Update to 2.77

https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin

0001-doc-document-pam_cap-and-its-conf.patch

@@ -1,179 +0,0 @@
-From 7787f4019a86b962ef3b44305cde5888a14cfe52 Mon Sep 17 00:00:00 2001
-From: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>
-Date: Wed, 3 Apr 2024 11:57:14 -0700
-Subject: [PATCH] doc: document pam_cap and its conf
-
-Signed-off-by: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>
----
- doc/Makefile          |  8 ++--
- doc/capability.conf.5 | 85 +++++++++++++++++++++++++++++++++++++++++++
- doc/pam_cap.8         | 35 ++++++++++++++++++
- 3 files changed, 125 insertions(+), 3 deletions(-)
- create mode 100644 doc/capability.conf.5
- create mode 100644 doc/pam_cap.8
-
-diff --git a/doc/Makefile b/doc/Makefile
-index 6919488..9d1574c 100644
---- a/doc/Makefile
-+++ b/doc/Makefile
-@@ -32,9 +32,10 @@ MAN3S = cap_init.3 cap_free.3 cap_dup.3 \
- 	psx_syscall.3 psx_syscall3.3 psx_syscall6.3 psx_set_sensitivity.3 \
- 	psx_load_syscalls.3 __psx_syscall.3 \
- 	libpsx.3
--MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8
-+MAN5S = capability.conf.5
-+MAN8S = getcap.8 setcap.8 getpcaps.8 captree.8 pam_cap.8
- 
--MANS = $(MAN1S) $(MAN3S) $(MAN8S)
-+MANS = $(MAN1S) $(MAN3S) $(MAN5S) $(MAN8S)
- 
- all: $(MANS)
- 
-@@ -54,10 +55,11 @@ html:
- 	done
- 
- install:
--	mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man8
-+	mkdir -p -m 755 $(FAKEROOT)$(MANDIR)/man1 $(FAKEROOT)$(MANDIR)/man3 $(FAKEROOT)$(MANDIR)/man5 $(FAKEROOT)$(MANDIR)/man8
- 	for man in \
- 		$(FAKEROOT)$(MANDIR)/man1 $(MAN1S) \
- 		$(FAKEROOT)$(MANDIR)/man3 $(MAN3S) \
-+		$(FAKEROOT)$(MANDIR)/man5 $(MAN5S) \
- 		$(FAKEROOT)$(MANDIR)/man8 $(MAN8S) \
- 		; \
- 	do \
-diff --git a/doc/capability.conf.5 b/doc/capability.conf.5
-new file mode 100644
-index 0000000..10ff63b
---- /dev/null
-+++ b/doc/capability.conf.5
-@@ -0,0 +1,85 @@
-+.\" generated with Ronn-NG/v0.9.1
-+.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
-+.TH "CAPABILITY\.CONF" "5" "April 2024" ""
-+.SH "NAME"
-+\fBcapability\.conf\fR \- pam_cap module configuration file
-+.SH "SYNOPSIS"
-+\fB/etc/security/capability\.conf\fR
-+.SH "DESCRIPTION"
-+The syntax for lines in this configuration file is:
-+.P
-+\fB# <\-\- \'#\' precedes a comment\fR
-+.P
-+\fB<IAB><SPACE><WHO>\fR
-+.P
-+Where \fB<IAB>\fR refers to the text format for an inheritable IAB capability tuple, or the words \fBall\fR or \fBnone\fR\.
-+.P
-+The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\.
-+.P
-+Here \fB<WHO>\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\.
-+.P
-+The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\.
-+.P
-+Examples of valid syntax are:
-+.IP "" 4
-+.nf
-+# only root gets to keep what it had
-+
-+all                                root
-+
-+
-+# this should fire for user beta only, who will have
-+
-+# cap_chown dropped from their bounding set\.
-+
-+!cap_chown                         beta
-+
-+
-+# the next one should snag the members of the \'three\' group
-+
-+# granting them cap_setuid and cap_chown
-+
-+cap_setuid,cap_chown               @three
-+
-+
-+# this would apply to beta and gamma, but beta is already
-+
-+# granted a lack of cap_chown above\. Further, if gamma is
-+
-+# in the \'three\' group, it would not reach this line\.
-+
-+cap_chown                          beta gamma
-+
-+
-+# members of the \'one\' group are granted the cap_setuid Inheritable
-+
-+# capability, but cap_chown is dropped from their bounding set\.
-+
-+!cap_chown,cap_setuid              @one
-+
-+
-+# user alpha gets an ambient capability (unless it is also
-+
-+# a member of the groups \'one\' or \'three\')\.
-+
-+^cap_setuid                        alpha
-+
-+
-+# user delta (if not a member of groups \'one\' and \'three\') will get
-+
-+# cap_chown and cap_setgid Ambient capabilities, but have cap_setuid
-+
-+# dropped from its bounding set\.
-+
-+^cap_chown,^cap_setgid,!cap_setuid delta
-+
-+
-+# any remaining members of group \'four\' will get the cap_setuid
-+
-+# Inheritable capability\.
-+
-+cap_setuid                         @four
-+.fi
-+.IP "" 0
-+.SH "SEE ALSO"
-+pam_cap(8)
-diff --git a/doc/pam_cap.8 b/doc/pam_cap.8
-new file mode 100644
-index 0000000..93c1a71
---- /dev/null
-+++ b/doc/pam_cap.8
-@@ -0,0 +1,35 @@
-+.\" generated with Ronn-NG/v0.9.1
-+.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
-+.TH "PAM_CAP" "8" "April 2024" ""
-+.SH "NAME"
-+\fBpam_cap\fR \- Capabilities PAM module
-+.SH "SYNOPSIS"
-+[service\-name] \fBauth\fR control\-flag \fBpam_cap\fR [options]
-+.SH "DESCRIPTION"
-+The \fBpam_so\fR module can be used to specify \fIInheritable\fR capabilities to process trees rooted in the PAM application\. The module also supports blocking \fIBounding\fR vector capabilities and adding \fIAmbient\fR vector capabilities\.
-+.P
-+For general PAM apps to work correctly, the application must be run with at least \fBCAP_SETPCAP\fR raised in its \fIPermitted\fR capability flag\. Many PAM applications run as \fIroot\fR, which has all of the bits in the \fIBounding\fR set raised, so this requirement is typically met\. To grant an \fIAmbient\fR vector capability, the corresponding Permitted bit must be available to the application too\.
-+.P
-+The \fBpam_so\fR module is a Linux\-PAM \fIauth\fR module\. It provides functionality to back \fBpam_sm_authenticate()\fR and \fBpam_sm_setcred()\fR\. It is the latter that actually modifies the inheritable 3\-tuple of capability vectors: the configured \fIIAB\fR\. In a typical application configuration you might have a line like this:
-+.IP "" 4
-+.nf
-+auth    optional    pam_cap\.so
-+.fi
-+.IP "" 0
-+.P
-+The module arguments are:
-+.IP "\[ci]" 4
-+\fBdebug\fR: While supported, this is a no\-op at present\.
-+.IP "\[ci]" 4
-+\fBconfig=\fR\fI/path/to/file\fR: Override the default config for the module\. The unspecified default value for this file is \fB/etc/security/capability\.conf\fR\. Note, \fBconfig=/dev/null\fR is a valid value\. See \fBdefault=\fR below for situations in which this might be appropriate\.
-+.IP "\[ci]" 4
-+\fBkeepcaps\fR: This is as much as the \fBpam_cap\.so\fR module can do to help an application support use of the \fIAmbient\fR capability vector\. The application support for the \fIAmbient\fR set is poor at the present time\.
-+.IP "\[ci]" 4
-+\fBautoauth\fR: This argument causes the \fBpam_cap\.so\fR module to return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR being authenticated exists\. The absence of this argument will cause \fBpam_cap\.so\fR to only return \fBPAM_SUCCESS\fR if the \fBPAM_USER\fR is covered by a specific rule in the prevailing config file\.
-+.IP "\[ci]" 4
-+\fBdefault=\fR\fIIAB\fR: This argument is ignored if the prevailing configuration file contains a "\fB*\fR" rule\. If there is no such rule, the \fIIAB\fR 3\-tuple is inserted at the end of the config file and applies to all \fBPAM_USER\fRs not covered by an earlier rule\. Note, if you want all \fBPAM_USER\fRs to be covered by this default rule, you can supply the module argument \fBconfig=/dev/null\fR\.
-+.IP "\[ci]" 4
-+\fBdefer\fR: This argument arranges for the \fIIAB\fR capabilities granted to a user to be added sufficiently late in the Linux\-PAM authentication stack that they stick\. That is, \fIafter\fR the application does its \fBsetuid(UID)\fR call\. As such, in conjunction with the \fBkeepcaps\fR module argument, such compliant applications can support granting \fIAmbient\fR vector capabilities with \fBpam_cap\.so\fR\.
-+.IP "" 0
-+.SH "SEE ALSO"
-+pam\.conf(5), capability\.conf(5), pam(8)
--- 
-2.44.0
-

0001-doc-document-the-use-of-to-refer-to-all-users.patch

@@ -1,26 +0,0 @@
-From 70783bddc65628a1afc3dd2f8b4b3f03fc839b8e Mon Sep 17 00:00:00 2001
-From: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>
-Date: Fri, 5 Apr 2024 16:37:30 -0700
-Subject: [PATCH] doc: document the use of `*` to refer to all users
-
-Signed-off-by: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com>
----
- doc/capability.conf.5 | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/doc/capability.conf.5 b/doc/capability.conf.5
-index 10ff63b..15535f4 100644
---- a/doc/capability.conf.5
-+++ b/doc/capability.conf.5
-@@ -16,7 +16,7 @@ Where \fB<IAB>\fR refers to the text format for an inheritable IAB capability tu
- .P
- The reserved word \fBall\fR does \fInot\fR grant \fIall the inheritable capabilities\fR, but acts as a simple \fIpass\-through\fR for any prevailing IAB tuple capabilities\. The reserved word \fBnone\fR refers to an empty \fIInheritable\fR capability set (and by extension an empty \fIAmbient\fR vector)\.
- .P
--Here \fB<WHO>\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\.
-+Here \fB<WHO>\fR refers to the space separated PAM username values that will be granted the specified \fIIAB\fR tuple\. A name prefixed with the character \fB@\fR refers to the locally defined \fB/etc/group\fR \fIetc\fR users listed under that group name\. An asterisk "\fB*\fR" can be used to denote all users\.
- .P
- The parsing of the file chooses the first line that applies to the authenticating user, and attempts to apply that and only that\.
- .P
--- 
-2.44.0
-

_makenames-build.patch

@@ -0,0 +1,13 @@
+diff --git a/libcap/Makefile b/libcap/Makefile
+index f0eb87e..e90a950 100644
+--- a/libcap/Makefile
++++ b/libcap/Makefile
+@@ -80,7 +80,7 @@ $(PSXTITLE).pc: $(PSXTITLE).pc.in
+ 		$< >$@
+ 
+ _makenames: _makenames.c cap_names.list.h
+-	$(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@ $(BUILD_LDFLAGS)
++	$(BUILD_CC) $(BUILD_CFLAGS) $(BUILD_CPPFLAGS) $< -o $@
+ 
+ cap_names.h: _makenames
+ 	./_makenames > cap_names.h

gating.yaml

@@ -4,7 +4,6 @@ product_versions:
 decision_context: bodhi_update_push_testing
 subject_type: koji_build
 rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional}
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis}
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional}
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
@@ -14,7 +13,6 @@ product_versions:
 decision_context: bodhi_update_push_stable
 subject_type: koji_build
 rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpmdeplint.functional}
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.rpminspect.static-analysis}
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.installability.functional}
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

libcap.spec

@@ -1,6 +1,6 @@
 Name: libcap
-Version: 2.69
-Release: 8%{?dist}
+Version: 2.77
+Release: 1%{?dist}
 Summary: Library for getting and setting POSIX.1e capabilities
 URL: https://sites.google.com/site/fullycapable/
 License: BSD-3-Clause OR GPL-2.0-only
@@ -8,8 +8,7 @@ License: BSD-3-Clause OR GPL-2.0-only
 Source0: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.gz
 Source1: https://mirrors.edge.kernel.org/pub/linux/libs/security/linux-privs/libcap2/%{name}-%{version}.tar.sign
 Source2: https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/29EE848AE2CCF3F4.asc
-Patch0: 0001-doc-document-pam_cap-and-its-conf.patch
-Patch1: 0001-doc-document-the-use-of-to-refer-to-all-users.patch
+Patch0: _makenames-build.patch
 
 BuildRequires: pam-devel gcc
 BuildRequires: make
@@ -20,6 +19,13 @@ BuildRequires: gnupg2
 BuildRequires: golang >= 1.22
 %endif
 
+%if "%{_sbindir}" == "%{_bindir}"
+# Compat symlinks for Requires in other packages.
+# We rely on filesystem to create the symlinks for us.
+Requires:       filesystem(unmerged-sbin-symlinks)
+Provides:       /usr/sbin/setcap
+%endif
+
 %description
 libcap is a library for getting and setting POSIX.1e (formerly POSIX 6)
 draft 15 capabilities.
@@ -64,13 +70,13 @@ gzip -cd %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1
 
 
 %build
-%make_build prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'" all
+%make_build prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -a -v -x -ldflags='-compressdwarf=false -B gobuildid'" all
 
 %check
 make test
 
 %install
-%make_install prefix=%{_prefix} lib=%{_lib} CGO_REQUIRED=1 GO_BUILD_FLAGS="-buildmode=pie -ldflags='-B gobuildid'"
+%make_install prefix=%{_prefix} lib=%{_lib} SBINDIR=%{_sbindir} CGO_REQUIRED=1 CGO_CFLAGS="${CFLAGS}" CGO_LDFLAGS="${LDFLAGS}" GO_BUILD_FLAGS="-buildmode=pie -ldflags='-compressdwarf=false -B gobuildid'"
 
 mkdir -p %{buildroot}/%{_mandir}/man{2,3,5,8}
 mv -f doc/*.3 %{buildroot}/%{_mandir}/man3/
@@ -87,6 +93,7 @@ chmod +x %{buildroot}/%{_libdir}/*.so.*
 %{_sbindir}/{capsh,getcap,getpcaps,setcap}
 %{_mandir}/man1/capsh.1*
 %{_mandir}/man5/capability.conf.5*
+%{_mandir}/man7/cap_text_formats.7*
 %{_mandir}/man8/{getcap,getpcaps,setcap,pam_cap}.8*
 %{_libdir}/security/pam_cap.so
 %exclude %{_mandir}/man8/captree.8*
@@ -115,6 +122,49 @@ chmod +x %{buildroot}/%{_libdir}/*.so.*
 %endif
 
 %changelog
+* Tue Oct 28 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.77-1
+- Update to version 2.77 (rhbz#2406446)
+
+* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 2.76-4
+- rebuild
+
+* Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 2.76-3
+- Rebuild for golang-1.25.0
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.76-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+
+* Mon Apr 14 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.76-1
+- Update to version 2.76 (rhbz#2349318, rhbz#2352529)
+
+* Fri Jan 24 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.73-2
+- Update internal CI tests
+
+* Fri Jan 24 2025 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.73-1
+- Update to version 2.73 (rhbz#2340722)
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.71-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.71-2
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Mon Oct 28 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.71-1
+- Update to version 2.71
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.70-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.70-3
+- Rebuilt for the bin-sbin merge
+
+* Tue Jun 04 2024 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.70-2
+- Set CGO_CFLAGS=$CFLAGS and CGO_LDFLAGS=$LDFLAGS to build Go code
+
+* Mon May 20 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.70-1
+- Update to version 2.70
+
 * Fri Apr 05 2024 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 2.69-8
 - Make correction to the capability.conf manpage
 

sources

@@ -1,2 +1,2 @@
-SHA512 (libcap-2.69.tar.gz) = 75ee0fe8e1ac835f29cb76d233f731dcf126b73eed5229a130bbe4308a42441934d4e9cefeaaab45f774de2ed6859c752fbbfb9908e792f2f9f3d0f841e01aee
-SHA512 (libcap-2.69.tar.sign) = 00f323444463b020c999f6fab255a61bd719f8d0ec1b619352e4f1b13407acee9a8e176861e5b408f64a871dc4095c6a26af541c3a0d4efca364c2d4b3679d30
+SHA512 (libcap-2.77.tar.gz) = e5471afc4f149a8330e6df07effe58cac44d8a773b1fff0686e7039c41888e33402e1942fe5271a142e159a6088abbdbb7a82133389b3a9351749c2bf797b6b8
+SHA512 (libcap-2.77.tar.sign) = c362eefb80bbc110b7d7c676cc2b37e04bd3dab1b8b4577d62a0774b6300258743156c57102e8dc11c35d2ea876053dc57eae44197137273413b959df33ef0c0

tests/pkg-configs/test.sh

@@ -26,7 +26,7 @@ rlJournalStart
         rlRun "rpm -ql libcap-devel | grep libpsx.pc" 0 "There must be libpsx.pc"
         if [ $? -eq 0 ]; then
           PCFILE=$(rpm -ql libcap-devel | grep libpsx.pc)
-          rlRun "pkg-config --libs libpsx | grep -- '-lpsx -lpthread -Wl,-wrap,pthread_create'"
+          rlRun "pkg-config --libs libpsx | grep -- '-lpsx'"
           VER=$(awk '/Version:/ { print $2 }' $PCFILE | tail -1)
           rlRun "pkg-config --modversion libpsx | grep $VER"
           rlRun -s "pkg-config --print-variables libpsx"