Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package keylime for openSUSE:Factory checked in at 2026-11-04 19:42:50 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/keylime (Old) and /work/SRC/openSUSE:Factory/.keylime.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "keylime" Wed Nov 4 19:42:50 2026 rev:56 rq:1394661 version:7.14.3 Changes: -------- --- /work/SRC/openSUSE:Factory/keylime/keylime.changes 2026-07-08 17:36:35.845592665 +0200 +++ /work/SRC/openSUSE:Factory/.keylime.new.3759290/keylime.changes 2026-11-04 19:43:00.349247872 +0100 @@ -1,0 +2,14 @@ +Tue Nov 03 10:26:23 UTC 2026 - [email protected] + +- Fix ownership of packaged files (bsc#1289196) + * Install /usr/lib/keylime/tpm_cert_store as root:root, as the + EK CA certificates are only read by the services + * Install the vendor configuration in /usr/etc/keylime as + root:keylime with modes 0750/0640, readable but not writable + by the services + * Use the keylime group instead of tss in tmpfiles and + logrotate, as the server components never access the TPM + * keylime-config requires keylime-tpm_cert_store to ensure the + keylime user and group exist before installation + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ keylime.spec ++++++ --- /var/tmp/diff_new_pack.R8JTpO/_old 2026-11-04 19:43:02.364332220 +0100 +++ /var/tmp/diff_new_pack.R8JTpO/_new 2026-11-04 19:43:02.368332388 +0100 @@ -92,6 +92,8 @@ %package -n %{name}-config Summary: Configuration file for keylime Requires: python3-%{name} = %{version} +# Provides the keylime user and group used in the file attributes +Requires(pre): %{name}-tpm_cert_store = %{version} Conflicts: rust-keylime %description -n %{name}-config @@ -202,7 +204,8 @@ install -Dpm 0644 %{SOURCE4} %{buildroot}%{_tmpfilesdir}/%{name}.conf mkdir -p %{buildroot}%{_prefix}/lib/%{srcname} -cp -r ./tpm_cert_store %{buildroot}%{_prefix}/lib/%{srcname}/ +install -d -m 0755 %{buildroot}%{_prefix}/lib/%{srcname}/tpm_cert_store +install -p -m 0644 ./tpm_cert_store/* %{buildroot}%{_prefix}/lib/%{srcname}/tpm_cert_store/ %fdupes %{buildroot}%{_prefix}/lib/%{srcname}/ # %%check @@ -297,9 +300,9 @@ %{python_sitelib}/keylime-*.dist-info %files -n %{srcname}-config -%dir %attr(0700,keylime,tss) %{_distconfdir}/%{srcname} -%_config_norepl %attr (0600,keylime,tss) %{_distconfdir}/%{srcname}/ca.conf -%_config_norepl %attr (0600,keylime,tss) %{_distconfdir}/%{srcname}/logging.conf +%dir %attr(0750,root,keylime) %{_distconfdir}/%{srcname} +%_config_norepl %attr(0640,root,keylime) %{_distconfdir}/%{srcname}/ca.conf +%_config_norepl %attr(0640,root,keylime) %{_distconfdir}/%{srcname}/logging.conf %files -n %{srcname}-firewalld %dir %{_prefix}/lib/firewalld @@ -307,27 +310,27 @@ %{_prefix}/lib/firewalld/services/%{srcname}.xml %files -n %{srcname}-tpm_cert_store -%dir %attr(0700,keylime,tss) %{_prefix}/lib/%{srcname} -%dir %attr(0700,keylime,tss) %{_prefix}/lib/%{srcname}/tpm_cert_store -%attr(0600,keylime,tss) %{_prefix}/lib/%{srcname}/tpm_cert_store/* +%dir %{_prefix}/lib/%{srcname} +%dir %{_prefix}/lib/%{srcname}/tpm_cert_store +%{_prefix}/lib/%{srcname}/tpm_cert_store/* # We use this subpackage to store other unrelated things, as far as is # required by all the services %{_sysusersdir}/%{srcname}-user.conf %{_tmpfilesdir}/%{srcname}.conf %files -n %{srcname}-registrar -%dir %attr(0700,keylime,tss) %{_distconfdir}/%{srcname} -%_config_norepl %attr (0600,keylime,tss) %{_distconfdir}/%{srcname}/registrar.conf +%dir %attr(0750,root,keylime) %{_distconfdir}/%{srcname} +%_config_norepl %attr(0640,root,keylime) %{_distconfdir}/%{srcname}/registrar.conf %{_unitdir}/%{srcname}_registrar.service %files -n %{srcname}-verifier -%dir %attr(0700,keylime,tss) %{_distconfdir}/%{srcname} -%_config_norepl %attr (0600,keylime,tss) %{_distconfdir}/%{srcname}/verifier.conf +%dir %attr(0750,root,keylime) %{_distconfdir}/%{srcname} +%_config_norepl %attr(0640,root,keylime) %{_distconfdir}/%{srcname}/verifier.conf %{_unitdir}/%{srcname}_verifier.service %files -n %{srcname}-tenant -%dir %attr(0700,keylime,tss) %{_distconfdir}/%{srcname} -%_config_norepl %attr (0600,keylime,tss) %{_distconfdir}/%{srcname}/tenant.conf +%dir %attr(0750,root,keylime) %{_distconfdir}/%{srcname} +%_config_norepl %attr(0640,root,keylime) %{_distconfdir}/%{srcname}/tenant.conf %files -n %{srcname}-logrotate %_config_norepl %{_distconfdir}/logrotate.d/%{srcname} ++++++ keylime.conf ++++++ --- /var/tmp/diff_new_pack.R8JTpO/_old 2026-11-04 19:43:02.473336783 +0100 +++ /var/tmp/diff_new_pack.R8JTpO/_new 2026-11-04 19:43:02.477336951 +0100 @@ -1,6 +1,6 @@ #Type Path Mode User Group Age Argument... -d /var/log/keylime 0750 keylime tss - - -d /var/lib/keylime 0700 keylime tss - - -L /var/lib/keylime/tpm_cert_store 0700 keylime tss - ../../../usr/lib/keylime/tpm_cert_store -d /run/keylime 0700 keylime tss - - +d /var/log/keylime 0750 keylime keylime - - +d /var/lib/keylime 0700 keylime keylime - - +L /var/lib/keylime/tpm_cert_store 0700 keylime keylime - ../../../usr/lib/keylime/tpm_cert_store +d /run/keylime 0700 keylime keylime - - ++++++ logrotate.keylime ++++++ --- /var/tmp/diff_new_pack.R8JTpO/_old 2026-11-04 19:43:02.529339127 +0100 +++ /var/tmp/diff_new_pack.R8JTpO/_new 2026-11-04 19:43:02.533339295 +0100 @@ -1,5 +1,5 @@ /var/log/keylime/*.log { - su keylime tss + su keylime keylime weekly missingok rotate 4
