Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sysextmgr for openSUSE:Factory checked in at 2026-08-18 16:35:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sysextmgr (Old) and /work/SRC/openSUSE:Factory/.sysextmgr.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sysextmgr" Tue Aug 18 16:35:39 2026 rev:11 rq:1371592 version:1.2.0+git20260817.3f4cd50 Changes: -------- --- /work/SRC/openSUSE:Factory/sysextmgr/sysextmgr.changes 2026-08-12 16:11:10.919116998 +0200 +++ /work/SRC/openSUSE:Factory/.sysextmgr.new.1258/sysextmgr.changes 2026-08-18 16:35:56.422763223 +0200 @@ -1,0 +2,13 @@ +Mon Aug 17 14:47:29 UTC 2026 - Thorsten Kukuk <[email protected]> + +- Update to version 1.2.0+git20260817.3f4cd50: + * Release version 1.2.0 + * Remove .sysext for extension-release, too. + * Ignore dangling symlinks in /etc/extensions + * Fix manifest name for .sysext.raw images + * Unlink meta data file in cache on error + * Relax sysextmgr.service so that dissect does not need mountfsd + * sysextmgr.service: Add CacheDirectory so it's writeable + * Add bash completion for sysextmgrcli + +------------------------------------------------------------------- Old: ---- sysextmgr-1.1.0+git20260811.c3fa27f.tar.xz New: ---- sysextmgr-1.2.0+git20260817.3f4cd50.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sysextmgr.spec ++++++ --- /var/tmp/diff_new_pack.xb6nmE/_old 2026-08-18 16:35:57.165789805 +0200 +++ /var/tmp/diff_new_pack.xb6nmE/_new 2026-08-18 16:35:57.167789876 +0200 @@ -16,7 +16,7 @@ # Name: sysextmgr -Version: 1.1.0+git20260811.c3fa27f +Version: 1.2.0+git20260817.3f4cd50 Release: 0 Summary: Tools to manage systemd-sysext images License: GPL-2.0-or-later @@ -91,6 +91,7 @@ %{_mandir}/man1/sysextmgrcli.1%{?ext_man} %{_mandir}/man5/sysextmgr.conf.5%{?ext_man} %{_mandir}/man8/sysextmgrd.8%{?ext_man} +%{_datadir}/bash-completion/completions/sysextmgrcli %files -n sysextmgr-tukit-plugin %dir %{_prefix}/lib/tukit ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.xb6nmE/_old 2026-08-18 16:35:57.214791558 +0200 +++ /var/tmp/diff_new_pack.xb6nmE/_new 2026-08-18 16:35:57.219791737 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/openSUSE/sysextmgr.git</param> -<param name="changesrevision">c3fa27fa3460bec56870f21e749fb65415375a4d</param></service></servicedata> +<param name="changesrevision">3f4cd502eb4b280d5defe0367b3dc10f3a9fbdb3</param></service></servicedata> (No newline at EOF) ++++++ sysextmgr-1.1.0+git20260811.c3fa27f.tar.xz -> sysextmgr-1.2.0+git20260817.3f4cd50.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysextmgr-1.1.0+git20260811.c3fa27f/bash-completion/sysextmgrcli new/sysextmgr-1.2.0+git20260817.3f4cd50/bash-completion/sysextmgrcli --- old/sysextmgr-1.1.0+git20260811.c3fa27f/bash-completion/sysextmgrcli 1970-01-01 01:00:00.000000000 +0100 +++ new/sysextmgr-1.2.0+git20260817.3f4cd50/bash-completion/sysextmgrcli 2026-08-17 16:47:00.000000000 +0200 @@ -0,0 +1,83 @@ +# sysextmgrcli(1) completion -*- shell-script -*- + +_sysextmgrcli() +{ + local cur prev words cword split + _init_completion -s || return + + local commands='create-json check cleanup dump-json dump-manifest install list merge-json update' + local generic_opts='-h --help -v --version' + + # Find the subcommand: first word after "sysextmgrcli" that isn't an option. + local command i + for ((i = 1; i < cword; i++)); do + case ${words[i]} in + -*) ;; + *) command=${words[i]}; break ;; + esac + done + + if [[ -z $command ]]; then + COMPREPLY=( $(compgen -W "$commands $generic_opts" -- "$cur") ) + return + fi + + local opts + case $command in + create-json) + opts='-n --name -i --input -o --output -h --help' + ;; + check) + opts='-p --prefix -q --quiet -v --verbose -h --help' + ;; + cleanup) + opts='-q --quiet -v --verbose -h --help' + ;; + dump-json|dump-manifest) + opts='-h --help' + ;; + install) + opts='-u --url -v --verbose -h --help' + ;; + list) + opts='-u --url -a --all -v --verbose -h --help' + ;; + merge-json) + opts='-o --output -h --help' + ;; + update) + opts='-p --prefix -q --quiet -u --url -v --verbose -h --help' + ;; + *) + opts=$generic_opts + ;; + esac + + case $prev in + -i|--input|-o|--output) + _filedir + return + ;; + -p|--prefix) + _filedir -d + return + ;; + -u|--url|-n|--name) + return + ;; + esac + + if [[ $cur == -* ]]; then + COMPREPLY=( $(compgen -W "$opts" -- "$cur") ) + return + fi + + case $command in + dump-json|dump-manifest|merge-json) + _filedir json + ;; + esac +} && + complete -F _sysextmgrcli sysextmgrcli + +# ex: filetype=sh diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysextmgr-1.1.0+git20260811.c3fa27f/meson.build new/sysextmgr-1.2.0+git20260817.3f4cd50/meson.build --- old/sysextmgr-1.1.0+git20260811.c3fa27f/meson.build 2026-08-11 14:01:02.000000000 +0200 +++ new/sysextmgr-1.2.0+git20260817.3f4cd50/meson.build 2026-08-17 16:47:00.000000000 +0200 @@ -13,7 +13,7 @@ 'c_std=gnu17', 'warning_level=2'], license : ['GPL-2.0-or-later', 'LGPL-2.1-or-later'], - version : '1.1.0', + version : '1.2.0', ) conf = configuration_data() @@ -120,6 +120,15 @@ # Manual pages subdir('man') +# Bash completion +bash_completion = dependency('bash-completion', required : false) +if bash_completion.found() + bashcompletionsdir = bash_completion.get_variable(pkgconfig : 'completionsdir') +else + bashcompletionsdir = datadir / 'bash-completion/completions' +endif +install_data('bash-completion/sysextmgrcli', install_dir : bashcompletionsdir) + config_h = configure_file( output : 'config.h', configuration : conf) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysextmgr-1.1.0+git20260811.c3fa27f/src/extract.c new/sysextmgr-1.2.0+git20260817.3f4cd50/src/extract.c --- old/sysextmgr-1.1.0+git20260811.c3fa27f/src/extract.c 2026-08-11 14:01:02.000000000 +0200 +++ new/sysextmgr-1.2.0+git20260817.3f4cd50/src/extract.c 2026-08-17 16:47:00.000000000 +0200 @@ -39,8 +39,16 @@ if (asprintf(&erf, "/usr/lib/extension-release.d/extension-release.%s", name) < 0) return -ENOMEM; - /* remove .raw/.img */ - erf[strlen(erf) - 4] = '\0'; + if (endswith(name, ".sysext.raw") || endswith(name, ".sysext.img")) + { + /* remove .sysext.raw/.sysext.img */ + erf[strlen(erf) - 11] = '\0'; + } + else + { + /* remove .raw/.img */ + erf[strlen(erf) - 4] = '\0'; + } const char *const cmdline[] = { SYSTEMD_DISSECT_PATH, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysextmgr-1.1.0+git20260811.c3fa27f/src/images-list.c new/sysextmgr-1.2.0+git20260817.3f4cd50/src/images-list.c --- old/sysextmgr-1.1.0+git20260811.c3fa27f/src/images-list.c 2026-08-11 14:01:02.000000000 +0200 +++ new/sysextmgr-1.2.0+git20260817.3f4cd50/src/images-list.c 2026-08-17 16:47:00.000000000 +0200 @@ -96,33 +96,57 @@ if (num_dirs > 0) { - *result = malloc((num_dirs+1) * sizeof(char *)); + *result = calloc(num_dirs + 1, sizeof(char *)); if (*result == NULL) return -ENOMEM; - (*result)[num_dirs] = NULL; + int j = 0; for (int i = 0; i < num_dirs; i++) { if (de[i]->d_type == DT_LNK) { _cleanup_free_ char *fn = NULL; + _cleanup_free_ char *linkpath = NULL; + struct stat target_sb; char *p; + r = join_path(path, de[i]->d_name, &linkpath); + if (r < 0) + { + free(de[i]); + return r; + } + + /* stat() follows the symlink, so this fails if the + target does not exist. Such dangling symlinks are + ignored, since /etc/extensions may still reference + an image which got removed from the store. */ + if (stat(linkpath, &target_sb) != 0) + { + log_msg(LOG_WARNING, "Ignoring dangling symlink '%s'", linkpath); + free(de[i]); + continue; + } + r = readlink_malloc(path, de[i]->d_name, &fn); if (r < 0) - return r; + { + free(de[i]); + return r; + } p = strrchr(fn, '/'); if (p) - (*result)[i] = strdup(++p); + (*result)[j] = strdup(++p); else - (*result)[i] = strdup(fn); + (*result)[j] = strdup(fn); } else - (*result)[i] = strdup(de[i]->d_name); + (*result)[j] = strdup(de[i]->d_name); - if ((*result)[i] == NULL) + if ((*result)[j] == NULL) return -ENOMEM; + j++; free(de[i]); } free(de); @@ -250,7 +274,6 @@ { /* The meta data is not cached. So extract it from image. */ fd = open(cache_filename, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR); - if (fd < 0) { log_msg(LOG_ERR, "Cannot open filename %s: %s", cache_filename, strerror (errno)); @@ -262,19 +285,25 @@ { log_msg(LOG_ERR, "Failed to extract extension-release from '%s': %s", image_name, strerror(-r)); + unlink(cache_filename); return r; } else if (r > 0) { log_msg(LOG_ERR, "Failed to extract extension-release from '%s': systemd-dissect failed (%i)", image_name, r); + unlink(cache_filename); return -EINVAL; } } r = load_ext_release(cache_filename, &image); if (r < 0) - return r; + { + // unlink the cache, maybe corrupt + unlink(cache_filename); + return r; + } if (image) *res = TAKE_PTR(image); @@ -362,7 +391,9 @@ jsonfn = malloc(strlen(image_name) + strlen(".manifest.gz") + 1); char *p = stpcpy(jsonfn, image_name); - p = endswith(jsonfn, ".raw"); + p = endswith(jsonfn, ".sysext.raw"); + if (!p) + p = endswith(jsonfn, ".raw"); if (!p) { log_msg(LOG_ERR, "The image '%s' has no supported suffix", jsonfn); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysextmgr-1.1.0+git20260811.c3fa27f/units/sysextmgr.service new/sysextmgr-1.2.0+git20260817.3f4cd50/units/sysextmgr.service --- old/sysextmgr-1.1.0+git20260811.c3fa27f/units/sysextmgr.service 2026-08-11 14:01:02.000000000 +0200 +++ new/sysextmgr-1.2.0+git20260817.3f4cd50/units/sysextmgr.service 2026-08-17 16:47:00.000000000 +0200 @@ -4,13 +4,15 @@ [Service] Type=notify +CacheDirectory=sysextmgrd Environment="SYSEXTMGRD_OPTS=" EnvironmentFile=-/etc/default/sysextmgrd ExecStart=/usr/libexec/sysextmgrd -s $SYSEXTMGRD_OPTS LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes -PrivateDevices=yes +# With PrivateDevices systemd-dissect --copy-from would require mountfsd +#PrivateDevices=yes PrivateTmp=yes ProtectClock=yes ProtectControlGroups=yes @@ -18,7 +20,8 @@ ProtectKernelLogs=yes ProtectKernelModules=yes ProtectKernelTunables=yes -ProtectSystem=strict +# With strict systemd-dissect --copy-from would require mountfsd +ProtectSystem=full ReadWritePaths=/var/lib/sysext-store /etc/extensions RestrictRealtime=yes RestrictSUIDSGID=yes
