Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sdbootutil for openSUSE:Factory checked in at 2026-09-04 12:37:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sdbootutil (Old) and /work/SRC/openSUSE:Factory/.sdbootutil.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sdbootutil" Fri Sep 4 12:37:01 2026 rev:109 rq:1375627 version:1+git20260903.f91f636 Changes: -------- --- /work/SRC/openSUSE:Factory/sdbootutil/sdbootutil.changes 2026-08-27 18:49:50.850384885 +0200 +++ /work/SRC/openSUSE:Factory/.sdbootutil.new.1265/sdbootutil.changes 2026-09-04 12:37:53.943292417 +0200 @@ -1,0 +2,72 @@ +Thu Sep 03 13:44:56 UTC 2026 - Alberto Planas Dominguez <[email protected]> + +- Update to version 1+git20260903.f91f636: + * Include FIDO2 unlocked devices for ordering (bsc#1234010) + * Test in parallel for speed up + * Add --repair parameter to cleanup + * Fix shellcheck complain + * Report entries with missing files + * Avoid duplicate entries in non-snapper systems + * Add initial tests for sdbootutil + * Report the error if bootctl clean fails + +------------------------------------------------------------------- +Tue Sep 01 13:30:41 UTC 2026 - Alberto Planas Dominguez <[email protected]> + +- Update to version 1+git20260901.41540d5: + * No warn if a component is not in the event log + * Add status command + * Select the new sdbootutil if available + * Skip blank lines in measure-pcr-generator.sh + * Do not change crypttab for unrelated entries + * Report the bad PCR when update-prediction fail + * Do not write the recovery PIN in the journal + * Improves non snapshot system support + * Update help message for --measure-pcr + * Report when PCR 7 is dropped because shim update + * Add --strict parameter for --pcr policy + * Report dropped PCRs via a warn + * Adjust the limits for PolicyOR issues + * Avoid update predictions if the service is up + * Keep the exit status of sdbootutil call + +------------------------------------------------------------------- +Thu Aug 27 13:35:41 UTC 2026 - Alberto Planas Dominguez <[email protected]> + +- Update to version 1+git20260827.786f9a8: + * Do not accept empty passwords + * jeos-firstboot-enroll: report errors also in the journal + * Restore old crypttab via the exit trap + * Update CLAUDE data + * Detect half created openssl keys + * check_enrolled report when something was written in the LUKS2 header + * Improve a bit the disk-encryption-tool keyslot detection + * Avoid leak of env var secrets + * Wipe the d-e-t key in the enroll service and jeos module + * Remove the correct keyslot left by d-e-t + * Differentiate tpm2 and tpm2+pin for unattended unlock + * Use is_same_device in detect_tracked_device and drop greps + * Refactor check to avoid shellcheck complain + * Parse the entry file in a sigle place + * Validate the entry with the new kernel name + * Refactor enrollment interface and deprecate the old one + * New kernels will have different hash + * Warn If no crypttab entry found + * Extend is_same_device + * jeos-firstboot-enroll: validate the passwords + * sdbootutil-enroll: report when no encryption method is provided + * Write recovery pin after enrollment in jeos module + * Write recovery pin after enrollment + * Improve error detection in sdbootutil-enroll + * Increase keyctl timeout + * Merge require_unlock and set_unlock_method + * Be sure that the terminal check works with snapper + * Renerate initrd when new measure-pcr keys are created + * Separate ask-* parameters + * Fix reading credential and keyctl password + * Get the device password for each enrolling mechanism + * Drop elements from crypttab if the enrollment fails + * Validate the enrollment for each method + * Add warning when enrolling FIDO2 token + +------------------------------------------------------------------- Old: ---- sdbootutil-1+git20260825.c7a5a97.obscpio New: ---- sdbootutil-1+git20260903.f91f636.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sdbootutil.spec ++++++ --- /var/tmp/diff_new_pack.vpcpLs/_old 2026-09-04 12:37:54.967328390 +0200 +++ /var/tmp/diff_new_pack.vpcpLs/_new 2026-09-04 12:37:54.969328460 +0200 @@ -18,7 +18,7 @@ %global rustflags '-Clink-arg=-Wl,-z,relro,-z,now' Name: sdbootutil -Version: 1+git20260825.c7a5a97 +Version: 1+git20260903.f91f636 Release: 0 Summary: Bootctl wrapper for BLS boot loaders License: MIT @@ -31,6 +31,8 @@ BuildRequires: libopenssl-devel BuildRequires: systemd-rpm-macros Requires: %{name}-dracut-measure-pcr +# 2.4.0 for --disable-external-tokens, used to validate a password +Requires: cryptsetup >= 2.4.0 Requires: dracut-pcr-signature Requires: e2fsprogs Requires: efibootmgr @@ -204,13 +206,26 @@ [ -e /sys/firmware/efi/efivars ] || exit 0 [ -z "$TRANSACTIONAL_UPDATE" ] || exit 0 [ -z "$VERBOSE_FILETRIGGERS" ] || echo "%{name}-%{version}-%{release}: updating bootloader" +# The marker is set by the snapper plugin, that already scheduled a +# deferred update-predictions for this transaction. The plugin sets +# it in the pre snapshot, so it is here before this trigger runs, and +# the deferred service runs after the post snapshot, once the entries +# that this trigger does not touch are in place. Updating the +# predictions here too builds the pcrlock policy and rewrites the TPM2 +# NVIndex a second time, inside the rpm transaction, and that first +# policy is discarded by the deferred run seconds later. +# +# Without the snapper plugin there is no marker and no deferral, so +# this trigger stays the only chance to update the predictions +predictions= +[ ! -e /run/sdbootutil/update-predictions ] || predictions=--disable-predictions if [ -e /etc/sysconfig/bootloader ]; then . /etc/sysconfig/bootloader &> /dev/null if [ "$LOADER_TYPE" = "grub2-bls" ] || [ "$LOADER_TYPE" = "systemd-boot" ]; then - sdbootutil update + sdbootutil update $predictions fi else - sdbootutil update + sdbootutil update $predictions fi %preun ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.vpcpLs/_old 2026-09-04 12:37:55.030330603 +0200 +++ /var/tmp/diff_new_pack.vpcpLs/_new 2026-09-04 12:37:55.034330744 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/openSUSE/sdbootutil.git</param> - <param name="changesrevision">c7a5a976e97cfb7e0a6a740e6a38f87333894cb1</param></service></servicedata> + <param name="changesrevision">f91f636d0fe261f4fecf667716deaf8ad35b4f5f</param></service></servicedata> (No newline at EOF) ++++++ sdbootutil-1+git20260825.c7a5a97.obscpio -> sdbootutil-1+git20260903.f91f636.obscpio ++++++ ++++ 5851 lines of diff (skipped) ++++++ sdbootutil.obsinfo ++++++ --- /var/tmp/diff_new_pack.vpcpLs/_old 2026-09-04 12:37:55.212336997 +0200 +++ /var/tmp/diff_new_pack.vpcpLs/_new 2026-09-04 12:37:55.216337137 +0200 @@ -1,5 +1,5 @@ name: sdbootutil -version: 1+git20260825.c7a5a97 -mtime: 1787668821 -commit: c7a5a976e97cfb7e0a6a740e6a38f87333894cb1 +version: 1+git20260903.f91f636 +mtime: 1788443044 +commit: f91f636d0fe261f4fecf667716deaf8ad35b4f5f
