upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281
xshared: Accept an option if any given command allows it
Fixed commit made option checking overly strict: Some commands may be
commbined (foremost --list and --zero), reject a given option only if it
is not allowed by any of the given commands.
When fixing for rpmlint warnings, the standard symlinks installed by
package's 'make install' were removed but they are in fact necessary for
the globbing in %files section to happen. Replace them by empty files
after removal to fix this.
Fixes: e71883b551
This partially reverts commit 2f0c9f89a9.
This time around, we also manually create symlinks in /usr/sbin to handle
systems with unmerged /usr/sbin. This should fix the problems reported in
https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that
are %ghost, filesystem filetriggers are not triggered, so the symlinks may not
be created automatically (depending on the specific upgrade path).
In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin
as equivalent, and filesystem has been updated to merge alternatives symlinks
in /usr/sbin. We also need to move the files in this package to allow the merge
to be finalized on upgraded systems.
This reverts commit 43696a4be3 and also
the follow-up work from c8015c16af.
Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as
equivalent, we can drop the workaround here. I used this package as
test case for the new chkconfig/alternatives code. With the changes
in both packages, we get proper behaviour without warnings, and on
upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin
to ./bin, happens as expected.
Issue mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=2361004.
The %ghost directives in %files sections pick up the symlinks installed
by the iptables build system, when in fact these are maintained in
Fedora by alternatives. To avoid the confusion, remove them.
To avoid causing 'W: zero-perms-ghost', add a %attr statement to the
respective %ghost lines.
Provide the service as part of iptables-services. The
arptables-nft-helper was already quite similar to
arptables-legacy-helper, it should serve fine for legacy arptables, too.
Even if specific %_*dir macros cannot be used, %_prefix must be used at a
minimum to refer to the installation path of files from the given package.
This is a requirement for flatpak builds.
update-alternatives becomes unhappy when called with paths under /usr/bin
and /usr/sbin that are mixed:
>>> Non-critical error in post-install scriptlet: iptables-legacy-0:1.8.11-3.fc42.x86_64
>>> Scriptlet output:
>>> the primary link for iptables must be /usr/sbin/iptables
>>>
>>> [RPM] %post(iptables-legacy-1.8.11-3.fc42.x86_64) scriptlet failed, exit status 2
Things will mostly work if we keep using the old path:
* On new installs, /usr/sbin will be a symlink, so the /usr/sbin paths will
just point to /usr/bin and both sets of paths will work equivalently.
* On upgrades, we'll maintain the /usr/sbin paths, which should be fine also,
since everything must support using those paths for compatiblity.
* The only thing that will not work is the merging of /usr/sbin to ./bin once
/usr/sbin only contains symlinks. The scriptlets in filesystem.rpm would need
to be adjusted to handle that case (i.e. allow symlinks /usr/sbin/foo →
../bin/foo and /usr/sbin/foo → /etc/alternatives/foo to be removed). This
special case can be handled later.
There are two subpackages which provide /usr/s?bin/iptables: -nft and -legacy.
In mock, for whatever reason, iptables-legacy was being installed, from the rebuild
with merged-sbin, but since there was no dependency on the updated filesystem,
an old version of filesystem was left, and only /usr/bin/iptables would available.
As part of https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin,
alternatives is moved from /usr/sbin/alternatives to /usr/bin/alternatives.
(This happened when alternatives rpm was rebuilt in a build
environment with the updated definitions.)
On traditional systems a compat symlink is created, so both paths
work. This means that packages that use paths into /usr/sbin do not
need to be rebuilt and will continue to work fine. Unfortunately, on
ostree systems, the compat symlinks are missing, so calls to
/usr/sbin/alternatives fail.
There is no benefit from specifying the full path to binaries in
scriptlets because the scriptlets are called with a well-defined
$PATH. So drop the full path, so that the package works fine no matter
where exactly alternatives is installed.
On one hand, the test will fail as the RPM is called 'iptables-nft' (or
'iptables-legacy', but that's not the default). On the other, if
iptables RPM is missing the commands will fail as well so this check
happens implicitly anyway.
- Make iptables-xml a relative symlink
- Drop not needed xtables.conf
- Ship iptables.xslt with iptables-legacy package
- Ship ebtables-translate tool with iptables-nft package
Resolves: rhbz#2160427
