Hello community, here is the log from the commit of package rpmlint for openSUSE:Factory checked in at 2020-04-04 12:04:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpmlint (Old) and /work/SRC/openSUSE:Factory/.rpmlint.new.3248 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rpmlint" Sat Apr 4 12:04:59 2020 rev:332 rq:790150 version:1.11 Changes: -------- --- /work/SRC/openSUSE:Factory/rpmlint/rpmlint.changes 2020-03-03 10:13:55.478362895 +0100 +++ /work/SRC/openSUSE:Factory/.rpmlint.new.3248/rpmlint.changes 2020-04-04 12:05:32.790649505 +0200 @@ -1,0 +2,13 @@ +Tue Mar 31 11:52:38 UTC 2020 - [email protected] + +- Update to version master: + * Whitelisting: avoid duplicate checks / error messages for the same files + * Whitelisting: fix whitelisting checks when files are symbolic links + * Mention upstream repo in README + +------------------------------------------------------------------- +Fri Mar 27 16:59:18 UTC 2020 - Axel Braun <[email protected]> + +- Bug 1167431 - AUDIT-0: User/group orthanc for rpmlint + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ rpmlint.spec: same change ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.A0VIyy/_old 2020-04-04 12:05:34.606651417 +0200 +++ /var/tmp/diff_new_pack.A0VIyy/_new 2020-04-04 12:05:34.610651421 +0200 @@ -3,4 +3,4 @@ <param name="url">https://github.com/openSUSE/rpmlint-tests.git</param> <param name="changesrevision">3ea152ba41f080462891f99711fee3712c56c8c7</param></service><service name="tar_scm"> <param name="url">https://github.com/openSUSE/rpmlint-checks.git</param> - <param name="changesrevision">d26befa3c953dd4f96265bd58c6dad472a6ea512</param></service></servicedata> \ No newline at end of file + <param name="changesrevision">00c0040faa30370f367de0d2bec3e7449db8c44b</param></service></servicedata> \ No newline at end of file ++++++ config ++++++ --- /var/tmp/diff_new_pack.A0VIyy/_old 2020-04-04 12:05:34.630651443 +0200 +++ /var/tmp/diff_new_pack.A0VIyy/_new 2020-04-04 12:05:34.634651446 +0200 @@ -184,6 +184,7 @@ 'ntp', 'oinstall', 'openvswitch', + 'orthanc', 'ovirtagent', 'ceilometer', 'cinder', @@ -397,6 +398,7 @@ 'octavia', 'openvswitch', 'oracle', + 'orthanc' 'otrs', 'ovirtagent', 'partimag', ++++++ rpmlint-checks-master.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-checks-master/README new/rpmlint-checks-master/README --- old/rpmlint-checks-master/README 2020-02-06 10:14:08.000000000 +0100 +++ new/rpmlint-checks-master/README 2020-03-31 11:35:13.000000000 +0200 @@ -2,3 +2,9 @@ when adding or modifying a test make sure to update https://github.com/openSUSE/rpmlint-tests as well! + +Wwith RPMLint 2.0 the checks are merged and obsolete in upstream git repo: + https://github.com/rpm-software-management/rpmlint + +If you have a bugfix check the code there if it is affected. +If you are developing a new functionality just directly go there and do not add new tests here. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-checks-master/Whitelisting.py new/rpmlint-checks-master/Whitelisting.py --- old/rpmlint-checks-master/Whitelisting.py 2020-02-06 10:14:08.000000000 +0100 +++ new/rpmlint-checks-master/Whitelisting.py 2020-03-31 11:35:13.000000000 +0200 @@ -110,6 +110,8 @@ # checked in setDigests() so we can skip the respective error handling # here. + fileinfos = pkg.files() + for path, digest in self.digests().items(): if self.isSkipDigest(digest): continue @@ -119,11 +121,30 @@ try: h = hashlib.new(alg) - # NOTE: this path is dynamic and rpmlint unpacks the RPM + src_info = fileinfos.get(path, None) + + if not src_info: + raise Exception("expected file {} is not part of the RPM".format(path)) + + # resolve potential symbolic links + # + # this function handles both absolute and relative symlinks + # and does not access paths outside the RPM. + # + # it is not safe against symlink loops, however, it will + # result in an infinite loop it such cases. But there are + # probably a lot of other possibilities to DoS the RPM build + # process or rpmlint. + dst_info = pkg.readlink(src_info) + + if not dst_info: + raise Exception("symlink {} -> {} is broken or pointing outside this RPM".format(src_info.path, src_info.linkto)) + + # NOTE: this path is dynamic, rpmlint unpacks the RPM # contents into a temporary directory even when outside the # build environment i.e. the file content should always be # available to us. - with open(pkg.dirName() + path, 'rb') as fd: + with open(dst_info.path, 'rb') as fd: while True: chunk = fd.read(4096) if not chunk: @@ -134,6 +155,8 @@ encountered = h.hexdigest() except IOError as e: encountered = "error:" + str(e) + except Exception as e: + encountered = "error:" + str(e) dig_res = DigestVerificationResult(path, alg, digest, encountered) results.append(dig_res) @@ -341,6 +364,7 @@ return files = pkg.files() + already_tested = set() for f in files: for restricted in self.m_restricted_paths: @@ -365,6 +389,14 @@ printError(pkg, self.m_error_map['unauthorized'], f) continue + # avoid testing the same paths multiple times thereby avoiding + # duplicate error messages or unnecessary re-checks of the same + # files. + # this is necessary since whitelisting entries can consist of + # groups of files that are all checked in one go below. + if f in already_tested: + continue + # for the case that there's no match of digests, remember the most # recent digest verification result for diagnosis output towards # the user @@ -376,11 +408,15 @@ digest_matches, results = audit.compareDigests(pkg) if digest_matches: + for r in results: + already_tested.add(r.path()) break if not diag_results: diag_results = results else: + for r in diag_results: + already_tested.add(r.path()) # none of the digest entries matched self._printVerificationResults(diag_results) printError(pkg, self.m_error_map['changed'], f)
