588dc46 > /dev/null ||
-# rpm --import
/usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc || touch $triggerfile
-#fi
+for KFN in /usr/lib/rpm/gnupg/keys/gpg-pubkey-*.asc; do
+ if [ ! -e "$KFN" ];then
+ #
+ # check if file exists because if the glob match did
+ # not find files bash will use the glob string as
+ # result and we just continue in this case
+ #
+ continue
+ fi
+ KEY=$(basename "$KFN" .asc)
+ rpm -q "$KEY" >/dev/null && continue
+ echo "Importing $KEY to rpm database"
+ rpm --import "$KFN" || touch "$triggerfile"
+done
# if we have finished import, disable and stop the timer.
-if [ ! -f $triggerfile -a -x /usr/bin/systemctl ] ; then
- systemctl stop openSUSE-build-key-import.timer
- systemctl disable openSUSE-build-key-import.timer
+if [ ! -f "$triggerfile" ] && [ -x /usr/bin/systemctl ] ; then
+ systemctl stop openSUSE-build-key-import.timer
+ systemctl disable openSUSE-build-key-import.timer
fi
++++++ key2rpmname ++++++
--- /var/tmp/diff_new_pack.7jadmL/_old 2026-07-19 20:04:25.726283975 +0200
+++ /var/tmp/diff_new_pack.7jadmL/_new 2026-07-19 20:04:25.726283975 +0200
@@ -2,10 +2,14 @@
function keyname() {
for key in "$@"; do
while read line; do
- [ "${line:0:4}" = "pub:" ] || continue
- IFS=: eval set -- "\$line"
- keyid="${5:8}"
- printf "gpg-pubkey-%s-%08x\n" "${keyid,,}" "$6"
+ if [ "${line:0:4}" = "pub:" ]; then
+ IFS=: eval set -- "\$line"
+ keyid="${5:8}"
+ fi
+ if [ "${line:0:4}" = "uid:" ]; then
+ IFS=: eval set -- "\$line"
+ printf "gpg-pubkey-%s-%08x\n" "${keyid,,}" "$6"
+ fi
done < <(gpg --with-colons --import-options show-only --import
2>/dev/null < "$key")
done
}
