+ From 1a2554da434548e916240796fe7ca9689c5771fe Mon Sep 17 00:00:00 2001

+ From: Panu Matilainen <pmatilai@redhat.com>

+ Date: Thu, 27 May 2021 13:58:58 +0300

+ Subject: [PATCH] Macroize find-debuginfo script location

+ 

+ Makes it easier to handle varying paths, mainly in preparation for the

+ next step.

+ 

+ (cherry picked from commit ce48167f37af59b6366083fb78a314f7931c0c6b)

+ ---

+  configure.ac | 1 +

+  macros.in    | 4 +++-

+  2 files changed, 4 insertions(+), 1 deletion(-)

+ 

+ diff --git a/configure.ac b/configure.ac

+ index 39f9a0e5b..35b4dff4c 100644

+ --- a/configure.ac

+ +++ b/configure.ac

+ @@ -113,6 +113,7 @@ AC_PATH_PROG(__NM, nm, /usr/bin/nm, $MYPATH)

+  AC_PATH_PROG(__OBJCOPY, objcopy, /usr/bin/objcopy, $MYPATH)

+  AC_PATH_PROG(__OBJDUMP, objdump, /usr/bin/objdump, $MYPATH)

+  AC_PATH_PROG(__STRIP, strip, /usr/bin/strip, $MYPATH)

+ +AC_PATH_PROG(__FIND_DEBUGINFO, find-debuginfo, /usr/bin/find-debuginfo, $MYPATH)

+  

+  AC_PATH_PROG(__GIT, git, /usr/bin/git, $MYPATH)

+  AC_PATH_PROG(__HG, hg, /usr/bin/hg, $MYPATH)

+ diff --git a/macros.in b/macros.in

+ index 24b124702..2bcf07ef8 100644

+ --- a/macros.in

+ +++ b/macros.in

+ @@ -80,6 +80,8 @@

+  %__remsh		%{__rsh}

+  %__strip		@__STRIP@

+  

+ +%__find_debuginfo	@__FIND_DEBUGINFO@

+ +

+  #==============================================================================

+  # Conditional build stuff.

+  

+ @@ -149,7 +151,7 @@

+  #       _find_debuginfo_vendor_opts to pass options to the script.

+  #

+  %__debug_install_post   \

+ -    %{_rpmconfigdir}/find-debuginfo.sh \\\

+ +    %{__find_debuginfo} \\\

+      %{?_smp_build_ncpus:-j%{_smp_build_ncpus}} \\\

+      %{?_missing_build_ids_terminate_build:--strict-build-id} \\\

+      %{?_no_recompute_build_ids:-n} \\\

+ -- 

+ 2.41.0

+ 

+ Based on

+ 

+ From 7db2efa95d859cebda2b095ffdffac42812bd6d9 Mon Sep 17 00:00:00 2001

+ From: Darren Kenny <darren.kenny@oracle.com>

+ Date: Tue, 22 Feb 2022 16:57:00 +0000

+ Subject: [PATCH] ima: Install on filesystems without xattr support without

+  failing

+ 

+ If an RPM contains IMA signed digests and rpm-plugin-ima is installed,

+ then any attempt to install to a filesystem that doesn't support

+ extended attributes will cause the RPM installation to fail.

+ 

+ This can be seen, for example, if installing a file /boot, which is

+ usually a vFAT filesystem.

+ 

+ The rpm-plugin for selinux fixed this some time back, and that same

+ logic can be applied to IMA too - where, if a failure to set an extended

+ attribute results in an errno that is set to EOPNOTSUPP, then this

+ should not cause a complete failure, but should instead just be logged

+ at a debug level.

+ 

+ Signed-off-by: Darren Kenny <darren.kenny@oracle.com>

+ 

+ --- rpm-4.16.1.3/plugins/ima.c.orig	2023-05-02 18:19:25.095992859 +0200

+ +++ rpm-4.16.1.3/plugins/ima.c	2023-05-02 18:21:46.032941008 +0200

+ @@ -69,10 +69,13 @@

+  	fsig = rpmfiFSignature(fi, &len);

+  	if (fsig && (check_zero_hdr(fsig, len) == 0)) {

+  	    if (lsetxattr(path, XATTR_NAME_IMA, fsig, len, 0) < 0) {

+ -	        rpmlog(RPMLOG_ERR,

+ +		int is_err = errno != EOPNOTSUPP; 

+ +	        rpmlog(is_err?RPMLOG_ERR:RPMLOG_DEBUG,

+  			"ima: could not apply signature on '%s': %s\n",

+  			path, strerror(errno));

+ -	        rc = RPMRC_FAIL;

+ +		if (is_err) {

+ +		    rc = RPMRC_FAIL;

+ +		}

+  	    }

+  	}

+  

+ --- rpm-4.16.1.3/tests/Makefile.am.orig	2023-05-03 12:44:36.287582896 +0200

+ +++ rpm-4.16.1.3/tests/Makefile.am	2023-05-03 12:46:34.182938006 +0200

+ @@ -170,7 +170,7 @@

+  	for d in dev etc magic tmp var; do if [ ! -d testing/$${d} ]; then mkdir testing/$${d}; fi; done

+  	for node in urandom stdin stderr stdout null full; do ln -s /dev/$${node} testing/dev/$${node}; done

+  	for cf in hosts resolv.conf passwd shadow group gshadow mtab ; do [ -f /etc/$${cf} ] && ln -s /etc/$${cf} testing/etc/$${cf}; done

+ -	for prog in gzip cat patch tar sh ln chmod rm mkdir uname grep sed find file ionice mktemp nice cut sort diff touch install wc coreutils xargs; do p=`which $${prog}`; if [ "$${p}" != "" ]; then ln -s $${p} testing/$(bindir)/; fi; done

+ +	for prog in gzip cat patch tar sh ln chmod rm mkdir uname grep sed find file ionice mktemp nice cut sort diff touch install wc coreutils xargs debugedit find-debuginfo find-debuginfo.sh ; do p=`which $${prog}`; if [ "$${p}" != "" ]; then ln -s $${p} testing/$(bindir)/; fi; done

+  	for d in /proc /sys /selinux /etc/selinux; do if [ -d $${d} ]; then ln -s $${d} testing/$${d}; fi; done

+  	(cd testing/magic && file -C)

+  	chmod -R u-w testing/

+ %global rel 25.1

+ Patch125: rpm-4.16.1.3-IMA-without-xattr.patch

+ Patch909: rpm-4.16.1.3-external-debugedit.patch

+ Patch1002: 0001-Macroize-find-debuginfo-script-location.patch

+ Patch1003: rpm-4.16.1.3-backport-multithreaded-zstd.patch

+ BuildRequires: fakechroot gnupg2 debugedit

+ Requires: debugedit

+ cat > $RPM_BUILD_ROOT/%{rpmhome}/debugedit << END

+ #!/bin/sh

+ /usr/bin/debugedit "\$@"

+ END

+ cat > $RPM_BUILD_ROOT/%{rpmhome}/sepdebugcrcfix << END

+ #!/bin/sh

+ /usr/bin/sepdebugcrcfix "\$@"

+ END

+ cat > $RPM_BUILD_ROOT/%{rpmhome}/find-debuginfo.sh << END

+ #!/bin/sh

+ /usr/bin/find-debuginfo.sh "\$@"

+ END

+ 

+ * Thu Aug 17 2023 Richard Phibel <richardphibel@meta.com> - 4.16.1.3-25.1

+ - Merge upstream changes for Hyperscale

+ 

+ * Fri Jun 30 2023 Florian Festi <ffesti@redhat.com> - 4.16.1.3-25

+ - Followup on #2166383

+ - Add compat scripts calling external find-debug, sepdebugcrcfix and debugedit

+ - Add %%__find_debuginfo macro

+ 

+ * Thu May 04 2023 Florian Festi <ffesti@redhat.com> - 4.16.1.3-24

+ - Use external find-debug and debugedit (#2166383)

+ 

+ * Wed May 03 2023 Florian Festi <ffesti@redhat.com> - 4.16.1.3-23

+ - Don't error out on IMA signatures on files not supporting them

+   (#2157835, #2157836)

+