From 47853f2cf6575812d28093b750be2f2e897c153d Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 16 Oct 2025 17:29:52 +0800 Subject: [PATCH 1/4] Use RSAHEADER to tell if a package has been signed Packages now use RPM v4 signature %{RSAHEADER}. %{SIGPGP} is the name of the RPM v3 header+payload signature and can't be used to tell if a package has been signed, # uname -r 6.16.10-200.fc42.x86_64 # rpm -q --queryformat "%{SIGPGP:pgpsig}\n" --all|grep -c "^(none)$" 586 # rpm -q --queryformat "%{RSAHEADER}\n" --all|grep -c "^(none)$" 5 Signed-off-by: Coiby Xu --- ima-add-sigs.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ima-add-sigs.sh b/ima-add-sigs.sh index 6be5c48..f0e9dd0 100755 --- a/ima-add-sigs.sh +++ b/ima-add-sigs.sh @@ -132,7 +132,7 @@ if [[ -z $reinstall_threshold ]]; then fi fi -unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{SIGPGP:pgpsig}\n" "$package" | grep -c "^(none)$") +unsigned_packages_in_rpm_db=$(rpm -q --queryformat "%{RSAHEADER}\n" "$package" | grep -c "^(none)$") if [[ $unsigned_packages_in_rpm_db -ge $reinstall_threshold ]]; then add_by_reinstall From 7e1ffed77c9c75a3068cffd4ecd10cc2d7984cf3 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 27 Oct 2025 11:48:53 +0800 Subject: [PATCH 2/4] Allow packit to make and propose a build Currently, only users with commit access to the dist-git repo can make and propose a build. But packit doesn't have commit access to the repo. So explicitly allow packit to do make and propose a build. Fixes: e962d0c ("Use packit to automate ima-evm-utils releasing") Signed-off-by: Coiby Xu --- .packit.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.packit.yaml b/.packit.yaml index 3360032..a97cb7f 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -23,12 +23,12 @@ jobs: # PR in src.fedoraproject.org been merged. - job: koji_build trigger: commit - allowed_pr_authors: ["all_committers"] + allowed_pr_authors: ["all_committers", "packit"] dist_git_branches: - fedora-all # This is triggered at Fedora messaging bus about koji build finished. - job: bodhi_update trigger: commit - allowed_builders: ["all_committers"] + allowed_builders: ["all_committers", "packit"] dist_git_branches: From 3d7171c676d2290952cf481fae31ed0a347a3344 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Thu, 16 Oct 2025 17:36:34 +0800 Subject: [PATCH 3/4] Release 1.6.2-7 Signed-off-by: Coiby Xu --- ima-evm-utils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index d8add48..49588a3 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -8,7 +8,7 @@ Name: ima-evm-utils Version: 1.6.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: IMA/EVM support utilities License: GPL-2.0-or-later Url: https://github.com/linux-integrity/ @@ -145,6 +145,9 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %{_libdir}/libimaevm.so %changelog +* Thu Oct 16 2025 Coiby Xu - 1.6.2-7 +- Use RSAHEADER to tell if a package has been signedn + * Thu Jul 24 2025 Fedora Release Engineering - 1.6.2-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 667e783b37838ccb6a2cb2198a22f280b2bb5548 Mon Sep 17 00:00:00 2001 From: Coiby Xu Date: Mon, 27 Oct 2025 12:25:09 +0800 Subject: [PATCH 4/4] Fix a typo in changelog Signed-off-by: Coiby Xu --- ima-evm-utils.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ima-evm-utils.spec b/ima-evm-utils.spec index 49588a3..29915ec 100644 --- a/ima-evm-utils.spec +++ b/ima-evm-utils.spec @@ -146,7 +146,7 @@ install -D %{SOURCE4} $RPM_BUILD_ROOT%{_bindir}/ima-setup %changelog * Thu Oct 16 2025 Coiby Xu - 1.6.2-7 -- Use RSAHEADER to tell if a package has been signedn +- ima-add-sigs: Use RSAHEADER to tell if a package has been signed * Thu Jul 24 2025 Fedora Release Engineering - 1.6.2-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild