开源软件构建与测试

_service:extract_file:rpm.spec Deleted

@@ -1,504 +0,0 @@
-Name:          rpm
-Version:       4.17.0
-Release:       3
-Summary:       RPM Package Manager
-License:       GPLv2+
-URL:           http://www.rpm.org/
-Source0:       http://ftp.rpm.org/releases/rpm-4.17.x/%{name}-%{version}.tar.bz2
-
-Patch1: Unbundle-config-site-and-add-RPM-LD-FLAGS-macro.patch
-Patch2: rpm-4.12.0-rpm2cpio-hack.patch
-Patch3: add-dist-to-release-by-default.patch
-Patch4: revert-always-execute-file-trigger-scriptlet-callbac.patch
-Patch5: bugfix-rpm-4.11.3-add-aarch64_ilp32-arch.patch
-Patch6: bugfix-rpm-4.14.2-wait-once-get-rpmlock-fail.patch
-Patch7: Generate-digest-lists.patch
-Patch8: Add-digest-list-plugin.patch
-Patch9: Don-t-add-dist-to-release-if-it-is-already-there.patch
-Patch10: Use-user.digest_list-to-avoid-duplicate-processing-o.patch
-Patch11: call-process_digest_list-after-files-are-added.patch
-Patch12: fix-lsetxattr-error-in-container.patch
-Patch13: get-in-use-of-ndb.patch
-Patch14: backport-Use-root-as-default-UID_0_USER-and-UID_0_GROUP.patch
-Patch15: still-in-use-of-python-scripts-from-old-version.patch
-
-BuildRequires: gcc autoconf automake libtool make gawk popt-devel openssl-devel readline-devel
-BuildRequires: zlib-devel libzstd-devel xz-devel bzip2-devel libarchive-devel ima-evm-utils-devel
-BuildRequires: dbus-devel fakechroot elfutils-devel elfutils-libelf-devel ima-evm-utils
-BuildRequires: lua-devel libcap-devel libacl-devel libselinux-devel file-devel gettext-devel ncurses-devel
-BuildRequires: system-rpm-config dwz gnupg2 debugedit
-Requires:      coreutils popt curl zstd libcap crontabs logrotate
-Obsoletes:     %{name}-build-libs %{name}-sign-libs %{name}-sign %{name}-cron
-Provides:      %{name}-build-libs %{name}-sign-libs %{name}-sign %{name}-cron
-Obsoletes:     %{name}-plugin-selinux %{name}-plugin-syslog %{name}-plugin-systemd-inhibit < 4.15.1-28  %{name}-plugin-ima %{name}-plugin-prioreset
-Provides:      %{name}-plugin-selinux %{name}-plugin-syslog %{name}-plugin-ima %{name}-plugin-prioreset
-
-%description
-The RPM Package Manager (RPM) is a powerful package management system capability as below
-
--building computer software from source into easily distributable packages
--installing, updating and uninstalling packaged software
--querying detailed information about the packaged software, whether installed or not
--verifying integrity of packaged software and resulting software installation
-
-%package libs
-Summary:     Shared library of rpm 4.17
-Requires:    %{name} = %{version}-%{release}
-
-%description libs
-Shared library of rpm 4.17.
-
-%package build
-Summary:     Scripts and executable programs used to build packages
-Requires:    %{name} = %{version}-%{release}
-Requires:    elfutils binutils findutils sed grep gawk diffutils file patch
-Requires:    tar unzip gzip bzip2 cpio xz zstd pkgconfig system-rpm-config
-Requires:    gdb-headless debugedit
-
-%description build
-This package provides scripts and executable programs that used to
-build rpm packages.
-
-%package -n python3-%{name}
-Summary: Python3 bindings for RPM user
-BuildRequires: python3-devel
-%{?python_provide:%python_provide python3-%{name}}
-Requires: %{name} = %{version}-%{release}
-Provides: %{name}-python3 = %{version}-%{release}
-Obsoletes: %{name}-python3 < %{version}-%{release}
-
-%description -n python3-%{name}
-This package contains a module that allow applications
-written with Python3 to use the interface
-supplied by RPM.
-
-%package devel
-Summary:  Development files for RPM handling
-Requires: %{name} = %{version}-%{release}
-Requires: popt-devel
-
-%description devel
-%{summary}.
-
-%package plugin-systemd-inhibit
-Summary: rpm plugin to get systemd-inhibit lock
-Requires: %{name} = %{version}-%{release}
-
-%description plugin-systemd-inhibit
-This package use systemd-inhibit to block systemd from entering
-idle, sleep or shutdown while an rpm transcation is running.
-
-%package help
-Summary: Man page for %{name}
-BuildArch: noarch
-Obsoletes: apidocs
-
-%description help
-%{summary}.
-
-%prep
-%autosetup -n %{name}-%{version} -p1
-
-%build
-CPPFLAGS="$CPPFLAGS -DLUA_COMPAT_APIINTCASTS"
-CFLAGS="$RPM_OPT_FLAGS -DLUA_COMPAT_APIINTCASTS"
-LDFLAGS="$LDFLAGS %{?__global_ldflags}"
-export CPPFLAGS CFLAGS LDFLAGS
-
-autoreconf -i -f
-
-for i in $(find . -name ltmain.sh) ; do
-     %{__sed} -i.backup -e 's~compiler_flags=$~compiler_flags="%{_hardened_ldflags}"~' $i
-done;
-
-./configure \
-    --prefix=%{_usr} \
-    --sysconfdir=%{_sysconfdir} \
-    --localstatedir=%{_var} \
-    --sharedstatedir=%{_var}/lib \
-    --libdir=%{_libdir} \
-    --build=%{_target_platform} \
-    --host=%{_target_platform} \
-    --with-vendor=%{_vendor} \
-    --with-external-db \
-    --with-lua \
-    --with-selinux \
-    --with-cap \
-    --with-acl \
-    --with-imaevm \
-    --enable-zstd \
-    --enable-python \
-    --enable-bdb-ro \
-    --enable-ndb \
-    --enable-bdb=no \
-    --enable-sqlite=no \
-    --with-crypto=openssl \
-    --with-fapolicyd=no \
-    --with-fsverity=no
-
-%make_build
-
-pushd python
-%{__python3} setup.py build
-popd
-
-%install
-%make_install
-
-pushd python
-%{__python3} setup.py install --skip-build --root $RPM_BUILD_ROOT
-popd
-
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily
-install -m 755 scripts/rpm.daily ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/rpm
-
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d
-install -m 644 scripts/rpm.log ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/rpm
-
-install -m 755 build-aux/config.guess ${RPM_BUILD_ROOT}%{_rpmconfigdir}/
-install -m 755 build-aux/config.sub ${RPM_BUILD_ROOT}%{_rpmconfigdir}/
-
-mkdir -p ${RPM_BUILD_ROOT}/usr/lib/tmpfiles.d
-echo "r /var/lib/rpm/__db.*" > ${RPM_BUILD_ROOT}/usr/lib/tmpfiles.d/rpm.conf
-
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/rpm
-mkdir -p $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d
-mkdir -p $RPM_BUILD_ROOT/var/lib/rpm
-
-./rpmdb --define "_db_backend ndb" --dbpath=$(pwd)/ndb/ --initdb
-cp -va ndb/. $RPM_BUILD_ROOT/var/lib/rpm/
-
-%find_lang %{name}
-
-find $RPM_BUILD_ROOT -name "*.la"|xargs rm -f
-
-rm -f $RPM_BUILD_ROOT/%{_rpmconfigdir}/{perldeps.pl,perl.*,pythond*}
-rm -f $RPM_BUILD_ROOT/%{_fileattrsdir}/{perl*,python*}
-rm -f $RPM_BUILD_ROOT/%{_rpmconfigdir}/{tcl.req,osgideps.pl}
-rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/dbus-1/system.d/org.rpm.conf
-
-%check
-make check || (cat tests/rpmtests.log; exit 0)
-
-%post -p /sbin/ldconfig
-
-%postun -p /sbin/ldconfig
-
-%post libs -p /sbin/ldconfig
-
-%postun libs -p /sbin/ldconfig
-
-%posttrans
-{
-    set -e
-    dbpath=$(rpm -E %{_dbpath})
-    while  -e ${dbpath}/Packages 
-    do
-       date >> /var/log/rebuilddb.log 2>&1
-       rpm -vvv --rebuilddb >> /var/log/rebuilddb.log 2>&1
-    done

_service:tar_scm:rpm.spec Added

@@ -0,0 +1,662 @@
+Name:          rpm
+Version:       4.17.0
+Release:       21
+Summary:       RPM Package Manager
+License:       GPLv2+
+URL:           http://www.rpm.org/
+Source0:       http://ftp.rpm.org/releases/rpm-4.17.x/%{name}-%{version}.tar.bz2
+
+Patch1: Unbundle-config-site-and-add-RPM-LD-FLAGS-macro.patch
+Patch2: rpm-4.12.0-rpm2cpio-hack.patch
+Patch3: add-dist-to-release-by-default.patch
+Patch4: revert-always-execute-file-trigger-scriptlet-callbac.patch
+Patch5: bugfix-rpm-4.11.3-add-aarch64_ilp32-arch.patch
+Patch6: bugfix-rpm-4.14.2-wait-once-get-rpmlock-fail.patch
+Patch7: Generate-digest-lists.patch
+Patch8: Add-digest-list-plugin.patch
+Patch9: Don-t-add-dist-to-release-if-it-is-already-there.patch
+Patch10: Generate-digest-lists-before-calling-genCpioListAndH.patch
+Patch11: call-process_digest_list-after-files-are-added.patch
+Patch12: fix-lsetxattr-error-in-container.patch
+Patch13: rpm-selinux-plugin-check-context-file-exist.patch
+Patch14: get-in-use-of-ndb.patch
+Patch15: still-in-use-of-python-scripts-from-old-version.patch
+Patch16: Add-loongarch-architecture-support.patch
+Patch17: Fix-digest_list_counter.patch
+Patch18: Check-rpm-parser.patch
+Patch19: Remove-digest-list-from-the-kernel-during-package-re.patch
+Patch20: Add-license-to-digest_list.c.patch
+Patch21: Avoid-generating-digest-lists-if-they-are-already-pa.patch
+Patch22: dont-remove-ima-xattr-of-parser-when-upgrading.patch
+Patch23: rpm-Add-sw64-architecture.patch
+Patch24: add-default-machine-name-to-support-loongarch.patch
+
+Patch6000: backport-Use-root-as-default-UID_0_USER-and-UID_0_GROUP.patch
+Patch6001: backport-Check-file-iterator-for-being-NULL-consistently.patch
+Patch6002: backport-Process-MPI-s-from-all-kinds-of-signatures.patch
+Patch6003: backport-Refactor-pgpDigParams-construction-to-helper-functio.patch
+Patch6004: backport-Validate-and-require-subkey-binding-signatures-on-PG.patch
+Patch6005: backport-Revert-Explictly-skip-non-installed-files-on-erasur.patch
+Patch6006: backport-Fix-hash-context-leak.patch
+Patch6007: backport-Fix-hashlen-overflow.patch
+Patch6008: backport-Fix-some-Lua-stack-leaks-in-our-initialization-code.patch
+Patch6009: backport-Simplify-rpm_print-fixing-a-Lua-stack-leak-as-a-bonu.patch
+Patch6010: backport-Switch-the-floating-point-type-in-rpmhook-from-float.patch
+Patch6011: backport-Fix-a-memleak-in-ndb-from-opened-but-not-closed-dbis.patch
+Patch6012: backport-Fix-possible-NULL-pointer-dereference-in-rpmfcClassi.patch
+Patch6013: backport-Fix-old-Python-ts.check-argument-order-regression.patch
+Patch6014: backport-Fix-memory-leak-in-pgpPrtParams.patch
+Patch6015: backport-Fix-use-after-free-in-haveSignature.patch
+Patch6016: backport-Close-file-before-replacing-signed.patch
+Patch6017: backport-Fix-__cplusplus-misspelled-as-_cplusplus.patch
+Patch6018: backport-treat-0-as-valid-file-descriptor.patch
+Patch6019: backport-Skip-recorded-symlinks-in-setperms-RhBug-1900662.patch
+Patch6020: backport-Check-that-the-CRC-length-is-correct.patch
+Patch6021: backport-Make-rpmfiSetFX-return-code-meaningful.patch
+Patch6022: backport-Avoid-reading-out-of-bounds-of-the-i18ntable.patch
+Patch6023: backport-rpmkeys-exit-non-zero-on-I-O-errors.patch
+
+Patch6024: backport-Prevent-NULL-deref-in-rpmfsGetStates.patch
+Patch6025: backport-Fix-memory-leak-in-pgpPrtParams-1.patch
+Patch6026: backport-Fix-return-value-checks-in-OpenSSL-code.patch
+Patch6027: backport-Avoid-double-frees-if-EVP_PKEY_assign_RSA-fails.patch
+Patch6028: backport-Require-creation-time-to-be-unique-and-hashed.patch
+Patch6029: backport-Add-a-hashed-flag-to-pgpPrtSubtype.patch
+Patch6030: backport-Parse-key-usage-flags.patch
+Patch6031: backport-Ignore-subkeys-that-cannot-be-used-for-signing.patch
+Patch6032: backport-Avoid-unneded-MPI-reparsing.patch
+Patch6033: backport-Fix-OpenPGP-key-ID-parsing-regression.patch
+Patch6034: backport-Fix-changelog-parsing-affecting-caller-timezone-stat.patch
+Patch6035: backport-rpm2cpio.sh-Don-t-drop-newlines-from-header-sizes.patch
+Patch6036: backport-Prevent-readelf-internet-access-during-rpaths-checki.patch
+Patch6037: backport-Fix-short-circuiting-of-version-strings-in-expressio.patch
+
+Patch6038: backport-Add-optional-callback-on-directory-changes-during-rp.patch
+Patch6039: backport-CVE-2021-35937-CVE-2021-35939.patch
+Patch6040: backport-Consolidate-skipped-hardlink-with-content-case-with-.patch
+Patch6041: backport-Fix-sanitize-the-hardlink-metadata-setting-logic.patch
+Patch6042: backport-Convert-the-file-creation-steps-the-at-family-of-cal.patch
+Patch6043: backport-Bury-rpmio-FD-use-to-fsmUnpack.patch
+Patch6044: backport-Return-descriptor-of-created-file-from-fsmMkfile.patch
+Patch6045: backport-CVE-2021-35938.patch
+Patch6046: backport-rpm2cpio.sh-strip-null-bytes-with-tr.patch
+Patch6047: backport-rpm2cpio.sh-only-read-needed-bytes-of-file-magic.patch
+Patch6048: backport-Fix-rpm-lua-rpm_vercmp-error-message-if-second-argum.patch
+Patch6049: backport-Make-pgpPubkeyFingerprint-do-something-meaningful-ag.patch
+Patch6050: backport-Fix-possible-descriptor-leak-in-fsmOpenat.patch
+Patch6051: backport-Move-file-metadata-setting-back-to-unpack-stage.patch
+Patch6052: backport-Fix-header-leak-in-rpmInstall.patch
+Patch6053: backport-Fix-eiu-sourceURL-info-leak-in-rpmInstall.patch
+Patch6054: backport-Fix-h-blob-leak-when-installing-source-rpms.patch
+Patch6055: backport-Fix-Header-leak-when-running-rpm2cpio.patch
+Patch6056: backport-Use-unsigned-integers-more-consistently-in-the-handl.patch
+Patch6057: backport-Fix-file-leak-when-src-rpm-in-URL-format-is-used-for.patch
+Patch6058: backport-Fix-BANames-leak-in-handlePreambleTag.patch
+Patch6059: backport-Fix-prog-leak-in-parseScript.patch
+Patch6060: backport-Fix-elf-leak-in-getElfColor.patch
+Patch6061: backport-Fix-sbp-leak-when-running-rpmbuild-with-quiet.patch
+Patch6062: backport-Fix-memleak-when-running-generate_buildrequires.patch
+Patch6063: backport-Fix-memleak-when-fsmRename-failed-in-fsmCommit.patch
+Patch6064: backport-Fix-fileleak-and-memleak-in-rpmInstall.patch
+Patch6065: backport-Fix-fileleak-when-urlGetFile-fails-in-rpmInstall.patch
+
+Patch9000: rpm-fix-rpm-is-blocked-when-open-fifo-file.patch
+
+BuildRequires: gcc autoconf automake libtool make gawk popt-devel openssl-devel readline-devel
+BuildRequires: zlib-devel zstd-devel >= 1.3.8 xz-devel bzip2-devel libarchive-devel ima-evm-utils-devel
+BuildRequires: dbus-devel fakechroot elfutils-devel elfutils-libelf-devel ima-evm-utils
+BuildRequires: lua-devel libcap-devel libacl-devel libselinux-devel file-devel gettext-devel ncurses-devel
+BuildRequires: system-rpm-config dwz gnupg2 debugedit
+Requires:      coreutils popt curl zstd >= 1.4.0 libcap crontabs logrotate
+Obsoletes:     %{name}-build-libs %{name}-sign-libs %{name}-sign %{name}-cron
+Provides:      %{name}-build-libs %{name}-sign-libs %{name}-sign %{name}-cron
+Obsoletes:     %{name}-plugin-selinux %{name}-plugin-syslog %{name}-plugin-systemd-inhibit < 4.15.1-28  %{name}-plugin-ima %{name}-plugin-prioreset
+Provides:      %{name}-plugin-selinux %{name}-plugin-syslog %{name}-plugin-ima %{name}-plugin-prioreset
+
+%description
+The RPM Package Manager (RPM) is a powerful package management system capability as below
+
+-building computer software from source into easily distributable packages
+-installing, updating and uninstalling packaged software
+-querying detailed information about the packaged software, whether installed or not
+-verifying integrity of packaged software and resulting software installation
+
+%package libs
+Summary:     Shared library of rpm 4.17
+Requires:    %{name} = %{version}-%{release}
+
+%description libs
+Shared library of rpm 4.17.
+
+%package build
+Summary:     Scripts and executable programs used to build packages
+Requires:    %{name} = %{version}-%{release}
+Requires:    elfutils binutils findutils sed grep gawk diffutils file patch
+Requires:    tar unzip gzip bzip2 cpio xz zstd pkgconfig system-rpm-config
+Requires:    gdb-headless debugedit
+
+%description build
+This package provides scripts and executable programs that used to
+build rpm packages.
+
+%package -n python3-%{name}
+Summary: Python3 bindings for RPM user
+BuildRequires: python3-devel
+%{?python_provide:%python_provide python3-%{name}}
+Requires: %{name} = %{version}-%{release}
+Provides: %{name}-python3 = %{version}-%{release}
+Obsoletes: %{name}-python3 < %{version}-%{release}
+
+%description -n python3-%{name}
+This package contains a module that allow applications
+written with Python3 to use the interface
+supplied by RPM.
+
+%package devel
+Summary:  Development files for RPM handling
+Requires: %{name} = %{version}-%{release}
+Requires: popt-devel
+
+%description devel
+%{summary}.
+
+%package plugin-systemd-inhibit
+Summary: rpm plugin to get systemd-inhibit lock
+Requires: %{name} = %{version}-%{release}
+
+%description plugin-systemd-inhibit
+This package use systemd-inhibit to block systemd from entering
+idle, sleep or shutdown while an rpm transcation is running.
+
+%package help
+Summary: Man page for %{name}
+BuildArch: noarch
+Obsoletes: apidocs
+
+%description help
+%{summary}.
+
+%prep
+%autosetup -n %{name}-%{version} -p1
+%ifnarch sw_64
+%patch23 -R -p1
+%endif
+
+%build
+CPPFLAGS="$CPPFLAGS -DLUA_COMPAT_APIINTCASTS"
+CFLAGS="$RPM_OPT_FLAGS -DLUA_COMPAT_APIINTCASTS"
+LDFLAGS="$LDFLAGS %{?__global_ldflags}"
+export CPPFLAGS CFLAGS LDFLAGS
+
+autoreconf -i -f
+
+for i in $(find . -name ltmain.sh) ; do
+     %{__sed} -i.backup -e 's~compiler_flags=$~compiler_flags="%{_hardened_ldflags}"~' $i
+done;
+
+./configure \
+    --prefix=%{_usr} \
+    --sysconfdir=%{_sysconfdir} \

_service:extract_file:Add-digest-list-plugin.patch Deleted

@@ -1,586 +0,0 @@
-From e49074a4e4bd0699d2c4a5bb3a0dc5ca45e19e12 Mon Sep 17 00:00:00 2001
-From: Roberto Sassu <roberto.sassu@huawei.com>
-Date: Wed, 26 Feb 2020 15:54:24 +0100
-Subject: PATCH 2/3 Add digest list plugin
-
----
- macros.in             |   1 +
- plugins/Makefile.am   |   4 +
- plugins/digest_list.c | 498 ++++++++++++++++++++++++++++++++++++++++++
- rpmio/digest.h        |   1 +
- rpmio/rpmpgp.c        |   3 +
- 5 files changed, 507 insertions(+)
- create mode 100644 plugins/digest_list.c
-
-diff --git a/macros.in b/macros.in
-index 402749362..8619c1323 100644
---- a/macros.in
-+++ b/macros.in
-@@ -1184,6 +1184,7 @@ package or when debugging this package.\
- %__transaction_prioreset	%{__plugindir}/prioreset.so
- %__transaction_audit		%{__plugindir}/audit.so
- %__transaction_dbus_announce	%{__plugindir}/dbus_announce.so
-+%__transaction_digest_list	%{__plugindir}/digest_list.so
- 
- #------------------------------------------------------------------------------
- # Macros for further automated spec %setup and patch application
-diff --git a/plugins/Makefile.am b/plugins/Makefile.am
-index d4ef039ed..07aa3585b 100644
---- a/plugins/Makefile.am
-+++ b/plugins/Makefile.am
-@@ -48,3 +48,7 @@ audit_la_sources = audit.c
- audit_la_LIBADD = $(top_builddir)/lib/librpm.la $(top_builddir)/rpmio/librpmio.la @WITH_AUDIT_LIB@
- plugins_LTLIBRARIES += audit.la
- endif
-+
-+digest_list_la_sources = digest_list.c
-+digest_list_la_LIBADD = $(top_builddir)/lib/librpm.la $(top_builddir)/rpmio/librpmio.la
-+plugins_LTLIBRARIES += digest_list.la
-diff --git a/plugins/digest_list.c b/plugins/digest_list.c
-new file mode 100644
-index 000000000..beb397309
---- /dev/null
-+++ b/plugins/digest_list.c
-@@ -0,0 +1,499 @@
-+#include "system.h"
-+#include "errno.h"
-+
-+#include <fcntl.h>
-+#include <rpm/rpmlog.h>
-+#include <rpm/rpmts.h>
-+#include <rpm/header.h>
-+#include <rpmio/digest.h>
-+#include <rpmio/rpmpgp.h>
-+#include <rpm/rpmfileutil.h>
-+#include "lib/rpmplugin.h"
-+#include <netinet/in.h>
-+#include <sys/stat.h>
-+#include <openssl/sha.h>
-+#include <sys/xattr.h>
-+#include <linux/xattr.h>
-+#include <asm/byteorder.h>
-+#include <sys/wait.h>
-+
-+#include "debug.h"
-+
-+#define IMA_DIR "/sys/kernel/security/ima"
-+#define DIGEST_LIST_DATA_PATH IMA_DIR "/digest_list_data"
-+#define DIGEST_LIST_DATA_DEL_PATH IMA_DIR "/digest_list_data_del"
-+#define DIGEST_LIST_COUNT IMA_DIR "/digests_count"
-+#define DIGEST_LIST_DEFAULT_PATH "/etc/ima/digest_lists"
-+#define RPM_PARSER "/usr/libexec/rpm_parser"
-+
-+#define DIGEST_LIST_OP_ADD 0
-+#define DIGEST_LIST_OP_DEL 1
-+
-+enum hash_algo {
-+	HASH_ALGO_MD4,
-+	HASH_ALGO_MD5,
-+	HASH_ALGO_SHA1,
-+	HASH_ALGO_RIPE_MD_160,
-+	HASH_ALGO_SHA256,
-+	HASH_ALGO_SHA384,
-+	HASH_ALGO_SHA512,
-+	HASH_ALGO_SHA224,
-+	HASH_ALGO_RIPE_MD_128,
-+	HASH_ALGO_RIPE_MD_256,
-+	HASH_ALGO_RIPE_MD_320,
-+	HASH_ALGO_WP_256,
-+	HASH_ALGO_WP_384,
-+	HASH_ALGO_WP_512,
-+	HASH_ALGO_TGR_128,
-+	HASH_ALGO_TGR_160,
-+	HASH_ALGO_TGR_192,
-+	HASH_ALGO_SM3_256,
-+	HASH_ALGO__LAST
-+};
-+
-+#define PGPHASHALGO__LAST PGPHASHALGO_SHA224 + 1
-+enum hash_algo pgp_algo_mappingPGPHASHALGO__LAST = {
-+	PGPHASHALGO_MD5 = HASH_ALGO_MD5,
-+	PGPHASHALGO_SHA1 = HASH_ALGO_SHA1,
-+	PGPHASHALGO_SHA224 = HASH_ALGO_SHA224,
-+	PGPHASHALGO_SHA256 = HASH_ALGO_SHA256,
-+	PGPHASHALGO_SHA384 = HASH_ALGO_SHA384,
-+	PGPHASHALGO_SHA512 = HASH_ALGO_SHA512,
-+};
-+
-+/* from integrity.h */
-+enum evm_ima_xattr_type {
-+	IMA_XATTR_DIGEST = 0x01,
-+	EVM_XATTR_HMAC,
-+	EVM_IMA_XATTR_DIGSIG,
-+	IMA_XATTR_DIGEST_NG,
-+	EVM_XATTR_PORTABLE_DIGSIG,
-+	EVM_IMA_XATTR_DIGEST_LIST,
-+	IMA_XATTR_LAST
-+};
-+
-+struct evm_ima_xattr_data {
-+	uint8_t type;
-+	uint8_t digestSHA512_DIGEST_LENGTH + 1;
-+} __attribute__((packed));
-+
-+struct signature_v2_hdr {
-+	uint8_t type;		/* xattr type */
-+	uint8_t version;	/* signature format version */
-+	uint8_t hash_algo;	/* Digest algorithm enum hash_algo */
-+	__be32 keyid;		/* IMA key identifier - not X509/PGP specific */
-+	__be16 sig_size;	/* signature size */
-+	uint8_t sig0;		/* signature payload */
-+} __attribute__((packed));
-+
-+static int upload_digest_list(char *path, int type, int digest_list_signed)
-+{
-+	size_t size;
-+	char buf21;
-+	const char *ima_path = DIGEST_LIST_DATA_PATH;
-+	struct stat st;
-+	pid_t pid;
-+	int ret = 0, fd;
-+
-+	if (type == TR_REMOVED)
-+		ima_path = DIGEST_LIST_DATA_DEL_PATH;
-+
-+	if (stat(ima_path, &st) == -1)
-+		return 0;
-+
-+	/* First determine if kernel interface can accept new digest lists */
-+	fd = open(DIGEST_LIST_COUNT, O_RDONLY);
-+	if (fd < 0) {
-+		rpmlog(RPMLOG_ERR, "digest_list: could not open IMA interface "
-+		       "'%s': %s\n", DIGEST_LIST_COUNT, strerror(errno));
-+		return -EACCES;
-+	}
-+
-+	ret = read(fd, buf, sizeof(buf));
-+	close(fd);
-+
-+	if (ret <= 0) {
-+		rpmlog(RPMLOG_ERR, "digest_list: could not read from IMA "
-+		       "interface '%s': %s\n", DIGEST_LIST_COUNT,
-+		       strerror(errno));
-+		return -EACCES;
-+	}
-+
-+	/* Last character is newline */
-+	bufret - 1 = '\0';
-+
-+	rpmlog(RPMLOG_DEBUG, "digest_list: digests count %s\n", buf);
-+
-+	if (*buf == '0') {
-+		rpmlog(RPMLOG_DEBUG, "digest_list: not uploading '%s' to IMA "
-+		       "interface '%s'\n", path, ima_path);
-+		return RPMRC_OK;
-+	}
-+
-+	/* If the digest list is not signed, execute the RPM parser */
-+	if (!digest_list_signed) {
-+		if ((pid = fork()) == 0) {
-+			execlp(RPM_PARSER, RPM_PARSER, (type == TR_ADDED) ?
-+			       "add" : "del", path, NULL);
-+			_exit(EXIT_FAILURE);
-+		}
-+
-+		waitpid(pid, &ret, 0);
-+		if (ret != 0)
-+			rpmlog(RPMLOG_ERR, "digest_list: %s returned %d\n",
-+			       RPM_PARSER, ret);
-+		return 0;
-+	}
-+
-+	fd = open(ima_path, O_WRONLY);
-+	if (fd < 0) {
-+		rpmlog(RPMLOG_ERR, "digest_list: could not open IMA interface "
-+		       "'%s': %s\n", ima_path, strerror(errno));
-+		return -EACCES;
-+	}
-+
-+	/* Write the path of the digest list to securityfs */

_service:extract_file:Don-t-add-dist-to-release-if-it-is-already-there.patch Deleted

_service:extract_file:Generate-digest-lists.patch Deleted

@@ -1,323 +0,0 @@
-From 4d1801825c754171962050ee9c36c2d69c630ece Mon Sep 17 00:00:00 2001
-From: Roberto Sassu <roberto.sassu@huawei.com>
-Date: Thu, 12 Mar 2020 17:29:55 +0100
-Subject: PATCH 1/3 Generate digest lists
-
----
- build/files.c | 176 ++++++++++++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 169 insertions(+), 7 deletions(-)
-
-diff --git a/build/files.c b/build/files.c
-index 6dfd801c8..ab6938d8c 100644
---- a/build/files.c
-+++ b/build/files.c
-@@ -50,6 +50,7 @@
- #define DEBUG_LIB_PREFIX	"/usr/lib/debug/"
- #define DEBUG_ID_DIR		"/usr/lib/debug/.build-id"
- #define DEBUG_DWZ_DIR 		"/usr/lib/debug/.dwz"
-+#define DIGEST_LIST_DIR		"/.digest_lists"
- 
- #undef HASHTYPE
- #undef HTKEYTYPE
-@@ -129,6 +130,8 @@ typedef struct AttrRec_s {
- 
- /* list of files */
- static StringBuf check_fileList = NULL;
-+/* list of files per binary package */
-+static StringBuf check_fileList_bin_pkg = NULL;
- 
- typedef struct FileEntry_s {
-     rpmfileAttrs attrFlags;
-@@ -193,6 +196,10 @@ typedef struct FileList_s {
-     struct FileEntry_s cur;
- } * FileList;
- 
-+static char *digest_list_dir;
-+
-+static int genDigestList(Header header, FileList fl, StringBuf fileList);
-+
- static void nullAttrRec(AttrRec ar)
- {
-     memset(ar, 0, sizeof(*ar));
-@@ -997,11 +997,14 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
- {
-     FileListRec flp;
-     char bufBUFSIZ;
-+    char file_infoBUFSIZ;
-+    char file_digest128 * 2 + 1;
-     int i, npaths = 0;
-     int fail_on_dupes = rpmExpandNumeric("%{?_duplicate_files_terminate_build}") > 0;
-     uint32_t defaultalgo = PGPHASHALGO_MD5, digestalgo;
-     rpm_loff_t totalFileSize = 0;
-     Header h = pkg->header; /* just a shortcut */
-+    int processed = 0;
-     time_t source_date_epoch = 0;
-     char *srcdate = getenv("SOURCE_DATE_EPOCH");
- 
-@@ -1058,8 +1067,9 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
-     
-     pkg->dpaths = xmalloc((fl->files.used + 1) * sizeof(*pkg->dpaths));
- 
-+process_files:
-     /* Generate the header. */
--    for (i = 0, flp = fl->files.recs; i < fl->files.used; i++, flp++) {
-+    for (i = processed, flp = fl->files.recs + processed; i < fl->files.used; i++, flp++) {
- 	rpm_ino_t fileid = flp - fl->files.recs;
- 
-  	/* Merge duplicate entries. */
-@@ -1190,7 +1200,8 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
- 	    (void) rpmDoDigest(digestalgo, flp->diskPath, 1, 
- 			       (unsigned char *)buf);
- 	headerPutString(h, RPMTAG_FILEDIGESTS, buf);
--	
-+	snprintf(file_digest, sizeof(file_digest), "%s", buf);
-+
- 	buf0 = '\0';
- 	if (S_ISLNK(flp->fl_mode)) {
- 	    ssize_t llen = readlink(flp->diskPath, buf, BUFSIZ-1);
-@@ -1230,7 +1241,33 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
- 	flp->flags &= PARSEATTR_MASK;
- 
- 	headerPutUint32(h, RPMTAG_FILEFLAGS, &(flp->flags) ,1);
-+
-+	if (!processed && check_fileList_bin_pkg && S_ISREG(flp->fl_mode) &&
-+		!(flp->flags & RPMFILE_GHOST)) {
-+	    appendStringBuf(check_fileList_bin_pkg, "path=");
-+	    appendStringBuf(check_fileList_bin_pkg, flp->diskPath);
-+	    snprintf(file_info, sizeof(file_info),
-+		"|digestalgopgp=%d|digest=%s|mode=%d"
-+		"|uname=%s|gname=%s|caps=%s\n",
-+		digestalgo, file_digest, flp->fl_mode,
-+		rpmstrPoolStr(fl->pool, flp->uname),
-+		rpmstrPoolStr(fl->pool, flp->gname), flp->caps &&
-+		strlen(flp->caps) ? flp->caps : "");
-+	    appendStringBuf(check_fileList_bin_pkg, file_info);
-+	}
-+    }
-+
-+    if (!processed) {
-+	if (genDigestList(pkg->header, fl, check_fileList_bin_pkg) > 0) {
-+	    fl->processingFailed = 1;
-+	} else if (i < fl->files.used) {
-+	    pkg->dpaths = xrealloc(pkg->dpaths,
-+				   (fl->files.used + 1) * sizeof(*pkg->dpaths));
-+	    processed = i;
-+	    goto process_files;
-+	}
-     }
-+
-     pkg->dpathsnpaths = NULL;
- 
-     if (totalFileSize < UINT32_MAX) {
-@@ -1343,8 +1380,8 @@ static int validFilename(const char *fn)
-  * @param statp		file stat (possibly NULL)
-  * @return		RPMRC_OK on success
-  */
--static rpmRC addFile(FileList fl, const char * diskPath,
--		struct stat * statp)
-+static rpmRC addFile_common(FileList fl, const char * diskPath,
-+		struct stat * statp, int digest_list)
- {
-     size_t plen = strlen(diskPath);
-     char bufplen + 1;
-@@ -1355,6 +1392,10 @@ static rpmRC addFile(FileList fl, const char * diskPath,
-     gid_t fileGid;
-     const char *fileUname;
-     const char *fileGname;
-+    char realPathPATH_MAX;
-+    int digest_list_prefix = 0;
-+    struct stat st;
-+    int exclude = 0;
-     rpmRC rc = RPMRC_FAIL; /* assume failure */
- 
-     /* Strip trailing slash. The special case of '/' path is handled below. */
-@@ -1390,6 +1431,33 @@ static rpmRC addFile(FileList fl, const char * diskPath,
-     if (*cpioPath == '\0')
- 	cpioPath = "/";
- 
-+    snprintf(realPath, sizeof(realPath), "%s", diskPath);
-+    rpmCleanPath(realPath);
-+
-+    digest_list_prefix = (!strncmp(realPath, digest_list_dir,
-+			  strlen(digest_list_dir)));
-+
-+    if ((!digest_list && digest_list_prefix) ||
-+	(digest_list && !digest_list_prefix)) {
-+	    rc = RPMRC_OK;
-+	    goto exit;
-+    }
-+
-+    if (digest_list) {
-+	if (strncmp(cpioPath, DIGEST_LIST_DIR, sizeof(DIGEST_LIST_DIR) - 1)) {
-+	    rc = RPMRC_OK;
-+	    goto exit;
-+	}
-+
-+	cpioPath += sizeof(DIGEST_LIST_DIR) - 1;
-+
-+	snprintf(realPath, sizeof(realPath), "%.*s%s",
-+		 (int)(strlen(digest_list_dir) - sizeof(DIGEST_LIST_DIR) + 1),
-+		 digest_list_dir, cpioPath);
-+	if (!stat(realPath, &st))
-+	    exclude = 1;
-+    }
-+
-     /*
-      * Unless recursing, we dont have stat() info at hand. Handle the
-      * various cases, preserving historical behavior wrt %dev():
-@@ -1527,6 +1595,8 @@ static rpmRC addFile(FileList fl, const char * diskPath,
- 	}
- 
- 	flp->flags = fl->cur.attrFlags;
-+	if (exclude)
-+	    flp->flags |= RPMFILE_EXCLUDE;
- 	flp->specdFlags = fl->cur.specdFlags;
- 	flp->verifyFlags = fl->cur.verifyFlags;
- 
-@@ -1547,6 +1617,32 @@ exit:
-     return rc;
- }
- 
-+/**
-+ * Add a file to the package manifest.
-+ * @param fl		package file tree walk data
-+ * @param diskPath	path to file
-+ * @param statp		file stat (possibly NULL)
-+ * @return		RPMRC_OK on success
-+ */
-+static rpmRC addFile(FileList fl, const char * diskPath,
-+		struct stat * statp)
-+{
-+	return addFile_common(fl, diskPath, statp, 0);
-+}
-+
-+/**
-+ * Add a digest list to the package manifest.
-+ * @param fl		package file tree walk data
-+ * @param diskPath	path to digest list
-+ * @param statp		file stat (possibly NULL)
-+ * @return		RPMRC_OK on success

_service:extract_file:Unbundle-config-site-and-add-RPM-LD-FLAGS-macro.patch Deleted

@@ -1,38 +0,0 @@
-From eee654b9652fb9387018f9653431a11401a354fd Mon Sep 17 00:00:00 2001
-From: openeuler-basic <shenyangyang4@huawei.com>
-Date: Thu, 9 Jan 2020 19:16:58 +0800
-Subject: PATCH Unbundle config site and add RPM LD FLAGS macro
-
----
- macros.in | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/macros.in b/macros.in
-index fe9803a..4027493 100644
---- a/macros.in
-+++ b/macros.in
-@@ -794,10 +794,11 @@ package or when debugging this package.\
-   RPM_SOURCE_DIR=\"%{u2p:%{_sourcedir}}\"\
-   RPM_BUILD_DIR=\"%{u2p:%{_builddir}}\"\
-   RPM_OPT_FLAGS=\"%{optflags}\"\
-+  RPM_LD_FLAGS=\"%{?build_ldflags}\"\
-   RPM_ARCH=\"%{_arch}\"\
-   RPM_OS=\"%{_os}\"\
-   RPM_BUILD_NCPUS=\"%{_smp_build_ncpus}\"\
--  export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_BUILD_NCPUS\
-+  export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_BUILD_NCPUS RPM_OPT_FLAGS\
-   RPM_DOC_DIR=\"%{_docdir}\"\
-   export RPM_DOC_DIR\
-   RPM_PACKAGE_NAME=\"%{NAME}\"\
-@@ -813,6 +814,8 @@ package or when debugging this package.\
-   export CLASSPATH}\
-   PKG_CONFIG_PATH=\"${PKG_CONFIG_PATH}:%{_libdir}/pkgconfig:%{_datadir}/pkgconfig\"\
-   export PKG_CONFIG_PATH\
-+  CONFIG_SITE=${CONFIG_SITE:-NONE}\
-+  export CONFIG_SITE\
-   \
-   %%{verbose}?"set -x":""\
-   umask 022\
--- 
-1.8.3.1
-

_service:extract_file:Use-user.digest_list-to-avoid-duplicate-processing-o.patch Deleted

@@ -1,57 +0,0 @@
-From e07cef55252fddf45ff39e264097c04a726d0d79 Mon Sep 17 00:00:00 2001
-From: Roberto Sassu <roberto.sassu@huawei.com>
-Date: Fri, 7 Aug 2020 09:32:27 +0200
-Subject: PATCH Use user.digest_list to avoid duplicate processing of the
- digest lists
-
----
- plugins/digest_list.c | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/plugins/digest_list.c b/plugins/digest_list.c
-index beb397309..9fcb5c4c5 100644
---- a/plugins/digest_list.c
-+++ b/plugins/digest_list.c
-@@ -417,7 +417,7 @@ static int process_digest_list(rpmte te, int parser)
- 			 DIGEST_LIST_DEFAULT_PATH, rpmteN(te), rpmteV(te),
- 			 rpmteR(te), rpmteA(te));
- 
--	size = lgetxattr(path, XATTR_NAME_IMA, NULL, 0);
-+	size = lgetxattr(path, "user.digest_list", NULL, 0);
- 
- 	/* Don't upload again if digest list was already processed */
- 	if ((rpmteType(te) == TR_ADDED && size > 0) ||
-@@ -446,6 +446,14 @@ static int process_digest_list(rpmte te, int parser)
- 			ret = RPMRC_FAIL;
- 			goto out;
- 		}
-+
-+		ret = lsetxattr(path, "user.digest_list", "1", 1, 0);
-+		if (ret < 0)
-+			rpmlog(RPMLOG_ERR, "digest_list: cannot add "
-+			       "user.digest_list to '%s'\n", path);
-+		else
-+			rpmlog(RPMLOG_DEBUG, "digest_list: user.digest_list "
-+			       "successfully added to '%s'\n", path);
- 	}
- 
- 	/* Upload digest list to securityfs */
-@@ -457,12 +465,12 @@ static int process_digest_list(rpmte te, int parser)
- 			goto out;
- 		}
- 
--		ret = lremovexattr(path, XATTR_NAME_IMA);
-+		ret = lremovexattr(path, "user.digest_list");
- 		if (ret < 0)
- 			rpmlog(RPMLOG_ERR, "digest_list: cannot remove "
--			       "security.ima from '%s'\n", path);
-+			       "user.digest_list from '%s'\n", path);
- 		else
--			rpmlog(RPMLOG_DEBUG, "digest_list: security.ima "
-+			rpmlog(RPMLOG_DEBUG, "digest_list: user.digest_list "
- 			       "successfully removed from '%s'\n", path);
- 	}
- out:
--- 
-2.27.GIT
-

_service:extract_file:add-dist-to-release-by-default.patch Deleted

@@ -1,37 +0,0 @@
-From af9a2347cd725a8dbb6045d7d3e9661d524af110 Mon Sep 17 00:00:00 2001
-From: openEuler Buildteam <buildteam@openeuler.org>
-Date: Wed, 4 Mar 2020 16:12:58 +0800
-Subject: PATCH add dist to release by default
-
----
- build/parsePreamble.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/build/parsePreamble.c b/build/parsePreamble.c
-index b0a17c8..cac899a 100644
---- a/build/parsePreamble.c
-+++ b/build/parsePreamble.c
-@@ -808,6 +808,11 @@ static rpmRC handlePreambleTag(rpmSpec spec, Package pkg, rpmTagVal tag,
-     case RPMTAG_VERSION:
-     case RPMTAG_RELEASE:
- 	SINGLE_TOKEN_ONLY;
-+        if (tag == RPMTAG_RELEASE) {
-+            char *dist = rpmExpand("%{?dist}",NULL);
-+            rasprintf(&field,"%s%s",field,dist);
-+            free(dist);
-+        }
- 	if (rpmCharCheck(spec, field, ALLOWED_CHARS_VERREL))
- 	   goto exit;
- 	headerPutString(pkg->header, tag, field);
-@@ -987,6 +992,8 @@ static rpmRC handlePreambleTag(rpmSpec spec, Package pkg, rpmTagVal tag,
-     }
-     rc = RPMRC_OK;
- exit:
-+    if (tag == RPMTAG_RELEASE)
-+        free(field);
-     return rc;	
- }
- 
--- 
-1.8.3.1
-

_service:extract_file:backport-Use-root-as-default-UID_0_USER-and-UID_0_GROUP.patch Deleted

@@ -1,29 +0,0 @@
-From 7b3a3f004f96ed3cb9cc377f7e64bfc88195dfc2 Mon Dec 13 16:41:34 2021
-From: From: Florian Festi <ffesti@redhat.com>
-Date: Mon, 13 Dec 2021 16:41:34 +0800
-Subject: PATCH Use root as default UID_0_USER and UID_0_GROUP
-
-If /etc/passwd or /etc/group was not available during building rpm itself
-these ended up empty. This affects builds done later on using rpmbuild.
-
-Resolves: #1838
----
- configure.ac | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/configure.ac b/configure.ac
-index cdaf2b6..8656043 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1050,6 +1050,8 @@ fi
- 
- user_with_uid0=$(awk -F: '$3==0 {print $1;exit}' /etc/passwd)
- group_with_gid0=$(awk -F: '$3==0 {print $1;exit}' /etc/group)
-+if test -z "$user_with_uid0" ; then user_with_uid0=root ; fi
-+if test -z "$group_with_gid0" ; then group_with_gid0=root ; fi
- AC_DEFINE_UNQUOTED(UID_0_USER,"$user_with_uid0",Get the user name having userid 0)
- AC_DEFINE_UNQUOTED(GID_0_GROUP,"$group_with_gid0",Get the group name having groupid 0)
- 
--- 
-1.8.3.1
-

_service:extract_file:bugfix-rpm-4.11.3-add-aarch64_ilp32-arch.patch Deleted

@@ -1,80 +0,0 @@
-diff -Nur rpm-4.14.2.old/installplatform rpm-4.14.2/installplatform
---- rpm-4.14.2.old/installplatform	2017-08-10 16:08:07.113108701 +0800
-+++ rpm-4.14.2/installplatform	2019-01-30 17:28:25.511000000 +0800
-@@ -180,6 +180,13 @@
- 	CANONARCH=riscv64
- 	CANONCOLOR=3
- 	;;
-+    aarch64_ilp32)
-+        ISANAME=aarch
-+        ISABITS=32
-+        CANONARCH=aarch64
-+        CANONCOLOR=0
-+        LIB=libilp32
-+        ;;
-     noarch)
- 	CANONARCH=noarch
- 	CANONCOLOR=0
-diff -Nur rpm-4.14.2.old/rpmrc.in rpm-4.14.2/rpmrc.in
---- rpm-4.14.2.old/rpmrc.in	2019-01-29 18:43:15.795000000 +0800
-+++ rpm-4.14.2/rpmrc.in	2019-01-30 20:30:17.916000000 +0800
-@@ -99,7 +99,7 @@
- optflags: sh4a -O2 -g -mieee
- 
- optflags: aarch64 -O2 -g
--
-+optflags: aarch64_ilp32 -O2 -g -mabi=ilp32
- optflags: riscv64 -O2 -g
- 
- #############################################################
-@@ -149,7 +149,7 @@
- archcolor: sh4 1
- 
- archcolor: aarch64 2
--
-+archcolor: aarch64_ilp32 1
- archcolor: riscv64 2
- 
- #############################################################
-@@ -243,7 +243,7 @@
- arch_canon:	sh4a: sh4a	17
- arch_canon:	xtensa: xtensa	18
- arch_canon:	aarch64: aarch64 19
--
-+arch_canon:     aarch64_ilp32: aarch64 19
- arch_canon:	mipsr6: mipsr6	20
- arch_canon:	mipsr6el: mipsr6el	20
- arch_canon:	mips64r6: mips64r6	21
-@@ -377,11 +377,11 @@
- buildarchtranslate: sh4a: sh4
- 
- buildarchtranslate: aarch64: aarch64
--
-+buildarchtranslate: aarch64_ilp32: aarch64_ilp32
- buildarchtranslate: riscv: riscv64
- buildarchtranslate: riscv64: riscv64
- 
--#############################################################
-+#########################################/####################
- # Architecture compatibility
- 
- arch_compat: alphaev67: alphaev6
-@@ -485,7 +485,8 @@
- arch_compat: sh4: noarch
- arch_compat: sh4a: sh4
- 
--arch_compat: aarch64: noarch
-+arch_compat: aarch64_ilp32: aarch64 noarch
-+arch_compat: aarch64: aarch64_ilp32 noarch
- 
- arch_compat: riscv: noarch
- arch_compat: riscv64: noarch
-@@ -522,7 +523,7 @@
- buildarch_compat: ia64: noarch
- 
- buildarch_compat: aarch64: noarch
--
-+buildarch_compat: aarch64_ilp32: noarch
- buildarch_compat: riscv: noarch
- buildarch_compat: riscv64: noarch
-

_service:extract_file:bugfix-rpm-4.14.2-wait-once-get-rpmlock-fail.patch Deleted

@@ -1,35 +0,0 @@
-From c6699a7e90acfaa421830ce0fc12940335e40d7b Mon Sep 17 00:00:00 2001
-From: shanshishi <shanshishi@huawei.com>
-Date: Sun, 19 May 2019 16:49:45 +0800
-Subject: PATCH rpm: wait once get rpmlock fail
-
-reason: When executing the rpm command concurrently, it will block some
-times, because of lock is applied before.
-
-Signed-off-by: shanshishi <shanshishi@huawei.com>
----
- lib/rpmlock.c | 5 +----
- 1 file changed, 1 insertion(+), 4 deletions(-)
-
-diff --git a/lib/rpmlock.c b/lib/rpmlock.c
-index d693c4b..86e07b3 100644
---- a/lib/rpmlock.c
-+++ b/lib/rpmlock.c
-@@ -125,13 +125,10 @@ rpmlock rpmlockNew(const char *lock_path, const char *descr)
- int rpmlockAcquire(rpmlock lock)
- {
-     int locked = 0; /* assume failure */
--    int myerrno = errno;
--    int maywait = isatty(STDIN_FILENO); /* dont wait within scriptlets */
--    errno = myerrno;
- 
-     if (lock) {
- 	locked = rpmlock_acquire(lock, RPMLOCK_WRITE);
--	if (!locked && (lock->openmode & RPMLOCK_WRITE) && maywait) {
-+	if (!locked && (lock->openmode & RPMLOCK_WRITE)) {
- 	    rpmlog(RPMLOG_WARNING, _("waiting for %s lock on %s\n"),
- 		    lock->descr, lock->path);
- 	    locked = rpmlock_acquire(lock, (RPMLOCK_WRITE|RPMLOCK_WAIT));
--- 
-1.7.12.4
-

_service:extract_file:call-process_digest_list-after-files-are-added.patch Deleted

@@ -1,115 +0,0 @@
-From 641ec5a50cb5057e02c4cfe7bd537a32fafdd665 Mon Sep 17 00:00:00 2001
-From: Roberto Sassu <roberto.sassu@huawei.com>
-Date: Mon, 26 Oct 2020 12:10:31 +0800
-Subject: PATCH call process_digest_list after files are added
-
-Signed-off-by: Anakin Zhang <benjamin93@163.com>
----
- plugins/digest_list.c | 78 ++++++++++++++++++++++++++++++++++++++-----
- 1 file changed, 69 insertions(+), 9 deletions(-)
-
-diff --git a/plugins/digest_list.c b/plugins/digest_list.c
-index 9fcb5c4..7213b41 100644
---- a/plugins/digest_list.c
-+++ b/plugins/digest_list.c
-@@ -479,28 +479,88 @@ out:
- 	return ret;
- }
- 
-+rpmte cur_te;
-+int digest_list_counter;
-+
- static rpmRC digest_list_psm_pre(rpmPlugin plugin, rpmte te)
- {
--	process_digest_list(te, 0);
--	if (!strcmp(rpmteN(te), "digest-list-tools"))
--		process_digest_list(te, 1);
-+	Header rpm = rpmteHeader(te);
-+	rpmtd dirnames;
-+	int i;
-+
-+	digest_list_counter = 0;
-+
-+	dirnames = rpmtdNew();
-+	headerGet(rpm, RPMTAG_DIRNAMES, dirnames, 0);
-+
-+	while ((i = rpmtdNext(dirnames)) >= 0) {
-+		char *dirname = (char *) rpmtdGetString(dirnames);
-+		if (!strncmp(dirname, DIGEST_LIST_DEFAULT_PATH,
-+			     sizeof(DIGEST_LIST_DEFAULT_PATH) - 1))
-+			digest_list_counter++;
-+	}
- 
-+	rpmtdFree(dirnames);
-+
-+	cur_te = te;
- 	return RPMRC_OK;
- }
- 
--static rpmRC digest_list_psm_post(rpmPlugin plugin, rpmte te, int res)
-+static rpmRC digest_list_file_common(rpmPlugin plugin, rpmfi fi,
-+				     const char* path, mode_t file_mode,
-+				     rpmFsmOp op, int pre, int res)
- {
--	if (res != RPMRC_OK)
-+	rpmFileAction action = XFO_ACTION(op);
-+
-+	if (!digest_list_counter)
-+		return RPMRC_OK;
-+
-+	if (!cur_te)
-+		return RPMRC_OK;
-+
-+	if (!pre && res != RPMRC_OK)
-+		return res;
-+
-+	if ((pre && action != FA_ERASE) ||
-+	    (!pre && action != FA_CREATE))
- 		return RPMRC_OK;
- 
--	process_digest_list(te, 0);
--	if (!strcmp(rpmteN(te), "digest-list-tools"))
--		process_digest_list(te, 1);
-+	if (digest_list_counter) {
-+		if (!pre) {
-+			if (!strncmp(path, DIGEST_LIST_DEFAULT_PATH,
-+				     sizeof(DIGEST_LIST_DEFAULT_PATH) - 1))
-+				digest_list_counter--;
-+		} else {
-+			digest_list_counter = 0;
-+		}
-+
-+		if (digest_list_counter)
-+			return RPMRC_OK;
-+	}
-+
-+	process_digest_list(cur_te, 0);
-+	if (!strcmp(rpmteN(cur_te), "digest-list-tools"))
-+		process_digest_list(cur_te, 1);
- 
- 	return RPMRC_OK;
- }
- 
-+static rpmRC digest_list_file_pre(rpmPlugin plugin, rpmfi fi,
-+				  const char* path, mode_t file_mode,
-+				  rpmFsmOp op)
-+{
-+	return digest_list_file_common(plugin, fi, path, file_mode, op, 1, 0);
-+}
-+
-+static rpmRC digest_list_file_post(rpmPlugin plugin, rpmfi fi,
-+				  const char* path, mode_t file_mode,
-+				  rpmFsmOp op, int res)
-+{
-+	return digest_list_file_common(plugin, fi, path, file_mode, op, 0, res);
-+}
-+
- struct rpmPluginHooks_s digest_list_hooks = {
- 	.psm_pre = digest_list_psm_pre,
--	.psm_post = digest_list_psm_post,
-+	.fsm_file_pre = digest_list_file_pre,
-+	.fsm_file_post = digest_list_file_post,
- };
--- 
-2.23.0
-

_service:extract_file:fix-lsetxattr-error-in-container.patch Deleted

@@ -1,64 +0,0 @@
-From 848cad38da6c727c91f0fcb8052f9402de598737 Mon Sep 17 00:00:00 2001
-From: Zhang Tianxing <zhangtianxing3@huawei.com>
-Date: Mon, 13 Sep 2021 17:32:11 +0800
-Subject: PATCH fix lsetxattr error in container
-
-The digest list plugin in rpm will set security.ima xattr to IMA digest lists
-when installing or updating an rpm package. However, in a container without
-CAP_SYS_ADMIN, we'll get error messages when calling lsetxattr.
-
-This patch is to skip lsetxattr when CAP_SYS_ADMIN is missing.
-
-Signed-off-by: Zhang Tianxing <zhangtianxing3@huawei.com>
----
- plugins/digest_list.c | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
-
-diff --git a/plugins/digest_list.c b/plugins/digest_list.c
-index 6bc9415..2d14463 100644
---- a/plugins/digest_list.c
-+++ b/plugins/digest_list.c
-@@ -12,6 +12,7 @@
- #include <sys/stat.h>
- #include <openssl/sha.h>
- #include <sys/xattr.h>
-+#include <sys/capability.h>
- #include <linux/xattr.h>
- #include <asm/byteorder.h>
- #include <sys/wait.h>
-@@ -370,6 +371,10 @@ static int process_digest_list(rpmte te, int parser)
- 	int digest_list_signed = 0;
- 	struct stat st;
- 	ssize_t size;
-+	struct __user_cap_header_struct cap_header_data;
-+	cap_user_header_t cap_header = &cap_header_data;
-+	struct __user_cap_data_struct cap_data_data;
-+	cap_user_data_t cap_data = &cap_data_data;
- 	rpmRC ret = RPMRC_OK;
- 
- 	path = malloc(PATH_MAX);
-@@ -435,7 +440,21 @@ static int process_digest_list(rpmte te, int parser)
- 				ret = RPMRC_FAIL;
- 				goto out;
- 			}
-+		}
- 
-+		/* don't call lsetxattr without CAP_SYS_ADMIN */
-+		cap_header->pid = getpid();
-+		cap_header->version = _LINUX_CAPABILITY_VERSION_1;
-+		if (capget(cap_header, cap_data) < 0) {
-+			ret = -ENOENT;
-+			goto out;
-+		}
-+		if (!(cap_data->effective & CAP_TO_MASK(CAP_SYS_ADMIN))) {
-+			ret = -EPERM;
-+			goto out;
-+		}
-+
-+		if (!digest_list_signed) {
- 			/* Write RPM header sig to security.ima */
- 			ret = write_rpm_digest_list_ima_xattr(te, path);
- 		} else {
--- 
-2.27.0
-

_service:extract_file:get-in-use-of-ndb.patch Deleted

@@ -1,42 +0,0 @@
-From 8ba0780a26429bbb474e23112627ebbaeb9abfee Mon Sep 17 00:00:00 2001
-From: renmingshuai <renmingshuai@huawei.com>
-Date: Mon, 29 Nov 2021 10:53:24 +0800
-Subject: PATCH get in use of ndb
-
----
- configure.ac | 4 ++--
- macros.in    | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 6b161dc..ab1c667 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -490,9 +490,9 @@ AM_CONDITIONAL(BDB_RO, test "$enable_bdb_ro" = yes)
- # Check for SQLITE support
- AC_ARG_ENABLE(sqlite,
-               AS_HELP_STRING(--enable-sqlite=@<:@yes/no/auto@:>@),
--                              build with sqlite rpm database format support (default=yes)),
-+                              build with sqlite rpm database format support (default=auto)),
-               enable_sqlite="$enableval",
--              enable_sqlite=yes)
-+              enable_sqlite=auto)
- 
- AS_IF(test "x$enable_sqlite" != "xno", 
-   PKG_CHECK_MODULES(SQLITE, sqlite3 >= 3.22.0, have_sqlite=yes, have_sqlite=no)
-diff --git a/macros.in b/macros.in
-index 22f675c..3e81918 100644
---- a/macros.in
-+++ b/macros.in
-@@ -602,7 +602,7 @@ package or when debugging this package.\
- # sqlite Sqlite database
- # dummy dummy backend (no actual functionality)
- #
--%_db_backend	      sqlite
-+%_db_backend	      ndb
- 
- #==============================================================================
- # ---- GPG/PGP/PGP5 signature macros.
--- 
-1.8.3.1
-

_service:extract_file:revert-always-execute-file-trigger-scriptlet-callbac.patch Deleted

_service:extract_file:rpm-4.12.0-rpm2cpio-hack.patch Deleted

_service:extract_file:still-in-use-of-python-scripts-from-old-version.patch Deleted

@@ -1,210 +0,0 @@
-From 4ec83c32024a8faf0a66a4275acbcd15751ee303 Mon Sep 17 00:00:00 2001
-From: renhongxun <renhongxun@huawei.com>
-Date: Wed, 29 Dec 2021 16:37:45 +0800
-Subject: PATCH still in use of python scripts from old version
-
----
- platform.in                    |   3 ++
- scripts/Makefile.am            |   8 +--
- scripts/brp-python-bytecompile | 112 +++++++++++++++++++++++++++++++++++++++++
- scripts/brp-python-hardlink    |  25 +++++++++
- 4 files changed, 144 insertions(+), 4 deletions(-)
- create mode 100644 scripts/brp-python-bytecompile
- create mode 100755 scripts/brp-python-hardlink
-
-diff --git a/platform.in b/platform.in
-index 71496b8..748186e 100644
---- a/platform.in
-+++ b/platform.in
-@@ -82,10 +82,13 @@
- #
- 
- %__arch_install_post   @ARCH_INSTALL_POST@
-+%_python_bytecompile_errors_terminate_build 0
-+%_python_bytecompile_extra   1
- 
- # Standard brp-macro naming:
- # convert all '-' in basename to '_', add two leading underscores.
- %__brp_compress %{_rpmconfigdir}/brp-compress %{?_prefix}
-+%__brp_python_bytecompile %{_rpmconfigdir}/brp-python-bytecompile "" "%{?_python_bytecompile_errors_terminate_build}" "%{?_python_bytecompile_extra}"
- %__brp_strip %{_rpmconfigdir}/brp-strip %{__strip}
- %__brp_strip_comment_note %{_rpmconfigdir}/brp-strip-comment-note %{__strip} %{__objdump}
- %__brp_strip_static_archive %{_rpmconfigdir}/brp-strip-static-archive %{__strip}
-diff --git a/scripts/Makefile.am b/scripts/Makefile.am
-index 4aed76b..5a1c494 100644
---- a/scripts/Makefile.am
-+++ b/scripts/Makefile.am
-@@ -6,8 +6,8 @@ AM_CFLAGS = @RPMCFLAGS@
- CLEANFILES =
- 
- EXTRA_DIST = \
--	brp-compress \
--	brp-strip brp-strip-comment-note \
-+        brp-compress brp-python-bytecompile \
-+        brp-strip brp-strip-comment-note brp-python-hardlink \
- 	brp-strip-static-archive brp-elfperms \
- 	brp-remove-la-files \
- 	check-files check-prereqs \
-@@ -23,8 +23,8 @@ EXTRA_DIST = \
- 	fontconfig.prov script.req
- 
- rpmconfig_SCRIPTS = \
--	brp-compress \
--	brp-strip brp-strip-comment-note \
-+        brp-compress brp-python-bytecompile \
-+        brp-strip brp-strip-comment-note brp-python-hardlink \
- 	brp-strip-static-archive brp-elfperms \
- 	brp-remove-la-files \
- 	check-files check-prereqs \
-diff --git a/scripts/brp-python-bytecompile b/scripts/brp-python-bytecompile
-new file mode 100644
-index 0000000..d9c4832
---- /dev/null
-+++ b/scripts/brp-python-bytecompile
-@@ -0,0 +1,112 @@
-+#!/bin/bash
-+errors_terminate=$2
-+extra=$3
-+
-+# If using normal root, avoid changing anything.
-+if  -z "$RPM_BUILD_ROOT"  ||  "$RPM_BUILD_ROOT" = "/" ; then
-+	exit 0
-+fi
-+
-+# Figure out how deep we need to descend.  We could pick an insanely high
-+# number and hope it's enough, but somewhere, somebody's sure to run into it.
-+depth=`(find "$RPM_BUILD_ROOT" -type f -name "*.py" -print0 ; echo /) | \
-+       xargs -0 -n 1 dirname | sed 's,^/,,g' | sort -u | tail -n 1 | wc -c`
-+if  -z "$depth"  ||  "$depth" -le "1" ; then
-+	exit 0
-+fi
-+
-+function python_bytecompile()
-+{
-+    local options=$1
-+    local python_binary=$2
-+    local exclude=$3
-+    local python_libdir=$4
-+    local depth=$5
-+    local real_libdir=$6
-+
-+cat << EOF | $python_binary $options
-+import compileall, sys, os, re
-+
-+python_libdir = "$python_libdir"
-+depth = $depth
-+real_libdir = "$real_libdir"
-+build_root = "$RPM_BUILD_ROOT"
-+exclude = r"$exclude"
-+
-+class Filter:
-+    def search(self, path):
-+        ret = not os.path.realpath(path).startswith(build_root)
-+        if exclude:
-+            ret = ret or re.search(exclude, path)
-+        return ret
-+
-+sys.exit(not compileall.compile_dir(python_libdir, depth, real_libdir, force=1, rx=Filter(), quiet=1))
-+EOF
-+}
-+
-+# .pyc/.pyo files embed a "magic" value, identifying the ABI version of Python
-+# bytecode that they are for.
-+#
-+# The files below RPM_BUILD_ROOT could be targeting multiple versions of
-+# python (e.g. a single build that emits several subpackages e.g. a
-+# python26-foo subpackage, a python31-foo subpackage etc)
-+#
-+# Support this by assuming that below each /usr/lib/python$VERSION/, all
-+# .pyc/.pyo files are to be compiled for /usr/bin/python$VERSION.
-+# 
-+# For example, below /usr/lib/python2.6/, we're targeting /usr/bin/python2.6
-+# and below /usr/lib/python3.1/, we're targeting /usr/bin/python3.1
-+
-+shopt -s nullglob
-+for python_libdir in `find "$RPM_BUILD_ROOT" -type d|grep -E "/usr/lib(64)?/python0-9\.(0-9$|0-9{2}$)"`;
-+do
-+	python_binary=/usr/bin/$(basename $python_libdir)
-+	real_libdir=${python_libdir/$RPM_BUILD_ROOT/}
-+	echo "Bytecompiling .py files below $python_libdir using $python_binary"
-+
-+	# Generate normal (.pyc) byte-compiled files.
-+	python_bytecompile "" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
-+	if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
-+		# One or more of the files had a syntax error
-+		exit 1
-+	fi
-+
-+	# Generate optimized (.pyo) byte-compiled files.
-+	python_bytecompile "-O" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
-+	if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
-+		# One or more of the files had a syntax error
-+		exit 1
-+	fi
-+done
-+
-+
-+# Handle other locations in the filesystem using the default python implementation
-+# if extra is set to 0, don't do this
-+if  0$extra -eq 0 ; then
-+	exit 0
-+fi
-+
-+# If we don't have a default python interpreter, we cannot proceed
-+default_python=${1:-/usr/bin/python}
-+if  ! -x "$default_python" ; then
-+	exit 0
-+fi
-+
-+# Figure out if there are files to be bytecompiled with the default_python at all
-+# this prevents unnecessary default_python invocation
-+find "$RPM_BUILD_ROOT" -type f -name "*.py" | grep -Ev "/bin/|/sbin/|/usr/lib(64)?/python0-9\.0-9|/usr/share/doc" || exit 0
-+
-+# Generate normal (.pyc) byte-compiled files.
-+python_bytecompile "" $default_python "/bin/|/sbin/|/usr/lib(64)?/python0-9\.0-9|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
-+if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
-+	# One or more of the files had a syntax error
-+	exit 1
-+fi
-+
-+# Generate optimized (.pyo) byte-compiled files.
-+python_bytecompile "-O" $default_python "/bin/|/sbin/|/usr/lib(64)?/python0-9\.0-9|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
-+if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
-+	# One or more of the files had a syntax error
-+	exit 1
-+fi
-+exit 0
-diff --git a/scripts/brp-python-hardlink b/scripts/brp-python-hardlink
-new file mode 100755
-index 0000000..5fd1b43
---- /dev/null
-+++ b/scripts/brp-python-hardlink
-@@ -0,0 +1,25 @@
-+#!/bin/sh
-+
-+# If using normal root, avoid changing anything.
-+if  -z "$RPM_BUILD_ROOT"  ||  "$RPM_BUILD_ROOT" = "/" ; then
-+	exit 0
-+fi
-+
-+hardlink_if_same() {
-+	if cmp -s "$1" "$2" ; then
-+		ln -f "$1" "$2"
-+		return 0
-+	fi
-+	return 1
-+}
-+
-+# Hardlink identical *.pyc, *.pyo, and *.opt-12.pyc.
-+# Originally from PLD's rpm-build-macros

_service:tar_scm:Add-digest-list-plugin.patch Added

@@ -0,0 +1,586 @@
+From e49074a4e4bd0699d2c4a5bb3a0dc5ca45e19e12 Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Wed, 26 Feb 2020 15:54:24 +0100
+Subject: PATCH 2/3 Add digest list plugin
+
+---
+ macros.in             |   1 +
+ plugins/Makefile.am   |   4 +
+ plugins/digest_list.c | 498 ++++++++++++++++++++++++++++++++++++++++++
+ rpmio/digest.h        |   1 +
+ rpmio/rpmpgp.c        |   3 +
+ 5 files changed, 507 insertions(+)
+ create mode 100644 plugins/digest_list.c
+
+diff --git a/macros.in b/macros.in
+index 402749362..8619c1323 100644
+--- a/macros.in
++++ b/macros.in
+@@ -1184,6 +1184,7 @@ package or when debugging this package.\
+ %__transaction_prioreset	%{__plugindir}/prioreset.so
+ %__transaction_audit		%{__plugindir}/audit.so
+ %__transaction_dbus_announce	%{__plugindir}/dbus_announce.so
++%__transaction_digest_list	%{__plugindir}/digest_list.so
+ 
+ #------------------------------------------------------------------------------
+ # Macros for further automated spec %setup and patch application
+diff --git a/plugins/Makefile.am b/plugins/Makefile.am
+index d4ef039ed..07aa3585b 100644
+--- a/plugins/Makefile.am
++++ b/plugins/Makefile.am
+@@ -48,3 +48,7 @@ audit_la_sources = audit.c
+ audit_la_LIBADD = $(top_builddir)/lib/librpm.la $(top_builddir)/rpmio/librpmio.la @WITH_AUDIT_LIB@
+ plugins_LTLIBRARIES += audit.la
+ endif
++
++digest_list_la_sources = digest_list.c
++digest_list_la_LIBADD = $(top_builddir)/lib/librpm.la $(top_builddir)/rpmio/librpmio.la
++plugins_LTLIBRARIES += digest_list.la
+diff --git a/plugins/digest_list.c b/plugins/digest_list.c
+new file mode 100644
+index 000000000..beb397309
+--- /dev/null
++++ b/plugins/digest_list.c
+@@ -0,0 +1,499 @@
++#include "system.h"
++#include "errno.h"
++
++#include <fcntl.h>
++#include <rpm/rpmlog.h>
++#include <rpm/rpmts.h>
++#include <rpm/header.h>
++#include <rpmio/digest.h>
++#include <rpmio/rpmpgp.h>
++#include <rpm/rpmfileutil.h>
++#include "lib/rpmplugin.h"
++#include <netinet/in.h>
++#include <sys/stat.h>
++#include <openssl/sha.h>
++#include <sys/xattr.h>
++#include <linux/xattr.h>
++#include <asm/byteorder.h>
++#include <sys/wait.h>
++
++#include "debug.h"
++
++#define IMA_DIR "/sys/kernel/security/ima"
++#define DIGEST_LIST_DATA_PATH IMA_DIR "/digest_list_data"
++#define DIGEST_LIST_DATA_DEL_PATH IMA_DIR "/digest_list_data_del"
++#define DIGEST_LIST_COUNT IMA_DIR "/digests_count"
++#define DIGEST_LIST_DEFAULT_PATH "/etc/ima/digest_lists"
++#define RPM_PARSER "/usr/libexec/rpm_parser"
++
++#define DIGEST_LIST_OP_ADD 0
++#define DIGEST_LIST_OP_DEL 1
++
++enum hash_algo {
++	HASH_ALGO_MD4,
++	HASH_ALGO_MD5,
++	HASH_ALGO_SHA1,
++	HASH_ALGO_RIPE_MD_160,
++	HASH_ALGO_SHA256,
++	HASH_ALGO_SHA384,
++	HASH_ALGO_SHA512,
++	HASH_ALGO_SHA224,
++	HASH_ALGO_RIPE_MD_128,
++	HASH_ALGO_RIPE_MD_256,
++	HASH_ALGO_RIPE_MD_320,
++	HASH_ALGO_WP_256,
++	HASH_ALGO_WP_384,
++	HASH_ALGO_WP_512,
++	HASH_ALGO_TGR_128,
++	HASH_ALGO_TGR_160,
++	HASH_ALGO_TGR_192,
++	HASH_ALGO_SM3_256,
++	HASH_ALGO__LAST
++};
++
++#define PGPHASHALGO__LAST PGPHASHALGO_SHA224 + 1
++enum hash_algo pgp_algo_mappingPGPHASHALGO__LAST = {
++	PGPHASHALGO_MD5 = HASH_ALGO_MD5,
++	PGPHASHALGO_SHA1 = HASH_ALGO_SHA1,
++	PGPHASHALGO_SHA224 = HASH_ALGO_SHA224,
++	PGPHASHALGO_SHA256 = HASH_ALGO_SHA256,
++	PGPHASHALGO_SHA384 = HASH_ALGO_SHA384,
++	PGPHASHALGO_SHA512 = HASH_ALGO_SHA512,
++};
++
++/* from integrity.h */
++enum evm_ima_xattr_type {
++	IMA_XATTR_DIGEST = 0x01,
++	EVM_XATTR_HMAC,
++	EVM_IMA_XATTR_DIGSIG,
++	IMA_XATTR_DIGEST_NG,
++	EVM_XATTR_PORTABLE_DIGSIG,
++	EVM_IMA_XATTR_DIGEST_LIST,
++	IMA_XATTR_LAST
++};
++
++struct evm_ima_xattr_data {
++	uint8_t type;
++	uint8_t digestSHA512_DIGEST_LENGTH + 1;
++} __attribute__((packed));
++
++struct signature_v2_hdr {
++	uint8_t type;		/* xattr type */
++	uint8_t version;	/* signature format version */
++	uint8_t hash_algo;	/* Digest algorithm enum hash_algo */
++	__be32 keyid;		/* IMA key identifier - not X509/PGP specific */
++	__be16 sig_size;	/* signature size */
++	uint8_t sig0;		/* signature payload */
++} __attribute__((packed));
++
++static int upload_digest_list(char *path, int type, int digest_list_signed)
++{
++	size_t size;
++	char buf21;
++	const char *ima_path = DIGEST_LIST_DATA_PATH;
++	struct stat st;
++	pid_t pid;
++	int ret = 0, fd;
++
++	if (type == TR_REMOVED)
++		ima_path = DIGEST_LIST_DATA_DEL_PATH;
++
++	if (stat(ima_path, &st) == -1)
++		return 0;
++
++	/* First determine if kernel interface can accept new digest lists */
++	fd = open(DIGEST_LIST_COUNT, O_RDONLY);
++	if (fd < 0) {
++		rpmlog(RPMLOG_ERR, "digest_list: could not open IMA interface "
++		       "'%s': %s\n", DIGEST_LIST_COUNT, strerror(errno));
++		return -EACCES;
++	}
++
++	ret = read(fd, buf, sizeof(buf));
++	close(fd);
++
++	if (ret <= 0) {
++		rpmlog(RPMLOG_ERR, "digest_list: could not read from IMA "
++		       "interface '%s': %s\n", DIGEST_LIST_COUNT,
++		       strerror(errno));
++		return -EACCES;
++	}
++
++	/* Last character is newline */
++	bufret - 1 = '\0';
++
++	rpmlog(RPMLOG_DEBUG, "digest_list: digests count %s\n", buf);
++
++	if (*buf == '0') {
++		rpmlog(RPMLOG_DEBUG, "digest_list: not uploading '%s' to IMA "
++		       "interface '%s'\n", path, ima_path);
++		return RPMRC_OK;
++	}
++
++	/* If the digest list is not signed, execute the RPM parser */
++	if (!digest_list_signed) {
++		if ((pid = fork()) == 0) {
++			execlp(RPM_PARSER, RPM_PARSER, (type == TR_ADDED) ?
++			       "add" : "del", path, NULL);
++			_exit(EXIT_FAILURE);
++		}
++
++		waitpid(pid, &ret, 0);
++		if (ret != 0)
++			rpmlog(RPMLOG_ERR, "digest_list: %s returned %d\n",
++			       RPM_PARSER, ret);
++		return 0;
++	}
++
++	fd = open(ima_path, O_WRONLY);
++	if (fd < 0) {
++		rpmlog(RPMLOG_ERR, "digest_list: could not open IMA interface "
++		       "'%s': %s\n", ima_path, strerror(errno));
++		return -EACCES;
++	}
++
++	/* Write the path of the digest list to securityfs */

_service:tar_scm:Add-license-to-digest_list.c.patch Added

_service:tar_scm:Add-loongarch-architecture-support.patch Added

@@ -0,0 +1,99 @@
+From 3100da59abd272fc3f301a30ebabedf86b0b4a00 Mon Sep 17 00:00:00 2001
+From: Sun Haiyong <sunhaiyong@loongson.cn>
+Date: Tue, 21 Dec 2021 20:40:27 +0800
+Subject: PATCH Add loongarch architecture support.
+
+---
+ installplatform | 12 ++++++++++++
+ rpmrc.in        | 17 +++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+diff --git a/installplatform b/installplatform
+index 12339fc..74c50a2 100755
+--- a/installplatform
++++ b/installplatform
+@@ -168,6 +168,18 @@ for ARCH in noarch `grep ^arch_canon $RPMRC | cut -d: -f2`; do
+ 	CANONARCH=mips64r6el
+ 	CANONCOLOR=3
+ 	;;
++    loongarch32)
++	ISANAME=loongarch
++	ISABITS=32
++	CANONARCH=loongarch32
++	CANONCOLOR=0
++	;;
++    loongarch64)
++	ISANAME=loongarch
++	ISABITS=64
++	CANONARCH=loongarch64
++	CANONCOLOR=3
++	;;
+     m68k)
+ 	ISANAME=m68k
+ 	ISABITS=32
+diff --git a/rpmrc.in b/rpmrc.in
+index 5bd9ba3..fc2932a 100644
+--- a/rpmrc.in
++++ b/rpmrc.in
+@@ -67,6 +67,8 @@ optflags: mipsr6el -O2 -g
+ optflags: mips64r6 -O2 -g
+ optflags: mips64r6el -O2 -g
+ 
++optflags: loongarch64 -O2 -g
++
+ optflags: armv3l -O2 -g -march=armv3
+ optflags: armv4b -O2 -g -march=armv4
+ optflags: armv4l -O2 -g -march=armv4
+@@ -137,6 +139,9 @@ archcolor: mipsr6el 1
+ archcolor: mips64r6 2
+ archcolor: mips64r6el 2
+ 
++archcolor: loongarch32 1
++archcolor: loongarch64 2
++
+ archcolor: m68k 1
+ 
+ archcolor: m68kmint 1
+@@ -257,6 +262,9 @@ arch_canon:	mips64r6el: mips64r6el	21
+ arch_canon:	riscv: riscv64	22
+ arch_canon:	riscv64: riscv64	22
+ 
++arch_canon:	loongarch32:	loongarch32	25
++arch_canon:	loongarch64:	loongarch64	26
++
+ #############################################################
+ # Canonical OS names and numbers
+ 
+@@ -360,6 +368,9 @@ buildarchtranslate: mipsr6el: mipsr6el
+ buildarchtranslate: mips64r6: mips64r6
+ buildarchtranslate: mips64r6el: mips64r6el
+ 
++buildarchtranslate: loongarch32: loongarch32
++buildarchtranslate: loongarch64: loongarch64
++
+ buildarchtranslate: m68k: m68k
+ 
+ buildarchtranslate: atarist: m68kmint
+@@ -449,6 +460,9 @@ arch_compat: mipsr6el: noarch
+ arch_compat: mips64r6: mipsr6
+ arch_compat: mips64r6el: mipsr6el
+ 
++arch_compat: loongarch32: noarch
++arch_compat: loongarch64: loongarch32
++
+ arch_compat: hppa2.0: hppa1.2
+ arch_compat: hppa1.2: hppa1.1
+ arch_compat: hppa1.1: hppa1.0
+@@ -586,6 +600,9 @@ buildarch_compat: mipsr6el: noarch
+ buildarch_compat: mips64r6: noarch
+ buildarch_compat: mips64r6el: noarch
+ 
++buildarch_compat: loongarch32: noarch
++buildarch_compat: loongarch64: noarch
++
+ buildarch_compat: armv4b: noarch
+ buildarch_compat: armv8l: armv7l
+ buildarch_compat: armv7l: armv6l
+-- 
+2.30.0
+

_service:tar_scm:Avoid-generating-digest-lists-if-they-are-already-pa.patch Added

@@ -0,0 +1,50 @@
+From d0b01bb4366ca467bfd1386820fe17ae58aa3c8c Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Wed, 17 Mar 2021 17:25:46 +0100
+Subject: PATCH Avoid generating digest lists if they are already packaged
+
+---
+ build/files.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/build/files.c b/build/files.c
+index d5c83a094..a30828e1c 100644
+--- a/build/files.c
++++ b/build/files.c
+@@ -51,6 +51,7 @@
+ #define DEBUG_ID_DIR		"/usr/lib/debug/.build-id"
+ #define DEBUG_DWZ_DIR 		"/usr/lib/debug/.dwz"
+ #define DIGEST_LIST_DIR		"/.digest_lists"
++#define DEST_DIGEST_LIST_DIR	"/etc/ima/digest_lists"
+ 
+ #undef HASHTYPE
+ #undef HTKEYTYPE
+@@ -993,7 +994,7 @@ static void genDigestListInput(FileList fl, Package pkg, int isSrc)
+     char bufBUFSIZ;
+     char file_infoBUFSIZ;
+     char file_digest128 * 2 + 1;
+-    int i;
++    int i, gen_digest_lists = 1;
+     uint32_t defaultalgo = PGPHASHALGO_MD5, digestalgo;
+     Header h = pkg->header; /* just a shortcut */
+ 
+@@ -1100,9 +1101,15 @@ static void genDigestListInput(FileList fl, Package pkg, int isSrc)
+ 		strlen(flp->caps) ? flp->caps : "");
+ 	    appendStringBuf(check_fileList_bin_pkg, file_info);
+ 	}
++
++	if (S_ISREG(flp->fl_mode) &&
++	    !strncmp(flp->cpioPath, DEST_DIGEST_LIST_DIR,
++		     sizeof(DEST_DIGEST_LIST_DIR) - 1))
++		gen_digest_lists = 0;
+     }
+ 
+-    if (genDigestList(pkg->header, fl, check_fileList_bin_pkg) > 0)
++    if (gen_digest_lists &&
++		genDigestList(pkg->header, fl, check_fileList_bin_pkg) > 0)
+ 	fl->processingFailed = 1;
+ }
+ 
+-- 
+2.26.2
+

_service:tar_scm:Check-rpm-parser.patch Added

_service:tar_scm:Don-t-add-dist-to-release-if-it-is-already-there.patch Added

_service:tar_scm:Fix-digest_list_counter.patch Added

@@ -0,0 +1,81 @@
+From 8ecd5fc6884ae165e38e16b900cc4da90665b9db Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Wed, 10 Mar 2021 12:22:39 +0100
+Subject: PATCH 1/5 Fix digest_list_counter
+
+---
+ plugins/digest_list.c | 38 +++++++++++++++++++++++---------------
+ 1 file changed, 23 insertions(+), 15 deletions(-)
+
+diff --git a/plugins/digest_list.c b/plugins/digest_list.c
+index 2dfa21e35..bb778c57f 100644
+--- a/plugins/digest_list.c
++++ b/plugins/digest_list.c
+@@ -477,8 +477,8 @@ int digest_list_counter;
+ static rpmRC digest_list_psm_pre(rpmPlugin plugin, rpmte te)
+ {
+ 	Header rpm = rpmteHeader(te);
+-	rpmtd dirnames;
+-	int i;
++	rpmtd dirnames, dirindexes;
++	int i = -1;
+ 
+ 	digest_list_counter = 0;
+ 
+@@ -487,13 +487,26 @@ static rpmRC digest_list_psm_pre(rpmPlugin plugin, rpmte te)
+ 
+ 	while ((i = rpmtdNext(dirnames)) >= 0) {
+ 		char *dirname = (char *) rpmtdGetString(dirnames);
++
+ 		if (!strncmp(dirname, DIGEST_LIST_DEFAULT_PATH,
+-			     sizeof(DIGEST_LIST_DEFAULT_PATH) - 1))
+-			digest_list_counter++;
++			     sizeof(DIGEST_LIST_DEFAULT_PATH) - 1) &&
++		    dirnamesizeof(DIGEST_LIST_DEFAULT_PATH) - 1 == '/')
++			break;
+ 	}
+ 
+ 	rpmtdFree(dirnames);
+ 
++	if (i == -1)
++		return RPMRC_OK;
++
++	dirindexes = rpmtdNew();
++	headerGet(rpm, RPMTAG_DIRINDEXES, dirindexes, 0);
++	while (rpmtdNext(dirindexes) >= 0)
++		if (rpmtdGetNumber(dirindexes) == i)
++			digest_list_counter++;
++
++	rpmtdFree(dirindexes);
++
+ 	cur_te = te;
+ 	return RPMRC_OK;
+ }
+@@ -517,18 +530,13 @@ static rpmRC digest_list_file_common(rpmPlugin plugin, rpmfi fi,
+ 	    (!pre && action != FA_CREATE))
+ 		return RPMRC_OK;
+ 
+-	if (digest_list_counter) {
+-		if (!pre) {
+-			if (!strncmp(path, DIGEST_LIST_DEFAULT_PATH,
+-				     sizeof(DIGEST_LIST_DEFAULT_PATH) - 1))
+-				digest_list_counter--;
+-		} else {
+-			digest_list_counter = 0;
+-		}
++	if (strncmp(path, DIGEST_LIST_DEFAULT_PATH,
++		    sizeof(DIGEST_LIST_DEFAULT_PATH) - 1) ||
++	    pathsizeof(DIGEST_LIST_DEFAULT_PATH) - 1 != '/')
++		return RPMRC_OK;
+ 
+-		if (digest_list_counter)
+-			return RPMRC_OK;
+-	}
++	if (!pre && --digest_list_counter)
++		return RPMRC_OK;
+ 
+ 	process_digest_list(cur_te, 0);
+ 	if (!strcmp(rpmteN(cur_te), "digest-list-tools"))
+-- 
+2.26.2
+

_service:tar_scm:Generate-digest-lists-before-calling-genCpioListAndH.patch Added

@@ -0,0 +1,255 @@
+From 2b0cab0ed63e77582b047f723b69a0e3dd647566 Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Wed, 12 Aug 2020 18:23:42 +0200
+Subject: PATCH Generate digest lists before calling genCpioListAndHeader()
+
+Signed-off-by: luhuaxin <luhuaxin1@huawei.com>
+---
+ build/files.c | 182 ++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 147 insertions(+), 35 deletions(-)
+
+diff --git a/build/files.c b/build/files.c
+index d1e56c0..5358ead 100644
+--- a/build/files.c
++++ b/build/files.c
+@@ -1000,20 +1000,149 @@ static int seenHardLink(FileRecords files, FileListRec flp, rpm_ino_t *fileid)
+  * @param pkg		(sub) package
+  * @param isSrc		pass 1 for source packages 0 otherwise
+  */
+-static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
++static void genDigestListInput(FileList fl, Package pkg, int isSrc)
+ {
+     FileListRec flp;
+     char bufBUFSIZ;
+     char file_infoBUFSIZ;
+     char file_digest128 * 2 + 1;
++    int i;
++    uint32_t defaultalgo = PGPHASHALGO_MD5, digestalgo;
++    Header h = pkg->header; /* just a shortcut */
++
++    /*
++     * See if non-md5 file digest algorithm is requested. If not
++     * specified, quietly assume md5. Otherwise check if supported type.
++     */
++    digestalgo = rpmExpandNumeric(isSrc ? "%{_source_filedigest_algorithm}" :
++					  "%{_binary_filedigest_algorithm}");
++    if (digestalgo == 0) {
++	digestalgo = defaultalgo;
++    }
++
++    if (rpmDigestLength(digestalgo) == 0) {
++	rpmlog(RPMLOG_WARNING,
++	       _("Unknown file digest algorithm %u, falling back to MD5\n"),
++	       digestalgo);
++	digestalgo = defaultalgo;
++    }
++
++    /* Sort the big list */
++    if (fl->files.recs) {
++	qsort(fl->files.recs, fl->files.used,
++	      sizeof(*(fl->files.recs)), compareFileListRecs);
++    }
++
++    /* Generate the header. */
++    for (i = 0, flp = fl->files.recs; i < fl->files.used; i++, flp++) {
++	/* Merge duplicate entries. */
++	while (i < (fl->files.used - 1) &&
++	    rstreq(flp->cpioPath, flp1.cpioPath)) {
++
++	    /* Two entries for the same file found, merge the entries. */
++	    /* Note that an %exclude is a duplication of a file reference */
++
++	    /* file flags */
++	    flp1.flags |= flp->flags;
++
++	    if (!(flp1.flags & RPMFILE_EXCLUDE))
++		rpmlog(RPMLOG_WARNING, _("File listed twice: %s\n"),
++			flp->cpioPath);
++
++	    /* file mode */
++	    if (S_ISDIR(flp->fl_mode)) {
++		if ((flp1.specdFlags & (SPECD_DIRMODE | SPECD_DEFDIRMODE)) <
++		    (flp->specdFlags & (SPECD_DIRMODE | SPECD_DEFDIRMODE)))
++			flp1.fl_mode = flp->fl_mode;
++	    } else {
++		if ((flp1.specdFlags & (SPECD_FILEMODE | SPECD_DEFFILEMODE)) <
++		    (flp->specdFlags & (SPECD_FILEMODE | SPECD_DEFFILEMODE)))
++			flp1.fl_mode = flp->fl_mode;
++	    }
++
++	    /* uid */
++	    if ((flp1.specdFlags & (SPECD_UID | SPECD_DEFUID)) <
++		(flp->specdFlags & (SPECD_UID | SPECD_DEFUID)))
++	    {
++		flp1.fl_uid = flp->fl_uid;
++		flp1.uname = flp->uname;
++	    }
++
++	    /* gid */
++	    if ((flp1.specdFlags & (SPECD_GID | SPECD_DEFGID)) <
++		(flp->specdFlags & (SPECD_GID | SPECD_DEFGID)))
++	    {
++		flp1.fl_gid = flp->fl_gid;
++		flp1.gname = flp->gname;
++	    }
++
++	    /* verify flags */
++	    if ((flp1.specdFlags & (SPECD_VERIFY | SPECD_DEFVERIFY)) <
++		(flp->specdFlags & (SPECD_VERIFY | SPECD_DEFVERIFY)))
++		    flp1.verifyFlags = flp->verifyFlags;
++
++	    /* XXX to-do: language */
++
++	    flp++; i++;
++	}
++
++	/* Skip files that were marked with %exclude. */
++	if (flp->flags & RPMFILE_EXCLUDE)
++	{
++	    argvAdd(&pkg->fileExcludeList, flp->cpioPath);
++	    continue;
++	}
++
++	buf0 = '\0';
++	if (S_ISREG(flp->fl_mode) && !(flp->flags & RPMFILE_GHOST))
++	    (void) rpmDoDigest(digestalgo, flp->diskPath, 1,
++			       (unsigned char *)buf);
++	headerPutString(h, RPMTAG_FILEDIGESTS, buf);
++	snprintf(file_digest, sizeof(file_digest), "%s", buf);
++
++	if (check_fileList_bin_pkg && S_ISREG(flp->fl_mode) &&
++		!(flp->flags & RPMFILE_GHOST)) {
++	    appendStringBuf(check_fileList_bin_pkg, "path=");
++	    appendStringBuf(check_fileList_bin_pkg, flp->diskPath);
++	    snprintf(file_info, sizeof(file_info),
++		"|digestalgopgp=%d|digest=%s|mode=%d"
++		"|uname=%s|gname=%s|caps=%s\n",
++		digestalgo, file_digest, flp->fl_mode,
++		rpmstrPoolStr(fl->pool, flp->uname),
++		rpmstrPoolStr(fl->pool, flp->gname), flp->caps &&
++		strlen(flp->caps) ? flp->caps : "");
++	    appendStringBuf(check_fileList_bin_pkg, file_info);
++	}
++    }
++
++    if (genDigestList(pkg->header, fl, check_fileList_bin_pkg) > 0)
++	fl->processingFailed = 1;
++}
++
++/**
++ * Add file entries to header.
++ * @todo Should directories have %doc/%config attributes? (#14531)
++ * @todo Remove RPMTAG_OLDFILENAMES, add dirname/basename instead.
++ * @param fl		package file tree walk data
++ * @param pkg		(sub) package
++ * @param isSrc		pass 1 for source packages 0 otherwise
++ */
++static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
++{
++    FileListRec flp;
++    char bufBUFSIZ;
+     int i, npaths = 0;
+     int fail_on_dupes = rpmExpandNumeric("%{?_duplicate_files_terminate_build}") > 0;
+     uint32_t defaultalgo = PGPHASHALGO_MD5, digestalgo;
+     rpm_loff_t totalFileSize = 0;
+     Header h = pkg->header; /* just a shortcut */
+-    int processed = 0;
+     time_t source_date_epoch = 0;
+     char *srcdate = getenv("SOURCE_DATE_EPOCH");
++    struct rpmtd_s oldfiledigests;
++
++    headerGet(h, RPMTAG_FILEDIGESTS, &oldfiledigests, HEADERGET_ALLOC);
++    headerDel(h, RPMTAG_FILEDIGESTS);
++    rpmtdInit(&oldfiledigests);
+ 
+     /* Limit the maximum date to SOURCE_DATE_EPOCH if defined
+      * similar to the tar --clamp-mtime option
+@@ -1080,9 +1209,8 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
+     
+     pkg->dpaths = xmalloc((fl->files.used + 1) * sizeof(*pkg->dpaths));
+ 
+-process_files:
+     /* Generate the header. */
+-    for (i = processed, flp = fl->files.recs + processed; i < fl->files.used; i++, flp++) {
++    for (i = 0, flp = fl->files.recs; i < fl->files.used; i++, flp++) {
+ 	rpm_ino_t fileid = flp - fl->files.recs;
+ 
+  	/* Merge duplicate entries. */
+@@ -1212,13 +1340,17 @@ process_files:
+ 	if (fl->haveCaps) {
+ 	    headerPutString(h, RPMTAG_FILECAPS, flp->caps);
+ 	}
+-	
++
+ 	buf0 = '\0';
+-	if (S_ISREG(flp->fl_mode) && !(flp->flags & RPMFILE_GHOST))
+-	    (void) rpmDoDigest(digestalgo, flp->diskPath, 1, 
+-			       (unsigned char *)buf);
+-	headerPutString(h, RPMTAG_FILEDIGESTS, buf);
+-	snprintf(file_digest, sizeof(file_digest), "%s", buf);
++	if (strstr(flp->diskPath, DIGEST_LIST_DIR) || !oldfiledigests.count) {
++	    if (S_ISREG(flp->fl_mode) && !(flp->flags & RPMFILE_GHOST))
++	        (void) rpmDoDigest(digestalgo, flp->diskPath, 1,
++				   (unsigned char *)buf);
++	    headerPutString(h, RPMTAG_FILEDIGESTS, buf);
++	} else {
++	    headerPutString(h, RPMTAG_FILEDIGESTS,
++			    rpmtdNextString(&oldfiledigests));
++	}
+

_service:tar_scm:Generate-digest-lists.patch Added

@@ -0,0 +1,323 @@
+From 4d1801825c754171962050ee9c36c2d69c630ece Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Thu, 12 Mar 2020 17:29:55 +0100
+Subject: PATCH 1/3 Generate digest lists
+
+---
+ build/files.c | 176 ++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 169 insertions(+), 7 deletions(-)
+
+diff --git a/build/files.c b/build/files.c
+index 6dfd801c8..ab6938d8c 100644
+--- a/build/files.c
++++ b/build/files.c
+@@ -50,6 +50,7 @@
+ #define DEBUG_LIB_PREFIX	"/usr/lib/debug/"
+ #define DEBUG_ID_DIR		"/usr/lib/debug/.build-id"
+ #define DEBUG_DWZ_DIR 		"/usr/lib/debug/.dwz"
++#define DIGEST_LIST_DIR		"/.digest_lists"
+ 
+ #undef HASHTYPE
+ #undef HTKEYTYPE
+@@ -129,6 +130,8 @@ typedef struct AttrRec_s {
+ 
+ /* list of files */
+ static StringBuf check_fileList = NULL;
++/* list of files per binary package */
++static StringBuf check_fileList_bin_pkg = NULL;
+ 
+ typedef struct FileEntry_s {
+     rpmfileAttrs attrFlags;
+@@ -193,6 +196,10 @@ typedef struct FileList_s {
+     struct FileEntry_s cur;
+ } * FileList;
+ 
++static char *digest_list_dir;
++
++static int genDigestList(Header header, FileList fl, StringBuf fileList);
++
+ static void nullAttrRec(AttrRec ar)
+ {
+     memset(ar, 0, sizeof(*ar));
+@@ -997,11 +997,14 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
+ {
+     FileListRec flp;
+     char bufBUFSIZ;
++    char file_infoBUFSIZ;
++    char file_digest128 * 2 + 1;
+     int i, npaths = 0;
+     int fail_on_dupes = rpmExpandNumeric("%{?_duplicate_files_terminate_build}") > 0;
+     uint32_t defaultalgo = PGPHASHALGO_MD5, digestalgo;
+     rpm_loff_t totalFileSize = 0;
+     Header h = pkg->header; /* just a shortcut */
++    int processed = 0;
+     time_t source_date_epoch = 0;
+     char *srcdate = getenv("SOURCE_DATE_EPOCH");
+ 
+@@ -1058,8 +1067,9 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
+     
+     pkg->dpaths = xmalloc((fl->files.used + 1) * sizeof(*pkg->dpaths));
+ 
++process_files:
+     /* Generate the header. */
+-    for (i = 0, flp = fl->files.recs; i < fl->files.used; i++, flp++) {
++    for (i = processed, flp = fl->files.recs + processed; i < fl->files.used; i++, flp++) {
+ 	rpm_ino_t fileid = flp - fl->files.recs;
+ 
+  	/* Merge duplicate entries. */
+@@ -1190,7 +1200,8 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
+ 	    (void) rpmDoDigest(digestalgo, flp->diskPath, 1, 
+ 			       (unsigned char *)buf);
+ 	headerPutString(h, RPMTAG_FILEDIGESTS, buf);
+-	
++	snprintf(file_digest, sizeof(file_digest), "%s", buf);
++
+ 	buf0 = '\0';
+ 	if (S_ISLNK(flp->fl_mode)) {
+ 	    ssize_t llen = readlink(flp->diskPath, buf, BUFSIZ-1);
+@@ -1230,7 +1241,33 @@ static void genCpioListAndHeader(FileList fl, Package pkg, int isSrc)
+ 	flp->flags &= PARSEATTR_MASK;
+ 
+ 	headerPutUint32(h, RPMTAG_FILEFLAGS, &(flp->flags) ,1);
++
++	if (!processed && check_fileList_bin_pkg && S_ISREG(flp->fl_mode) &&
++		!(flp->flags & RPMFILE_GHOST)) {
++	    appendStringBuf(check_fileList_bin_pkg, "path=");
++	    appendStringBuf(check_fileList_bin_pkg, flp->diskPath);
++	    snprintf(file_info, sizeof(file_info),
++		"|digestalgopgp=%d|digest=%s|mode=%d"
++		"|uname=%s|gname=%s|caps=%s\n",
++		digestalgo, file_digest, flp->fl_mode,
++		rpmstrPoolStr(fl->pool, flp->uname),
++		rpmstrPoolStr(fl->pool, flp->gname), flp->caps &&
++		strlen(flp->caps) ? flp->caps : "");
++	    appendStringBuf(check_fileList_bin_pkg, file_info);
++	}
++    }
++
++    if (!processed) {
++	if (genDigestList(pkg->header, fl, check_fileList_bin_pkg) > 0) {
++	    fl->processingFailed = 1;
++	} else if (i < fl->files.used) {
++	    pkg->dpaths = xrealloc(pkg->dpaths,
++				   (fl->files.used + 1) * sizeof(*pkg->dpaths));
++	    processed = i;
++	    goto process_files;
++	}
+     }
++
+     pkg->dpathsnpaths = NULL;
+ 
+     if (totalFileSize < UINT32_MAX) {
+@@ -1343,8 +1380,8 @@ static int validFilename(const char *fn)
+  * @param statp		file stat (possibly NULL)
+  * @return		RPMRC_OK on success
+  */
+-static rpmRC addFile(FileList fl, const char * diskPath,
+-		struct stat * statp)
++static rpmRC addFile_common(FileList fl, const char * diskPath,
++		struct stat * statp, int digest_list)
+ {
+     size_t plen = strlen(diskPath);
+     char bufplen + 1;
+@@ -1355,6 +1392,10 @@ static rpmRC addFile(FileList fl, const char * diskPath,
+     gid_t fileGid;
+     const char *fileUname;
+     const char *fileGname;
++    char realPathPATH_MAX;
++    int digest_list_prefix = 0;
++    struct stat st;
++    int exclude = 0;
+     rpmRC rc = RPMRC_FAIL; /* assume failure */
+ 
+     /* Strip trailing slash. The special case of '/' path is handled below. */
+@@ -1390,6 +1431,33 @@ static rpmRC addFile(FileList fl, const char * diskPath,
+     if (*cpioPath == '\0')
+ 	cpioPath = "/";
+ 
++    snprintf(realPath, sizeof(realPath), "%s", diskPath);
++    rpmCleanPath(realPath);
++
++    digest_list_prefix = (!strncmp(realPath, digest_list_dir,
++			  strlen(digest_list_dir)));
++
++    if ((!digest_list && digest_list_prefix) ||
++	(digest_list && !digest_list_prefix)) {
++	    rc = RPMRC_OK;
++	    goto exit;
++    }
++
++    if (digest_list) {
++	if (strncmp(cpioPath, DIGEST_LIST_DIR, sizeof(DIGEST_LIST_DIR) - 1)) {
++	    rc = RPMRC_OK;
++	    goto exit;
++	}
++
++	cpioPath += sizeof(DIGEST_LIST_DIR) - 1;
++
++	snprintf(realPath, sizeof(realPath), "%.*s%s",
++		 (int)(strlen(digest_list_dir) - sizeof(DIGEST_LIST_DIR) + 1),
++		 digest_list_dir, cpioPath);
++	if (!stat(realPath, &st))
++	    exclude = 1;
++    }
++
+     /*
+      * Unless recursing, we dont have stat() info at hand. Handle the
+      * various cases, preserving historical behavior wrt %dev():
+@@ -1527,6 +1595,8 @@ static rpmRC addFile(FileList fl, const char * diskPath,
+ 	}
+ 
+ 	flp->flags = fl->cur.attrFlags;
++	if (exclude)
++	    flp->flags |= RPMFILE_EXCLUDE;
+ 	flp->specdFlags = fl->cur.specdFlags;
+ 	flp->verifyFlags = fl->cur.verifyFlags;
+ 
+@@ -1547,6 +1617,32 @@ exit:
+     return rc;
+ }
+ 
++/**
++ * Add a file to the package manifest.
++ * @param fl		package file tree walk data
++ * @param diskPath	path to file
++ * @param statp		file stat (possibly NULL)
++ * @return		RPMRC_OK on success
++ */
++static rpmRC addFile(FileList fl, const char * diskPath,
++		struct stat * statp)
++{
++	return addFile_common(fl, diskPath, statp, 0);
++}
++
++/**
++ * Add a digest list to the package manifest.
++ * @param fl		package file tree walk data
++ * @param diskPath	path to digest list
++ * @param statp		file stat (possibly NULL)
++ * @return		RPMRC_OK on success

_service:tar_scm:Remove-digest-list-from-the-kernel-during-package-re.patch Added

@@ -0,0 +1,106 @@
+From 0f088c5c9efa8ab877455bc273d7e536c763f824 Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Thu, 11 Mar 2021 11:59:45 +0100
+Subject: PATCH Remove digest list from the kernel during package
+ reinstallation
+
+Signed-off-by: luhuaxin <luhuaxin1@huawei.com>
+---
+ plugins/digest_list.c | 36 +++++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/plugins/digest_list.c b/plugins/digest_list.c
+index ca77282..63f8f1c 100644
+--- a/plugins/digest_list.c
++++ b/plugins/digest_list.c
+@@ -27,9 +27,6 @@
+ #define DIGEST_LIST_DEFAULT_PATH "/etc/ima/digest_lists"
+ #define RPM_PARSER "/usr/libexec/rpm_parser"
+ 
+-#define DIGEST_LIST_OP_ADD 0
+-#define DIGEST_LIST_OP_DEL 1
+-
+ enum hash_algo {
+ 	HASH_ALGO_MD4,
+ 	HASH_ALGO_MD5,
+@@ -372,12 +369,13 @@ out:
+ 	return ret;
+ }
+ 
+-static int process_digest_list(rpmte te, int parser)
++static int process_digest_list(rpmte te, int parser, int pre)
+ {
+ 	char *path = NULL, *path_sig = NULL;
+ 	int digest_list_signed = 0;
+ 	struct stat st;
+ 	ssize_t size;
++	int type = rpmteType(te);
+ 	struct __user_cap_header_struct cap_header_data;
+ 	cap_user_header_t cap_header = &cap_header_data;
+ 	struct __user_cap_data_struct cap_data_data;
+@@ -431,15 +429,7 @@ static int process_digest_list(rpmte te, int parser)
+ 
+ 	size = lgetxattr(path, XATTR_NAME_IMA, NULL, 0);
+ 
+-	/* Don't upload again if digest list was already processed */
+-	if ((rpmteType(te) == TR_ADDED && size > 0) ||
+-	    (rpmteType(te) == TR_REMOVED && size < 0)) {
+-		rpmlog(RPMLOG_DEBUG, "digest_list: '%s' already processed, "
+-		       "nothing to do\n", path);
+-		goto out;
+-	}
+-
+-	if (rpmteType(te) == TR_ADDED) {
++	if (type == TR_ADDED && !pre && size < 0) {
+ 		if (!digest_list_signed) {
+ 			/* Write RPM header to the disk */
+ 			ret = write_rpm_digest_list(te, path);
+@@ -472,12 +462,18 @@ static int process_digest_list(rpmte te, int parser)
+ 			ret = RPMRC_FAIL;
+ 			goto out;
+ 		}
++	} else if (type == TR_ADDED && pre) {
++		if (size < 0)
++			goto out;
++
++		/* rpm is overwriting the digest list, remove from the kernel */
++		type = TR_REMOVED;
+ 	}
+ 
+ 	/* Upload digest list to securityfs */
+-	upload_digest_list(path, rpmteType(te), digest_list_signed);
++	upload_digest_list(path, type, digest_list_signed);
+ 
+-	if (rpmteType(te) == TR_REMOVED) {
++	if (type == TR_REMOVED) {
+ 		if (!digest_list_signed) {
+ 			unlink(path);
+ 			goto out;
+@@ -552,8 +548,10 @@ static rpmRC digest_list_file_common(rpmPlugin plugin, rpmfi fi,
+ 	if (!pre && res != RPMRC_OK)
+ 		return res;
+ 
+-	if ((pre && action != FA_ERASE) ||
+-	    (!pre && action != FA_CREATE))
++	if (!pre && rpmteType(cur_te) != TR_ADDED)
++		return RPMRC_OK;
++
++	if (pre && action == FA_SKIP)
+ 		return RPMRC_OK;
+ 
+ 	if (strncmp(path, DIGEST_LIST_DEFAULT_PATH,
+@@ -564,9 +562,9 @@ static rpmRC digest_list_file_common(rpmPlugin plugin, rpmfi fi,
+ 	if (!pre && --digest_list_counter)
+ 		return RPMRC_OK;
+ 
+-	process_digest_list(cur_te, 0);
++	process_digest_list(cur_te, 0, pre);
+ 	if (!strcmp(rpmteN(cur_te), "digest-list-tools"))
+-		process_digest_list(cur_te, 1);
++		process_digest_list(cur_te, 1, pre);
+ 
+ 	return RPMRC_OK;
+ }
+-- 
+2.33.0
+

_service:tar_scm:Unbundle-config-site-and-add-RPM-LD-FLAGS-macro.patch Added

@@ -0,0 +1,38 @@
+From eee654b9652fb9387018f9653431a11401a354fd Mon Sep 17 00:00:00 2001
+From: openeuler-basic <shenyangyang4@huawei.com>
+Date: Thu, 9 Jan 2020 19:16:58 +0800
+Subject: PATCH Unbundle config site and add RPM LD FLAGS macro
+
+---
+ macros.in | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/macros.in b/macros.in
+index fe9803a..4027493 100644
+--- a/macros.in
++++ b/macros.in
+@@ -794,10 +794,11 @@ package or when debugging this package.\
+   RPM_SOURCE_DIR=\"%{u2p:%{_sourcedir}}\"\
+   RPM_BUILD_DIR=\"%{u2p:%{_builddir}}\"\
+   RPM_OPT_FLAGS=\"%{optflags}\"\
++  RPM_LD_FLAGS=\"%{?build_ldflags}\"\
+   RPM_ARCH=\"%{_arch}\"\
+   RPM_OS=\"%{_os}\"\
+   RPM_BUILD_NCPUS=\"%{_smp_build_ncpus}\"\
+-  export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_BUILD_NCPUS\
++  export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_BUILD_NCPUS RPM_OPT_FLAGS\
+   RPM_DOC_DIR=\"%{_docdir}\"\
+   export RPM_DOC_DIR\
+   RPM_PACKAGE_NAME=\"%{NAME}\"\
+@@ -813,6 +814,8 @@ package or when debugging this package.\
+   export CLASSPATH}\
+   PKG_CONFIG_PATH=\"${PKG_CONFIG_PATH}:%{_libdir}/pkgconfig:%{_datadir}/pkgconfig\"\
+   export PKG_CONFIG_PATH\
++  CONFIG_SITE=${CONFIG_SITE:-NONE}\
++  export CONFIG_SITE\
+   \
+   %%{verbose}?"set -x":""\
+   umask 022\
+-- 
+1.8.3.1
+

_service:tar_scm:add-default-machine-name-to-support-loongarch.patch Added

_service:tar_scm:add-dist-to-release-by-default.patch Added

@@ -0,0 +1,37 @@
+From af9a2347cd725a8dbb6045d7d3e9661d524af110 Mon Sep 17 00:00:00 2001
+From: openEuler Buildteam <buildteam@openeuler.org>
+Date: Wed, 4 Mar 2020 16:12:58 +0800
+Subject: PATCH add dist to release by default
+
+---
+ build/parsePreamble.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/build/parsePreamble.c b/build/parsePreamble.c
+index b0a17c8..cac899a 100644
+--- a/build/parsePreamble.c
++++ b/build/parsePreamble.c
+@@ -808,6 +808,11 @@ static rpmRC handlePreambleTag(rpmSpec spec, Package pkg, rpmTagVal tag,
+     case RPMTAG_VERSION:
+     case RPMTAG_RELEASE:
+ 	SINGLE_TOKEN_ONLY;
++        if (tag == RPMTAG_RELEASE) {
++            char *dist = rpmExpand("%{?dist}",NULL);
++            rasprintf(&field,"%s%s",field,dist);
++            free(dist);
++        }
+ 	if (rpmCharCheck(spec, field, ALLOWED_CHARS_VERREL))
+ 	   goto exit;
+ 	headerPutString(pkg->header, tag, field);
+@@ -987,6 +992,8 @@ static rpmRC handlePreambleTag(rpmSpec spec, Package pkg, rpmTagVal tag,
+     }
+     rc = RPMRC_OK;
+ exit:
++    if (tag == RPMTAG_RELEASE)
++        free(field);
+     return rc;	
+ }
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Add-a-hashed-flag-to-pgpPrtSubtype.patch Added

@@ -0,0 +1,55 @@
+From 55849d2d6e16096dbd30fd3a5c751f13bb03484b Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Sun, 27 Mar 2022 12:04:46 -0400
+Subject: PATCH Add a hashed flag to pgpPrtSubtype()
+
+This is needed for key usage flags parsing, as key usage flags outside
+of the hashed region must be ignored.  For now, just use it to
+unconditionally ignore unhashed creation time subpackets.
+---
+ rpmio/rpmpgp.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 59c80d7..9b8503e 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -437,7 +437,7 @@ int pgpSignatureType(pgpDigParams _digp)
+ }
+ 
+ static int pgpPrtSubType(const uint8_t *h, size_t hlen, pgpSigType sigtype, 
+-			 pgpDigParams _digp)
++			 pgpDigParams _digp, int hashed)
+ {
+     const uint8_t *p = h;
+     size_t plen = 0, i;
+@@ -474,6 +474,8 @@ static int pgpPrtSubType(const uint8_t *h, size_t hlen, pgpSigType sigtype,
+ 		pgpPrtVal(" ", pgpKeyServerPrefsTbl, pi);
+ 	    break;
+ 	case PGPSUBTYPE_SIG_CREATE_TIME:  /* signature creation time */
++	    if (!hashed)
++		break; /* RFC 4880 §5.2.3.4 creation time MUST be hashed */
+ 	    if (plen-1 != sizeof(_digp->time))
+ 		break; /* other lengths not understood */
+ 	    if (_digp->saved & PGPDIG_SIG_HAS_CREATION_TIME)
+@@ -666,7 +668,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 	    _digp->hashlen = sizeof(*v) + plen;
+ 	    _digp->hash = memcpy(xmalloc(_digp->hashlen), v, _digp->hashlen);
+ 	}
+-	if (pgpPrtSubType(p, plen, v->sigtype, _digp))
++	if (pgpPrtSubType(p, plen, v->sigtype, _digp, 1))
+ 	    return 1;
+ 	p += plen;
+ 
+@@ -680,7 +682,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 	if ((p + plen) > hend)
+ 	    return 1;
+ 
+-	if (pgpPrtSubType(p, plen, v->sigtype, _digp))
++	if (pgpPrtSubType(p, plen, v->sigtype, _digp, 0))
+ 	    return 1;
+ 	p += plen;
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Add-optional-callback-on-directory-changes-during-rp.patch Added

@@ -0,0 +1,105 @@
+From fb13f7fd9eff012cb7b9dbf94ac5381c69404055 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Wed, 9 Feb 2022 14:47:14 +0200
+Subject: PATCH Add optional callback on directory changes during rpmfi
+ iteration
+
+Internal only for now in case we need to fiddle with the API some more,
+but no reason this couldn't be made public later.
+---
+ lib/rpmfi.c          | 24 +++++++++++++++++++++++-
+ lib/rpmfi_internal.h | 17 +++++++++++++++++
+ 2 files changed, 40 insertions(+), 1 deletion(-)
+
+diff --git a/lib/rpmfi.c b/lib/rpmfi.c
+index 4673fbb..e8e7d08 100644
+--- a/lib/rpmfi.c
++++ b/lib/rpmfi.c
+@@ -55,6 +55,9 @@ struct rpmfi_s {
+     int intervalStart;		/*!< Start of iterating interval. */
+     int intervalEnd;		/*!< End of iterating interval. */
+ 
++    rpmfiChdirCb onChdir;	/*!< Callback for directory changes */
++    void *onChdirData;		/*!< Caller private callback data */
++
+     rpmfiles files;		/*!< File info set */
+     rpmcpio_t archive;		/*!< Archive with payload */
+     unsigned char * found;	/*!< Bit field of files found in the archive */
+@@ -312,6 +312,17 @@ int rpmfiDI(rpmfi fi)
+ }
+ #endif
+ 
++int rpmfiSetOnChdir(rpmfi fi, rpmfiChdirCb cb, void *data)
++{
++    int rc = -1;
++    if (fi != NULL) {
++	fi->onChdir = cb;
++	fi->onChdirData = data;
++	rc = 0;
++    }
++    return rc;
++}
++
+ int rpmfiFX(rpmfi fi)
+ {
+     return (fi != NULL ? fi->i : -1);
+@@ -313,9 +327,17 @@ int rpmfiSetFX(rpmfi fi, int fx)
+     int i = -1;
+ 
+     if (fi != NULL && fx >= 0 && fx < rpmfilesFC(fi->files)) {
++	int dx = fi->j;
++	i = fi->i;
+ 	fi->i = fx;
+ 	fi->j = rpmfilesDI(fi->files, fi->i);
+ 	i = fi->i;
++
++	if (fi->j != dx && fi->onChdir) {
++	    int chrc = fi->onChdir(fi, fi->onChdirData);
++	    if (chrc < 0)
++		i = chrc;
++	}
+     }
+     return i;
+ }
+@@ -1780,9 +1802,9 @@ static rpmfi initIter(rpmfiles files, int itype, int link)
+     if (files && itype>=0 && itype<=RPMFILEITERMAX) {
+ 	fi = xcalloc(1, sizeof(*fi)); 
+ 	fi->i = -1;
++	fi->j = -1;
+ 	fi->files = link ? rpmfilesLink(files) : files;
+ 	fi->next = nextfuncsitype;
+-	fi->i = -1;
+ 	if (itype == RPMFI_ITER_BACK) {
+ 	    fi->i = rpmfilesFC(fi->files);
+ 	} else if (itype >=RPMFI_ITER_READ_ARCHIVE
+diff --git a/lib/rpmfi_internal.h b/lib/rpmfi_internal.h
+index dccc6ccb..37f1d45 100644
+--- a/lib/rpmfi_internal.h
++++ b/lib/rpmfi_internal.h
+@@ -14,6 +14,23 @@ extern "C" {
+ #endif
+ 
+ /** \ingroup rpmfi
++ * Callback on file iterator directory changes
++ * @param fi		file info
++ * @param data		caller private callback data
++ * @return		0 on success, < 0 on error (to stop iteration)
++ */
++typedef int (*rpmfiChdirCb)(rpmfi fi, void *data);
++
++/** \ingroup rpmfi
++ * Set a callback for directory changes during iteration.
++ * @param fi		file info
++ * @param cb		callback function
++ * @param data		caller private callback data
++ * @return		string pool handle (weak reference)
++ */
++int rpmfiSetOnChdir(rpmfi fi, rpmfiChdirCb cb, void *data);
++
++/** \ingroup rpmfi
+  * Return file info set string pool handle
+  * @param fi		file info
+  * @return		string pool handle (weak reference)
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Avoid-double-frees-if-EVP_PKEY_assign_RSA-fails.patch Added

@@ -0,0 +1,95 @@
+From 0a91d1f62d5b6e1cac4d0a7c2ac9f75faad50534 Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Fri, 9 Apr 2021 13:34:12 -0400
+Subject: PATCH Avoid double frees if EVP_PKEY_assign_RSA fails
+
+Previously, the bignums would be left as dangling and double-freed.
+---
+ rpmio/digest_openssl.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/rpmio/digest_openssl.c b/rpmio/digest_openssl.c
+index 20c272d..02f34a9 100644
+--- a/rpmio/digest_openssl.c
++++ b/rpmio/digest_openssl.c
+@@ -292,8 +292,8 @@ struct pgpDigKeyRSA_s {
+ 
+     BIGNUM *n; /* Common Modulus */
+     BIGNUM *e; /* Public Exponent */
+-
+     EVP_PKEY *evp_pkey; /* Fully constructed key */
++    unsigned char immutable; /* if set, this key cannot be mutated */
+ };
+ 
+ static int constructRSASigningKey(struct pgpDigKeyRSA_s *key)
+@@ -301,33 +301,34 @@ static int constructRSASigningKey(struct pgpDigKeyRSA_s *key)
+     if (key->evp_pkey) {
+         /* We've already constructed it, so just reuse it */
+         return 1;
+-    }
++    } else if (key->immutable)
++	return 0;
++    key->immutable = 1;
+ 
+     /* Create the RSA key */
+     RSA *rsa = RSA_new();
+     if (!rsa) return 0;
+ 
+-    if (!RSA_set0_key(rsa, key->n, key->e, NULL)) {
+-        RSA_free(rsa);
+-        return 0;
+-    }
++    if (RSA_set0_key(rsa, key->n, key->e, NULL) <= 0)
++	goto exit;
++    key->n = key->e = NULL;
+ 
+     /* Create an EVP_PKEY container to abstract the key-type. */
+-    key->evp_pkey = EVP_PKEY_new();
+-    if (!key->evp_pkey) {
+-        RSA_free(rsa);
+-        return 0;
+-    }
++    if (!(key->evp_pkey = EVP_PKEY_new()))
++	goto exit;
+ 
+     /* Assign the RSA key to the EVP_PKEY structure.
+        This will take over memory management of the RSA key */
+     if (!EVP_PKEY_assign_RSA(key->evp_pkey, rsa)) {
+         EVP_PKEY_free(key->evp_pkey);
+         key->evp_pkey = NULL;
+-        RSA_free(rsa);
++	goto exit;
+     }
+ 
+     return 1;
++exit:
++    RSA_free(rsa);
++    return 0;
+ }
+ 
+ static int pgpSetKeyMpiRSA(pgpDigAlg pgpkey, int num, const uint8_t *p)
+@@ -335,9 +336,10 @@ static int pgpSetKeyMpiRSA(pgpDigAlg pgpkey, int num, const uint8_t *p)
+     size_t mlen = pgpMpiLen(p) - 2;
+     struct pgpDigKeyRSA_s *key = pgpkey->data;
+ 
+-    if (!key) {
++    if (!key)
+         key = pgpkey->data = xcalloc(1, sizeof(*key));
+-    }
++    else if (key->immutable)
++	return 1;
+ 
+     switch (num) {
+     case 0:
+@@ -347,7 +349,7 @@ static int pgpSetKeyMpiRSA(pgpDigAlg pgpkey, int num, const uint8_t *p)
+             return 1;
+         }
+ 
+-        key->nbytes = mlen;
++	key->nbytes = mlen;
+         /* Create a BIGNUM from the pointer.
+            Note: this assumes big-endian data as required by PGP */
+         key->n = BN_bin2bn(p+2, mlen, NULL);
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Avoid-reading-out-of-bounds-of-the-i18ntable.patch Added

@@ -0,0 +1,29 @@
+From db8fc1057e38839adc04e263fe255ce86cab9fa7 Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Sat, 12 Feb 2022 13:46:28 -0500
+Subject: PATCH Avoid reading out of bounds of the i18ntable
+
+If the i18ntable was smaller than the i18nstring entry an out of bounds
+read could result.  This should not happen in a valid package, but even
+if RPM rejected such packages during load, this situation could still
+result as a result of usage of the RPM API.
+---
+ lib/header.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/header.c b/lib/header.c
+index 098ea5d..c939006 100644
+--- a/lib/header.c
++++ b/lib/header.c
+@@ -1311,7 +1311,7 @@ static int copyI18NEntry(Header h, indexEntry entry, rpmtd td,
+ 
+ 	/* For each entry in the header ... */
+ 	for (langNum = 0, t = table->data, ed = entry->data;
+-	     langNum < entry->info.count;
++	     langNum < entry->info.count && langNum < table->info.count;
+ 	     langNum++, t += strlen(t) + 1, ed += strlen(ed) + 1) {
+ 
+ 	    int match = headerMatchLocale(t, l, le);
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Avoid-unneded-MPI-reparsing.patch Added

@@ -0,0 +1,39 @@
+From 8948ec79f6c300e91319469ba72b9bd3480fe686 Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Sun, 27 Mar 2022 12:54:36 -0400
+Subject: PATCH Avoid unneded MPI reparsing
+
+Modify pgpPrtSig() to ignore the MPIs of a signature if its `tag`
+parameter is 0.  The only caller that sets `tag` to 0 is
+pgpPrtParamSubkeys() (via parseSubkeySig()), which does not actually
+check any cryptographic signatures.  The subkey binding signature has
+been checked earlier in pgpPrtParams().
+---
+ rpmio/rpmpgp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 22ac9c8..2b93661 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -637,7 +637,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 
+ 	p = ((uint8_t *)v) + sizeof(*v);
+ 	_digp->data = p;
+-	rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp);
++	rc = tag ? pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp) : 0;
+     }	break;
+     case 4:
+     {   pgpPktSigV4 v = (pgpPktSigV4)h;
+@@ -700,7 +700,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 	    return 1;
+ 
+ 	_digp->data = p;
+-	rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp);
++	rc = tag ? pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp) : 0;
+     }	break;
+     default:
+ 	rpmlog(RPMLOG_WARNING, _("Unsupported version of signature: V%d\n"), version);
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Bury-rpmio-FD-use-to-fsmUnpack.patch Added

@@ -0,0 +1,129 @@
+From bbc270d78fb361bd78eac9a9117070caeb537d4a Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Mon, 14 Feb 2022 12:35:58 +0200
+Subject: PATCH Bury rpmio FD use to fsmUnpack()
+
+fsmUnpack() is the only place in FSM that needs to deal with rpmio FD
+types, everywhere else they are nothing but a hindrance that need to
+be converted to OS level descriptors for use. Better deal with OS
+level descriptors to begin with.
+---
+ lib/fsm.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index 13b1142..b019f57 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -110,14 +110,14 @@ static int fsmSetFCaps(const char *path, const char *captxt)
+     return rc;
+ }
+ 
+-static int fsmClose(FD_t *wfdp)
++static int fsmClose(int *wfdp)
+ {
+     int rc = 0;
+-    if (wfdp && *wfdp) {
++    if (wfdp && *wfdp >= 0) {
+ 	int myerrno = errno;
+ 	static int oneshot = 0;
+ 	static int flush_io = 0;
+-	int fdno = Fileno(*wfdp);
++	int fdno = *wfdp;
+ 
+ 	if (!oneshot) {
+ 	    flush_io = (rpmExpandNumeric("%{?_flush_io}") > 0);
+@@ -126,61 +126,56 @@ static int fsmClose(FD_t *wfdp)
+ 	if (flush_io) {
+ 	    fsync(fdno);
+ 	}
+-	if (Fclose(*wfdp))
++	if (close(fdno))
+ 	    rc = RPMERR_CLOSE_FAILED;
+ 
+ 	if (_fsm_debug) {
+ 	    rpmlog(RPMLOG_DEBUG, " %8s (%d) %s\n", __func__,
+ 		   fdno, (rc < 0 ? strerror(errno) : ""));
+ 	}
+-	*wfdp = NULL;
++	*wfdp = -1;
+ 	errno = myerrno;
+     }
+     return rc;
+ }
+ 
+-static int fsmOpen(FD_t *wfdp, int dirfd, const char *dest)
++static int fsmOpen(int *wfdp, int dirfd, const char *dest)
+ {
+     int rc = 0;
+     /* Create the file with 0200 permissions (write by owner). */
+     int fd = openat(dirfd, dest, O_WRONLY|O_EXCL|O_CREAT, 0200);
+ 
+-    if (fd >= 0) {
+-	*wfdp = fdDup(fd);
+-	close(fd);
+-    }
+-
+-    if (fd < 0 || Ferror(*wfdp))
++    if (fd < 0)
+ 	rc = RPMERR_OPEN_FAILED;
+ 
+     if (_fsm_debug) {
+ 	rpmlog(RPMLOG_DEBUG, " %8s (%s %d) %s\n", __func__,
+-	       dest, Fileno(*wfdp), (rc < 0 ? strerror(errno) : ""));
++	       dest, fd, (rc < 0 ? strerror(errno) : ""));
+     }
+-
+-    if (rc)
+-	fsmClose(wfdp);
++    *wfdp = fd;
+ 
+     return rc;
+ }
+ 
+-static int fsmUnpack(rpmfi fi, FD_t fd, rpmpsm psm, int nodigest)
++static int fsmUnpack(rpmfi fi, int fdno, rpmpsm psm, int nodigest)
+ {
++    FD_t fd = fdDup(fdno);
+     int rc = rpmfiArchiveReadToFilePsm(fi, fd, nodigest, psm);
+     if (_fsm_debug) {
+ 	rpmlog(RPMLOG_DEBUG, " %8s (%s %" PRIu64 " bytes %d) %s\n", __func__,
+ 	       rpmfiFN(fi), rpmfiFSize(fi), Fileno(fd),
+ 	       (rc < 0 ? strerror(errno) : ""));
+     }
++    Fclose(fd);
+     return rc;
+ }
+ 
+ static int fsmMkfile(int dirfd, rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 		     rpmpsm psm, int nodigest,
+-		     struct filedata_s ** firstlink, FD_t *firstlinkfile)
++		     struct filedata_s ** firstlink, int *firstlinkfile)
+ {
+     int rc = 0;
+-    FD_t fd = NULL;
++    int fd = -1;
+ 
+     if (*firstlink == NULL) {
+ 	/* First encounter, open file for writing */
+@@ -206,7 +201,7 @@ static int fsmMkfile(int dirfd, rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 	if (*firstlink) {
+ 	    fp->setmeta = 1;
+ 	    *firstlink = NULL;
+-	    *firstlinkfile = NULL;
++	    *firstlinkfile = -1;
+ 	}
+     }
+ 
+@@ -811,7 +806,7 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+     int fc = rpmfilesFC(files);
+     int nodigest = (rpmtsFlags(ts) & RPMTRANS_FLAG_NOFILEDIGEST) ? 1 : 0;
+     int nofcaps = (rpmtsFlags(ts) & RPMTRANS_FLAG_NOCAPS) ? 1 : 0;
+-    FD_t firstlinkfile = NULL;
++    int firstlinkfile = -1;
+     char *tid = NULL;
+     struct filedata_s *fdata = xcalloc(fc, sizeof(*fdata));
+     struct filedata_s *firstlink = NULL;
+-- 
+1.8.3.1
+

_service:tar_scm:backport-CVE-2021-35937-CVE-2021-35939.patch Added

@@ -0,0 +1,281 @@
+From 96ec957e281220f8e137a2d5eb23b83a6377d556 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Thu, 10 Feb 2022 14:32:43 +0200
+Subject: PATCH Validate intermediate symlinks during installation,
+ CVE-2021-35939
+
+Whenever directory changes during unpacking, walk the entire tree from
+starting from / and validate any symlinks crossed, fail the install
+on invalid links.
+
+This is the first of step of many towards securing our file operations
+against local tamperers and besides plugging that one CVE, paves the way
+for the next step by adding the necessary directory fd tracking.
+This also bumps the rpm OS requirements to a whole new level by requiring
+the *at() family of calls from POSIX-1.2008.
+
+This necessarily does a whole lot of huffing and puffing we previously
+did not do. It should be possible to cache secure (ie root-owned)
+directory structures to avoid validating everything a million times
+but for now, just keeping things simple.
+---
+ INSTALL      |   2 +
+ configure.ac |   3 +-
+ lib/fsm.c    | 144 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++---
+ 3 files changed, 142 insertions(+), 7 deletions(-)
+
+diff --git a/INSTALL b/INSTALL
+index 677ef88..961a160 100644
+--- a/INSTALL
++++ b/INSTALL
+@@ -103,6 +103,8 @@ option to configure).  For GCC, OpenMP 4.5 is fully supported since GCC 6.1,
+ which is available from
+     http://www.gnu.org/
+ 
++Rpm requires a POSIX.1-2008 level operating system.
++
+ To compile RPM:
+ --------------
+ 
+diff --git a/configure.ac b/configure.ac
+index 3ee3407..0099e5f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -580,7 +580,8 @@ AC_CHECK_FUNCS(secure_getenv __secure_getenv)
+ 
+ AC_CHECK_FUNCS(
+    mkstemp getcwd basename dirname realpath setenv unsetenv regcomp lchown \
+-    utimes getline localtime_r statvfs getaddrinfo ,
++    utimes getline localtime_r statvfs getaddrinfo \
++    openat mkdirat fstatat ,
+    , AC_MSG_ERROR(function required by rpm))
+ 
+ AC_LIBOBJ(fnmatch)
+diff --git a/lib/fsm.c b/lib/fsm.c
+index 9118983..b6b152a 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -8,6 +8,7 @@
+ #include <inttypes.h>
+ #include <utime.h>
+ #include <errno.h>
++#include <fcntl.h>
+ #if WITH_CAP
+ #include <sys/capability.h>
+ #endif
+@@ -20,6 +21,7 @@
+ #include "rpmio/rpmio_internal.h"	/* fdInit/FiniDigest */
+ #include "lib/fsm.h"
+ #include "lib/rpmte_internal.h"	/* XXX rpmfs */
++#include "lib/rpmfi_internal.h" /* rpmfiSetOnChdir */
+ #include "lib/rpmplugins.h"	/* rpm plugins hooks */
+ #include "lib/rpmug.h"
+ 
+@@ -406,17 +408,118 @@ static int fsmRmdir(const char *path)
+     return rc;
+ }
+ 
+-static int fsmMkdir(const char *path, mode_t mode)
++static int fsmMkdir(int dirfd, const char *path, mode_t mode)
+ {
+-    int rc = mkdir(path, (mode & 07777));
++    int rc = mkdirat(dirfd, path, (mode & 07777));
+     if (_fsm_debug)
+-	rpmlog(RPMLOG_DEBUG, " %8s (%s, 0%04o) %s\n", __func__,
+-	       path, (unsigned)(mode & 07777),
++	rpmlog(RPMLOG_DEBUG, " %8s (%d %s, 0%04o) %s\n", __func__,
++	       dirfd, path, (unsigned)(mode & 07777),
+ 	       (rc < 0 ? strerror(errno) : ""));
+     if (rc < 0)	rc = RPMERR_MKDIR_FAILED;
+     return rc;
+ }
+ 
++static int fsmOpenat(int dirfd, const char *path, int flags)
++{
++    struct stat lsb, sb;
++    int sflags = flags | O_NOFOLLOW;
++    int fd = openat(dirfd, path, sflags);
++
++    /*
++     * Only ever follow symlinks by root or target owner. Since we can't
++     * open the symlink itself, the order matters: we stat the link *after*
++     * opening the target, and if the link ownership changed between the calls
++     * it could've only been the link owner or root.
++     */
++    if (fd < 0 && errno == ELOOP && flags != sflags) {
++	int ffd = openat(dirfd, path, flags);
++	if (ffd >= 0 && fstatat(dirfd, path, &lsb, AT_SYMLINK_NOFOLLOW) == 0) {
++	    if (fstat(ffd, &sb) == 0) {
++		if (lsb.st_uid == 0 || lsb.st_uid == sb.st_uid) {
++		    fd = ffd;
++		} else {
++		    close(ffd);
++		}
++	    }
++	}
++    }
++    return fd;
++}
++
++static int fsmDoMkDir(rpmPlugins plugins, int dirfd, const char *dn,
++			int owned, mode_t mode)
++{
++    int rc;
++    rpmFsmOp op = (FA_CREATE);
++    if (!owned)
++	op |= FAF_UNOWNED;
++
++    /* Run fsm file pre hook for all plugins */
++    rc = rpmpluginsCallFsmFilePre(plugins, NULL, dn, mode, op);
++
++    if (!rc)
++	rc = fsmMkdir(dirfd, dn, mode);
++
++    if (!rc) {
++	rc = rpmpluginsCallFsmFilePrepare(plugins, NULL, dn, dn, mode, op);
++    }
++
++    /* Run fsm file post hook for all plugins */
++    rpmpluginsCallFsmFilePost(plugins, NULL, dn, mode, op, rc);
++
++    if (!rc) {
++	rpmlog(RPMLOG_DEBUG,
++		"%s directory created with perms %04o\n",
++		dn, (unsigned)(mode & 07777));
++    }
++
++    return rc;
++}
++
++static int ensureDir(rpmPlugins plugins, const char *p, int owned, int create)
++{
++    char *path = xstrdup(p);
++    char *dp = path;
++    char *sp = NULL, *bn;
++    int oflags = O_RDONLY;
++
++    int dirfd = fsmOpenat(-1, "/", oflags);
++    int fd = dirfd; /* special case of "/" */
++
++    while ((bn = strtok_r(dp, "/", &sp)) != NULL) {
++	struct stat sb;
++	fd = fsmOpenat(dirfd, bn, oflags);
++
++	if (fd < 0 && errno == ENOENT && create) {
++	    mode_t mode = S_IFDIR | (_dirPerms & 07777);
++	    if (fsmDoMkDir(plugins, dirfd, bn, owned, mode) == 0) {
++		fd = fsmOpenat(dirfd, bn, oflags|O_NOFOLLOW);
++	    }
++	}
++
++	if (fd >= 0 && fstat(fd, &sb) == 0 && !S_ISDIR(sb.st_mode)) {
++	    close(fd);
++	    errno = ENOTDIR;
++	    fd = -1;
++	}
++
++	close(dirfd);
++	if (fd >= 0) {
++	    dirfd = fd;
++	} else {
++	    dirfd = -1;
++	    rpmlog(RPMLOG_ERR, _("failed to open dir %s of %s: %s\n"),
++				bn, p, strerror(errno));
++	    break;
++	}
++
++	dp = NULL;
++    }
++
++    free(path);
++    return dirfd;
++}
++
+ static int fsmMkfifo(const char *path, mode_t mode)
+ {
+     int rc = mkfifo(path, (mode & 07777));
+@@ -507,7 +610,7 @@ static int fsmMkdirs(rpmfiles files, rpmfs fs, rpmPlugins plugins)
+ 		rc = rpmpluginsCallFsmFilePre(plugins, NULL, dn, mode, op);
+

_service:tar_scm:backport-CVE-2021-35938.patch Added

@@ -0,0 +1,40 @@
+From 25a435e90844ea98fe5eb7bef22c1aecf3a9c033 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Mon, 14 Feb 2022 14:29:33 +0200
+Subject: PATCH Set file metadata via fd-based ops for everything but
+ symlinks
+
+Regular file ops are fd-based already, for the rest we need to open them
+manually. Files with temporary suffix must never be followed, for
+directories (and pre-existing FA_TOUCHed files) use the rpm symlink
+"root or target owner allowed" rule wrt following.
+
+This mostly fixes CVE-2021-35938, but as we're not yet using dirfd-based
+operatiosn for everything there are corner cases left undone. And then
+there's the plugin API which needs updating for all this.
+---
+ lib/fsm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index 913e9de..6f781c6 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -1133,6 +1133,14 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+                     rc = RPMERR_UNKNOWN_FILETYPE;
+             }
+ 
++	    if (!rc && fd == -1 && !S_ISLNK(fp->sb.st_mode)) {
++		/* Only follow safe symlinks, and never on temporary files */
++		fd = fsmOpenat(di.dirfd, fp->fpath,
++				fp->suffix ? AT_SYMLINK_NOFOLLOW : 0);
++		if (fd < 0)
++		    rc = RPMERR_OPEN_FAILED;
++	    }
++
+ 	    if (fd != firstlinkfile)
+ 		fsmClose(&fd);
+ 	}
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Check-file-iterator-for-being-NULL-consistently.patch Added

@@ -0,0 +1,67 @@
+From 470498bd5a51f8d98ae8e721beea58ef81c19a51 Mon Sep 17 00:00:00 2001
+From: Florian Festi <ffesti@redhat.com>
+Date: Wed, 22 Sep 2021 16:10:53 +0200
+Subject: PATCH Check file iterator for being NULL consistently
+
+No point in allowing NULL only for one of the arguments.
+
+Thanks to ex0z3 (https://github.com/ex0z3) for reporting!
+
+Resolves: #1782
+---
+ lib/rpmfi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/lib/rpmfi.c b/lib/rpmfi.c
+index c6c9699..b67680c 100644
+--- a/lib/rpmfi.c
++++ b/lib/rpmfi.c
+@@ -735,7 +735,7 @@ uint32_t rpmfilesFLinks(rpmfiles fi, int ix, const int ** files)
+ 
+ uint32_t rpmfiFLinks(rpmfi fi, const int ** files)
+ {
+-    return rpmfilesFLinks(fi->files, fi ? fi->i : -1, files);
++    return rpmfilesFLinks(fi ? fi->files : NULL, fi ? fi->i : -1, files);
+ }
+ 
+ uint32_t rpmfilesFNlink(rpmfiles fi, int ix)
+@@ -1948,22 +1948,22 @@ const char * rpmfiOFN(rpmfi fi)
+ 
+ const unsigned char * rpmfiFDigest(rpmfi fi, int *algo, size_t *len)
+ {
+-    return rpmfilesFDigest(fi->files, fi ? fi->i : -1, algo, len);
++    return rpmfilesFDigest(fi ? fi->files : NULL, fi ? fi->i : -1, algo, len);
+ }
+ 
+ const unsigned char * rpmfiFSignature(rpmfi fi, size_t *len)
+ {
+-    return rpmfilesFSignature(fi->files, fi ? fi->i : -1, len);
++    return rpmfilesFSignature(fi ? fi->files : NULL, fi ? fi->i : -1, len);
+ }
+ 
+ const unsigned char * rpmfiVSignature(rpmfi fi, size_t *len, uint16_t *algo)
+ {
+-    return rpmfilesVSignature(fi->files, fi ? fi->i : -1, len, algo);
++    return rpmfilesVSignature(fi ? fi->files : NULL, fi ? fi->i : -1, len, algo);
+ }
+ 
+ uint32_t rpmfiFDepends(rpmfi fi, const uint32_t ** fddictp)
+ {
+-    return rpmfilesFDepends(fi->files,  fi ? fi->i : -1, fddictp);
++    return rpmfilesFDepends(fi ? fi->files : NULL,  fi ? fi->i : -1, fddictp);
+ }
+ 
+ int rpmfiStat(rpmfi fi, int flags, struct stat *sb)
+@@ -1983,7 +1983,8 @@ int rpmfiStat(rpmfi fi, int flags, struct stat *sb)
+ 
+ int rpmfiCompare(const rpmfi afi, const rpmfi bfi)
+ {
+-    return rpmfilesCompare(afi->files, afi ? afi->i : -1, bfi->files, bfi ? bfi->i : -1);
++    return rpmfilesCompare(afi ? afi->files : NULL, afi ? afi->i : -1,
++			   bfi ? bfi->files : NULL, bfi ? bfi->i : -1);
+ }
+ 
+ rpmVerifyAttrs rpmfiVerify(rpmfi fi, rpmVerifyAttrs omitMask)
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Check-that-the-CRC-length-is-correct.patch Added

_service:tar_scm:backport-Close-file-before-replacing-signed.patch Added

_service:tar_scm:backport-Consolidate-skipped-hardlink-with-content-case-with-.patch Added

@@ -0,0 +1,56 @@
+From cc22fc694d30a64862f0b16d137deaab5416382d Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 11 Feb 2022 13:05:45 +0200
+Subject: PATCH Consolidate skipped hardlink with content case with the
+ others
+
+Handling this in a separate clause makes the logic much clearer and
+(in theory at least) lets us handle hardlinks to any content, not
+just regular files.
+---
+ lib/fsm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index ec6ee2c..82610c7 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -832,9 +832,18 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+     while (!rc && (fx = rpmfiNext(fi)) >= 0) {
+ 	struct filedata_s *fp = &fdatafx;
+ 
++	/*
++	 * Tricksy case: this file is a being skipped, but it's part of
++	 * a hardlinked set and has the actual content linked with it.
++	 * Write the content to the first non-skipped file of the set
++	 * instead.
++	 */
++	if (fp->skip && firstlink && rpmfiArchiveHasContent(fi))
++	    fp = firstlink;
++
+         if (!fp->skip) {
+ 	    /* Directories replacing something need early backup */
+-	    if (!fp->suffix) {
++	    if (!fp->suffix && fp != firstlink) {
+ 		rc = fsmBackup(fi, fp->action);
+ 	    }
+ 
+@@ -904,15 +913,6 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+                 if (!IS_DEV_LOG(fp->fpath))
+                     rc = RPMERR_UNKNOWN_FILETYPE;
+             }
+-	} else if (firstlink && rpmfiArchiveHasContent(fi)) {
+-	    /*
+-	     * Tricksy case: this file is a being skipped, but it's part of
+-	     * a hardlinked set and has the actual content linked with it.
+-	     * Write the content to the first non-skipped file of the set
+-	     * instead.
+-	     */
+-	    rc = fsmMkfile(fi, firstlink, files, psm, nodigest,
+-			   &firstlink, &firstlinkfile);
+ 	}
+ 
+ 	/* Notify on success. */
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Convert-the-file-creation-steps-the-at-family-of-cal.patch Added

@@ -0,0 +1,189 @@
+From b599e28112ce5cee98b9ffa7bd96886ec5155e9c Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 11 Feb 2022 15:35:16 +0200
+Subject: PATCH Convert the file creation steps the *at() family of calls
+
+Supposedly no functional changes here, we just need all these things
+converted before we can swap over to relative paths.
+---
+ configure.ac |  2 +-
+ lib/fsm.c    | 59 ++++++++++++++++++++++++++++++-----------------------------
+ 2 files changed, 31 insertions(+), 30 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 0099e5f..ac90037 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -581,7 +581,7 @@ AC_CHECK_FUNCS(secure_getenv __secure_getenv)
+ AC_CHECK_FUNCS(
+    mkstemp getcwd basename dirname realpath setenv unsetenv regcomp lchown \
+     utimes getline localtime_r statvfs getaddrinfo \
+-    openat mkdirat fstatat ,
++    openat mkdirat fstatat linkat symlinkat mkfifoat mknodat ,
+    , AC_MSG_ERROR(function required by rpm))
+ 
+ AC_LIBOBJ(fnmatch)
+diff --git a/lib/fsm.c b/lib/fsm.c
+index ae1bd3f..8443954 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -214,13 +214,13 @@ const char * dnlNextIterator(DNLI_t dnli)
+     return dn;
+ }
+ 
+-static int fsmLink(const char *opath, const char *path)
++static int fsmLink(int odirfd, const char *opath, int dirfd, const char *path)
+ {
+-    int rc = link(opath, path);
++    int rc = linkat(odirfd, opath, dirfd, path, 0);
+ 
+     if (_fsm_debug) {
+-	rpmlog(RPMLOG_DEBUG, " %8s (%s, %s) %s\n", __func__,
+-	       opath, path, (rc < 0 ? strerror(errno) : ""));
++	rpmlog(RPMLOG_DEBUG, " %8s (%d %s, %d %s) %s\n", __func__,
++	       odirfd, opath, dirfd, path, (rc < 0 ? strerror(errno) : ""));
+     }
+ 
+     if (rc < 0)
+@@ -139,17 +139,18 @@ static int fsmClose(FD_t *wfdp)
+     return rc;
+ }
+ 
+-static int fsmOpen(FD_t *wfdp, const char *dest)
++static int fsmOpen(FD_t *wfdp, int dirfd, const char *dest)
+ {
+     int rc = 0;
+     /* Create the file with 0200 permissions (write by owner). */
+-    {
+-	mode_t old_umask = umask(0577);
+-	*wfdp = Fopen(dest, "wx.ufdio");
+-	umask(old_umask);
++    int fd = openat(dirfd, dest, O_WRONLY|O_EXCL|O_CREAT, 0200);
++
++    if (fd >= 0) {
++	*wfdp = fdDup(fd);
++	close(fd);
+     }
+ 
+-    if (Ferror(*wfdp))
++    if (fd < 0 || Ferror(*wfdp))
+ 	rc = RPMERR_OPEN_FAILED;
+ 
+     if (_fsm_debug) {
+@@ -174,7 +175,7 @@ static int fsmUnpack(rpmfi fi, FD_t fd, rpmpsm psm, int nodigest)
+     return rc;
+ }
+ 
+-static int fsmMkfile(rpmfi fi, struct filedata_s *fp, rpmfiles files,
++static int fsmMkfile(int dirfd, rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 		     rpmpsm psm, int nodigest,
+ 		     struct filedata_s ** firstlink, FD_t *firstlinkfile)
+ {
+@@ -183,7 +184,7 @@ static int fsmMkfile(rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 
+     if (*firstlink == NULL) {
+ 	/* First encounter, open file for writing */
+-	rc = fsmOpen(&fd, fp->fpath);
++	rc = fsmOpen(&fd, dirfd, fp->fpath);
+ 	/* If it's a part of a hardlinked set, the content may come later */
+ 	if (fp->sb.st_nlink > 1) {
+ 	    *firstlink = fp;
+@@ -192,7 +193,7 @@ static int fsmMkfile(rpmfi fi, struct filedata_s *fp, rpmfiles files,
+     } else {
+ 	/* Create hard links for others and avoid redundant metadata setting */
+ 	if (*firstlink != fp) {
+-	    rc = fsmLink((*firstlink)->fpath, fp->fpath);
++	    rc = fsmLink(dirfd, (*firstlink)->fpath, dirfd, fp->fpath);
+ 	}
+ 	fd = *firstlinkfile;
+     }
+@@ -382,13 +383,13 @@ static int ensureDir(rpmPlugins plugins, const char *p, int owned, int create)
+     return dirfd;
+ }
+ 
+-static int fsmMkfifo(const char *path, mode_t mode)
++static int fsmMkfifo(int dirfd, const char *path, mode_t mode)
+ {
+-    int rc = mkfifo(path, (mode & 07777));
++    int rc = mkfifoat(dirfd, path, (mode & 07777));
+ 
+     if (_fsm_debug) {
+-	rpmlog(RPMLOG_DEBUG, " %8s (%s, 0%04o) %s\n",
+-	       __func__, path, (unsigned)(mode & 07777),
++	rpmlog(RPMLOG_DEBUG, " %8s (%d %s, 0%04o) %s\n",
++	       __func__, dirfd, path, (unsigned)(mode & 07777),
+ 	       (rc < 0 ? strerror(errno) : ""));
+     }
+ 
+@@ -398,14 +399,14 @@ static int fsmMkfifo(const char *path, mode_t mode)
+     return rc;
+ }
+ 
+-static int fsmMknod(const char *path, mode_t mode, dev_t dev)
++static int fsmMknod(int dirfd, const char *path, mode_t mode, dev_t dev)
+ {
+     /* FIX: check S_IFIFO or dev != 0 */
+-    int rc = mknod(path, (mode & ~07777), dev);
++    int rc = mknodat(dirfd, path, (mode & ~07777), dev);
+ 
+     if (_fsm_debug) {
+-	rpmlog(RPMLOG_DEBUG, " %8s (%s, 0%o, 0x%x) %s\n",
+-	       __func__, path, (unsigned)(mode & ~07777),
++	rpmlog(RPMLOG_DEBUG, " %8s (%d %s, 0%o, 0x%x) %s\n",
++	       __func__, dirfd, path, (unsigned)(mode & ~07777),
+ 	       (unsigned)dev, (rc < 0 ? strerror(errno) : ""));
+     }
+ 
+@@ -440,13 +441,13 @@ static void fsmDebug(const char *fpath, rpmFileAction action,
+ 	    (fpath ? fpath : ""));
+ }
+ 
+-static int fsmSymlink(const char *opath, const char *path)
++static int fsmSymlink(const char *opath, int dirfd, const char *path)
+ {
+-    int rc = symlink(opath, path);
++    int rc = symlinkat(opath, dirfd, path);
+ 
+     if (_fsm_debug) {
+-	rpmlog(RPMLOG_DEBUG, " %8s (%s, %s) %s\n", __func__,
+-	       opath, path, (rc < 0 ? strerror(errno) : ""));
++	rpmlog(RPMLOG_DEBUG, " %8s (%s, %d %s) %s\n", __func__,
++	       opath, dirfd, path, (rc < 0 ? strerror(errno) : ""));
+     }
+ 
+     if (rc < 0)
+@@ -884,7 +885,7 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+ 
+             if (S_ISREG(fp->sb.st_mode)) {
+ 		if (rc == RPMERR_ENOENT) {
+-		    rc = fsmMkfile(fi, fp, files, psm, nodigest,
++		    rc = fsmMkfile(di.dirfd, fi, fp, files, psm, nodigest,
+ 				   &firstlink, &firstlinkfile);
+ 		}
+             } else if (S_ISDIR(fp->sb.st_mode)) {
+@@ -896,19 +897,19 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+                 }
+             } else if (S_ISLNK(fp->sb.st_mode)) {
+ 		if (rc == RPMERR_ENOENT) {
+-		    rc = fsmSymlink(rpmfiFLink(fi), fp->fpath);
++		    rc = fsmSymlink(rpmfiFLink(fi), di.dirfd, fp->fpath);
+ 		}
+             } else if (S_ISFIFO(fp->sb.st_mode)) {
+                 /* This mimics cpio S_ISSOCK() behavior but probably isn't right */
+                 if (rc == RPMERR_ENOENT) {
+-                    rc = fsmMkfifo(fp->fpath, 0000);
++                    rc = fsmMkfifo(di.dirfd, fp->fpath, 0000);
+                 }
+             } else if (S_ISCHR(fp->sb.st_mode) ||
+                        S_ISBLK(fp->sb.st_mode) ||
+                        S_ISSOCK(fp->sb.st_mode))
+             {
+                 if (rc == RPMERR_ENOENT) {
+-                    rc = fsmMknod(fp->fpath, fp->sb.st_mode, fp->sb.st_rdev);
++                    rc = fsmMknod(di.dirfd, fp->fpath, fp->sb.st_mode, fp->sb.st_rdev);
+                 }
+             } else {
+                 /* XXX Special case /dev/log, which shouldn't be packaged anyways */
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-BANames-leak-in-handlePreambleTag.patch Added

_service:tar_scm:backport-Fix-Header-leak-when-running-rpm2cpio.patch Added

_service:tar_scm:backport-Fix-OpenPGP-key-ID-parsing-regression.patch Added

@@ -0,0 +1,28 @@
+From 7f830132fe717d4b31c035bb3d08379451e3cd81 Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Thu, 14 Apr 2022 15:38:11 -0400
+Subject: PATCH Fix OpenPGP key ID parsing regression
+
+This fixes a regression in 598a771d8b4f4f480d4990ccf59b978d537201dd,
+which caused RPM to parse key flags from a hashed key ID subpacket.  As
+a result, RPM would wrongly reject a signature that had both key ID and
+key usage flags subpackets in the hashed section.
+---
+ rpmio/rpmpgp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 93c1be2..ea3905b 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -323,6 +323,7 @@ static int pgpPrtSubType(const uint8_t *h, size_t hlen, pgpSigType sigtype,
+ 		_digp->saved |= PGPDIG_SAVED_ID;
+ 		memcpy(_digp->signid, p+1, sizeof(_digp->signid));
+ 	    }
++	    break;
+ 	case PGPSUBTYPE_KEY_FLAGS: /* Key usage flags */
+ 	    /* Subpackets in the unhashed section cannot be trusted */
+ 	    if (!hashed)
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-__cplusplus-misspelled-as-_cplusplus.patch Added

@@ -0,0 +1,39 @@
+From 989d7c593c7ab12e17ea8f486856bafac6a1ae37 Mon Sep 17 00:00:00 2001
+From: Peter Pentchev <roam@ringlet.net>
+Date: Sat, 27 Nov 2021 00:43:41 +0200
+Subject: PATCH Fix __cplusplus misspelled as _cplusplus.
+
+---
+ sign/rpmsignfiles.h  | 2 +-
+ sign/rpmsignverity.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sign/rpmsignfiles.h b/sign/rpmsignfiles.h
+index 2ff623c..a21a006 100644
+--- a/sign/rpmsignfiles.h
++++ b/sign/rpmsignfiles.h
+@@ -19,7 +19,7 @@ extern "C" {
+ RPM_GNUC_INTERNAL
+ rpmRC rpmSignFiles(Header sigh, Header h, const char *key, char *keypass);
+ 
+-#ifdef _cplusplus
++#ifdef __cplusplus
+ }
+ #endif
+ 
+diff --git a/sign/rpmsignverity.h b/sign/rpmsignverity.h
+index d869e8d..16e6c98 100644
+--- a/sign/rpmsignverity.h
++++ b/sign/rpmsignverity.h
+@@ -29,7 +29,7 @@ RPM_GNUC_INTERNAL
+ rpmRC rpmSignVerity(FD_t fd, Header sigh, Header h, char *key,
+ 		    char *keypass, char *cert, uint16_t algo);
+ 
+-#ifdef _cplusplus
++#ifdef __cplusplus
+ }
+ #endif
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-a-memleak-in-ndb-from-opened-but-not-closed-dbis.patch Added

_service:tar_scm:backport-Fix-changelog-parsing-affecting-caller-timezone-stat.patch Added

_service:tar_scm:backport-Fix-eiu-sourceURL-info-leak-in-rpmInstall.patch Added

_service:tar_scm:backport-Fix-elf-leak-in-getElfColor.patch Added

_service:tar_scm:backport-Fix-file-leak-when-src-rpm-in-URL-format-is-used-for.patch Added

@@ -0,0 +1,33 @@
+From 0b34438ccc3fdcbdaa6226d2398df88cc7439603 Mon Sep 17 00:00:00 2001
+From: xujing <xujing125@huawei.com>
+Date: Thu, 24 Nov 2022 17:16:46 +0800
+Subject: PATCH 2/3 Fix file leak when src rpm in URL format is used for
+ installation
+
+%{_tmppath}/rpm-tmp.* is created by rpmMkTempFile() when src rpm in
+URL format is used for installation, which is leaked.
+---
+ lib/rpminstall.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/lib/rpminstall.c b/lib/rpminstall.c
+index eb68deb4d..b392cf1c3 100644
+--- a/lib/rpminstall.c
++++ b/lib/rpminstall.c
+@@ -673,8 +673,12 @@ exit:
+ 	}
+     }
+     if (eiu->sourceURL != NULL) {
+-        for (i = 0; i < eiu->numSRPMS; i++)
++        for (i = 0; i < eiu->numSRPMS; i++) {
++	    if (eiu->sourceURLi == NULL) continue;
++	    if (eiu->pkgStatei == 1)
++	        (void) unlink(eiu->sourceURLi);
+ 	    eiu->sourceURLi = _free(eiu->sourceURLi);
++	}
+     }
+     eiu->pkgState = _free(eiu->pkgState);
+     eiu->pkgURL = _free(eiu->pkgURL);
+-- 
+2.33.0
+

_service:tar_scm:backport-Fix-fileleak-and-memleak-in-rpmInstall.patch Added

@@ -0,0 +1,63 @@
+From f0f983b145583eeed618cf3cbc5d39bedd8af5a5 Mon Sep 17 00:00:00 2001
+From: xujing <xujing125@huawei.com>
+Date: Mon, 28 Nov 2022 11:19:20 +0800
+Subject: PATCH 2/3 Fix fileleak and memleak in rpmInstall
+
+The "*eiu->fnp" from "eiu->pkgURLeiu->pkgx" which is alloced. when
+Fopen or rpmReadPackageFile fails in tryReadHeader, "*eiu->fnp" is
+set to NULL but not freed. In addition, if "eiu->pkgStateeiu->pkgx"
+is set, the file is leaked too. Fix it.
+
+Only resource free is added, no other logic change.
+---
+ lib/rpminstall.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/lib/rpminstall.c b/lib/rpminstall.c
+index b392cf1c3..90474fabf 100644
+--- a/lib/rpminstall.c
++++ b/lib/rpminstall.c
+@@ -355,7 +355,6 @@ static int tryReadHeader(rpmts ts, struct rpmEIU * eiu, Header * hdrp)
+ 	   fd = NULL;
+        }
+        eiu->numFailed++;
+-       *eiu->fnp = NULL;
+        return RPMRC_FAIL;
+    }
+ 
+@@ -371,7 +370,6 @@ static int tryReadHeader(rpmts ts, struct rpmEIU * eiu, Header * hdrp)
+    if (eiu->rpmrc == RPMRC_FAIL) {
+        rpmlog(RPMLOG_ERR, _("%s cannot be installed\n"), *eiu->fnp);
+        eiu->numFailed++;
+-       *eiu->fnp = NULL;
+    }
+ 
+    return RPMRC_OK;
+@@ -554,8 +552,12 @@ restart:
+ 	rpmlog(RPMLOG_DEBUG, "============== %s\n", *eiu->fnp);
+ 	(void) urlPath(*eiu->fnp, &fileName);
+ 
+-	if (tryReadHeader(ts, eiu, &h) == RPMRC_FAIL)
++	if (tryReadHeader(ts, eiu, &h) == RPMRC_FAIL) {
++	    if (eiu->pkgStateeiu->fnp - eiu->pkgURL == 1)
++		(void) unlink(*eiu->fnp);
++	    *eiu->fnp = _free(*eiu->fnp);
+ 	    continue;
++	}
+ 
+ 	if (eiu->rpmrc == RPMRC_NOTFOUND) {
+ 	    rc = tryReadManifest(eiu);
+@@ -564,6 +566,10 @@ restart:
+ 		headerFree(h);
+ 	        goto restart;
+ 	    }
++	} else if (eiu->rpmrc == RPMRC_FAIL) {
++	    if (eiu->pkgStateeiu->fnp - eiu->pkgURL == 1)
++		(void) unlink(*eiu->fnp);
++	    *eiu->fnp = _free(*eiu->fnp);
+ 	}
+ 
+ 	if (headerIsSource(h)) {
+-- 
+2.27.0
+

_service:tar_scm:backport-Fix-fileleak-when-urlGetFile-fails-in-rpmInstall.patch Added

_service:tar_scm:backport-Fix-h-blob-leak-when-installing-source-rpms.patch Added

_service:tar_scm:backport-Fix-hash-context-leak.patch Added

@@ -0,0 +1,34 @@
+From 6e9531430d70fe80b67782ed57f1526aec9ed711 Mon Sep 17 00:00:00 2001
+From: Justus Winter <justus@sequoia-pgp.org>
+Date: Thu, 28 Oct 2021 13:32:22 +0200
+Subject: PATCH Fix hash context leak
+
+The hash context is duplicated unconditionally, but there is an
+execution path exiting the function without it being finalized.
+---
+ rpmio/rpmpgp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 861f670..1e4f667 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -1310,6 +1310,7 @@ rpmRC pgpVerifySignature(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx)
+     }
+ 
+     rpmDigestFinal(ctx, (void **)&hash, &hashlen, 0);
++    ctx = NULL;
+ 
+     /* Compare leading 16 bits of digest for quick check. */
+     if (hash == NULL || memcmp(hash, sig->signhash16, 2) != 0)
+@@ -1333,6 +1334,7 @@ rpmRC pgpVerifySignature(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx)
+ 
+ exit:
+     free(hash);
++    rpmDigestFinal(ctx, NULL, NULL, 0);
+     return res;
+ 
+ }
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-hashlen-overflow.patch Added

@@ -0,0 +1,46 @@
+From 3f142b210ae0c01e1b21c2c057b12db574386e7a Mon Sep 17 00:00:00 2001
+From: Justus Winter <justus@sequoia-pgp.org>
+Date: Wed, 27 Oct 2021 09:51:13 +0200
+Subject: PATCH Fix hashlen overflow
+
+struct pgpDigParams_s keeps a copy of the verbatim key material for
+hashing.  The length of this data is kept in 'hashlen' which
+previously was a uint8_t.  However, the size of the signature's hashed
+subpacket area can be up to 2^16 bytes, and one needs to hash some of
+the signature packet's fields on top of that.
+
+Hence, 'hashlen' must be at least a uint32_t.
+
+This overflow happens in practice as soon as the signature's hashed
+subpacket area contains an embedded signature.  See section 11.1 of
+RFC4880:
+
+   Each Subkey packet MUST be followed by one Signature packet, which
+   should be a subkey binding signature issued by the top-level key.
+   For subkeys that can issue signatures, the subkey binding signature
+   MUST contain an Embedded Signature subpacket with a primary key
+   binding signature (0x19) issued by the subkey on the top-level key.
+
+While the embedded signature may be in the unhashed subpacket area
+because it is self-authenticating, it is more robust to put it in the
+hashed area.
+---
+ rpmio/digest.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/rpmio/digest.h b/rpmio/digest.h
+index 690d176..3b72a28 100644
+--- a/rpmio/digest.h
++++ b/rpmio/digest.h
+@@ -33,7 +33,7 @@ struct pgpDigParams_s {
+ 
+     uint8_t hash_algo;
+     uint8_t sigtype;
+-    uint8_t hashlen;
++    uint32_t hashlen;
+     uint8_t signhash162;
+     pgpKeyID_t signid;
+     uint8_t saved;
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-header-leak-in-rpmInstall.patch Added

@@ -0,0 +1,42 @@
+From 15a0c73f4698bc58fa2a633d46527c7813150f3a Mon Sep 17 00:00:00 2001
+From: xujing <xujing125@huawei.com>
+Date: Thu, 24 Nov 2022 10:43:11 +0800
+Subject: PATCH Fix header leak in rpmInstall()
+
+When rpm installs a package, the header from tryReadHeader()
+in rpmInstall() is leaked in some cases.
+---
+ lib/rpminstall.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/rpminstall.c b/lib/rpminstall.c
+index 9167dbdde..097599681 100644
+--- a/lib/rpminstall.c
++++ b/lib/rpminstall.c
+@@ -561,13 +561,14 @@ restart:
+ 	    rc = tryReadManifest(eiu);
+ 	    if (rc == RPMRC_OK) {
+ 	        eiu->prevx++;
++		headerFree(h);
+ 	        goto restart;
+ 	    }
+ 	}
+ 
+ 	if (headerIsSource(h)) {
++	    headerFree(h);
+ 	    if (ia->installInterfaceFlags & INSTALL_FRESHEN) {
+-		headerFree(h);
+ 	        continue;
+ 	    }
+ 	    rpmlog(RPMLOG_DEBUG, "\tadded source package %d\n",
+@@ -592,6 +593,7 @@ restart:
+ 		rpmlog(RPMLOG_ERR, _("package %s is not relocatable\n"),
+ 		       headerGetString(h, RPMTAG_NAME));
+ 		eiu->numFailed++;
++		headerFree(h);
+ 		goto exit;
+ 	    }
+ 	}
+-- 
+2.33.0
+

_service:tar_scm:backport-Fix-memleak-when-fsmRename-failed-in-fsmCommit.patch Added

_service:tar_scm:backport-Fix-memleak-when-running-generate_buildrequires.patch Added

_service:tar_scm:backport-Fix-memory-leak-in-pgpPrtParams-1.patch Added

_service:tar_scm:backport-Fix-memory-leak-in-pgpPrtParams.patch Added

@@ -0,0 +1,38 @@
+From b6dffb6dc5ffa2ddc389743f0507876cab341315 Mon Sep 17 00:00:00 2001
+From: Michal Domonkos <mdomonko@redhat.com>
+Date: Fri, 7 Jan 2022 16:10:26 +0100
+Subject: PATCH Fix memory leak in pgpPrtParams()
+
+Make sure selfsig is freed in case we break out of the loop in this
+block.
+
+Note that the tests added with the binding validation commit bd36c5d do
+not cover this code path so valgrind won't show this.
+---
+ rpmio/rpmpgp.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 1e4f667..3560328 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -1147,12 +1147,11 @@ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype,
+ 
+ 	if (selfsig) {
+ 	    /* subkeys must be followed by binding signature */
+-	    if (prevtag == PGPTAG_PUBLIC_SUBKEY) {
+-		if (selfsig->sigtype != PGPSIGTYPE_SUBKEY_BINDING)
+-		    break;
+-	    }
++	    int xx = 1; /* assume failure */
+ 
+-	    int xx = pgpVerifySelf(digp, selfsig, all, i);
++	    if (!(prevtag == PGPTAG_PUBLIC_SUBKEY &&
++		  selfsig->sigtype != PGPSIGTYPE_SUBKEY_BINDING))
++		xx = pgpVerifySelf(digp, selfsig, all, i);
+ 
+ 	    selfsig = pgpDigParamsFree(selfsig);
+ 	    if (xx)
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-old-Python-ts.check-argument-order-regression.patch Added

@@ -0,0 +1,32 @@
+From f0c158cbc8a50a776b44de2c0fe744c451155a41 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Tue, 4 Jan 2022 15:57:10 +0200
+Subject: PATCH Fix old Python ts.check() argument order regression
+
+Commit fab2debfe440d677dbd072c3cd73d2c99876e7a5 managed to mess up the
+order of the last two callback arguments, doh.
+
+Goes to show that nobody has missed this stuff in 12+ years, so it might
+be more merciful to put this thing out of its misery...
+
+Fixes: #1871
+---
+ python/rpm/transaction.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/rpm/transaction.py b/python/rpm/transaction.py
+index 991fd9a..ba39881 100644
+--- a/python/rpm/transaction.py
++++ b/python/rpm/transaction.py
+@@ -159,7 +159,7 @@ class TransactionSet(TransactionSetCore):
+                 needver = ""
+ 
+             res.append(((n, v, r),
+-                        (needname, needver), needflags, sense, p.key))
++                        (needname, needver), needflags, p.key, sense))
+ 
+         return res
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-possible-NULL-pointer-dereference-in-rpmfcClassi.patch Added

@@ -0,0 +1,39 @@
+From 1c15d748d3536a21b6edbbf9254db76fefb4b275 Mon Sep 17 00:00:00 2001
+From: Dmitry Gerasimov <d.gerasimov@omp.ru>
+Date: Mon, 27 Dec 2021 12:27:57 +0300
+Subject: PATCH Fix possible NULL pointer dereference in rpmfcClassify
+
+Here is simplified overview of possible dereference:
+
+        if (fc == NULL) {
+            rpmlog(RPMLOG_ERR, _("Empty file classifier\n"));
+            goto exit;
+        }
+
+        // ...
+
+    exit:
+        rpmstrPoolFreeze(fc->cdict, 0);
+                         ~~~~~~~~~
+
+This issue was found by Svace Static Analyzer.
+---
+ build/rpmfc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/build/rpmfc.c b/build/rpmfc.c
+index eb51a36..cf2c203 100644
+--- a/build/rpmfc.c
++++ b/build/rpmfc.c
+@@ -1168,7 +1168,7 @@ rpmRC rpmfcClassify(rpmfc fc, ARGV_t argv, rpm_mode_t * fmode)
+ 
+     if (fc == NULL) {
+ 	rpmlog(RPMLOG_ERR, _("Empty file classifier\n"));
+-	goto exit;
++	return RPMRC_FAIL;
+     }
+ 
+     /* It is OK when we have no files to classify. */
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-possible-descriptor-leak-in-fsmOpenat.patch Added

@@ -0,0 +1,45 @@
+From af08077fb4c60dee516948ce7bf9bed91de62119 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Tue, 13 Sep 2022 10:26:05 +0300
+Subject: PATCH Fix possible descriptor leak in fsmOpenat()
+
+For the very unlikely case when openat() succeeded but fstatat()
+doesn't, the directory descriptor may be leaved opened. Rearrange
+the code a bit to ensure it'll always get closed when appropriate.
+
+Suggested-by: Pavel Kopylov <pkopylov@cloudlinux.com>
+Suggested-by: Dmitry Antipov <dantipov@cloudlinux.com>
+---
+ lib/fsm.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index e4ec07e..c9ab3e1 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -427,14 +427,16 @@ static int fsmOpenat(int dirfd, const char *path, int flags)
+      */
+     if (fd < 0 && errno == ELOOP && flags != sflags) {
+ 	int ffd = openat(dirfd, path, flags);
+-	if (ffd >= 0 && fstatat(dirfd, path, &lsb, AT_SYMLINK_NOFOLLOW) == 0) {
+-	    if (fstat(ffd, &sb) == 0) {
+-		if (lsb.st_uid == 0 || lsb.st_uid == sb.st_uid) {
+-		    fd = ffd;
+-		} else {
+-		    close(ffd);
++	if (ffd >= 0) {
++	    if (fstatat(dirfd, path, &lsb, AT_SYMLINK_NOFOLLOW) == 0) {
++		if (fstat(ffd, &sb) == 0) {
++		    if (lsb.st_uid == 0 || lsb.st_uid == sb.st_uid) {
++			fd = ffd;
++		    }
+ 		}
+ 	    }
++	    if (ffd != fd)
++		close(ffd);
+ 	}
+     }
+     return fd;
+-- 
+2.33.0
+

_service:tar_scm:backport-Fix-prog-leak-in-parseScript.patch Added

@@ -0,0 +1,35 @@
+From c013821c0c9350b67d9f9a02848e1a7f87fa180b Mon Sep 17 00:00:00 2001
+From: xujing <xujing125@huawei.com>
+Date: Fri, 25 Nov 2022 17:04:11 +0800
+Subject: PATCH 2/5 Fix prog leak in parseScript
+
+The "prog" will be alloced when using "-p" options, which cause src
+"proc" leak. Add "origproc" to point to src "proc" to fix it.
+---
+ build/parseScript.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/build/parseScript.c b/build/parseScript.c
+index df7919238..f8b693ac6 100644
+--- a/build/parseScript.c
++++ b/build/parseScript.c
+@@ -102,6 +102,7 @@ int parseScript(rpmSpec spec, int parsePart)
+     poptContext optCon = NULL;
+     char *name = NULL;
+     char *prog = xstrdup("/bin/sh");
++    char *origprog = prog;
+     char *file = NULL;
+     int priority = 1000000;
+     struct poptOption optionsTable = {
+@@ -482,6 +483,8 @@ exit:
+     free(reqargs);
+     freeStringBuf(sb);
+     free(progArgv);
++    if (origprog != prog)
++	free(origprog);
+     free(prog);
+     free(name);
+     free(file);
+-- 
+2.27.0
+

_service:tar_scm:backport-Fix-return-value-checks-in-OpenSSL-code.patch Added

@@ -0,0 +1,131 @@
+From 1ddaeddffa52f02db198417ebf73cb6c5d432250 Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Sun, 7 Feb 2021 16:46:31 -0500
+Subject: PATCH Fix return value checks in OpenSSL code
+
+According to `man 3ssl` the only successful return value for
+EVP_PKEY_verify_init() is 1, and EVP_PKEY_CTX_set_rsa_padding() and
+EVP_PKEY_CTX_set_signature_md() can both return 0 or a negative number
+on failure or any positive number on success.  BN_bn2binpad() returns -1
+on error, but 0 (an empty key or signature) is also not valid.
+Therefore use != 1 to check the return value of EVP_PKEY_verify_init(),
+<= 0 to check the return values of the other three functions mentioned
+above.  Also delete a bunch of cruft.
+---
+ rpmio/digest_openssl.c | 55 +++++++++++---------------------------------------
+ 1 file changed, 12 insertions(+), 43 deletions(-)
+
+diff --git a/rpmio/digest_openssl.c b/rpmio/digest_openssl.c
+index 0cb781e..20c272d 100644
+--- a/rpmio/digest_openssl.c
++++ b/rpmio/digest_openssl.c
+@@ -450,7 +450,7 @@ static void pgpFreeSigRSA(pgpDigAlg pgpsig)
+ static int pgpVerifySigRSA(pgpDigAlg pgpkey, pgpDigAlg pgpsig,
+                            uint8_t *hash, size_t hashlen, int hash_algo)
+ {
+-    int rc, ret;
++    int rc = 1; /* assume failure */
+     EVP_PKEY_CTX *pkey_ctx = NULL;
+     struct pgpDigSigRSA_s *sig = pgpsig->data;
+ 
+@@ -458,53 +458,32 @@ static int pgpVerifySigRSA(pgpDigAlg pgpkey, pgpDigAlg pgpsig,
+ 
+     struct pgpDigKeyRSA_s *key = pgpkey->data;
+ 
+-    if (!constructRSASigningKey(key)) {
+-        rc = 1;
++    if (!constructRSASigningKey(key))
+         goto done;
+-    }
+ 
+     pkey_ctx = EVP_PKEY_CTX_new(key->evp_pkey, NULL);
+-    if (!pkey_ctx) {
+-        rc = 1;
++    if (!pkey_ctx)
+         goto done;
+-    }
+ 
+-    ret = EVP_PKEY_verify_init(pkey_ctx);
+-    if (ret < 0) {
+-        rc = 1;
++    if (EVP_PKEY_verify_init(pkey_ctx) != 1)
+         goto done;
+-    }
+ 
+-    ret = EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PADDING);
+-    if (ret < 0) {
+-        rc = 1;
++    if (EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PADDING) <= 0)
+         goto done;
+-    }
+ 
+-    ret = EVP_PKEY_CTX_set_signature_md(pkey_ctx, getEVPMD(hash_algo));
+-    if (ret < 0) {
+-        rc = 1;
++    if (EVP_PKEY_CTX_set_signature_md(pkey_ctx, getEVPMD(hash_algo)) <= 0)
+         goto done;
+-    }
+ 
+     int pkey_len = EVP_PKEY_size(key->evp_pkey);
+     padded_sig = xcalloc(1, pkey_len);
+-    if (!BN_bn2binpad(sig->bn, padded_sig, pkey_len)) {
+-        rc = 1;
++    if (BN_bn2binpad(sig->bn, padded_sig, pkey_len) <= 0)
+         goto done;
+-    }
+ 
+-    ret = EVP_PKEY_verify(pkey_ctx, padded_sig, pkey_len, hash, hashlen);
+-    if (ret == 1)
++    if (EVP_PKEY_verify(pkey_ctx, padded_sig, pkey_len, hash, hashlen) == 1)
+     {
+         /* Success */
+         rc = 0;
+     }
+-    else
+-    {
+-        /* Failure */
+-        rc = 1;
+-    }
+ 
+ done:
+     EVP_PKEY_CTX_free(pkey_ctx);
+@@ -735,32 +714,22 @@ static void pgpFreeSigDSA(pgpDigAlg pgpsig)
+ static int pgpVerifySigDSA(pgpDigAlg pgpkey, pgpDigAlg pgpsig,
+                            uint8_t *hash, size_t hashlen, int hash_algo)
+ {
+-    int rc, ret;
++    int rc = 1; /* assume failure */
+     struct pgpDigSigDSA_s *sig = pgpsig->data;
+ 
+     struct pgpDigKeyDSA_s *key = pgpkey->data;
+ 
+-    if (!constructDSASigningKey(key)) {
+-        rc = 1;
++    if (!constructDSASigningKey(key))
+         goto done;
+-    }
+ 
+-    if (!constructDSASignature(sig)) {
+-        rc = 1;
++    if (!constructDSASignature(sig))
+         goto done;
+-    }
+ 
+-    ret = DSA_do_verify(hash, hashlen, sig->dsa_sig, key->dsa_key);
+-    if (ret == 1)
++    if (DSA_do_verify(hash, hashlen, sig->dsa_sig, key->dsa_key) == 1)
+     {
+         /* Success */
+         rc = 0;
+     }
+-    else
+-    {
+-        /* Failure */
+-        rc = 1;
+-    }
+ 
+ done:
+     return rc;
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-rpm-lua-rpm_vercmp-error-message-if-second-argum.patch Added

_service:tar_scm:backport-Fix-sanitize-the-hardlink-metadata-setting-logic.patch Added

@@ -0,0 +1,67 @@
+From dce44771b2a3325b3dc1ebfe41027df9910a39fd Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 11 Feb 2022 13:18:11 +0200
+Subject: PATCH Fix + sanitize the hardlink metadata setting logic
+
+Fix the initial setmeta value to something meaningful: we will never
+set metadata on skipped files, and hardlinks are handled with a special
+logic during install. They'd need different kind of special logic on
+FA_TOUCH so just play it safe and always apply metadata on those.
+
+Harlink metadata setting on install should happen on the *last* entry
+of hardlinked set that gets installed (wrt various skip scenarios)
+as otherwise creating those additional links affects the timestamp.
+Note in particular the "last file of..." case in fsmMkfile() where we
+the comment said just that, but set the metadata on the *first* file
+which would then be NULL'ed away.
+
+This all gets current masked by the fact that we do the metadata setting on
+a separate round, but that is about to change plus this makes the overall
+logic clearer anyhow.
+---
+ lib/fsm.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index 82610c7..d9cfe6f 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -193,7 +193,6 @@ static int fsmMkfile(rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 	/* Create hard links for others and avoid redundant metadata setting */
+ 	if (*firstlink != fp) {
+ 	    rc = fsmLink((*firstlink)->fpath, fp->fpath);
+-	    fp->setmeta = 0;
+ 	}
+ 	fd = *firstlinkfile;
+     }
+@@ -204,7 +203,7 @@ static int fsmMkfile(rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 	    rc = fsmUnpack(fi, fd, psm, nodigest);
+ 	/* Last file of hardlink set, ensure metadata gets set */
+ 	if (*firstlink) {
+-	    (*firstlink)->setmeta = 1;
++	    fp->setmeta = 1;
+ 	    *firstlink = NULL;
+ 	    *firstlinkfile = NULL;
+ 	}
+@@ -797,7 +796,6 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+ 	else
+ 	    fp->action = rpmfsGetAction(fs, fx);
+ 	fp->skip = XFA_SKIPPING(fp->action);
+-	fp->setmeta = 1;
+ 	if (XFA_CREATING(fp->action) && !S_ISDIR(rpmfiFMode(fi)))
+ 	    fp->suffix = tid;
+ 	fp->fpath = fsmFsPath(fi, fp->suffix);
+@@ -805,6 +803,10 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+ 	/* Remap file perms, owner, and group. */
+ 	rc = rpmfiStat(fi, 1, &fp->sb);
+ 
++	/* Hardlinks are tricky and handled elsewhere for install */
++	fp->setmeta = (fp->skip == 0) &&
++		      (fp->sb.st_nlink == 1 || fp->action == FA_TOUCH);
++
+ 	setFileState(fs, fx);
+ 	fsmDebug(fp->fpath, fp->action, &fp->sb);
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-sbp-leak-when-running-rpmbuild-with-quiet.patch Added

@@ -0,0 +1,28 @@
+From 6130bd31038ff17a03fcac6ec7e41ac744163dde Mon Sep 17 00:00:00 2001
+From: xujing <xujing125@huawei.com>
+Date: Sat, 26 Nov 2022 11:39:48 +0800
+Subject: PATCH 4/5 Fix *sbp leak when running rpmbuild with --quiet
+
+When running rpmbuild with --quiet, the "*sbp" may be alloced many
+times in buildSpec by calling doScript but only freed once. Fix it.
+---
+ build/build.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/build/build.c b/build/build.c
+index 9cd569b83..4437f6c9c 100644
+--- a/build/build.c
++++ b/build/build.c
+@@ -216,6 +216,9 @@ rpmRC doScript(rpmSpec spec, rpmBuildFlags what, const char *name,
+     buildCmd = rpmExpand(mCmd, " ", scriptName, NULL);
+     (void) poptParseArgvString(buildCmd, &argc, &argv);
+ 
++    if (sb_stdoutp && *sb_stdoutp)
++	*sb_stdoutp = freeStringBuf(*sb_stdoutp);
++
+     rpmlog(RPMLOG_NOTICE, _("Executing(%s): %s\n"), name, buildCmd);
+     if (rpmfcExec((ARGV_const_t)argv, NULL, sb_stdoutp, 1,
+ 		  spec->buildSubdir)) {
+-- 
+2.27.0
+

_service:tar_scm:backport-Fix-short-circuiting-of-version-strings-in-expressio.patch Added

@@ -0,0 +1,50 @@
+From 321933f060896f721e361a1c8a8d3731bdcee827 Mon Sep 17 00:00:00 2001
+From: Michael Schroeder <mls@suse.de>
+Date: Wed, 22 Jun 2022 14:07:01 +0200
+Subject: PATCH Fix short circuiting of version strings in expressions
+
+We use an empty string when discarding a value due to short circuiting, but
+an empty string is not allowed for versions. So use "0" in that case.
+
+Fixes: #1883
+---
+ rpmio/expression.c | 2 +-
+ tests/rpmmacro.at  | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/rpmio/expression.c b/rpmio/expression.c
+index a389a04..98a44bb 100644
+--- a/rpmio/expression.c
++++ b/rpmio/expression.c
+@@ -477,7 +477,7 @@ static int rdToken(ParseState state)
+       if (qtok == TOK_STRING) {
+ 	v = valueMakeString(temp);
+       } else {
+-	v = valueMakeVersion(temp);
++	v = valueMakeVersion(state->flags & RPMEXPR_DISCARD ? "0" : temp);
+         free(temp); /* version doesn't take ownership of the string */
+         if (v == 0) {
+ 	  exprErr(state, _("invalid version"), p+1);
+diff --git a/tests/rpmmacro.at b/tests/rpmmacro.at
+index d1490b4..c4376d4 100644
+--- a/tests/rpmmacro.at
++++ b/tests/rpmmacro.at
+@@ -533,6 +533,7 @@ runroot rpm \
+     --eval '%"%{aaa}"' \
+     --eval '%%{?ccc}' \
+     --eval '%v"1:2.3-4"' \
++    --eval '%v"0" && v"0"' \
+ ,
+ 0,
+ 4096
+@@ -542,6 +543,7 @@ runroot rpm \
+ 5
+ 0
+ 1:2.3-4
++0
+ ,
+ )
+ AT_CLEANUP
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Fix-some-Lua-stack-leaks-in-our-initialization-code.patch Added

_service:tar_scm:backport-Fix-use-after-free-in-haveSignature.patch Added

@@ -0,0 +1,33 @@
+From ae3d2d234ae47ff85229d3fce97a266fa1aa5a61 Mon Sep 17 00:00:00 2001
+From: Michal Domonkos <mdomonko@redhat.com>
+Date: Fri, 7 Jan 2022 13:57:24 +0100
+Subject: PATCH Fix use-after-free in haveSignature()
+
+pgpPrtParams() may leave sig2 unchanged and if we're not in the very
+first iteration of the while() loop, we could pass a freed pointer to
+pgpDigParamsCmp().  Fix by setting it to NULL after freeing.
+
+Found by Coverity, after commit bd36c5d (subkey binding validation),
+although note that the commit didn't introduce this bug; it just seems
+to have been a false negative that got "fixed" by the changes in
+pgpPrtParams() in that commit.
+---
+ sign/rpmgensig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
+index d8c84e9..e88f9b7 100644
+--- a/sign/rpmgensig.c
++++ b/sign/rpmgensig.c
+@@ -364,7 +364,7 @@ static int haveSignature(rpmtd sigtd, Header h)
+ 	pgpPrtParams(oldtd.data, oldtd.count, PGPTAG_SIGNATURE, &sig2);
+ 	if (pgpDigParamsCmp(sig1, sig2) == 0)
+ 	    rc = 1;
+-	pgpDigParamsFree(sig2);
++	sig2 = pgpDigParamsFree(sig2);
+     }
+     pgpDigParamsFree(sig1);
+     rpmtdFreeData(&oldtd);
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Ignore-subkeys-that-cannot-be-used-for-signing.patch Added

@@ -0,0 +1,104 @@
+From a9cca032a2b7c0c6bcacc6ab4ecd25c95cc75305 Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Sun, 27 Mar 2022 12:49:07 -0400
+Subject: PATCH Ignore subkeys that cannot be used for signing
+
+This ensures that a signature is only accepted if the subkey that made
+it is actually allowed to sign.  Test 265 verifies that RPM ignores
+subkeys that cannot sign.
+
+A subkey is considered to be capable of signing if, and only if, its
+subkey binding signature has a hashed key flags subpacket that contains
+the flag 0x02.  RFC4880 requires that the subkey binding signature be
+v4, which this requirement enforces implicitly.  RFC4880 also requires
+that primary key binding signatures be present and checked.  This is not
+yet implemented, but may be implemented later.
+
+Fixes #1911.
+---
+ rpmio/rpmpgp.c     | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
+ tests/rpmsigdig.at |  2 --
+ 2 files changed, 47 insertions(+), 3 deletions(-)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 66837b1..22ac9c8 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -1133,6 +1133,31 @@ static int pgpVerifySelf(pgpDigParams key, pgpDigParams selfsig,
+     return rc;
+ }
+ 
++static int parseSubkeySig(const struct pgpPkt *pkt, uint8_t tag,
++			  pgpDigParams *params_p) {
++    pgpDigParams params = *params_p = NULL; /* assume failure */
++
++    if (pkt->tag != PGPTAG_SIGNATURE)
++	goto fail;
++
++    params = pgpDigParamsNew(tag);
++
++    if (pgpPrtSig(tag, pkt->body, pkt->blen, params))
++	goto fail;
++
++    if (params->sigtype != PGPSIGTYPE_SUBKEY_BINDING &&
++	params->sigtype != PGPSIGTYPE_SUBKEY_REVOKE)
++    {
++	goto fail;
++    }
++
++    *params_p = params;
++    return 0;
++fail:
++    pgpDigParamsFree(params);
++    return -1;
++}
++
+ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype,
+ 		 pgpDigParams * ret)
+ {
+@@ -1238,7 +1263,28 @@ int pgpPrtParamsSubkeys(const uint8_t *pkts, size_t pktlen,
+ 		pgpDigParamsFree(digpscount);
+ 		continue;
+ 	    }
+-	    count++;
++
++	    pgpDigParams subkey_sig = NULL;
++	    if (decodePkt(p, pend - p, &pkt) ||
++	        parseSubkeySig(&pkt, 0, &subkey_sig))
++	    {
++		pgpDigParamsFree(digpscount);
++		break;
++	    }
++
++	    /* Is the subkey revoked or incapable of signing? */
++	    int ignore = subkey_sig->sigtype != PGPSIGTYPE_SUBKEY_BINDING ||
++			 !((subkey_sig->saved & PGPDIG_SIG_HAS_KEY_FLAGS) &&
++			   (subkey_sig->key_flags & 0x02));
++	    if (ignore) {
++		pgpDigParamsFree(digpscount);
++	    } else {
++		digpscount->key_flags = subkey_sig->key_flags;
++		digpscount->saved |= PGPDIG_SIG_HAS_KEY_FLAGS;
++		count++;
++	    }
++	    p += (pkt.body - pkt.head) + pkt.blen;
++	    pgpDigParamsFree(subkey_sig);
+ 	}
+     }
+     rc = (p == pend) ? 0 : -1;
+diff --git a/tests/rpmsigdig.at b/tests/rpmsigdig.at
+index 5d781d8..ab9b473 100644
+--- a/tests/rpmsigdig.at
++++ b/tests/rpmsigdig.at
+@@ -247,8 +247,6 @@ UNW2iqnN3BA7guhOv6OMiROF1+I7Q5nWT63mQC7IgQ==
+ gpg(rpm.org RSA testkey <rsa@rpm.org>) = 4:4344591e1964c5fc-58e63918
+ gpg(1964c5fc) = 4:4344591e1964c5fc-58e63918
+ gpg(4344591e1964c5fc) = 4:4344591e1964c5fc-58e63918
+-gpg(f00650f8) = 4:185e6146f00650f8-58e63918
+-gpg(185e6146f00650f8) = 4:185e6146f00650f8-58e63918
+ ,
+ )
+ AT_CLEANUP
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Make-pgpPubkeyFingerprint-do-something-meaningful-ag.patch Added

@@ -0,0 +1,64 @@
+From dc9e8169790eba18130fb96c13f56ecba6c9b346 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Tue, 6 Sep 2022 09:28:10 +0300
+Subject: PATCH Make pgpPubkeyFingerprint() do something meaningful again
+
+Commit 4bbeec134aab33e24f960be28a7b2198359c1f67 "fixed" an old
+terminology confusion about keyid vs fingerprint, but in the process
+broke pgpPubkeyFingerprint() for any external callers, as it now only
+feeds on decoded packets whereas before it did the decoding by itself.
+Add the decoding step back to the public function to make it usable outside
+rpmpgp_internal.c again, retrieving a fingerprint seems like an useful
+(public) API to have.
+
+This is kind of a regression fix in that prior to commit
+4bbeec134aab33e24f960be28a7b2198359c1f67 pgpPubkeyFingerprint() returned
+meaningful data to the outside caller and afterwards it didn't, however
+that commit broke the API anyhow so it's kinda complicated.
+Maybe we should just call it a bugfix and be done with it.
+
+Related to #1549
+---
+ rpmio/rpmpgp.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index d4dd4b89d..8d0d76869 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -650,7 +650,7 @@ static int pgpPrtUserID(pgpTag tag, const uint8_t *h, size_t hlen,
+     return 0;
+ }
+ 
+-int pgpPubkeyFingerprint(const uint8_t *h, size_t hlen,
++static int getPubkeyFingerprint(const uint8_t *h, size_t hlen,
+ 			  uint8_t **fp, size_t *fplen)
+ {
+     int rc = -1; /* assume failure */
+@@ -717,11 +717,22 @@ int pgpPubkeyFingerprint(const uint8_t *h, size_t hlen,
+     return rc;
+ }
+ 
++int pgpPubkeyFingerprint(const uint8_t * pkt, size_t pktlen,
++                         uint8_t **fp, size_t *fplen)
++{
++    struct pgpPkt p;
++
++    if (decodePkt(pkt, pktlen, &p))
++	return -1;
++
++    return getPubkeyFingerprint(p.body, p.blen, fp, fplen);
++}
++
+ static int getKeyID(const uint8_t *h, size_t hlen, pgpKeyID_t keyid)
+ {
+     uint8_t *fp = NULL;
+     size_t fplen = 0;
+-    int rc = pgpPubkeyFingerprint(h, hlen, &fp, &fplen);
++    int rc = getPubkeyFingerprint(h, hlen, &fp, &fplen);
+     if (fp && fplen > 8) {
+ 	memcpy(keyid, (fp + (fplen-8)), 8);
+ 	free(fp);
+-- 
+2.33.0
+

_service:tar_scm:backport-Make-rpmfiSetFX-return-code-meaningful.patch Added

@@ -0,0 +1,51 @@
+From 318efbaec80a90f1d9ac76d0cd433f6ea3c103fa Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Thu, 10 Feb 2022 10:07:06 +0200
+Subject: PATCH Make rpmfiSetFX() return code meaningful
+
+Up to now, rpmfiSetFX() has returned the previous file index on success,
+and -1 on error. Which seems okay on the outset, but on a just
+initialized iterator the file index is at -1 which means the returned
+-1 sometimes indicates an error and sometimes success. This is so broken
+that none of the callers even try to use it (grep for it). Which is
+lucky in the sense that it means we can change it.
+
+Simply return the newly set index on success and -1 on error, it may
+not be the greatest return code on earth but at least it's
+non-ambiguous.
+---
+ lib/rpmfi.c | 2 +-
+ lib/rpmfi.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/rpmfi.c b/lib/rpmfi.c
+index 30e0738..4965aee 100644
+--- a/lib/rpmfi.c
++++ b/lib/rpmfi.c
+@@ -314,9 +314,9 @@ int rpmfiSetFX(rpmfi fi, int fx)
+     int i = -1;
+ 
+     if (fi != NULL && fx >= 0 && fx < rpmfilesFC(fi->files)) {
+-	i = fi->i;
+ 	fi->i = fx;
+ 	fi->j = rpmfilesDI(fi->files, fi->i);
++	i = fi->i;
+     }
+     return i;
+ }
+diff --git a/lib/rpmfi.h b/lib/rpmfi.h
+index 989582b..52310c6 100644
+--- a/lib/rpmfi.h
++++ b/lib/rpmfi.h
+@@ -39,7 +39,7 @@ int rpmfiFX(rpmfi fi);
+  * Set current file index in file info set iterator.
+  * @param fi		file info set iterator
+  * @param fx		new file index
+- * @return		current file index
++ * @return		new file index, -1 on error
+  */
+ int rpmfiSetFX(rpmfi fi, int fx);
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Move-file-metadata-setting-back-to-unpack-stage.patch Added

@@ -0,0 +1,69 @@
+From da79e3c3ae7da8719f0bf87a1a60e046597b8240 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 11 Feb 2022 13:28:25 +0200
+Subject: PATCH Move file metadata setting back to unpack stage
+
+Commit a82251b44ee2d2802ee8aea1b3d89f88beee4bad moved metadata setting
+to a separate step because there are potential benefits to doing so, but
+the current downsides are worse: as long as we operate in potentially
+untrusted directories, we'd need to somehow verify the content is what we
+initially laid down to avoid possible privilege escalation from non-root
+owned directories.
+
+This commit does not fix that vulnerability, only makes the window much
+smaller and paves the way for the real fix(es) without introducing a
+second round of directory tree validation chase to the picture.
+---
+ lib/fsm.c | 22 +++++++---------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index d9cfe6fa9..ae1bd3f48 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -880,7 +880,7 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+ 
+ 	    /* When touching we don't need any of this... */
+ 	    if (fp->action == FA_TOUCH)
+-		continue;
++		goto setmeta;
+ 
+             if (S_ISREG(fp->sb.st_mode)) {
+ 		if (rc == RPMERR_ENOENT) {
+@@ -1143,6 +1143,12 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+ 		    rc = RPMERR_OPEN_FAILED;
+ 	    }
+ 
++setmeta:
++	    if (!rc && fp->setmeta) {
++		rc = fsmSetmeta(fp->fpath, fi, plugins, fp->action,
++				&fp->sb, nofcaps);
++	    }
++
+ 	    if (fd != firstlinkfile)
+ 		fsmClose(&fd);
+ 	}
+@@ -931,20 +937,6 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+     if (!rc && fx < 0 && fx != RPMERR_ITER_END)
+ 	rc = fx;
+ 
+-    /* Set permissions, timestamps etc for non-hardlink entries */
+-    fi = rpmfilesIter(files, RPMFI_ITER_FWD);
+-    while (!rc && (fx = rpmfiNext(fi)) >= 0) {
+-	struct filedata_s *fp = &fdatafx;
+-	if (!fp->skip && fp->setmeta) {
+-	    rc = fsmSetmeta(fp->fpath, fi, plugins, fp->action,
+-			    &fp->sb, nofcaps);
+-	}
+-	if (rc)
+-	    *failedFile = xstrdup(fp->fpath);
+-	fp->stage = FILE_PREP;
+-    }
+-    fi = rpmfiFree(fi);
+-
+     /* If all went well, commit files to final destination */
+     fi = rpmfilesIter(files, RPMFI_ITER_FWD);
+     while (!rc && (fx = rpmfiNext(fi)) >= 0) {
+-- 
+2.27.0
+

_service:tar_scm:backport-Parse-key-usage-flags.patch Added

@@ -0,0 +1,78 @@
+From 598a771d8b4f4f480d4990ccf59b978d537201dd Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Sun, 27 Mar 2022 12:07:34 -0400
+Subject: PATCH Parse key usage flags
+
+RPM needs to know if a subkey can be used for signing.  Signatures made
+by a subkey that cannot be used for signing are invalid.  Add a
+key_flags member to pgpDigParams_s to store this information, and a
+PGPDIG_SIG_HAS_KEY_FLAGS flag to indicate that it is valid.  The key
+usage flags are reset for every signature.  Key usage flags in the
+unhashed section are ignored.  If there is more than one key usage flags
+subpacket in the hashed section, the signature is rejected.
+---
+ rpmio/digest.h |  2 ++
+ rpmio/rpmpgp.c | 13 ++++++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/rpmio/digest.h b/rpmio/digest.h
+index ec7f339..6a326d2 100644
+--- a/rpmio/digest.h
++++ b/rpmio/digest.h
+@@ -28,6 +28,7 @@ struct pgpDigParams_s {
+     const uint8_t * data;
+     uint8_t tag;
+ 
++    uint8_t key_flags;		/*!< key usage flags */
+     uint8_t version;		/*!< version number. */
+     uint32_t time;		/*!< key/signature creation time. */
+     uint8_t pubkey_algo;		/*!< public key algorithm. */
+@@ -41,6 +42,7 @@ struct pgpDigParams_s {
+ #define	PGPDIG_SAVED_TIME	(1 << 0)
+ #define	PGPDIG_SAVED_ID		(1 << 1)
+ #define	PGPDIG_SIG_HAS_CREATION_TIME	(1 << 2)
++#define	PGPDIG_SIG_HAS_KEY_FLAGS	(1 << 3)
+ 
+     pgpDigAlg alg;
+ };
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 9b8503e..66837b1 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -500,6 +500,17 @@ static int pgpPrtSubType(const uint8_t *h, size_t hlen, pgpSigType sigtype,
+ 		_digp->saved |= PGPDIG_SAVED_ID;
+ 		memcpy(_digp->signid, p+1, sizeof(_digp->signid));
+ 	    }
++	case PGPSUBTYPE_KEY_FLAGS: /* Key usage flags */
++	    /* Subpackets in the unhashed section cannot be trusted */
++	    if (!hashed)
++		break;
++	    /* Reject duplicate key usage flags */
++	    if (_digp->saved & PGPDIG_SIG_HAS_KEY_FLAGS)
++		return 1;
++	    impl = *p;
++	    _digp->saved |= PGPDIG_SIG_HAS_KEY_FLAGS;
++	    _digp->key_flags = plen >= 2 ? p1 : 0;
++	    break;
+ 	case PGPSUBTYPE_EXPORTABLE_CERT:
+ 	case PGPSUBTYPE_TRUST_SIG:
+ 	case PGPSUBTYPE_REGEX:
+@@ -510,7 +521,6 @@ static int pgpPrtSubType(const uint8_t *h, size_t hlen, pgpSigType sigtype,
+ 	case PGPSUBTYPE_PREFER_KEYSERVER:
+ 	case PGPSUBTYPE_PRIMARY_USERID:
+ 	case PGPSUBTYPE_POLICY_URL:
+-	case PGPSUBTYPE_KEY_FLAGS:
+ 	case PGPSUBTYPE_SIGNER_USERID:
+ 	case PGPSUBTYPE_REVOKE_REASON:
+ 	case PGPSUBTYPE_FEATURES:
+@@ -602,6 +612,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 
+     /* Reset the saved flags */
+     _digp->saved &= PGPDIG_SAVED_TIME | PGPDIG_SAVED_ID;
++    _digp->key_flags = 0;
+ 
+     if (pgpVersion(h, hlen, &version))
+ 	return rc;
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Prevent-NULL-deref-in-rpmfsGetStates.patch Added

_service:tar_scm:backport-Prevent-readelf-internet-access-during-rpaths-checki.patch Added

@@ -0,0 +1,32 @@
+From 3cec59812c8126088a51924c6aeea112ce9b545a Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Wed, 22 Jun 2022 13:22:00 +0300
+Subject: PATCH Prevent readelf internet access during rpaths checking
+ (RhBug:2079600)
+
+Recent binutils can do debug section lookups over the internet, but this
+is something we never want during rpmbuild (everything else aside, we're
+just building the thing so there wont be anything on the net anyhow).
+Disable the lookups by setting DEBUGINFOD_URLS to empty rather than
+using the specific option as this is compatible with any old version of
+readelf.
+---
+ scripts/check-rpaths-worker | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/check-rpaths-worker b/scripts/check-rpaths-worker
+index e32e823..26f74f0 100755
+--- a/scripts/check-rpaths-worker
++++ b/scripts/check-rpaths-worker
+@@ -94,7 +94,7 @@ function msg()
+ 
+ function check_rpath() {
+     pos=0
+-    rpath=$(readelf -W -d "$1" 2>/dev/null | LANG=C grep -E "$(RPATH|RUNPATH)$.*:") || return 0
++    rpath=$(DEBUGINFOD_URLS="" readelf -W -d "$1" 2>/dev/null | LANG=C grep -E "$(RPATH|RUNPATH)$.*:") || return 0
+     rpath=$(echo "$rpath" | LANG=C sed -e "s!.*$RPATH\|RUNPATH$.*: \$.*$\!\2!p;d")
+ 
+     tmp=aux:$rpath:/lib/aux || :
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Process-MPI-s-from-all-kinds-of-signatures.patch Added

@@ -0,0 +1,57 @@
+From b5e8bc74b2b05aa557f663fe227b94d2bc64fbd8 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Thu, 30 Sep 2021 09:51:10 +0300
+Subject: PATCH Process MPI's from all kinds of signatures
+
+No immediate effect but needed by the following commits.
+---
+ rpmio/rpmpgp.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index ee5c81e..340de5f 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -543,7 +543,7 @@ pgpDigAlg pgpDigAlgFree(pgpDigAlg alg)
+     return NULL;
+ }
+ 
+-static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype,
++static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo,
+ 		const uint8_t *p, const uint8_t *h, size_t hlen,
+ 		pgpDigParams sigp)
+ {
+@@ -556,10 +556,8 @@ static int pgpPrtSigParams(pgpTag tag, uint8_t pubkey_algo, uint8_t sigtype,
+ 	int mpil = pgpMpiLen(p);
+ 	if (pend - p < mpil)
+ 	    break;
+-	if (sigtype == PGPSIGTYPE_BINARY || sigtype == PGPSIGTYPE_TEXT) {
+-	    if (sigalg->setmpi(sigalg, i, p))
+-		break;
+-	}
++	if (sigalg->setmpi(sigalg, i, p))
++	    break;
+ 	p += mpil;
+     }
+ 
+@@ -618,7 +618,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 
+ 	p = ((uint8_t *)v) + sizeof(*v);
+ 	_digp->data = p;
+-	rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp);
++	rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp);
+     }	break;
+     case 4:
+     {   pgpPktSigV4 v = (pgpPktSigV4)h;
+@@ -678,7 +678,7 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 	    return 1;
+ 
+ 	_digp->data = p;
+-	rc = pgpPrtSigParams(tag, v->pubkey_algo, v->sigtype, p, h, hlen, _digp);
++	rc = pgpPrtSigParams(tag, v->pubkey_algo, p, h, hlen, _digp);
+     }	break;
+     default:
+ 	rpmlog(RPMLOG_WARNING, _("Unsupported version of signature: V%d\n"), version);
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Refactor-pgpDigParams-construction-to-helper-functio.patch Added

@@ -0,0 +1,52 @@
+From 9f03f42e2614a68f589f9db8fe76287146522c0c Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Thu, 30 Sep 2021 09:56:20 +0300
+Subject: PATCH Refactor pgpDigParams construction to helper function
+
+No functional changes, just to reduce code duplication and needed by
+the following commits.
+---
+ rpmio/rpmpgp.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index 340de5f..aad7c27 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -1055,6 +1055,13 @@ unsigned int pgpDigParamsAlgo(pgpDigParams digp, unsigned int algotype)
+     return algo;
+ }
+ 
++static pgpDigParams pgpDigParamsNew(uint8_t tag)
++{
++    pgpDigParams digp = xcalloc(1, sizeof(*digp));
++    digp->tag = tag;
++    return digp;
++}
++
+ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype,
+ 		 pgpDigParams * ret)
+ {
+@@ -1072,8 +1079,7 @@ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype,
+ 	    if (pkttype && pkt.tag != pkttype) {
+ 		break;
+ 	    } else {
+-		digp = xcalloc(1, sizeof(*digp));
+-		digp->tag = pkt.tag;
++		digp = pgpDigParamsNew(pkt.tag);
+ 	    }
+ 	}
+ 
+@@ -1121,8 +1127,7 @@ int pgpPrtParamsSubkeys(const uint8_t *pkts, size_t pktlen,
+ 		digps = xrealloc(digps, alloced * sizeof(*digps));
+ 	    }
+ 
+-	    digpscount = xcalloc(1, sizeof(**digps));
+-	    digpscount->tag = PGPTAG_PUBLIC_SUBKEY;
++	    digpscount = pgpDigParamsNew(PGPTAG_PUBLIC_SUBKEY);
+ 	    /* Copy UID from main key to subkey */
+ 	    digpscount->userid = xstrdup(mainkey->userid);
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Require-creation-time-to-be-unique-and-hashed.patch Added

@@ -0,0 +1,101 @@
+From 7e7266c9af883ce49b3516a5bd099d218e8e3fac Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Sun, 6 Feb 2022 15:52:48 -0500
+Subject: PATCH Require creation time to be unique and hashed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+According to RFC 4880 §5.2.3.4 the signature creation time MUST be a
+hashed subpacket.  Enforce this requirement in RPM.  Also set the saved
+flags to PGPDIG_SAVED_TIME | PGPDIG_SAVED_ID |
+PGPDIG_SAVED_CREATION_TIME for v3 signatures, and do not overwrite an
+already saved key ID with one taken from a v3 signature.
+---
+ rpmio/digest.h |  4 +++-
+ rpmio/rpmpgp.c | 29 +++++++++++++++++++----------
+ 2 files changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/rpmio/digest.h b/rpmio/digest.h
+index 3b72a28..ec7f339 100644
+--- a/rpmio/digest.h
++++ b/rpmio/digest.h
+@@ -36,9 +36,11 @@ struct pgpDigParams_s {
+     uint32_t hashlen;
+     uint8_t signhash162;
+     pgpKeyID_t signid;
+-    uint8_t saved;
++    uint8_t saved;		/*!< Various flags.  `PGPDIG_SAVED_*` are never reset.
++				 * `PGPDIG_SIG_HAS_*` are reset for each signature. */
+ #define	PGPDIG_SAVED_TIME	(1 << 0)
+ #define	PGPDIG_SAVED_ID		(1 << 1)
++#define	PGPDIG_SIG_HAS_CREATION_TIME	(1 << 2)
+ 
+     pgpDigAlg alg;
+ };
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index f9e2658..0200900 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -473,16 +473,16 @@ static int pgpPrtSubType(const uint8_t *h, size_t hlen, pgpSigType sigtype,
+ 	    for (i = 1; i < plen; i++)
+ 		pgpPrtVal(" ", pgpKeyServerPrefsTbl, pi);
+ 	    break;
+-	case PGPSUBTYPE_SIG_CREATE_TIME:
++	case PGPSUBTYPE_SIG_CREATE_TIME:  /* signature creation time */
++	    if (plen-1 != sizeof(_digp->time))
++		break; /* other lengths not understood */
++	    if (_digp->saved & PGPDIG_SIG_HAS_CREATION_TIME)
++		return 1; /* duplicate timestamps not allowed */
+ 	    impl = *p;
+-	    if (!(_digp->saved & PGPDIG_SAVED_TIME) &&
+-		(sigtype == PGPSIGTYPE_POSITIVE_CERT || sigtype == PGPSIGTYPE_BINARY || sigtype == PGPSIGTYPE_TEXT || sigtype == PGPSIGTYPE_STANDALONE))
+-	    {
+-		if (plen-1 != sizeof(_digp->time))
+-		    break;
+-		_digp->saved |= PGPDIG_SAVED_TIME;
++	    if (!(_digp->saved & PGPDIG_SAVED_TIME))
+ 		_digp->time = pgpGrab(p+1, sizeof(_digp->time));
+-	    }
++	    _digp->saved |= PGPDIG_SAVED_TIME | PGPDIG_SIG_HAS_CREATION_TIME;
++	    break;
+ 	case PGPSUBTYPE_SIG_EXPIRE_TIME:
+ 	case PGPSUBTYPE_KEY_EXPIRE_TIME:
+ 	    pgpPrtTime(" ", p+1, plen-1);
+@@ -598,6 +598,9 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+     unsigned int plen;
+     int rc = 1;
+ 
++    /* Reset the saved flags */
++    _digp->saved &= PGPDIG_SAVED_TIME | PGPDIG_SAVED_ID;
++
+     if (pgpVersion(h, hlen, &version))
+ 	return rc;
+ 
+@@ -625,8 +628,11 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 	    _digp->hashlen = v->hashlen;
+ 	    _digp->sigtype = v->sigtype;
+ 	    _digp->hash = memcpy(xmalloc(v->hashlen), &v->sigtype, v->hashlen);
+-	    _digp->time = pgpGrab(v->time, sizeof(v->time));
+-	    memcpy(_digp->signid, v->signid, sizeof(_digp->signid));
++	    if (!(_digp->saved & PGPDIG_SAVED_TIME))
++		_digp->time = pgpGrab(v->time, sizeof(v->time));
++	    if (!(_digp->saved & PGPDIG_SAVED_ID))
++		memcpy(_digp->signid, v->signid, sizeof(_digp->signid));
++	    _digp->saved = PGPDIG_SAVED_TIME | PGPDIG_SIG_HAS_CREATION_TIME | PGPDIG_SAVED_ID;
+ 	    _digp->pubkey_algo = v->pubkey_algo;
+ 	    _digp->hash_algo = v->hash_algo;
+ 	    memcpy(_digp->signhash16, v->signhash16, sizeof(_digp->signhash16));
+@@ -664,6 +670,9 @@ static int pgpPrtSig(pgpTag tag, const uint8_t *h, size_t hlen,
+ 	    return 1;
+ 	p += plen;
+ 
++	if (!(_digp->saved & PGPDIG_SIG_HAS_CREATION_TIME))
++	    return 1; /* RFC 4880 §5.2.3.4 creation time MUST be hashed */
++
+ 	if (pgpGet(p, 2, hend, &plen))
+ 	    return 1;
+ 	p += 2;
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Return-descriptor-of-created-file-from-fsmMkfile.patch Added

@@ -0,0 +1,65 @@
+From 693d828c035848585b500dfde6f4e58cfb8d4de4 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Mon, 14 Feb 2022 12:44:42 +0200
+Subject: PATCH Return descriptor of created file from fsmMkfile()
+
+This will be needed for using fd-based metadata operations.
+---
+ lib/fsm.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index b019f57..7c4796f 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -172,7 +172,8 @@ static int fsmUnpack(rpmfi fi, int fdno, rpmpsm psm, int nodigest)
+ 
+ static int fsmMkfile(int dirfd, rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 		     rpmpsm psm, int nodigest,
+-		     struct filedata_s ** firstlink, int *firstlinkfile)
++		     struct filedata_s ** firstlink, int *firstlinkfile,
++		     int *fdp)
+ {
+     int rc = 0;
+     int fd = -1;
+@@ -204,9 +205,7 @@ static int fsmMkfile(int dirfd, rpmfi fi, struct filedata_s *fp, rpmfiles files,
+ 	    *firstlinkfile = -1;
+ 	}
+     }
+-
+-    if (fd != *firstlinkfile)
+-	fsmClose(&fd);
++    *fdp = fd;
+ 
+     return rc;
+ }
+@@ -1065,6 +1065,7 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+ 	    fp = firstlink;
+ 
+         if (!fp->skip) {
++	    int fd = -1;
+ 	    /* Directories replacing something need early backup */
+ 	    if (!fp->suffix && fp != firstlink) {
+ 		rc = fsmBackup(fi, fp->action);
+@@ -910,7 +910,7 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+             if (S_ISREG(fp->sb.st_mode)) {
+ 		if (rc == RPMERR_ENOENT) {
+ 		    rc = fsmMkfile(di.dirfd, fi, fp, files, psm, nodigest,
+-				   &firstlink, &firstlinkfile);
++				   &firstlink, &firstlinkfile, &fd);
+ 		}
+             } else if (S_ISDIR(fp->sb.st_mode)) {
+                 if (rc == RPMERR_ENOENT) {
+@@ -1131,6 +1132,9 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+                 if (!IS_DEV_LOG(fp->fpath))
+                     rc = RPMERR_UNKNOWN_FILETYPE;
+             }
++
++	    if (fd != firstlinkfile)
++		fsmClose(&fd);
+ 	}
+ 
+ 	/* Notify on success. */
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Revert-Explictly-skip-non-installed-files-on-erasur.patch Added

@@ -0,0 +1,32 @@
+From 26bb41e1cb7f7836302b3555cff8f20f9fc19188 Mon Sep 17 00:00:00 2001
+From: licunlong1 <licunlong1@huawei.com>
+Date: Thu, 21 Oct 2021 21:29:25 +0800
+Subject: PATCH don not skip abnormal files
+
+This reverts 2d52726bd55f008ea23262c2a3a31ae689cd2af4, as when removing
+the same file of different archs, if the file state is WRONGCOLOR, it
+sets the action to `skip`. This will result in some elf files left over.
+
+---
+ lib/transaction.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/lib/transaction.c b/lib/transaction.c
+index 55bc2d9..20cf680 100644
+--- a/lib/transaction.c
++++ b/lib/transaction.c
+@@ -689,10 +689,8 @@ assert(otherFi != NULL);
+ 	    }
+ 	    if (XFA_SKIPPING(rpmfsGetAction(fs, i)))
+ 		break;
+-	    if (rpmfilesFState(fi, i) != RPMFILE_STATE_NORMAL) {
+-		rpmfsSetAction(fs, i, FA_SKIP);
++	    if (rpmfilesFState(fi, i) != RPMFILE_STATE_NORMAL)
+ 		break;
+-	    }
+ 		
+ 	    /* Pre-existing modified config files need to be saved. */
+ 	    if (rpmfilesConfigConflict(fi, i)) {
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Simplify-rpm_print-fixing-a-Lua-stack-leak-as-a-bonu.patch Added

@@ -0,0 +1,39 @@
+From d41143cb5f6d88eb6e8bd999ad5ea2992bfb10f7 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Thu, 18 Nov 2021 13:38:20 +0200
+Subject: PATCH Simplify rpm_print(), fixing a Lua stack leak as a bonus
+
+Rather than laborously call tostring() in Lua, use the C-side equivalent
+of luaL_tostring(). This was new as of Lua 5.2, which explains why the
+original version from 2004 did things the hard way.
+
+Also fixes a stack leak from not popping "tostring" function after use.
+---
+ rpmio/rpmlua.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/rpmio/rpmlua.c b/rpmio/rpmlua.c
+index 6ad9119..7402307 100644
+--- a/rpmio/rpmlua.c
++++ b/rpmio/rpmlua.c
+@@ -688,16 +688,9 @@ static int rpm_print (lua_State *L)
+     int n = lua_gettop(L);  /* number of arguments */
+     int i;
+     if (!lua) return 0;
+-    lua_getglobal(L, "tostring");
+     for (i = 1; i <= n; i++) {
+-	const char *s;
+ 	size_t sl;
+-	lua_pushvalue(L, -1);  /* function to be called */
+-	lua_pushvalue(L, i);   /* value to print */
+-	lua_call(L, 1, 1);
+-	s = lua_tolstring(L, -1, &sl);  /* get result */
+-	if (s == NULL)
+-	    return luaL_error(L, "`tostring' must return a string to `print'");
++	const char *s = luaL_tolstring(L, i, &sl);
+ 	if (lua->printbuf) {
+ 	    rpmluapb prbuf = lua->printbuf;
+ 	    if (prbuf->used+sl+1 > prbuf->alloced) {
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Skip-recorded-symlinks-in-setperms-RhBug-1900662.patch Added

@@ -0,0 +1,40 @@
+From ed07a187734addfa16be9ee922398e4ff9859f53 Mon Sep 17 00:00:00 2001
+From: Michal Domonkos <mdomonko@redhat.com>
+Date: Tue, 7 Dec 2021 08:08:37 +0100
+Subject: PATCH Skip recorded symlinks in --setperms (RhBug:1900662)
+
+If a package contains a symlink in the buildroot which is declared as a
+ghost or config file but is a regular file or directory on the system
+where it's installed, a --setperms call will reset its permissions to
+those of a symlink (777 on Linux), which almost certainly is not the
+correct thing to do.
+
+To fix that, just skip files that were recorded as symlinks.
+
+This is a special case of a general issue in --setperms; since file
+permission semantics may change depending on the file type, to stay on
+the safe side, any (ghost or config) file whose type changes after
+installation should probably be skipped.  However, symlinks are the most
+prominent case here, so let's just focus on that now and avoid adding
+too much cleverness to a popt alias (this got us into trouble not too
+long ago, see commits 38c2f6e and 0d83637).  We may revisit this in the
+eventual C implementation.
+---
+ rpmpopt.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rpmpopt.in b/rpmpopt.in
+index 27d2986..d5a6b14 100644
+--- a/rpmpopt.in
++++ b/rpmpopt.in
+@@ -44,6 +44,7 @@ rpm	alias --scripts --qf '\
+ 	--POPTdesc=$"list install/erase scriptlets from package(s)"
+ 
+ rpm	alias --setperms -q --qf '\ -L %{FILENAMES:shescape} \ || \
++        \ -n %{FILELINKTOS:shescape} \ || \
+         ( \ $((%{FILEFLAGS} & 2#1001000)) != 0 \ && \ ! -e %{FILENAMES:shescape} \ ) || \
+         chmod %7{FILEMODES:octal} %{FILENAMES:shescape}\n' \
+ 		   --pipe "grep -v $none$ | grep '^. -L ' | sed 's/chmod .../chmod /' | sh" \
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Switch-the-floating-point-type-in-rpmhook-from-float.patch Added

@@ -0,0 +1,57 @@
+From a34bf5bdf601d6d0ae5d28193090a29b9ef12600 Mon Sep 17 00:00:00 2001
+From: Michael Schroeder <mls@suse.de>
+Date: Mon, 22 Nov 2021 11:12:20 +0100
+Subject: PATCH Switch the floating point type in rpmhook from float to
+ double
+
+There's no real reason why it should be float. Plus, the test if
+the number is an integer does not work for big integers that
+do not fit into a float.
+---
+ rpmio/rpmhook.c | 2 +-
+ rpmio/rpmhook.h | 2 +-
+ rpmio/rpmlua.c  | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/rpmio/rpmhook.c b/rpmio/rpmhook.c
+index 9fe2a21..1197983 100644
+--- a/rpmio/rpmhook.c
++++ b/rpmio/rpmhook.c
+@@ -187,7 +187,7 @@ static rpmhookArgs rpmhookArgsParse(const char *argt, va_list ap)
+ 		args->argvi.i = va_arg(ap, int);
+ 		break;
+ 	    case 'f':
+-		args->argvi.f = (float)va_arg(ap, double);
++		args->argvi.f = va_arg(ap, double);
+ 		break;
+ 	    case 'p':
+ 		args->argvi.p = va_arg(ap, void *);
+diff --git a/rpmio/rpmhook.h b/rpmio/rpmhook.h
+index 52f5634..842c126 100644
+--- a/rpmio/rpmhook.h
++++ b/rpmio/rpmhook.h
+@@ -4,7 +4,7 @@
+ typedef union {
+     const char * s;
+     int i;
+-    float f;
++    double f;
+     void * p;
+ } rpmhookArgv;
+ 
+diff --git a/rpmio/rpmlua.c b/rpmio/rpmlua.c
+index fe2e513..c5bdf42 100644
+--- a/rpmio/rpmlua.c
++++ b/rpmio/rpmlua.c
+@@ -650,7 +650,7 @@ static int rpm_call(lua_State *L)
+ 		    args->argvi.p = NULL;
+ 		    break;
+ 		case LUA_TNUMBER: {
+-		    float f = (float)lua_tonumber(L, i+1);
++		    double f = (double)lua_tonumber(L, i+1);
+ 		    if (f == (int)f) {
+ 			argti = 'i';
+ 			args->argvi.i = (int)f;
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Use-root-as-default-UID_0_USER-and-UID_0_GROUP.patch Added

@@ -0,0 +1,29 @@
+From 7b3a3f004f96ed3cb9cc377f7e64bfc88195dfc2 Mon Dec 13 16:41:34 2021
+From: From: Florian Festi <ffesti@redhat.com>
+Date: Mon, 13 Dec 2021 16:41:34 +0800
+Subject: PATCH Use root as default UID_0_USER and UID_0_GROUP
+
+If /etc/passwd or /etc/group was not available during building rpm itself
+these ended up empty. This affects builds done later on using rpmbuild.
+
+Resolves: #1838
+---
+ configure.ac | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index cdaf2b6..8656043 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1050,6 +1050,8 @@ fi
+ 
+ user_with_uid0=$(awk -F: '$3==0 {print $1;exit}' /etc/passwd)
+ group_with_gid0=$(awk -F: '$3==0 {print $1;exit}' /etc/group)
++if test -z "$user_with_uid0" ; then user_with_uid0=root ; fi
++if test -z "$group_with_gid0" ; then group_with_gid0=root ; fi
+ AC_DEFINE_UNQUOTED(UID_0_USER,"$user_with_uid0",Get the user name having userid 0)
+ AC_DEFINE_UNQUOTED(GID_0_GROUP,"$group_with_gid0",Get the group name having groupid 0)
+ 
+-- 
+1.8.3.1
+

_service:tar_scm:backport-Use-unsigned-integers-more-consistently-in-the-handl.patch Added

@@ -0,0 +1,63 @@
+From 8e6108a5964c7289f3db70f3d188293276416528 Mon Sep 17 00:00:00 2001
+From: Daniel Alley <dalley@redhat.com>
+Date: Thu, 8 Dec 2022 09:40:00 -0500
+Subject: PATCH Use unsigned integers more consistently in the handling of
+ tag data
+
+Not a functional change, it just makes the code more clear and
+self-consistent.
+---
+ lib/header.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/lib/header.c b/lib/header.c
+index 004102dd2..72fb3d4fe 100644
+--- a/lib/header.c
++++ b/lib/header.c
+@@ -568,7 +568,7 @@ static int regionSwab(indexEntry entry, int il, int dl,
+ 	    }
+ 	}   break;
+ 	case RPM_INT32_TYPE:
+-	{   int32_t * it = ie.data;
++	{   uint32_t * it = ie.data;
+ 	    for (; ie.info.count > 0; ie.info.count--, it += 1) {
+ 		if (dataEnd && ((unsigned char *)it) >= dataEnd)
+ 		    return -1;
+@@ -576,7 +576,7 @@ static int regionSwab(indexEntry entry, int il, int dl,
+ 	    }
+ 	}   break;
+ 	case RPM_INT16_TYPE:
+-	{   int16_t * it = ie.data;
++	{   uint16_t * it = ie.data;
+ 	    for (; ie.info.count > 0; ie.info.count--, it += 1) {
+ 		if (dataEnd && ((unsigned char *)it) >= dataEnd)
+ 		    return -1;
+@@ -772,9 +772,9 @@ static void * doExport(const struct indexEntry_s *hindex, int indexUsed,
+ 	    count = entry->info.count;
+ 	    src = entry->data;
+ 	    while (count--) {
+-		*((int32_t *)te) = htonl(*((int32_t *)src));
+-		te += sizeof(int32_t);
+-		src += sizeof(int32_t);
++		*((uint32_t *)te) = htonl(*((uint32_t *)src));
++		te += sizeof(uint32_t);
++		src += sizeof(uint32_t);
+ 	    }
+ 	    break;
+ 
+@@ -782,9 +782,9 @@ static void * doExport(const struct indexEntry_s *hindex, int indexUsed,
+ 	    count = entry->info.count;
+ 	    src = entry->data;
+ 	    while (count--) {
+-		*((int16_t *)te) = htons(*((int16_t *)src));
+-		te += sizeof(int16_t);
+-		src += sizeof(int16_t);
++		*((uint16_t *)te) = htons(*((uint16_t *)src));
++		te += sizeof(uint16_t);
++		src += sizeof(uint16_t);
+ 	    }
+ 	    break;
+ 
+-- 
+2.33.0
+

_service:tar_scm:backport-Validate-and-require-subkey-binding-signatures-on-PG.patch Added

@@ -0,0 +1,327 @@
+From bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Thu, 30 Sep 2021 09:59:30 +0300
+Subject: PATCH Validate and require subkey binding signatures on PGP public
+ keys
+
+All subkeys must be followed by a binding signature by the primary key
+as per the OpenPGP RFC, enforce the presence and validity in the parser.
+
+The implementation is as kludgey as they come to work around our
+simple-minded parser structure without touching API, to maximise
+backportability. Store all the raw packets internally as we decode them
+to be able to access previous elements at will, needed to validate ordering
+and access the actual data. Add testcases for manipulated keys whose
+import previously would succeed.
+
+Depends on the two previous commits:
+7b399fcb8f52566e6f3b4327197a85facd08db91 and
+236b802a4aa48711823a191d1b7f753c82a89ec5
+
+Fixes CVE-2021-3521.
+---
+ rpmio/rpmpgp.c                                  | 98 +++++++++++++++++++++++--
+ tests/Makefile.am                               |  3 +
+ tests/data/keys/CVE-2021-3521-badbind.asc       | 25 +++++++
+ tests/data/keys/CVE-2021-3521-nosubsig-last.asc | 25 +++++++
+ tests/data/keys/CVE-2021-3521-nosubsig.asc      | 37 ++++++++++
+ tests/rpmsigdig.at                              | 28 +++++++
+ 6 files changed, 209 insertions(+), 7 deletions(-)
+ create mode 100644 tests/data/keys/CVE-2021-3521-badbind.asc
+ create mode 100644 tests/data/keys/CVE-2021-3521-nosubsig-last.asc
+ create mode 100644 tests/data/keys/CVE-2021-3521-nosubsig.asc
+
+diff --git a/rpmio/rpmpgp.c b/rpmio/rpmpgp.c
+index aad7c27..d70802a 100644
+--- a/rpmio/rpmpgp.c
++++ b/rpmio/rpmpgp.c
+@@ -1062,37 +1062,121 @@ static pgpDigParams pgpDigParamsNew(uint8_t tag)
+     return digp;
+ }
+ 
++static int hashKey(DIGEST_CTX hash, const struct pgpPkt *pkt, int exptag)
++{
++    int rc = -1;
++    if (pkt->tag == exptag) {
++	uint8_t head = {
++	    0x99,
++	    (pkt->blen >> 8),
++	    (pkt->blen     ),
++	};
++
++	rpmDigestUpdate(hash, head, 3);
++	rpmDigestUpdate(hash, pkt->body, pkt->blen);
++	rc = 0;
++    }
++    return rc;
++}
++
++static int pgpVerifySelf(pgpDigParams key, pgpDigParams selfsig,
++			const struct pgpPkt *all, int i)
++{
++    int rc = -1;
++    DIGEST_CTX hash = NULL;
++
++    switch (selfsig->sigtype) {
++    case PGPSIGTYPE_SUBKEY_BINDING:
++	hash = rpmDigestInit(selfsig->hash_algo, 0);
++	if (hash) {
++	    rc = hashKey(hash, &all0, PGPTAG_PUBLIC_KEY);
++	    if (!rc)
++		rc = hashKey(hash, &alli-1, PGPTAG_PUBLIC_SUBKEY);
++	}
++	break;
++    default:
++	/* ignore types we can't handle */
++	rc = 0;
++	break;
++    }
++
++    if (hash && rc == 0)
++	rc = pgpVerifySignature(key, selfsig, hash);
++
++    rpmDigestFinal(hash, NULL, NULL, 0);
++
++    return rc;
++}
++
+ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype,
+ 		 pgpDigParams * ret)
+ {
+     const uint8_t *p = pkts;
+     const uint8_t *pend = pkts + pktlen;
+     pgpDigParams digp = NULL;
+-    struct pgpPkt pkt;
++    pgpDigParams selfsig = NULL;
++    int i = 0;
++    int alloced = 16; /* plenty for normal cases */
++    struct pgpPkt *all = xmalloc(alloced * sizeof(*all));
+     int rc = -1; /* assume failure */
++    int expect = 0;
++    int prevtag = 0;
+ 
+     while (p < pend) {
+-	if (decodePkt(p, (pend - p), &pkt))
++	struct pgpPkt *pkt = &alli;
++	if (decodePkt(p, (pend - p), pkt))
+ 	    break;
+ 
+ 	if (digp == NULL) {
+-	    if (pkttype && pkt.tag != pkttype) {
++	    if (pkttype && pkt->tag != pkttype) {
+ 		break;
+ 	    } else {
+-		digp = pgpDigParamsNew(pkt.tag);
++		digp = pgpDigParamsNew(pkt->tag);
+ 	    }
+ 	}
+ 
+-	if (pgpPrtPkt(&pkt, digp))
++	if (expect) {
++	    if (pkt->tag != expect)
++		break;
++	    selfsig = pgpDigParamsNew(pkt->tag);
++	}
++
++	if (pgpPrtPkt(pkt, selfsig ? selfsig : digp))
+ 	    break;
+ 
+-	p += (pkt.body - pkt.head) + pkt.blen;
++	if (selfsig) {
++	    /* subkeys must be followed by binding signature */
++	    if (prevtag == PGPTAG_PUBLIC_SUBKEY) {
++		if (selfsig->sigtype != PGPSIGTYPE_SUBKEY_BINDING)
++		    break;
++	    }
++
++	    int xx = pgpVerifySelf(digp, selfsig, all, i);
++
++	    selfsig = pgpDigParamsFree(selfsig);
++	    if (xx)
++		break;
++	    expect = 0;
++	}
++
++	if (pkt->tag == PGPTAG_PUBLIC_SUBKEY)
++	    expect = PGPTAG_SIGNATURE;
++	prevtag = pkt->tag;
++
++	i++;
++	p += (pkt->body - pkt->head) + pkt->blen;
+ 	if (pkttype == PGPTAG_SIGNATURE)
+ 	    break;
++
++	if (alloced <= i) {
++	    alloced *= 2;
++	    all = xrealloc(all, alloced * sizeof(*all));
++	}
+     }
+ 
+-    rc = (digp && (p == pend)) ? 0 : -1;
++    rc = (digp && (p == pend) && expect == 0) ? 0 : -1;
+ 
++    free(all);
+     if (ret && rc == 0) {
+ 	*ret = digp;
+     } else {
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index b4a2e2e..bc535d2 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -108,6 +108,9 @@ EXTRA_DIST += data/SPECS/hello-config-buildid.spec
+ EXTRA_DIST += data/SPECS/hello-cd.spec
+ EXTRA_DIST += data/keys/rpm.org-rsa-2048-test.pub
+ EXTRA_DIST += data/keys/rpm.org-rsa-2048-test.secret
++EXTRA_DIST += data/keys/CVE-2021-3521-badbind.asc
++EXTRA_DIST += data/keys/CVE-2021-3521-nosubsig.asc
++EXTRA_DIST += data/keys/CVE-2021-3521-nosubsig-last.asc
+ EXTRA_DIST += data/macros.testfile
+ EXTRA_DIST += data/macros.debug
+ EXTRA_DIST += data/SOURCES/foo.c
+diff --git a/tests/data/keys/CVE-2021-3521-badbind.asc b/tests/data/keys/CVE-2021-3521-badbind.asc
+new file mode 100644
+index 0000000..aea00f9
+--- /dev/null
++++ b/tests/data/keys/CVE-2021-3521-badbind.asc
+@@ -0,0 +1,25 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Version: rpm-4.17.90 (NSS-3)
++
++mQENBFjmORgBCAC7TMEk6wnjSs8Dr4yqSScWdU2pjcqrkTxuzdWvowcIUPZI0w/g
++HkRqGd4apjvY2V15kjL10gk3QhFP3pZ/9p7zh8o8NHX7aGdSGDK7NOq1eFaErPRY
++91LW9RiZ0lbOjXEzIL0KHxUiTQEmdXJT43DJMFPyW9fkCWg0OltiX618FUdWWfI8
++eySdLur1utnqBvdEbCUvWK2RX3vQZQdvEBODnNk2pxqTyV0w6VPQ96W++lF/5Aas
++7rUv3HIyIXxIggc8FRrnH+y9XvvHDonhTIlGnYZN4ubm9i4y3gOkrZlGTrEw7elQ
++1QeMyG2QQEbze8YjpTm4iLABCBrRfPRaQpwrABEBAAG0IXJwbS5vcmcgUlNBIHRl
++c3RrZXkgPHJzYUBycG0ub3JnPokBNwQTAQgAIQUCWOY5GAIbAwULCQgHAgYVCAkK
++CwIEFgIDAQIeAQIXgAAKCRBDRFkeGWTF/MxxCACnjqFL+MmPh9W9JQKT2DcLbBzf
++Cqo6wcEBoCOcwgRSk8dSikhARoteoa55JRJhuMyeKhhEAogE9HRmCPFdjezFTwgB
++BDVBpO2dZ023mLXDVCYX3S8pShOgCP6Tn4wqCnYeAdLcGg106N4xcmgtcssJE+Pr

_service:tar_scm:backport-rpm2cpio.sh-Don-t-drop-newlines-from-header-sizes.patch Added

@@ -0,0 +1,35 @@
+From a18a11924a715ace4b2d8e101688d164390cb188 Mon Sep 17 00:00:00 2001
+From: Florian Festi <ffesti@redhat.com>
+Date: Fri, 1 Jul 2022 14:44:11 +0200
+Subject: PATCH rpm2cpio.sh: Don't drop newlines from header sizes
+
+This script converts binary header sizes to decimal numbers. Shell is
+not that well suited for this task as it drops newlines at the end of
+command substitutions. Add a . character at the end and strip it right
+after that to avoid this problem.
+
+Resolves: rhbz#1983015
+---
+ scripts/rpm2cpio.sh | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/rpm2cpio.sh b/scripts/rpm2cpio.sh
+index c1c505f..f77d5f8 100755
+--- a/scripts/rpm2cpio.sh
++++ b/scripts/rpm2cpio.sh
+@@ -27,7 +27,11 @@ calcsize() {
+ 
+ 	i=0
+ 	while  $i -lt 8 ; do
+-		b="$(_dd $(($offset + $i)) bs=1 count=1)"
++		# add . to not loose \n
++		# strip \0 as it gets dropped with warning otherwise
++		b="$(_dd $(($offset + $i)) bs=1 count=1 | tr -d '\0' ; echo .)"
++		b=${b%.}    # strip . again
++
+ 		 -z "$b"  &&
+ 			b="0" ||
+ 			b="$(exec printf '%u\n' "'$b")"
+-- 
+1.8.3.1
+

_service:tar_scm:backport-rpm2cpio.sh-only-read-needed-bytes-of-file-magic.patch Added

_service:tar_scm:backport-rpm2cpio.sh-strip-null-bytes-with-tr.patch Added

@@ -0,0 +1,35 @@
+From d499887c9261fdab4d03ea29316ea5e8fc646bd3 Mon Sep 17 00:00:00 2001
+From: Florian Festi <ffesti@redhat.com>
+Date: Fri, 1 Jul 2022 14:49:09 +0200
+Subject: PATCH rpm2cpio.sh: strip null bytes with tr
+
+to avoid warnings
+---
+ scripts/rpm2cpio.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/rpm2cpio.sh b/scripts/rpm2cpio.sh
+index f77d5f8..59e8bc5 100755
+--- a/scripts/rpm2cpio.sh
++++ b/scripts/rpm2cpio.sh
+@@ -43,7 +43,7 @@ calcsize() {
+ 	offset=$(($offset + $rsize))
+ }
+ 
+-case "$(_dd 0 bs=8 count=1)" in
++case "$(_dd 0 bs=8 count=1 | tr -d '\0')" in
+ 	"$(printf '\355\253\356\333')"*) ;; # '\xed\xab\xee\xdb'
+ 	*) fatal "File doesn't look like rpm: $pkg" ;;
+ esac
+@@ -54,7 +54,7 @@ sigsize=$rsize
+ calcsize $(($offset + (8 - ($sigsize % 8)) % 8))
+ hdrsize=$rsize
+ 
+-case "$(_dd $offset bs=3 count=1)" in
++case "$(_dd $offset bs=3 count=1 | tr -d '\0')" in
+ 	"$(printf '\102\132')"*) _dd $offset | bunzip2 ;; # '\x42\x5a'
+ 	"$(printf '\037\213')"*) _dd $offset | gunzip  ;; # '\x1f\x8b'
+ 	"$(printf '\375\067')"*) _dd $offset | xzcat   ;; # '\xfd\x37'
+-- 
+1.8.3.1
+

_service:tar_scm:backport-rpmkeys-exit-non-zero-on-I-O-errors.patch Added

@@ -0,0 +1,53 @@
+From fc8386be36a32f8462a0d16a2dd3e5e18f7fbc2d Mon Sep 17 00:00:00 2001
+From: Demi Marie Obenour <demi@invisiblethingslab.com>
+Date: Mon, 12 Apr 2021 11:30:51 -0400
+Subject: PATCH rpmkeys: exit non-zero on I/O errors
+
+If writing to stdout or stderr fails, rpmkeys should exit with a
+non-zero status code.
+---
+ rpmkeys.c          |  4 ++++
+ tests/rpmsigdig.at | 13 +++++++++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/rpmkeys.c b/rpmkeys.c
+index 542601c..2c304de 100644
+--- a/rpmkeys.c
++++ b/rpmkeys.c
+@@ -86,5 +86,9 @@ int main(int argc, char *argv)
+ exit:
+     rpmtsFree(ts);
+     rpmcliFini(optCon);
++    fflush(stderr);
++    fflush(stdout);
++    if (ferror(stdout) || ferror(stderr))
++	return 255; /* I/O error */
+     return ec;
+ }
+diff --git a/tests/rpmsigdig.at b/tests/rpmsigdig.at
+index c8b9f13..429163e 100644
+--- a/tests/rpmsigdig.at
++++ b/tests/rpmsigdig.at
+@@ -24,6 +24,19 @@ runroot rpmkeys -Kv /data/RPMS/hello-2.0-1.x86_64.rpm /data/RPMS/hello-1.0-1.i38
+ )
+ AT_CLEANUP
+ 
++# ------------------------------
++# Test rpmkeys write errors
++AT_SETUP(rpmkeys -K no space left on stdout)
++AT_KEYWORDS(rpmkeys digest)
++AT_CHECK(
++RPMDB_INIT
++
++runroot rpmkeys -Kv /data/RPMS/hello-2.0-1.x86_64.rpm /data/RPMS/hello-1.0-1.i386.rpm >/dev/full
++,255,,Error writing to log: No space left on device
++)
++AT_CLEANUP
++
++
+ AT_SETUP(rpmkeys -Kv <reconstructed> 1)
+ AT_KEYWORDS(rpmkeys digest)
+ AT_CHECK(
+-- 
+1.8.3.1
+

_service:tar_scm:backport-treat-0-as-valid-file-descriptor.patch Added

_service:tar_scm:bugfix-rpm-4.11.3-add-aarch64_ilp32-arch.patch Added

@@ -0,0 +1,80 @@
+diff -Nur rpm-4.14.2.old/installplatform rpm-4.14.2/installplatform
+--- rpm-4.14.2.old/installplatform	2017-08-10 16:08:07.113108701 +0800
++++ rpm-4.14.2/installplatform	2019-01-30 17:28:25.511000000 +0800
+@@ -180,6 +180,13 @@
+ 	CANONARCH=riscv64
+ 	CANONCOLOR=3
+ 	;;
++    aarch64_ilp32)
++        ISANAME=aarch
++        ISABITS=32
++        CANONARCH=aarch64
++        CANONCOLOR=0
++        LIB=libilp32
++        ;;
+     noarch)
+ 	CANONARCH=noarch
+ 	CANONCOLOR=0
+diff -Nur rpm-4.14.2.old/rpmrc.in rpm-4.14.2/rpmrc.in
+--- rpm-4.14.2.old/rpmrc.in	2019-01-29 18:43:15.795000000 +0800
++++ rpm-4.14.2/rpmrc.in	2019-01-30 20:30:17.916000000 +0800
+@@ -99,7 +99,7 @@
+ optflags: sh4a -O2 -g -mieee
+ 
+ optflags: aarch64 -O2 -g
+-
++optflags: aarch64_ilp32 -O2 -g -mabi=ilp32
+ optflags: riscv64 -O2 -g
+ 
+ #############################################################
+@@ -149,7 +149,7 @@
+ archcolor: sh4 1
+ 
+ archcolor: aarch64 2
+-
++archcolor: aarch64_ilp32 1
+ archcolor: riscv64 2
+ 
+ #############################################################
+@@ -243,7 +243,7 @@
+ arch_canon:	sh4a: sh4a	17
+ arch_canon:	xtensa: xtensa	18
+ arch_canon:	aarch64: aarch64 19
+-
++arch_canon:     aarch64_ilp32: aarch64 19
+ arch_canon:	mipsr6: mipsr6	20
+ arch_canon:	mipsr6el: mipsr6el	20
+ arch_canon:	mips64r6: mips64r6	21
+@@ -377,11 +377,11 @@
+ buildarchtranslate: sh4a: sh4
+ 
+ buildarchtranslate: aarch64: aarch64
+-
++buildarchtranslate: aarch64_ilp32: aarch64_ilp32
+ buildarchtranslate: riscv: riscv64
+ buildarchtranslate: riscv64: riscv64
+ 
+-#############################################################
++#########################################/####################
+ # Architecture compatibility
+ 
+ arch_compat: alphaev67: alphaev6
+@@ -485,7 +485,8 @@
+ arch_compat: sh4: noarch
+ arch_compat: sh4a: sh4
+ 
+-arch_compat: aarch64: noarch
++arch_compat: aarch64_ilp32: aarch64 noarch
++arch_compat: aarch64: aarch64_ilp32 noarch
+ 
+ arch_compat: riscv: noarch
+ arch_compat: riscv64: noarch
+@@ -522,7 +523,7 @@
+ buildarch_compat: ia64: noarch
+ 
+ buildarch_compat: aarch64: noarch
+-
++buildarch_compat: aarch64_ilp32: noarch
+ buildarch_compat: riscv: noarch
+ buildarch_compat: riscv64: noarch
+

_service:tar_scm:bugfix-rpm-4.14.2-wait-once-get-rpmlock-fail.patch Added

@@ -0,0 +1,35 @@
+From c6699a7e90acfaa421830ce0fc12940335e40d7b Mon Sep 17 00:00:00 2001
+From: shanshishi <shanshishi@huawei.com>
+Date: Sun, 19 May 2019 16:49:45 +0800
+Subject: PATCH rpm: wait once get rpmlock fail
+
+reason: When executing the rpm command concurrently, it will block some
+times, because of lock is applied before.
+
+Signed-off-by: shanshishi <shanshishi@huawei.com>
+---
+ lib/rpmlock.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/lib/rpmlock.c b/lib/rpmlock.c
+index d693c4b..86e07b3 100644
+--- a/lib/rpmlock.c
++++ b/lib/rpmlock.c
+@@ -125,13 +125,10 @@ rpmlock rpmlockNew(const char *lock_path, const char *descr)
+ int rpmlockAcquire(rpmlock lock)
+ {
+     int locked = 0; /* assume failure */
+-    int myerrno = errno;
+-    int maywait = isatty(STDIN_FILENO); /* dont wait within scriptlets */
+-    errno = myerrno;
+ 
+     if (lock) {
+ 	locked = rpmlock_acquire(lock, RPMLOCK_WRITE);
+-	if (!locked && (lock->openmode & RPMLOCK_WRITE) && maywait) {
++	if (!locked && (lock->openmode & RPMLOCK_WRITE)) {
+ 	    rpmlog(RPMLOG_WARNING, _("waiting for %s lock on %s\n"),
+ 		    lock->descr, lock->path);
+ 	    locked = rpmlock_acquire(lock, (RPMLOCK_WRITE|RPMLOCK_WAIT));
+-- 
+1.7.12.4
+

_service:tar_scm:call-process_digest_list-after-files-are-added.patch Added

@@ -0,0 +1,115 @@
+From 641ec5a50cb5057e02c4cfe7bd537a32fafdd665 Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Mon, 26 Oct 2020 12:10:31 +0800
+Subject: PATCH call process_digest_list after files are added
+
+Signed-off-by: Anakin Zhang <benjamin93@163.com>
+---
+ plugins/digest_list.c | 78 ++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 69 insertions(+), 9 deletions(-)
+
+diff --git a/plugins/digest_list.c b/plugins/digest_list.c
+index 9fcb5c4..7213b41 100644
+--- a/plugins/digest_list.c
++++ b/plugins/digest_list.c
+@@ -479,28 +479,88 @@ out:
+ 	return ret;
+ }
+ 
++rpmte cur_te;
++int digest_list_counter;
++
+ static rpmRC digest_list_psm_pre(rpmPlugin plugin, rpmte te)
+ {
+-	process_digest_list(te, 0);
+-	if (!strcmp(rpmteN(te), "digest-list-tools"))
+-		process_digest_list(te, 1);
++	Header rpm = rpmteHeader(te);
++	rpmtd dirnames;
++	int i;
++
++	digest_list_counter = 0;
++
++	dirnames = rpmtdNew();
++	headerGet(rpm, RPMTAG_DIRNAMES, dirnames, 0);
++
++	while ((i = rpmtdNext(dirnames)) >= 0) {
++		char *dirname = (char *) rpmtdGetString(dirnames);
++		if (!strncmp(dirname, DIGEST_LIST_DEFAULT_PATH,
++			     sizeof(DIGEST_LIST_DEFAULT_PATH) - 1))
++			digest_list_counter++;
++	}
+ 
++	rpmtdFree(dirnames);
++
++	cur_te = te;
+ 	return RPMRC_OK;
+ }
+ 
+-static rpmRC digest_list_psm_post(rpmPlugin plugin, rpmte te, int res)
++static rpmRC digest_list_file_common(rpmPlugin plugin, rpmfi fi,
++				     const char* path, mode_t file_mode,
++				     rpmFsmOp op, int pre, int res)
+ {
+-	if (res != RPMRC_OK)
++	rpmFileAction action = XFO_ACTION(op);
++
++	if (!digest_list_counter)
++		return RPMRC_OK;
++
++	if (!cur_te)
++		return RPMRC_OK;
++
++	if (!pre && res != RPMRC_OK)
++		return res;
++
++	if ((pre && action != FA_ERASE) ||
++	    (!pre && action != FA_CREATE))
+ 		return RPMRC_OK;
+ 
+-	process_digest_list(te, 0);
+-	if (!strcmp(rpmteN(te), "digest-list-tools"))
+-		process_digest_list(te, 1);
++	if (digest_list_counter) {
++		if (!pre) {
++			if (!strncmp(path, DIGEST_LIST_DEFAULT_PATH,
++				     sizeof(DIGEST_LIST_DEFAULT_PATH) - 1))
++				digest_list_counter--;
++		} else {
++			digest_list_counter = 0;
++		}
++
++		if (digest_list_counter)
++			return RPMRC_OK;
++	}
++
++	process_digest_list(cur_te, 0);
++	if (!strcmp(rpmteN(cur_te), "digest-list-tools"))
++		process_digest_list(cur_te, 1);
+ 
+ 	return RPMRC_OK;
+ }
+ 
++static rpmRC digest_list_file_pre(rpmPlugin plugin, rpmfi fi,
++				  const char* path, mode_t file_mode,
++				  rpmFsmOp op)
++{
++	return digest_list_file_common(plugin, fi, path, file_mode, op, 1, 0);
++}
++
++static rpmRC digest_list_file_post(rpmPlugin plugin, rpmfi fi,
++				  const char* path, mode_t file_mode,
++				  rpmFsmOp op, int res)
++{
++	return digest_list_file_common(plugin, fi, path, file_mode, op, 0, res);
++}
++
+ struct rpmPluginHooks_s digest_list_hooks = {
+ 	.psm_pre = digest_list_psm_pre,
+-	.psm_post = digest_list_psm_post,
++	.fsm_file_pre = digest_list_file_pre,
++	.fsm_file_post = digest_list_file_post,
+ };
+-- 
+2.23.0
+

_service:tar_scm:dont-remove-ima-xattr-of-parser-when-upgrading.patch Added

@@ -0,0 +1,35 @@
+From 2c27c71952ce3ac61afeabd3ef4e1d182574e905 Mon Sep 17 00:00:00 2001
+From: luhuaxin <luhuaxin1@huawei.com>
+Date: Tue, 15 Mar 2022 20:54:06 +0800
+Subject: PATCH dont remove ima xattr of parser when upgrading
+
+Signed-off-by: luhuaxin <luhuaxin1@huawei.com>
+---
+ plugins/digest_list.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/digest_list.c b/plugins/digest_list.c
+index 0692b5b..1d7ef92 100644
+--- a/plugins/digest_list.c
++++ b/plugins/digest_list.c
+@@ -576,9 +576,16 @@ static rpmRC digest_list_file_common(rpmPlugin plugin, rpmfi fi,
+ 	if (!pre && --digest_list_counter)
+ 		return RPMRC_OK;
+ 
++	rpmlog(RPMLOG_DEBUG, "process ima digest, pre: %d, action: %d, teType: %d\n",
++		pre, action, rpmteType(cur_te));
+ 	process_digest_list(cur_te, 0, pre);
+-	if (!strcmp(rpmteN(cur_te), "digest-list-tools"))
++	if (!strcmp(rpmteN(cur_te), "digest-list-tools")) {
++		if (pre && rpmteType(cur_te) == TR_REMOVED)
++			return RPMRC_OK;
++
++		rpmlog(RPMLOG_DEBUG, "process parser digest\n");
+ 		process_digest_list(cur_te, 1, pre);
++	}
+ 
+ 	return RPMRC_OK;
+ }
+-- 
+2.33.0
+

_service:tar_scm:fix-lsetxattr-error-in-container.patch Added

@@ -0,0 +1,64 @@
+From 848cad38da6c727c91f0fcb8052f9402de598737 Mon Sep 17 00:00:00 2001
+From: Zhang Tianxing <zhangtianxing3@huawei.com>
+Date: Mon, 13 Sep 2021 17:32:11 +0800
+Subject: PATCH fix lsetxattr error in container
+
+The digest list plugin in rpm will set security.ima xattr to IMA digest lists
+when installing or updating an rpm package. However, in a container without
+CAP_SYS_ADMIN, we'll get error messages when calling lsetxattr.
+
+This patch is to skip lsetxattr when CAP_SYS_ADMIN is missing.
+
+Signed-off-by: Zhang Tianxing <zhangtianxing3@huawei.com>
+---
+ plugins/digest_list.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/plugins/digest_list.c b/plugins/digest_list.c
+index 6bc9415..2d14463 100644
+--- a/plugins/digest_list.c
++++ b/plugins/digest_list.c
+@@ -12,6 +12,7 @@
+ #include <sys/stat.h>
+ #include <openssl/sha.h>
+ #include <sys/xattr.h>
++#include <sys/capability.h>
+ #include <linux/xattr.h>
+ #include <asm/byteorder.h>
+ #include <sys/wait.h>
+@@ -370,6 +371,10 @@ static int process_digest_list(rpmte te, int parser)
+ 	int digest_list_signed = 0;
+ 	struct stat st;
+ 	ssize_t size;
++	struct __user_cap_header_struct cap_header_data;
++	cap_user_header_t cap_header = &cap_header_data;
++	struct __user_cap_data_struct cap_data_data;
++	cap_user_data_t cap_data = &cap_data_data;
+ 	rpmRC ret = RPMRC_OK;
+ 
+ 	path = malloc(PATH_MAX);
+@@ -435,7 +440,21 @@ static int process_digest_list(rpmte te, int parser)
+ 				ret = RPMRC_FAIL;
+ 				goto out;
+ 			}
++		}
+ 
++		/* don't call lsetxattr without CAP_SYS_ADMIN */
++		cap_header->pid = getpid();
++		cap_header->version = _LINUX_CAPABILITY_VERSION_1;
++		if (capget(cap_header, cap_data) < 0) {
++			ret = -ENOENT;
++			goto out;
++		}
++		if (!(cap_data->effective & CAP_TO_MASK(CAP_SYS_ADMIN))) {
++			ret = -EPERM;
++			goto out;
++		}
++
++		if (!digest_list_signed) {
+ 			/* Write RPM header sig to security.ima */
+ 			ret = write_rpm_digest_list_ima_xattr(te, path);
+ 		} else {
+-- 
+2.27.0
+

_service:tar_scm:get-in-use-of-ndb.patch Added

@@ -0,0 +1,42 @@
+From 8ba0780a26429bbb474e23112627ebbaeb9abfee Mon Sep 17 00:00:00 2001
+From: renmingshuai <renmingshuai@huawei.com>
+Date: Mon, 29 Nov 2021 10:53:24 +0800
+Subject: PATCH get in use of ndb
+
+---
+ configure.ac | 4 ++--
+ macros.in    | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 6b161dc..ab1c667 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -490,9 +490,9 @@ AM_CONDITIONAL(BDB_RO, test "$enable_bdb_ro" = yes)
+ # Check for SQLITE support
+ AC_ARG_ENABLE(sqlite,
+               AS_HELP_STRING(--enable-sqlite=@<:@yes/no/auto@:>@),
+-                              build with sqlite rpm database format support (default=yes)),
++                              build with sqlite rpm database format support (default=auto)),
+               enable_sqlite="$enableval",
+-              enable_sqlite=yes)
++              enable_sqlite=auto)
+ 
+ AS_IF(test "x$enable_sqlite" != "xno", 
+   PKG_CHECK_MODULES(SQLITE, sqlite3 >= 3.22.0, have_sqlite=yes, have_sqlite=no)
+diff --git a/macros.in b/macros.in
+index 22f675c..3e81918 100644
+--- a/macros.in
++++ b/macros.in
+@@ -602,7 +602,7 @@ package or when debugging this package.\
+ # sqlite Sqlite database
+ # dummy dummy backend (no actual functionality)
+ #
+-%_db_backend	      sqlite
++%_db_backend	      ndb
+ 
+ #==============================================================================
+ # ---- GPG/PGP/PGP5 signature macros.
+-- 
+1.8.3.1
+

_service:tar_scm:revert-always-execute-file-trigger-scriptlet-callbac.patch Added

_service:tar_scm:rpm-4.12.0-rpm2cpio-hack.patch Added

_service:tar_scm:rpm-Add-sw64-architecture.patch Added

@@ -0,0 +1,172 @@
+From 3c8ac8643a0d7c3c3ce972c0a0685d9d1c9de9bc Mon Sep 17 00:00:00 2001
+From: wzx <wuzx1226@qq.com>
+Date: Thu, 27 Oct 2022 11:27:23 +0800
+Subject: PATCH Add sw64 architecture
+
+Add sw64 architecture in file config.guess config.sub installplatform lib/rpmrc.c macros.in rpmrc.in and tools/elfdeps.c to support sw64 architecture.
+
+Signed-off-by: wzx <wuzx1226@qq.com>
+---
+ build-aux/config.guess |  8 ++++++++
+ build-aux/config.sub   |  1 +
+ installplatform        |  6 ++++++
+ lib/rpmrc.c            |  7 +++++++
+ macros.in              |  1 +
+ rpmrc.in               | 15 +++++++++++++++
+ tools/elfdeps.c        |  1 +
+ 7 files changed, 39 insertions(+)
+
+diff --git a/build-aux/config.guess b/build-aux/config.guess
+index b33c9e8..69e3005 100755
+--- a/build-aux/config.guess
++++ b/build-aux/config.guess
+@@ -913,6 +913,14 @@ EOF
+ 	UNAME_MACHINE=aarch64_be
+ 	echo "$UNAME_MACHINE"-unknown-linux-"$LIBC"
+ 	exit ;;
++    sw_64:Linux:*:*)
++	case `sed -n '/^cpu model/s/^.*: $.*$/\1/p' < /proc/cpuinfo` in
++	  sw)   UNAME_MACHINE=sw_64 ;;
++	esac
++	objdump --private-headers /bin/sh | grep -q ld.so.1
++	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
++	echo "$UNAME_MACHINE"-sunway-linux-"$LIBC"
++	exit ;;
+     alpha:Linux:*:*)
+ 	case `sed -n '/^cpu model/s/^.*: $.*$/\1/p' < /proc/cpuinfo` in
+ 	  EV5)   UNAME_MACHINE=alphaev5 ;;
+diff --git a/build-aux/config.sub b/build-aux/config.sub
+index b51fb8c..84a8688 100755
+--- a/build-aux/config.sub
++++ b/build-aux/config.sub
+@@ -1155,6 +1155,7 @@ case $cpu-$vendor in
+ 		case $cpu in
+ 			1750a | 580 \
+ 			| a29k \
++			| sw_64 \
+ 			| aarch64 | aarch64_be \
+ 			| abacus \
+ 			| alpha | alphaev4-8 | alphaev56 | alphaev678 \
+diff --git a/installplatform b/installplatform
+index ca490e0..2700199 100755
+--- a/installplatform
++++ b/installplatform
+@@ -108,6 +108,12 @@ for ARCH in noarch `grep ^arch_canon $RPMRC | cut -d: -f2`; do
+ 	CANONARCH=arm
+ 	CANONCOLOR=0
+ 	;;
++    sw_64*)
++	ISANAME=sw_64
++	ISABITS=64
++	CANONARCH=sw_64
++	CANONCOLOR=0
++	;;
+     alpha*)
+ 	ISANAME=alpha
+ 	ISABITS=64
+diff --git a/lib/rpmrc.c b/lib/rpmrc.c
+index 120777c..5d9507d 100644
+--- a/lib/rpmrc.c
++++ b/lib/rpmrc.c
+@@ -1268,6 +1268,13 @@ static void defaultMachine(rpmrcCtx ctx, const char ** arch, const char ** os)
+ 	}
+ #	endif
+ 
++#       if defined(__GNUC__) && defined(__sw_64__)
++        {
++                strcpy(un.machine, "sw_64sw6b");
++        }
++#       endif
++
++
+ #	if defined(__linux__) && defined(__i386__)
+ 	{
+ 	    char mclass = (char) (RPMClass() | '0');
+diff --git a/macros.in b/macros.in
+index 4dbf5b6..6722a74 100644
+--- a/macros.in
++++ b/macros.in
+@@ -1107,6 +1107,7 @@ package or when debugging this package.\
+ #------------------------------------------------------------------------------
+ # arch macro for all supported Alpha processors
+ %alpha	alpha alphaev56 alphaev6 alphaev67
++%sw_64 sw_64 sw_64sw6b
+ 
+ #------------------------------------------------------------------------------
+ # arch macro for all supported PowerPC 64 processors
+diff --git a/rpmrc.in b/rpmrc.in
+index 3a48af4..8d70f91 100644
+--- a/rpmrc.in
++++ b/rpmrc.in
+@@ -25,6 +25,9 @@ optflags: x86_64 -O2 -g
+ optflags: amd64 -O2 -g
+ optflags: ia32e -O2 -g
+ 
++optflags: sw_64 -O2 -g -mieee
++optflags: sw_64sw6b -O2 -g -mieee -mtune=sw6b
++
+ optflags: alpha -O2 -g -mieee
+ optflags: alphaev5 -O2 -g -mieee -mtune=ev5
+ optflags: alphaev56 -O2 -g -mieee -mtune=ev56
+@@ -112,6 +115,7 @@ optflags: riscv64 -O2 -g
+ archcolor: noarch 0
+ archcolor: i386 1
+ archcolor: alpha 2
++archcolor: sw_64 2
+ archcolor: sparc 1
+ archcolor: sparc64 2
+ archcolor: sparcv9 2
+@@ -176,6 +180,9 @@ arch_canon:	amd64:	amd64	1
+ arch_canon:	ia32e:	ia32e	1
+ arch_canon:	em64t:	em64t	1
+ 
++arch_canon:    sw_64:  sw_64   2
++arch_canon:    sw_64sw6b: sw_64sw6b    2
++
+ arch_canon:	alpha:	alpha	2
+ arch_canon:	alphaev5: alphaev5	2
+ arch_canon:	alphaev56: alphaev56	2
+@@ -315,6 +322,9 @@ buildarchtranslate: i586: i386
+ buildarchtranslate: i486: i386
+ buildarchtranslate: i386: i386
+ 
++buildarchtranslate: sw_64: sw_64
++buildarchtranslate: sw_64sw6b: sw_64
++
+ buildarchtranslate: alphaev5: alpha
+ buildarchtranslate: alphaev56: alpha
+ buildarchtranslate: alphapca56: alpha
+@@ -401,6 +411,8 @@ buildarchtranslate: riscv64: riscv64
+ 
+ #########################################/####################
+ # Architecture compatibility
++arch_compat: sw_64sw6b: sw_64
++arch_compat: sw_64: axp noarch
+ 
+ arch_compat: alphaev67: alphaev6
+ arch_compat: alphaev6: alphapca56
+@@ -570,6 +582,9 @@ buildarch_compat: sparcv9: sparcv8
+ buildarch_compat: sparcv8: sparc
+ buildarch_compat: sparc: noarch
+ 
++buildarch_compat: sw_64sw6b: sw_64
++buildarch_compat: sw_64: noarch
++
+ buildarch_compat: alphaev67: alphaev6
+ buildarch_compat: alphaev6: alphapca56
+ buildarch_compat: alphapca56: alphaev56
+diff --git a/tools/elfdeps.c b/tools/elfdeps.c
+index d205935..590021b 100644
+--- a/tools/elfdeps.c
++++ b/tools/elfdeps.c
+@@ -85,6 +85,7 @@ static const char *mkmarker(GElf_Ehdr *ehdr)
+     if (ehdr->e_identEI_CLASS == ELFCLASS64) {
+ 	switch (ehdr->e_machine) {
+ 	case EM_ALPHA:
++	case EM_SW_64:
+ 	case EM_FAKE_ALPHA:
+ 	    /* alpha doesn't traditionally have 64bit markers */
+ 	    break;
+-- 
+2.33.0
+

_service:tar_scm:rpm-fix-rpm-is-blocked-when-open-fifo-file.patch Added

@@ -0,0 +1,32 @@
+From 988df03f8a293f7aa1d6bb872b981c5dfc6493d9 Mon Sep 17 00:00:00 2001
+From: xujing <xujing125@huawei.com>
+Date: Tue, 8 Nov 2022 10:36:36 +0800
+Subject: PATCH rpm: fix rpm is blocked when open fifo file
+
+---
+ lib/fsm.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/lib/fsm.c b/lib/fsm.c
+index c9ab3e1..c1c86b0 100644
+--- a/lib/fsm.c
++++ b/lib/fsm.c
+@@ -1137,8 +1137,13 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
+ 
+ 	    if (!rc && fd == -1 && !S_ISLNK(fp->sb.st_mode)) {
+ 		/* Only follow safe symlinks, and never on temporary files */
+-		fd = fsmOpenat(di.dirfd, fp->fpath,
+-				fp->suffix ? AT_SYMLINK_NOFOLLOW : 0);
++		int flags = fp->suffix ? AT_SYMLINK_NOFOLLOW : 0;
++
++		/* Open the FIFO file in O_RDWR mode to prevent process blocking */
++		if (S_ISFIFO(fp->sb.st_mode))
++		    flags |= O_RDWR;
++
++		fd = fsmOpenat(di.dirfd, fp->fpath, flags);
+ 		if (fd < 0)
+ 		    rc = RPMERR_OPEN_FAILED;
+ 	    }
+-- 
+2.27.0
+

_service:tar_scm:rpm-selinux-plugin-check-context-file-exist.patch Added

_service:tar_scm:still-in-use-of-python-scripts-from-old-version.patch Added

@@ -0,0 +1,210 @@
+From 4ec83c32024a8faf0a66a4275acbcd15751ee303 Mon Sep 17 00:00:00 2001
+From: renhongxun <renhongxun@huawei.com>
+Date: Wed, 29 Dec 2021 16:37:45 +0800
+Subject: PATCH still in use of python scripts from old version
+
+---
+ platform.in                    |   3 ++
+ scripts/Makefile.am            |   8 +--
+ scripts/brp-python-bytecompile | 112 +++++++++++++++++++++++++++++++++++++++++
+ scripts/brp-python-hardlink    |  25 +++++++++
+ 4 files changed, 144 insertions(+), 4 deletions(-)
+ create mode 100644 scripts/brp-python-bytecompile
+ create mode 100755 scripts/brp-python-hardlink
+
+diff --git a/platform.in b/platform.in
+index 71496b8..748186e 100644
+--- a/platform.in
++++ b/platform.in
+@@ -82,10 +82,13 @@
+ #
+ 
+ %__arch_install_post   @ARCH_INSTALL_POST@
++%_python_bytecompile_errors_terminate_build 0
++%_python_bytecompile_extra   1
+ 
+ # Standard brp-macro naming:
+ # convert all '-' in basename to '_', add two leading underscores.
+ %__brp_compress %{_rpmconfigdir}/brp-compress %{?_prefix}
++%__brp_python_bytecompile %{_rpmconfigdir}/brp-python-bytecompile "" "%{?_python_bytecompile_errors_terminate_build}" "%{?_python_bytecompile_extra}"
+ %__brp_strip %{_rpmconfigdir}/brp-strip %{__strip}
+ %__brp_strip_comment_note %{_rpmconfigdir}/brp-strip-comment-note %{__strip} %{__objdump}
+ %__brp_strip_static_archive %{_rpmconfigdir}/brp-strip-static-archive %{__strip}
+diff --git a/scripts/Makefile.am b/scripts/Makefile.am
+index 4aed76b..5a1c494 100644
+--- a/scripts/Makefile.am
++++ b/scripts/Makefile.am
+@@ -6,8 +6,8 @@ AM_CFLAGS = @RPMCFLAGS@
+ CLEANFILES =
+ 
+ EXTRA_DIST = \
+-	brp-compress \
+-	brp-strip brp-strip-comment-note \
++        brp-compress brp-python-bytecompile \
++        brp-strip brp-strip-comment-note brp-python-hardlink \
+ 	brp-strip-static-archive brp-elfperms \
+ 	brp-remove-la-files \
+ 	check-files check-prereqs \
+@@ -23,8 +23,8 @@ EXTRA_DIST = \
+ 	fontconfig.prov script.req
+ 
+ rpmconfig_SCRIPTS = \
+-	brp-compress \
+-	brp-strip brp-strip-comment-note \
++        brp-compress brp-python-bytecompile \
++        brp-strip brp-strip-comment-note brp-python-hardlink \
+ 	brp-strip-static-archive brp-elfperms \
+ 	brp-remove-la-files \
+ 	check-files check-prereqs \
+diff --git a/scripts/brp-python-bytecompile b/scripts/brp-python-bytecompile
+new file mode 100644
+index 0000000..d9c4832
+--- /dev/null
++++ b/scripts/brp-python-bytecompile
+@@ -0,0 +1,112 @@
++#!/bin/bash
++errors_terminate=$2
++extra=$3
++
++# If using normal root, avoid changing anything.
++if  -z "$RPM_BUILD_ROOT"  ||  "$RPM_BUILD_ROOT" = "/" ; then
++	exit 0
++fi
++
++# Figure out how deep we need to descend.  We could pick an insanely high
++# number and hope it's enough, but somewhere, somebody's sure to run into it.
++depth=`(find "$RPM_BUILD_ROOT" -type f -name "*.py" -print0 ; echo /) | \
++       xargs -0 -n 1 dirname | sed 's,^/,,g' | sort -u | tail -n 1 | wc -c`
++if  -z "$depth"  ||  "$depth" -le "1" ; then
++	exit 0
++fi
++
++function python_bytecompile()
++{
++    local options=$1
++    local python_binary=$2
++    local exclude=$3
++    local python_libdir=$4
++    local depth=$5
++    local real_libdir=$6
++
++cat << EOF | $python_binary $options
++import compileall, sys, os, re
++
++python_libdir = "$python_libdir"
++depth = $depth
++real_libdir = "$real_libdir"
++build_root = "$RPM_BUILD_ROOT"
++exclude = r"$exclude"
++
++class Filter:
++    def search(self, path):
++        ret = not os.path.realpath(path).startswith(build_root)
++        if exclude:
++            ret = ret or re.search(exclude, path)
++        return ret
++
++sys.exit(not compileall.compile_dir(python_libdir, depth, real_libdir, force=1, rx=Filter(), quiet=1))
++EOF
++}
++
++# .pyc/.pyo files embed a "magic" value, identifying the ABI version of Python
++# bytecode that they are for.
++#
++# The files below RPM_BUILD_ROOT could be targeting multiple versions of
++# python (e.g. a single build that emits several subpackages e.g. a
++# python26-foo subpackage, a python31-foo subpackage etc)
++#
++# Support this by assuming that below each /usr/lib/python$VERSION/, all
++# .pyc/.pyo files are to be compiled for /usr/bin/python$VERSION.
++# 
++# For example, below /usr/lib/python2.6/, we're targeting /usr/bin/python2.6
++# and below /usr/lib/python3.1/, we're targeting /usr/bin/python3.1
++
++shopt -s nullglob
++for python_libdir in `find "$RPM_BUILD_ROOT" -type d|grep -E "/usr/lib(64)?/python0-9\.(0-9$|0-9{2}$)"`;
++do
++	python_binary=/usr/bin/$(basename $python_libdir)
++	real_libdir=${python_libdir/$RPM_BUILD_ROOT/}
++	echo "Bytecompiling .py files below $python_libdir using $python_binary"
++
++	# Generate normal (.pyc) byte-compiled files.
++	python_bytecompile "" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
++	if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
++		# One or more of the files had a syntax error
++		exit 1
++	fi
++
++	# Generate optimized (.pyo) byte-compiled files.
++	python_bytecompile "-O" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
++	if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
++		# One or more of the files had a syntax error
++		exit 1
++	fi
++done
++
++
++# Handle other locations in the filesystem using the default python implementation
++# if extra is set to 0, don't do this
++if  0$extra -eq 0 ; then
++	exit 0
++fi
++
++# If we don't have a default python interpreter, we cannot proceed
++default_python=${1:-/usr/bin/python}
++if  ! -x "$default_python" ; then
++	exit 0
++fi
++
++# Figure out if there are files to be bytecompiled with the default_python at all
++# this prevents unnecessary default_python invocation
++find "$RPM_BUILD_ROOT" -type f -name "*.py" | grep -Ev "/bin/|/sbin/|/usr/lib(64)?/python0-9\.0-9|/usr/share/doc" || exit 0
++
++# Generate normal (.pyc) byte-compiled files.
++python_bytecompile "" $default_python "/bin/|/sbin/|/usr/lib(64)?/python0-9\.0-9|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
++if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
++	# One or more of the files had a syntax error
++	exit 1
++fi
++
++# Generate optimized (.pyo) byte-compiled files.
++python_bytecompile "-O" $default_python "/bin/|/sbin/|/usr/lib(64)?/python0-9\.0-9|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
++if  $? -ne 0  &&  0$errors_terminate -ne 0 ; then
++	# One or more of the files had a syntax error
++	exit 1
++fi
++exit 0
+diff --git a/scripts/brp-python-hardlink b/scripts/brp-python-hardlink
+new file mode 100755
+index 0000000..5fd1b43
+--- /dev/null
++++ b/scripts/brp-python-hardlink
+@@ -0,0 +1,25 @@
++#!/bin/sh
++
++# If using normal root, avoid changing anything.
++if  -z "$RPM_BUILD_ROOT"  ||  "$RPM_BUILD_ROOT" = "/" ; then
++	exit 0
++fi
++
++hardlink_if_same() {
++	if cmp -s "$1" "$2" ; then
++		ln -f "$1" "$2"
++		return 0
++	fi
++	return 1
++}
++
++# Hardlink identical *.pyc, *.pyo, and *.opt-12.pyc.
++# Originally from PLD's rpm-build-macros

_service Changed

_service:extract_file:rpm-4.17.0.tar.bz2 Deleted

_service:extract_file:rpm.yaml Deleted

_service:tar_scm:rpm-1645494202.8558c51.tar -> _service:tar_scm:rpm-4.17.0.tar.bz2 Changed

_service:tar_scm:rpm.yaml Added

Changes of Revision 3