Panu Matilainen [Mon, 13 Sep 2010 10:08:33 +0000 (13:08 +0300)]
Eliminate all fooUnlink() functions out of the API
- These are internal helpers only, all refcount users need to use
fooFree() or similar for correct operation. Add fwd declarations
where necessary to avoid moving code around unnecessarily.
- We could add these back later as aliases to fooFree() but for now,
just get them out of the way.
Panu Matilainen [Mon, 13 Sep 2010 10:06:31 +0000 (13:06 +0300)]
Unify header creation between headerNew() and headerLoad()
- Use internal helper instead of copy-slop code to allocate + init
the structure
Panu Matilainen [Mon, 13 Sep 2010 10:05:55 +0000 (13:05 +0300)]
Fix some broken fooUnlink() usages
- unreferencing should always go through fooFree() which does
the real refcounting and frees when references go out
Panu Matilainen [Mon, 13 Sep 2010 08:25:24 +0000 (11:25 +0300)]
Lift header verifying out of rpmdbNextIterator()
- No functional changes, just splicing up the ugly function
Panu Matilainen [Mon, 13 Sep 2010 07:44:14 +0000 (10:44 +0300)]
Minor optimizations on DBT initializations
- Move the DBT key+data to local scope where possible, only bother
zeroing them if they're actually going to be accessed.
Panu Matilainen [Mon, 13 Sep 2010 07:27:42 +0000 (10:27 +0300)]
...and now eliminate the unnecessary pointer variables
- Also check for NULL keyp in rpmdbExtendIterator() early to
avoid unnecessary zeroing + potential segfault from strlen(NULL)
Panu Matilainen [Mon, 13 Sep 2010 07:16:50 +0000 (10:16 +0300)]
Eliminate mi_key and mi_data from match iterator structure
- These are not used to hold iterator state but just for temporary
storage. Temporary data belongs to temporary variables.
- Assimilate rpmdbGrowIterator() into rpmdbExtendIterator() which
was just (ab)using mi_key for passing arguments into rpmdbGrowIterator()
and pass as argument instead.
- Declare local structs + pointers to them for this step to keep changes
minimal and "obvious"
Panu Matilainen [Wed, 8 Sep 2010 10:52:30 +0000 (13:52 +0300)]
Add test for manifest query in testsuite
Panu Matilainen [Wed, 8 Sep 2010 10:41:03 +0000 (13:41 +0300)]
Fix _USE_LIBIO test
- Commit
05b2d979e8097d648f91c773f2535a1f6013cb79 caused the
_USE_LIBIO test in rpmio.c to always fail as <stdio.h> wasn't included
yet at the time of the check, causing silent fallback to not
using libio even if actually available. Which in turn revealed
funky other little bugs, addressed in commits
d960e8c18764f7206ad723963f407e960dfb8ad9 and
be3c34dd15814d70a410b6fd646a2be7de14a1b5. Ptooey.
Panu Matilainen [Wed, 8 Sep 2010 10:31:25 +0000 (13:31 +0300)]
Differentiate between IO-errors and non-package "error" in rpmgi foo
- rpmgiLoadReadHeader() tested errno, but this isn't realiable:
rpmgiReadHeader() didn't differentiate between IO and other errors
properly so errno would be tested even when no errors (other than
not being a header) were present. This could be pretty much whatever
when no IO errors occurred in rpmgiReadHeader() but the file just
wasn't a header. With libio errno was typically EBADF, causing the
remaining code to execute, but without libio this happened to be
ENOENTRY, causing a silent failure on manifest query.
- This junk needs to die, really.
Panu Matilainen [Wed, 8 Sep 2010 10:01:57 +0000 (13:01 +0300)]
Fix rpmReadPackageManifest() on non-fpio FD when libio isn't available
- With libio, fdGetFILE() works on any io-type, but that's not the
case when libio isn't available. Using fdopen() makes it work
on both.
Panu Matilainen [Tue, 7 Sep 2010 20:15:08 +0000 (23:15 +0300)]
Turn rpmQueryVerify() into query iterator initializer
- Eliminates quite a bunch of redundant error code return hoop-jumping
and makes the iterator init + frees nicely paired all together
inside rpmcliArgIter().
Panu Matilainen [Tue, 7 Sep 2010 20:04:12 +0000 (23:04 +0300)]
Lift the remaining oddball case out of rpmQueryVerify()
- specfile queries are handled differently from everything else,
handle the special case in rpmcliArgIter()
Panu Matilainen [Tue, 7 Sep 2010 19:52:26 +0000 (22:52 +0300)]
Eliminate qva_mi and qva_gi from rpmQVKArguments
- These are internal only stuff and have no business being exported
in the API. Pass the iterators around in, duh, arguments as needed.
Panu Matilainen [Tue, 7 Sep 2010 19:39:14 +0000 (22:39 +0300)]
Eliminate some dozen redundant rpmcliShowMatches() calls
- Simply call it once at the end, its common for all the cases
Panu Matilainen [Tue, 7 Sep 2010 19:22:25 +0000 (22:22 +0300)]
Cut some extra twists from the query maze
- RPMQV_ALL and RPMQV_RPM do nothing but call rpmcli/giShowMatches()
in rpmQueryVerify(), call them directly from rpmcliArgIter() instead
- Make iterator allocation + deallocation symmetric: both
rpmcliArgIter() and rpmQueryVerify() now free what they alloced,
rpmfooShowMatches() is a weird place for freeing
Panu Matilainen [Tue, 7 Sep 2010 19:02:53 +0000 (22:02 +0300)]
Eliminate rpmQueryVerify() from librpm API
- This is an inconsistent oddball interface which only works for
limited query types, "cli" level API users are better off calling
rpmcliQuery() / rpmcliArgIter() instead
Panu Matilainen [Wed, 8 Sep 2010 04:48:04 +0000 (07:48 +0300)]
Urk, mixed up in branches and wrong stuff getting pushed. Revert.
- This reverts commits
9ac127c35272772e0fc862608f4bde9748862b3d and
7abc26e300afd4da71f220db496f813571a37f5a
Panu Matilainen [Tue, 7 Sep 2010 18:32:17 +0000 (21:32 +0300)]
Beat a little bit of sense into rpmQueryVerify()
- Single point of exit, assume failure
- Replace about a dozen rpmcliShowMatches() calls with one at the
bottom.
Panu Matilainen [Tue, 7 Sep 2010 18:13:34 +0000 (21:13 +0300)]
Mark ts argument unused in bunch of query APIs
- The ts argument used to be necessary and used for rpmfiNew() and spec
query but not any more...
Panu Matilainen [Tue, 7 Sep 2010 17:44:59 +0000 (20:44 +0300)]
Eliminate rpmcliShowMatches() from librpm API
- This is really just an internal helper which only even works with
limited set of queries.
Panu Matilainen [Tue, 7 Sep 2010 08:14:56 +0000 (11:14 +0300)]
Add bunch of verification tests to the test suite
- Basic tests for dependency, file and verifyscript error + success
behavior.
- Using lua for verifyscript to avoid issues with empty test-root
Panu Matilainen [Tue, 7 Sep 2010 06:49:29 +0000 (09:49 +0300)]
Fix error code on verify scriptlet failure
- Verify scriptlet failures were only logged but didn't reflect error
codes as they were considered "warn only" along with most others
Piotr Drąg [Sat, 4 Sep 2010 06:49:44 +0000 (06:49 +0000)]
l10n: Updated Polish (pl) translation to 100%
New status: 744 messages complete with 0 fuzzies and 0 untranslated.
Transmitted-via: Transifex (www.transifex.net).
Panu Matilainen [Fri, 3 Sep 2010 14:19:04 +0000 (17:19 +0300)]
And yet another translation update to pick up stuff moving around
Panu Matilainen [Fri, 3 Sep 2010 13:57:50 +0000 (16:57 +0300)]
Rip IAM_RPMDB, ie --initdb, --rebuilddb etc modes out of rpmqv.c and librpm
- Add popt exec aliases to rpmdb for backwards compatibility
- Change test-suite to use 'rpmdb --initdb' instead of 'rpm --initdb'
as popt exec aliases with absolute paths dont play very well
with the test-suite, duh...
Panu Matilainen [Fri, 3 Sep 2010 13:48:21 +0000 (16:48 +0300)]
Add a brand new rpmdb utility for rpmdb maintenance (dejavu again)
- rpmdb maintenance only requires privileges on the rpmdb directory,
not elsewhere on the system. Splitting to separate tool allows
finer grained SELinux policies and makes adding new db-specific
switches saner.
Panu Matilainen [Fri, 3 Sep 2010 13:31:13 +0000 (16:31 +0300)]
Rip IAM_RPMK, ie --import and --checksig modes out of rpmqv.c + librpm
- Add popt exec aliases to rpmkeys for backwards compatibility
Panu Matilainen [Fri, 3 Sep 2010 13:09:47 +0000 (16:09 +0300)]
Add a brand new rpmkeys utility for keyring operations
- Keyring operations (adding/viewing/removing keys and verifying
packages against a given keyring) are different from main rpm operations
in that they only need access to the rpm keyring, and no write access
anywhere else in the system. At the moment the rpm keyring happens
to be the rpmdb but that's just an implementation detail that is
likely to change sooner or later. Besides paving way to separating
the rpm keyring from the rpmdb, splitting this to a small, separate
utility allows limiting its required access from SELinux POV etc.
- For now, this only implements what's already in rpm: --import and
--checksig, remaining operations like listing and manipulating
keyring contents is left as an exercise for another day...
Panu Matilainen [Fri, 3 Sep 2010 12:57:14 +0000 (15:57 +0300)]
Further simplify rpmcliVerifySignatures()
- Since this is a rpmcliFoo() function, we can assume rpmcliInit()
is used and the verify disabling bits are set through the common
rpmcliQueryFlags set, making qva argument unnecessary.
Panu Matilainen [Fri, 3 Sep 2010 12:18:17 +0000 (15:18 +0300)]
Update translations again again to pick up changes from recent churn
Panu Matilainen [Fri, 3 Sep 2010 12:08:01 +0000 (15:08 +0300)]
Put the rpmLookupSignature() and rpmGetPassPhrase() out of their misery
Panu Matilainen [Fri, 3 Sep 2010 12:01:47 +0000 (15:01 +0300)]
Rrrriiip the addsign/resign/delsign bits out of rpmqv.c + friends
- Add popt exec aliases to rpmsign for backwards compatibility (dejavu...)
Panu Matilainen [Fri, 3 Sep 2010 11:40:18 +0000 (14:40 +0300)]
Add a brand new rpmsign utility for package signing
- Signing (and deleting) are different from everything else in rpm
in that it needs very little of rpm's facilities. For example access
to the rpmdb is not needed at all. Splitting this to a separate,
small utility allows various possibilities, like severely limiting
its access from SELinux POV, control of signature generation with
cli arguments (the main rpm executable is already overcrowded with
options). It's also the first step to allow reasonably splitting
rpm signing to a separate package; not everybody needs to sign
packages, yet signing support needs to drag in GPG and whatnot.
- Reimplement / refactor various librpm signature generation helpers
into somewhat saner internal versions.
Panu Matilainen [Fri, 3 Sep 2010 11:03:48 +0000 (14:03 +0300)]
Lookup signature type from cli utility already
- Avoid relying on the murky rpmLookupSignatureType() foobar on
low API level, pass the wanted tag explicitly from caller
- rpmLookupSignature(), rpmGetPassPhrase() + the bits they rely on
are now free of users within librpm itself
Panu Matilainen [Fri, 3 Sep 2010 09:02:17 +0000 (12:02 +0300)]
rpmcliSign() only creates or deletes signatures
- Lose the "this has got something to do with signatures and stuff"
dispatcher mode, rpmcliSign() now only does what it says. It also
doesn't need transaction set for anything. It doesn't need much
else than files to operate on, what to do and possibly a passphrase.
It probably will need more when rpmLookupSignatureType()
is put out of its misery, but this'll do for now.
- Lose the now unnecessary passPhrase member from QVA_t
Panu Matilainen [Fri, 3 Sep 2010 08:35:35 +0000 (11:35 +0300)]
Split argv loop out of the actual signing function, sanitize args
- The signing monster is big enough without extra loops. Also
signing as such doesn't need any of the QVA foo, just the package,
whether its adding or deleting and passhprase. Make it so.
- Remove some now unnecessary double cleanup of intermediate target
Panu Matilainen [Fri, 3 Sep 2010 08:18:27 +0000 (11:18 +0300)]
Signing doesn't need transaction set, eliminate the unused argument
Panu Matilainen [Fri, 3 Sep 2010 08:11:55 +0000 (11:11 +0300)]
Split package signing out of rpmchecksig.c
- No functional changes, supposedly
Panu Matilainen [Fri, 3 Sep 2010 07:54:09 +0000 (10:54 +0300)]
Use rpmcliVerifySignatures() directly from rpmqv.c main
Panu Matilainen [Fri, 3 Sep 2010 07:38:38 +0000 (10:38 +0300)]
Export the cli-level signature checking as rpmcliVerifySignatures()
- Signature verification is completely different from package signing,
another step towards making rpmcliSign() do what it's named after
Panu Matilainen [Fri, 3 Sep 2010 07:08:49 +0000 (10:08 +0300)]
Use rpmcliImportPubkeys() for importing instead of rpmcliSign()
- Add some more IamYourDaddy modes to rpmqv.c for now. We'll need to
add junk to get rid of others, sigh...
Panu Matilainen [Fri, 3 Sep 2010 06:39:14 +0000 (09:39 +0300)]
Export rpmcliImportPubkeys() (again) in the public API
- Key import is completely different from package signing, first
step in detaching key import from rpmcliSign()
Panu Matilainen [Fri, 3 Sep 2010 06:28:57 +0000 (09:28 +0300)]
Remove hysterically useless RPMSIGN_NONE + --sign popt leftovers
Panu Matilainen [Fri, 3 Sep 2010 06:01:29 +0000 (09:01 +0300)]
Eliminate unused rootdir member from rpmInstallArguments
Panu Matilainen [Fri, 3 Sep 2010 05:59:39 +0000 (08:59 +0300)]
Eliminate unused qva_prefix and qva_verbose from rpmQVKArguments
Panu Matilainen [Fri, 3 Sep 2010 05:17:57 +0000 (08:17 +0300)]
Use the common rpmcliQueryFlags for signature verify options in rpm cli too
- Technically this changes the rpmcliQuery() and rpmcliVerify() API
in the sense that we no longer honor the qva->qva_flags for the
--nosignature and others, but we assume anybody using these (as if
anybody was using the "cli" API) uses rpmcliInit() which takes
care of these common bits... shrug.
- Ditch ancient and hidden --nopgp --nogpg switches along with the
dishwater which are simply alias to --nosignature.
- Eliminate now unused qva_flags from rpmInstallArguments (along with
a double vsflags goo from rpmgraph)
Panu Matilainen [Fri, 3 Sep 2010 04:49:37 +0000 (07:49 +0300)]
Use the common rpmcliQueryFlags for signature verify options in rpmbuild
- The various --nosignature etc verification switches are common to
everything, and have been available through rpmcliQueryFlags via
the common popt table since 2002. Might as well finally use it
to limit the amount of duplicate popt goo.
Panu Matilainen [Thu, 2 Sep 2010 13:14:46 +0000 (16:14 +0300)]
Permit passing spec parse flags in python too
- The preferred flags default would be RPMSPEC_NONE, but it would break
compatibility with older rpm versions where rpm.spec() doesn't accept
flags.
Panu Matilainen [Thu, 2 Sep 2010 12:21:20 +0000 (15:21 +0300)]
Add an experimental low-level build method to python spec
- This is mostly just a toy for now, but serves as a kind of yardstick
for what is missing in librpmbuild to be generally useful for
building stuff.
Panu Matilainen [Thu, 2 Sep 2010 11:51:51 +0000 (14:51 +0300)]
Add the various spec + build flags to python
Panu Matilainen [Thu, 2 Sep 2010 11:47:33 +0000 (14:47 +0300)]
Cosmetics: use an enum instead of #defines for source type bits
Panu Matilainen [Thu, 2 Sep 2010 11:44:02 +0000 (14:44 +0300)]
Clarify RPMBUILD_STRINGBUF comment
Panu Matilainen [Thu, 2 Sep 2010 11:39:11 +0000 (14:39 +0300)]
Swap rpmSpecBuild() arguments for consistency with other APIs
- What we're building comes first, /how/ we're building comes second
- Update the sole caller, doesn't matter as this is a new interface...
Panu Matilainen [Thu, 2 Sep 2010 11:31:08 +0000 (14:31 +0300)]
Update translations again to pick up strings moving around etc
Panu Matilainen [Thu, 2 Sep 2010 11:30:36 +0000 (14:30 +0300)]
Oops, forgot to update POTFILES.in on poptBT.c removal
Panu Matilainen [Thu, 2 Sep 2010 11:25:30 +0000 (14:25 +0300)]
Add a new public function for retrieving build dependencies from spec
- Not needed by rpmbuild itself currently, but permits retrieving the
build dependency information in a format that's better suited for
further processing than an rpm problem set.
Panu Matilainen [Thu, 2 Sep 2010 11:13:28 +0000 (14:13 +0300)]
Move build dependency checking from cli tool to librpmbuild
- Add new public rpmSpecCheckDeps() function which can be used for
checking build dependencies of a spec against a transaction set.
- Change checkSpec() in rpmbuild cli to use the new interface
- rpmbuild.c is now free of direct spec structure accesses
Panu Matilainen [Thu, 2 Sep 2010 11:12:42 +0000 (14:12 +0300)]
Return NULL from rpmtsProblems() if no problems exist
- Avoids callers having to separately test for number of problems
and freeing when no problems exist
Panu Matilainen [Thu, 2 Sep 2010 11:12:25 +0000 (14:12 +0300)]
Cosmetics: update comments + use a specific type for buildAmount
Panu Matilainen [Thu, 2 Sep 2010 11:08:08 +0000 (14:08 +0300)]
Eliminate specFlags from rpmBuildArguments
- Spec parse flags are specific to parsing a spec, not building it.
This could be relevant again if a higher level build API is added
to the library but not ATM.
Panu Matilainen [Thu, 2 Sep 2010 10:31:44 +0000 (13:31 +0300)]
Eliminate targets from rpmBuildArguments
- Targets are obviously relevant for building but not in the
context of rpmSpecBuild which expects the environment to be set up
already. If/when we add a higher level build interface to librpmbuild
this comes relevant again, until then bury inside the cli-tool.
- Simplify the target parsery by using argvSplit() and friends.
Panu Matilainen [Thu, 2 Sep 2010 10:07:01 +0000 (13:07 +0300)]
Eliminate buildMode and buildChar from rpmBuildArguments
- The mode letters are only relevant for the rpmbuild cli tool. If/when
some of the related build logic is moved from the cli tool to the
library, we'll need a better way of expressing these combinations
than letters.
Panu Matilainen [Thu, 2 Sep 2010 09:52:56 +0000 (12:52 +0300)]
Eliminate verify flags from rpmBuildArguments
- Transaction set verification bits are not relevant to building,
bury inside the rpmbuild cli utility.
- Also the type was wrong, its rpmVerifyFlags, not rpmQueryFlags, duh
Panu Matilainen [Thu, 2 Sep 2010 09:46:21 +0000 (12:46 +0300)]
Eliminate noDeps and shortCircuit from rpmBuildArguments struct
- Both of these are only relevant to the rpmbuild cli utility,
eg checking for build-requires is up to caller, not librpmbuild.
Panu Matilainen [Thu, 2 Sep 2010 09:26:23 +0000 (12:26 +0300)]
Eliminate popt goo from librpmbuild
- Move the cli-switch manouvering into rpmbuild.c cli utility where
it belongs.
Panu Matilainen [Thu, 2 Sep 2010 09:12:46 +0000 (12:12 +0300)]
Eliminate _noDirTokens from librpmbuild API+ABI
- Add another flag set to control package generation, passing around
as necessary. Use this to implement --nodirtokens functionality
in a cleaner manner.
Panu Matilainen [Thu, 2 Sep 2010 08:19:46 +0000 (11:19 +0300)]
Eliminate freeNames() from librpmbuild ABI
- Call freeNames() at end of buildSpec() instead of requiring API
users to clean up after us. This does mean losing some of the
supposed caching advantage when building on more than one spec,
but hardly matters, one spec at a time is the typical build usage
anyway.
Panu Matilainen [Thu, 2 Sep 2010 08:01:15 +0000 (11:01 +0300)]
Detect short-circuited build based on executed build steps from buildSpec()
- Avoids having to access rpmBTArgs from deep packageBinaries(),
API changing is not an issue anymore...
Panu Matilainen [Thu, 2 Sep 2010 07:23:57 +0000 (10:23 +0300)]
Handle --nobuild as another buildAmount flag
Piotr Drąg [Wed, 1 Sep 2010 20:07:32 +0000 (20:07 +0000)]
l10n: Updated Polish (pl) translation to 100%
New status: 754 messages complete with 0 fuzzies and 0 untranslated.
Transmitted-via: Transifex (www.transifex.net).
Panu Matilainen [Wed, 1 Sep 2010 15:18:10 +0000 (18:18 +0300)]
Handle spec flags parse option figuring in popt callback already
Panu Matilainen [Wed, 1 Sep 2010 15:07:19 +0000 (18:07 +0300)]
Handle --nolang as another spec parse flag
Panu Matilainen [Wed, 1 Sep 2010 15:03:05 +0000 (18:03 +0300)]
Combine spec parsing options into a common flag bitfield
Panu Matilainen [Wed, 1 Sep 2010 14:29:27 +0000 (17:29 +0300)]
Rename freeSpec() -> rpmSpecFree() for namespacing
- librpmbuild actually now has what remotely resembles an API, after
we broke every single thing there was ;)
Panu Matilainen [Wed, 1 Sep 2010 14:20:22 +0000 (17:20 +0300)]
...and finally eliminate the spec crapola from transaction set for good
Panu Matilainen [Wed, 1 Sep 2010 14:18:11 +0000 (17:18 +0300)]
Eliminate transaction set from spec parsing internals
Panu Matilainen [Wed, 1 Sep 2010 14:13:26 +0000 (17:13 +0300)]
Pass flags directly to the lower level parseSpec() helper
Panu Matilainen [Wed, 1 Sep 2010 14:09:34 +0000 (17:09 +0300)]
Eliminate parseSpec() from librpmbuild, trim unused arguments
- We can't keep compatibility while eliminating goo like transaction set
from the arguments so dont bother trying.
Panu Matilainen [Wed, 1 Sep 2010 13:59:22 +0000 (16:59 +0300)]
Update callers to use the new rpmSpecParse() interface
Panu Matilainen [Wed, 1 Sep 2010 13:49:43 +0000 (16:49 +0300)]
A new saner interface for parsing spec files
- For now just a wrapper around parseSpec() that returns *gasp*
a pointer to a parsed spec structure.
- Limit the amount of goo that needs passing - optimally we'd only need
the spec + parsing flags, but due to %{buildroot} macro abuse in specs
we'll need that for now too.
Panu Matilainen [Wed, 1 Sep 2010 13:47:43 +0000 (16:47 +0300)]
Eliminate silly and unused timecheck feature from (lib)rpmbuild
- This was broken for years without anybody complaining, should
be safe to conclude nobody will miss it later either. And if
somebody misses it, this is a job for rpmlint really.
Panu Matilainen [Wed, 1 Sep 2010 11:31:49 +0000 (14:31 +0300)]
Spec rootDir is only relevant for building, eliminate from parseSpec()
- The whole rootDir seems dubious for build purposes, but in any case its
only relevant during the actual build process, not for spec parsing.
Set spec->rootDir from buildSpec() for the duration of the
build to avoid having to refactor doScript() and all right now.
Panu Matilainen [Wed, 1 Sep 2010 11:00:54 +0000 (14:00 +0300)]
Eliminate cookie from spec structure
- Cookies are not a property of spec but a given build, handle this
internally to buildSpec() except for --rebuild which passes the
srpm identifier cookie through buildArgs
Panu Matilainen [Wed, 1 Sep 2010 10:46:49 +0000 (13:46 +0300)]
Sanitize buildSpec() arguments a bit
Panu Matilainen [Wed, 1 Sep 2010 10:37:37 +0000 (13:37 +0300)]
Replace buildSpec() with a new interface in the API
- Accept the entire build arguments structure along with a spec, these
contain everything that we'll need
- Just a convenience wrapper for buildSpec() for now, more things
to follow...
- Update the sole existing caller accordingly
Panu Matilainen [Wed, 1 Sep 2010 09:26:26 +0000 (12:26 +0300)]
Lift remaining build-related stuff out of librpm over to build-side
- none of this belongs to librpm headers and ABI
Panu Matilainen [Tue, 31 Aug 2010 05:53:33 +0000 (08:53 +0300)]
Eliminate useless hardwired build debug foo
Panu Matilainen [Tue, 31 Aug 2010 11:37:51 +0000 (14:37 +0300)]
Passed-in values are const for every headerPutType() variant
- Silly oversight back then, oh well... this shouldn't affect any callers,
just avoids dumb warnings where none should be seen
Panu Matilainen [Wed, 1 Sep 2010 07:25:06 +0000 (10:25 +0300)]
Update translations to pick up new messages
Panu Matilainen [Wed, 1 Sep 2010 07:24:11 +0000 (10:24 +0300)]
Add newly added files to POTFILES.in too
Anssi Hannula [Mon, 16 Aug 2010 23:29:14 +0000 (02:29 +0300)]
debugedit: fix incorrect error messages regarding -b and -d
Steve Lawrence [Mon, 30 Aug 2010 20:32:32 +0000 (16:32 -0400)]
Add files for testing SELinux collection/plugin
This adds two basic tarballs, one containing two minimal executables
(foo & bar), and one contain a simple policy for the two executables.
This also adds a new spec file with a policy subpackage, the new
%sepolicy section, and the sepolicy collection.
Steve Lawrence [Mon, 30 Aug 2010 20:32:31 +0000 (16:32 -0400)]
Add SELinux policy plugin
This adds a new plugin specifically for a collection to load SELinux
policy. This implements the post_add and pre_remove plugin hooks. The
only time anything happens during the pre_remove hook is if post_add was
not called (i.e. if the transaction only removes policies).
This plugin extracts all the policy information from packages in the
sepolicy collection during the open te hook. It then determines which
policies should be installed/removed based on if the package is being
installed/removed and the type of the policy and the system policy. It
then executes semodule (or uses libsemanage if semodule cannot be
executed or installing in a chroot) to remove and install the necessary
policies. It then reloads the selinux state, reloads the file contexts,
and if necessary, relabels the file system.
Steve Lawrence [Mon, 30 Aug 2010 20:32:30 +0000 (16:32 -0400)]
Use selabel interfaces instead of matchpathcon
This replaces the old matchpathcon interfaces with the new selabel
interfaces for relabeling files, storing an selabel handle in the
transaction set.
With this change, also comes an added distinction between --nocontexts
being specified and a failure to read the load file contexts.
Previously, there was no distinction, and both cases used the
RPMTRANS_FLAG_NOCONTEXTS flag.
However, with the new policy plugin, it is necessary to make such a
distinction. This is because matchpathcon_init (now selabel interfaces)
can fail at the beginning of the transaction, but succeed later after
new policy is installed. Because of this, we may need to enable/disable
RPMTRANS_FLAG_NOCONTEXTS multiple times. However, because this flag
could also mean --nocontexts, we cannot do that. By storing the selabel
handle in the rpmts, we can easily keep track if the handle has been
successfully created, rather than overloading RPMTRANS_FLAG_NOCONTEXTS
with two meanings.
Steve Lawrence [Mon, 30 Aug 2010 20:32:29 +0000 (16:32 -0400)]
Add new %sepolicy section to the spec file format
The %sepolicy section is used to describe SELinux policy to be included
in a package. It's syntax is similar to other sections (%files, %pre,
%post, etc.) in that you can provide a string and -n after the
declaration to specify policy should be added to a subpackage.
For example:
%sepolicy
# policy in this section will be added to the main package
%sepolicy foo
# policy in this section will be added to the '<mainpackage>-foo' subpackage
%sepolicy -n bar
# policy in this section will be added to the 'bar' subpackage
The %sepolicy section contains zero or more %semodule directives, with the
following format:
%semodule [OPTIONS] path/to/module.pp
The available options are:
-b, --base
The module is a base module
-n, --name=NAME
The name of the module. If not given, assumes the name is the basename of
the module file with file extensions removed.
-t, --types=TYPES
One or more comma-separated strings specifying which policy types the
module can work with. To explicitly state that a module can work with any
policy type, "default" can be specified as the value. If not specified,
assumes the module can work with any policy type, and assigns the types as
"default".
Below is an example of this new format:
%sepolicy
%semodule -n foo -t mls policy/foo.pp
%semodule -n bar -t strict,targeted,mls -b policy/bar.pp
This also adds new header tags to store the new information:
RPMTAG_POLICYNAMES (string array)
RPMTAG_POLICYTYPES (string array)
RPMTAG_POLICYTYPESINDEXES (uint32 array)
RPMTAG_POLICYFLAGS (uint32 array)
The index of NAMES and FLAGS maps directly to the index of RPMTAG_POLICIES.
However, because a single policy can have multiple types, the mapping for
TYPES is not direct. For this, the index maps to TYPESINDEXES, which
contains the index of the policy that the type maps to. This is similar to
how DIRINDEXES is used to map DIRNAMES and BASENAMES. As an example, the
previous %sepolicy section would have the following header tags:
RPMTAG_POLICIES:
0: <foo.pp data, base64 encoded>
1: <bar.pp data, base64 encoded>
RPMTAG_POLICYNAMES:
0: foo
1: bar
RPMTAG_POLICYFLAGS:
0: 0
1: 1 # assumes flag 1 == BASE
RPMTAG_POILCYTYPES: RPMTAG_POLICYTYPESINDEXES:
0: mls 0: 0
1: strict 1: 1
2: targeted 2: 1
3: mls 3: 1
Steve Lawrence [Mon, 30 Aug 2010 20:32:28 +0000 (16:32 -0400)]
Remove the existing %policy directive
Remove the existing %policy directive, to be replaced with a new
%sepolicy section with more configurable options.
Steve Lawrence [Mon, 30 Aug 2010 20:32:27 +0000 (16:32 -0400)]
Update the plugin architecture to allow for remembering state
This moves most of the plugin logic to a new rpmplugins file with a
struct and functions for managing plugins, allowing for plugins to carry
state. This also adds init and cleanup hooks for plugins to initialize
and cleanup their state, and a new 'open te' hook allowing plugins to
read and save information from transaction elements.
This also generalizes the plugin architecture a bit so it isn't so
specific to collections.
Panu Matilainen [Thu, 26 Aug 2010 09:21:33 +0000 (12:21 +0300)]
Permit packages with no files to omit %files entirely
- Fixes the long standing obscure behavior of missing %files
section causes build to complete without errors but without producing
any packages either. Packages without files in them are perfectly
valid (eg metapackages), requiring empty %files section for those
is just unnecessary spec noise.
- Remove %files section on one of the test-suite specs to create
a test-case for this as a side-effect.
- This of course introduces a slight incompatibility with older rpm's,
if compatibility is required then just add those empty %files in the
spec, they dont hurt anything but the readers eyes.
Panu Matilainen [Thu, 26 Aug 2010 08:58:24 +0000 (11:58 +0300)]
Clean up newPackage() a bit
- No much point explicitly NULL'ing calloc()'ed memory, only initialize
the values that are something else + other cosmetics.