Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package dracut-pcr-signature for
openSUSE:Factory checked in at 2026-08-13 13:15:36
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/dracut-pcr-signature (Old)
and /work/SRC/openSUSE:Factory/.dracut-pcr-signature.new.17972 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "dracut-pcr-signature"
Thu Aug 13 13:15:36 2026 rev:18 rq:1370861 version:0.8+0
Changes:
--------
---
/work/SRC/openSUSE:Factory/dracut-pcr-signature/dracut-pcr-signature.changes
2026-05-08 16:42:12.261283851 +0200
+++
/work/SRC/openSUSE:Factory/.dracut-pcr-signature.new.17972/dracut-pcr-signature.changes
2026-08-13 13:15:56.237639479 +0200
@@ -1,0 +2,8 @@
+Wed Aug 12 13:47:42 UTC 2026 - Alberto Planas Dominguez <[email protected]>
+
+- Update to version 0.8+0:
+ * Install the module iff systemd-boot or grub2-bls
+ * Make sure that our sysefi.mount takes precedence
+ * Do not copy old tpm2-pcr-signature files
+
+-------------------------------------------------------------------
Old:
----
dracut-pcr-signature-0.7+0.tar.xz
New:
----
dracut-pcr-signature-0.8+0.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ dracut-pcr-signature.spec ++++++
--- /var/tmp/diff_new_pack.Udg6Yi/_old 2026-08-13 13:15:56.849666517 +0200
+++ /var/tmp/diff_new_pack.Udg6Yi/_new 2026-08-13 13:15:56.853666694 +0200
@@ -17,7 +17,7 @@
Name: dracut-pcr-signature
-Version: 0.7+0
+Version: 0.8+0
Release: 0
Summary: Dracut module to import PCR signatures
License: GPL-2.0-or-later
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.Udg6Yi/_old 2026-08-13 13:15:56.913669345 +0200
+++ /var/tmp/diff_new_pack.Udg6Yi/_new 2026-08-13 13:15:56.921669698 +0200
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://github.com/aplanas/dracut-pcr-signature.git</param>
- <param
name="changesrevision">d0e5ec8bdcaf64331e6e5b55415fe91420b04913</param></service></servicedata>
+ <param
name="changesrevision">12b6a6fff84b445eefd36d12cd29ae454d0b553d</param></service></servicedata>
(No newline at EOF)
++++++ dracut-pcr-signature-0.7+0.tar.xz -> dracut-pcr-signature-0.8+0.tar.xz
++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/dracut-pcr-signature-0.7+0/dracut-pcr-signature.spec
new/dracut-pcr-signature-0.8+0/dracut-pcr-signature.spec
--- old/dracut-pcr-signature-0.7+0/dracut-pcr-signature.spec 2026-05-06
14:26:40.000000000 +0200
+++ new/dracut-pcr-signature-0.8+0/dracut-pcr-signature.spec 2026-08-12
15:38:35.000000000 +0200
@@ -1,7 +1,7 @@
#
# spec file for package dracut-pcr-signature
#
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/dracut-pcr-signature-0.7+0/module-setup.sh
new/dracut-pcr-signature-0.8+0/module-setup.sh
--- old/dracut-pcr-signature-0.7+0/module-setup.sh 2026-05-06
14:26:40.000000000 +0200
+++ new/dracut-pcr-signature-0.8+0/module-setup.sh 2026-08-12
15:38:35.000000000 +0200
@@ -7,6 +7,21 @@
if ! [ -d /sys/class/tpmrm ] || [ -z "$(ls -A /sys/class/tpmrm)" ];
then
return 255
fi
+
+ # Only a BLS boot loader (systemd-boot or grub2-bls) drops the
+ # pcrlock.json in the ESP, so the module is useless when the
+ # system boots with a different one, like the classic grub2-efi.
+ # The package can still be installed there, as sdbootutil
+ # requires it, but the module is not added to the initrd.
+ if [ -e /etc/sysconfig/bootloader ]; then
+ local loader_type
+ # shellcheck disable=SC1091
+ loader_type="$(. /etc/sysconfig/bootloader &> /dev/null; echo
"$LOADER_TYPE")"
+ case "$loader_type" in
+ systemd-boot | grub2-bls | "") ;;
+ *) return 255 ;;
+ esac
+ fi
fi
return 0
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/dracut-pcr-signature-0.7+0/pcr-signature.service
new/dracut-pcr-signature-0.8+0/pcr-signature.service
--- old/dracut-pcr-signature-0.7+0/pcr-signature.service 2026-05-06
14:26:40.000000000 +0200
+++ new/dracut-pcr-signature-0.8+0/pcr-signature.service 2026-08-12
15:38:35.000000000 +0200
@@ -5,8 +5,11 @@
Wants=cryptsetup-pre.target
Before=cryptsetup-pre.target
-Wants=sysefi.mount
-After=sysefi.mount
+# The ordering against sysefi.mount is not declared here, but in a
+# drop-in written by sysefi-generator, and only when that generator is
+# the one providing the mount unit. Pulling in the sysefi.mount that
+# systemd's gpt-auto-generator provides creates an ordering cycle with
+# cryptsetup-pre.target.
[Service]
Type=oneshot
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/dracut-pcr-signature-0.7+0/pcr-signature.sh
new/dracut-pcr-signature-0.8+0/pcr-signature.sh
--- old/dracut-pcr-signature-0.7+0/pcr-signature.sh 2026-05-06
14:26:40.000000000 +0200
+++ new/dracut-pcr-signature-0.8+0/pcr-signature.sh 2026-08-12
15:38:35.000000000 +0200
@@ -1,7 +1,7 @@
#!/bin/bash
set -euo pipefail
-if [ -e "/run/systemd/pcrlock.json" ] || [ -e
"/run/systemd/tpm2-pcr-signature.json" ]; then
+if [ -e "/run/systemd/pcrlock.json" ]; then
echo "pcr-signature: signature file already present"
exit 0
fi
@@ -18,11 +18,6 @@
mkdir -p /run/systemd
cp "${location}/pcrlock.json" /run/systemd
break
- elif [ -e "${location}/tpm2-pcr-signature.json" ] && [ -e
"${location}/tpm2-pcr-public-key.pem" ]; then
- mkdir -p /run/systemd
- cp "${location}/tpm2-pcr-signature.json" /run/systemd
- cp "${location}/tpm2-pcr-public-key.pem" /run/systemd
- break
fi
done
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/dracut-pcr-signature-0.7+0/sysefi-generator.sh
new/dracut-pcr-signature-0.8+0/sysefi-generator.sh
--- old/dracut-pcr-signature-0.7+0/sysefi-generator.sh 2026-05-06
14:26:40.000000000 +0200
+++ new/dracut-pcr-signature-0.8+0/sysefi-generator.sh 2026-08-12
15:38:35.000000000 +0200
@@ -15,6 +15,10 @@
elif [ -e /dev/disk/by-designator/esp ]; then
DEV="/dev/disk/by-designator/esp"
else
+ # The ESP cannot be located, so no sysefi.mount is generated here.
+ # pcr-signature.service is not ordered against sysefi.mount either
+ # (see the drop-in below), so it will simply find /sysefi empty and
+ # do nothing.
exit 0
fi
@@ -33,3 +37,20 @@
Type=vfat
Options=utf8
EOF
+
+# Order pcr-signature.service against the mount unit only when this
+# generator is the one that created it. systemd's gpt-auto-generator
+# also provides a sysefi.mount (in the late generator directory, so ours
+# takes precedence), but that one has the default dependencies enabled
+# and requires [email protected], which is ordered after
+# systemd-fsck-root.service and therefore after cryptsetup.target. A
+# Wants=/After=sysefi.mount in pcr-signature.service, that is ordered
+# before cryptsetup-pre.target, closes an ordering cycle in that case.
+mkdir -p "$1/pcr-signature.service.d"
+cat > "$1/pcr-signature.service.d/10-sysefi-mount.conf" <<EOF
+# Automatically generated by pcr-signature-generator
+
+[Unit]
+Wants=sysefi.mount
+After=sysefi.mount
+EOF
