#388 Limit %selinux_requires to version, not release
Merged 4 months ago by zpytela. Opened 5 months ago by yselkowitz.
rpms/ yselkowitz/selinux-policy rawhide  into  rawhide

file modified
+5 -2
@@ -24,7 +24,7 @@ 

  Summary: SELinux policy configuration

  Name: selinux-policy

  Version: 40.8

- Release: 1%{?dist}

+ Release: 2%{?dist}

  License: GPL-2.0-or-later

  Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz

  Source1: modules-targeted-base.conf
@@ -486,7 +486,7 @@ 

  

  mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d

  install -m 644 %{SOURCE102} %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy

- sed -i 's/SELINUXPOLICYVERSION/%{version}-%{release}/' %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy

+ sed -i 's/SELINUXPOLICYVERSION/%{version}/' %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy

  sed -i 's@SELINUXSTOREPATH@%{_sharedstatedir}/selinux@' %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy

  

  mkdir -p %{buildroot}%{_unitdir}
@@ -814,6 +814,9 @@ 

  %endif

  

  %changelog

+ * Tue Jan 02 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 40.8-2

+ - Limit %%selinux_requires to version, not release

+ 

  * Thu Dec 21 2023 Zdenek Pytela <zpytela@redhat.com> - 40.8-1

  - Allow hypervkvp_t write access to NetworkManager_etc_rw_t

  - Add interface for write-only access to NetworkManager rw conf

Using exact NVR dependencies works well within RPMS from a single SRPM, but otherwise relies on assumptions which do not always hold out. Because %release includes %dist, this is particularly fragile in the context of the Rawhide->ELN->c10s build pipeline. For instance, if a package which uses %selinux_requires gets built for ELN with the rawhide selinux-policy, then .fcNN will be hardcoded into the ELN build, and the ELN build with .elnNNN will never meet the condition (since f > e).

Build failed. More information on how to proceed and troubleshoot errors available at https://fedoraproject.org/wiki/Zuul-based-ci
https://fedora.softwarefactory-project.io/zuul/buildset/37860c7d080f42878ef1560917a582b2

rebased onto e46b929

4 months ago

I realize that this came in during the end of December when folks are less likely to be around, but if we can't get a review of this by the end of this week, I'm going to go ahead and merge it as a provenpackager to unblock the CentOS Stream 10 bootstrap efforts. Thanks in advance for your understanding.

@sgallagh it has been discussed internally, there are some plans to make even bigger changes, but we can merge the pr as is now

Pull-Request has been merged by zpytela

4 months ago

Build failed. More information on how to proceed and troubleshoot errors available at https://fedoraproject.org/wiki/Zuul-based-ci
https://fedora.softwarefactory-project.io/zuul/buildset/a07879b965f54f5db2a9990f5d3eb9ab

Metadata