Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package mksusecd for openSUSE:Factory 
checked in at 2025-05-13 20:07:21
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/mksusecd (Old)
 and      /work/SRC/openSUSE:Factory/.mksusecd.new.30101 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "mksusecd"

Tue May 13 20:07:21 2025 rev:91 rq:1277058 version:3.9

Changes:
--------
--- /work/SRC/openSUSE:Factory/mksusecd/mksusecd.changes        2025-04-20 
20:03:54.734939813 +0200
+++ /work/SRC/openSUSE:Factory/.mksusecd.new.30101/mksusecd.changes     
2025-05-13 20:07:24.047704088 +0200
@@ -1,0 +2,12 @@
+Tue May 13 08:32:59 UTC 2025 - wfe...@opensuse.org
+
+- merge gh#openSUSE/mksusecd#87
+- create rh media in rh hybrid mode as default
+- doc update
+- add option to control efi image fs visibility
+- verifymedia: check also alternative grub config for live option
+- mksusecd: fix multi linux media signing (bsc#1243125)
+- several bug fixes (bsc#1243125)
+- 3.9
+
+--------------------------------------------------------------------

Old:
----
  mksusecd-3.8.tar.xz

New:
----
  mksusecd-3.9.tar.xz

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ mksusecd.spec ++++++
--- /var/tmp/diff_new_pack.6Rx683/_old  2025-05-13 20:07:24.639728994 +0200
+++ /var/tmp/diff_new_pack.6Rx683/_new  2025-05-13 20:07:24.643729162 +0200
@@ -18,7 +18,7 @@
 
 
 Name:           mksusecd
-Version:        3.8
+Version:        3.9
 Release:        0
 Summary:        Tool to create SUSE Linux installation ISOs
 License:        GPL-3.0+

++++++ mksusecd-3.8.tar.xz -> mksusecd-3.9.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/mksusecd-3.8/VERSION new/mksusecd-3.9/VERSION
--- old/mksusecd-3.8/VERSION    2025-04-17 19:16:59.000000000 +0200
+++ new/mksusecd-3.9/VERSION    2025-05-13 10:32:59.000000000 +0200
@@ -1 +1 @@
-3.8
+3.9
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/mksusecd-3.8/changelog new/mksusecd-3.9/changelog
--- old/mksusecd-3.8/changelog  2025-04-17 19:16:59.000000000 +0200
+++ new/mksusecd-3.9/changelog  2025-05-13 10:32:59.000000000 +0200
@@ -1,3 +1,12 @@
+2025-05-13:    3.9
+       - merge gh#openSUSE/mksusecd#87
+       - create rh media in rh hybrid mode as default
+       - doc update
+       - add option to control efi image fs visibility
+       - verifymedia: check also alternative grub config for live option
+       - mksusecd: fix multi linux media signing (bsc#1243125)
+       - several bug fixes (bsc#1243125)
+
 2025-04-17:    3.8
        - merge gh#openSUSE/mksusecd#86
        - add red hat/fedora media support to verifymedia (bsc#1241374)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/mksusecd-3.8/mksusecd new/mksusecd-3.9/mksusecd
--- old/mksusecd-3.8/mksusecd   2025-04-17 19:16:59.000000000 +0200
+++ new/mksusecd-3.9/mksusecd   2025-05-13 10:32:59.000000000 +0200
@@ -218,6 +218,7 @@
 sub new_products_xml;
 sub prepare_addon;
 sub check_mksquashfs_comp;
+sub check_tagmedia_signature_tag;
 sub eval_size;
 sub add_linuxrc_option;
 sub wipe_iso;
@@ -242,8 +243,8 @@
 my $opt_joliet = 1;
 my $opt_verbose = 0;
 my $opt_efi = 1;
-my $opt_hybrid = 1;
-my $opt_hybrid_fs = 'iso';
+my $opt_hybrid;
+my $opt_hybrid_fs;
 my $opt_hybrid_gpt;
 my $opt_hybrid_mbr;
 my $opt_no_prot_mbr;
@@ -251,7 +252,7 @@
 my $opt_no_mbr_chs;
 my $opt_zipl;
 my $opt_check;
-my $opt_digest = 'sha256';
+my $opt_digest;
 my @opt_initrds;
 my @opt_instsys;
 my @opt_rescue;
@@ -298,6 +299,7 @@
 my $opt_no_compression;
 my $opt_instsys_size;
 my $opt_mount_iso;
+my $opt_hide_efi_image;
 
 Getopt::Long::Configure("gnu_compat");
 
@@ -310,10 +312,14 @@
   'no-efi'           => sub { $opt_efi = 0 },
   'uefi'             => \$opt_efi,
   'no-uefi'          => sub { $opt_efi = 0 },
+  'efi-image'        => sub { $opt_hide_efi_image = 0 },
+  'no-efi-image'     => \$opt_hide_efi_image,
+  'uefi-image'       => sub { $opt_hide_efi_image = 0 },
+  'no-uefi-image'    => \$opt_hide_efi_image,
   'check'            => \$opt_check,
   'no-check'         => sub { $opt_check = 0 },
   'digest=s'         => \$opt_digest,
-  'no-digest'        => sub { $opt_digest = undef },
+  'no-digest'        => sub { $opt_digest = "" },
   'sign'             => \$opt_sign,
   'no-sign'          => sub { $opt_sign = 0 },
   'sign-image'       => \$opt_sign_image,
@@ -390,7 +396,7 @@
 
 usage 1 unless $opt_create || $opt_list_repos;
 usage 1 if $opt_hybrid_fs !~ '^(|iso|fat)$';
-usage 1 if defined($opt_digest) && $opt_digest !~ 
'^(md5|sha1|sha224|sha256|sha384|sha512)$';
+usage 1 if defined($opt_digest) && $opt_digest !~ 
'^(|md5|sha1|sha224|sha256|sha384|sha512)$';
 usage 1 if defined($opt_enable_repos) && $opt_enable_repos !~ 
/^(0|1|no|yes|auto|ask)$/i;
 
 for (keys %$opt_no_compression) {
@@ -478,6 +484,7 @@
 my $warned;
 my $read_write;
 my $mksquashfs_has_comp;
+my $tagmedia_has_signature_tag;
 my $image_size;
 my $syslinux_config;
 my $linuxrc_options;
@@ -499,6 +506,7 @@
 die "mkisofs: command not found\n" if ! -x $mkisofs->{command};
 
 $mksquashfs_has_comp = check_mksquashfs_comp;
+$tagmedia_has_signature_tag = check_tagmedia_signature_tag;
 
 if(defined $opt_size) {
   $image_size = eval_size $opt_size;
@@ -529,13 +537,6 @@
 }
 
 if($opt_create || $opt_list_repos) {
-#  if(@opt_kernel_rpms) {
-#    die "Sorry, you must run mksusecd as root to replace kernel modules." if 
$>;
-#  }
-
-  # we might need two mkisofs runs...
-  $two_runs = ($opt_hybrid && $opt_hybrid_fs) || $opt_crypto;
-
   $iso_file = $opt_dst;
 
   die "$iso_file: block device not allowed\n" if -b $iso_file;
@@ -584,6 +585,7 @@
         if(`find $d -xdev \\! -readable`) {
           die "Some files in $_ are not user-readable; you need root 
privileges.\n";
         }
+        # fixme: does not reliably work: with gpt+mbr, 'file' does not report 
a gpt
         if($iso_cnt == 1 && $t =~ /GPT partition table/) {
           if(!defined $opt_hybrid_gpt && !defined $opt_hybrid_mbr) {
             $opt_hybrid = 1;
@@ -633,7 +635,23 @@
   $media_style = get_media_style \@sources;
   $media_variant = get_media_variant \@sources;
 
-  print "media style $media_style, variant $media_variant\n" if $opt_verbose 
>= 1;
+  print "media style $media_style, variant $media_variant\n";
+
+  # default hybrid settings
+  if($media_style eq 'suse') {
+    $opt_hybrid = 1 if !defined($opt_hybrid);
+    $opt_hybrid_mbr = 1 if !defined($opt_hybrid_mbr) && 
!defined($opt_hybrid_gpt);
+    $opt_hybrid_fs = 'iso' if !defined($opt_hybrid_fs);
+  }
+  else {
+    # rh
+    $opt_hybrid = 1 if !defined($opt_hybrid);
+    $opt_hybrid_mbr = $opt_hybrid_gpt = 1 if !defined($opt_hybrid_mbr) && 
!defined($opt_hybrid_gpt);
+    $opt_hybrid_fs = '' if !defined($opt_hybrid_fs);
+  }
+
+  # we might need two mkisofs runs...
+  $two_runs = ($opt_hybrid && $opt_hybrid_fs) || $opt_crypto;
 
   analyze_products \@sources;
   build_filelist \@sources;
@@ -690,7 +708,7 @@
   if($opt_sign && (
       # we are going to change '/content' resp. '/CHECKSUMS' in one way or 
another
       @opt_initrds || @opt_instsys || @opt_rescue || @opt_kernel_rpms || 
$opt_boot_options ||
-      $opt_new_boot_entry || $opt_include_repos || update_content_or_checksums
+      $opt_new_boot_entry || $opt_include_repos || update_content_or_checksums 
|| $opt_sign_image
     )
   ) {
     extract_installkeys;
@@ -717,6 +735,7 @@
 
   prepare_addon;
 
+  # FIXME: suse also has it...
   if($media_style eq 'rh') {
     update_treeinfo;
   }
@@ -786,18 +805,30 @@
 
   wipe_iso if $opt_no_iso;
 
-  if(defined $opt_digest) {
+  if(!defined $opt_digest) {
+    $opt_digest = $media_style eq 'rh' ? 'md5' : 'sha256';
+  }
+
+  if($opt_digest ne "") {
     my $chk = $opt_check ? "--check" : "";
     my $digest = $opt_digest;
     my $pad = "";
+    my $style = $media_style;
     if($media_style eq 'suse') {
       $pad = "--pad 150";
     }
     else {
-      $digest = "md5";
-    };
+      if($opt_digest ne 'md5') {
+        $style = 'suse';
+        print "Warning: embedding $opt_digest digest in SUSE format.\n";
+      }
+    }
     print "calculating $digest...";
-    system "tagmedia --style $media_style $chk $pad --digest '$digest' 
'$iso_file' >/dev/null";
+    my $tag_sig_opt = "";
+    if($tagmedia_has_signature_tag) {
+      $tag_sig_opt = "--signature-tag" if $opt_sign_image;
+    }
+    system "tagmedia --style $style $chk $pad $tag_sig_opt --digest '$digest' 
'$iso_file' >/dev/null";
     print "\n";
     if($opt_sign && $sign_key_dir && $opt_sign_image) {
       my $tmp_dir = $tmp->dir();
@@ -905,6 +936,8 @@
 
       --uefi                      Make ISO UEFI bootable (default).
       --no-uefi                   Don't make ISO UEFI bootable.
+      --uefi-image                Make UEFI boot image visible in ISO9660 file 
system (default if it exists).
+      --no-uefi-image             Hide UEFI boot image in ISO9660 file system 
(default if it does not exist).
       --zipl                      Make image zIPL bootable (default on s390x).
       --no-zipl                   Don't make image zIPL bootable (default if 
not on s390x).
       --gpt                       Add GPT when in isohybrid mode.
@@ -1233,7 +1266,7 @@
       next if $boot->{$arch}{bl} && $boot->{$arch}{bl}{efi};
       next unless $arch eq 'x86_64' || $arch eq 'i386' || $arch eq 'aarch64';
       next unless -d fname("boot/$arch");
-      if($media_variant eq 'live') {
+      if($media_variant ne 'install') {
         next unless -d fname("boot/$arch/loader");
         $boot->{$arch}{bl}{efi} = { base => "boot/$arch/loader/efiboot.img", 
arch => $arch };
         if(-f fname("boot/$arch/loader/boot_hybrid.img")) {
@@ -1476,8 +1509,15 @@
     }
     elsif($opt_efi && $t eq 'efi') {
       $has_efi = 1;
-      my $f = fname($_->{$t}{base});
-      if(!$f || ! -s $f || rebuild_efi_image($_->{$t}{base})) {
+      my $efi_file = $_->{$t}{base};
+      my $f = fname($efi_file);
+
+      my $hide = $opt_hide_efi_image;
+      $hide = !defined($f) if !defined($hide);
+
+      printf "UEFI image: %s%s\n", $efi_file, $hide ? " (hidden)" : "";
+
+      if(!$f || ! -s $f || rebuild_efi_image($efi_file)) {
         create_efi_image $_->{$t}{base};
         $f = fname($_->{$t}{base});
       }
@@ -1487,6 +1527,11 @@
       push @{$mkisofs->{sort}}, "$f 1000001";
       $mkisofs->{options} .=
         " -eltorito-alt-boot -no-emul-boot -boot-load-size $s -b 
$_->{$t}{base}";
+      if($hide) {
+        # First line is not sufficient - why?
+        $mkisofs->{options} .= " -hide $efi_file -hide-joliet $efi_file";
+        $mkisofs->{options} .= " -hide $f -hide-joliet $f";
+      }
       print "El-Torito UEFI bootable ($_->{$t}{arch})\n";
       push @$iso_catalog, "UEFI ($_->{$t}{arch})";
       $mkisofs->{fix_catalog} = $iso_catalog;
@@ -3659,7 +3704,7 @@
 #
 sub update_content_or_checksums
 {
-  return 0 if $media_style eq 'rh' || $media_variant eq 'live';
+  return 0 unless $media_style eq 'suse' && $media_variant eq 'install';
   return $has_content ? update_content : update_checksums;
 }
 
@@ -4679,7 +4724,7 @@
           $c = 'xz --quiet -dc';
         }
         elsif($1 eq 'zst') {
-          $c = 'zstd --quiet -dc';
+          $c = 'zstd --quiet --force -dc';
         }
         elsif($1 eq 'bz2') {
           $c = 'bzip2 --quiet -dc';
@@ -5611,6 +5656,28 @@
 
 
 # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# check_tagmedia_signature_tag()
+#
+# Return 1 if tagmedia supports '--signature-tag' option, else 0.
+#
+sub check_tagmedia_signature_tag
+{
+  my $sig_ok = 0;
+
+  if(open my $f, "tagmedia --help 2>&1 |") {
+    while(<$f>) {
+      $sig_ok = 1, last if /^\s*--signature-tag\s/;
+    }
+    close $f;
+  }
+
+  print "tagmedia has '--signature-tag': $sig_ok\n" if $opt_verbose >= 2;
+
+  return $sig_ok;
+}
+
+
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 # eval_size(size_string)
 #
 # Interpret size_string and return size in (512 byte)-blocks.
@@ -5739,11 +5806,11 @@
   my $style = 'suse';
 
   for my $s (@$src) {
-    if(-d "$s->{dir}/isolinux" || -f "$s->{dir}/.discinfo") {
+    if(-f "$s->{dir}/.discinfo" || -f "$s->{dir}/Fedora-Legal-README.txt" ) {
       $style = 'rh';
       last;
     }
-    for my $r (glob "$s->{dir}/*/Packages") {
+    for my $r (glob "$s->{dir}/*/Packages $s->{dir}/Packages 
$s->{dir}/isolinux") {
       if(-d $r) {
         $style = 'rh';
         last;
@@ -5760,7 +5827,7 @@
 #
 # - sources: array_ref containing a list of directories
 #
-# Look at sources and determine media variant (install vs. live).
+# Look at sources and determine media variant (install, selfinstall, or live).
 #
 # Assume a Live medium if there's an '/LiveOS' dir.
 #
@@ -5774,6 +5841,10 @@
       $variant = 'live';
       last;
     }
+    if(-f "$s->{dir}/config.isoclient") {
+      $variant = 'selfinstall';
+      last;
+    }
   }
 
   return $variant;
@@ -5896,7 +5967,7 @@
 
   exit 0 if $opt_list_repos;
 
-  return if $media_style eq 'rh' || $media_variant eq 'live';
+  return unless $media_style eq 'suse' && $media_variant eq 'install';
 
   # don't merge repos if the user doesn't want to
   return if !$opt_merge_repos;
@@ -6000,7 +6071,7 @@
 
   open $f, "gzip --quiet -dc $xml[0] |" if $xml[0] =~ /\.gz$/;
   open $f, "xz --quiet -dc $xml[0] |" if $xml[0] =~ /\.xz$/;
-  open $f, "zstd --quiet -dc $xml[0] |" if $xml[0] =~ /\.zst$/;
+  open $f, "zstd --quiet --force -dc $xml[0] |" if $xml[0] =~ /\.zst$/;
 
   if(defined $f) {
     while(my $l = <$f>) {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/mksusecd-3.8/mksusecd_man.adoc 
new/mksusecd-3.9/mksusecd_man.adoc
--- old/mksusecd-3.8/mksusecd_man.adoc  2025-04-17 19:16:59.000000000 +0200
+++ new/mksusecd-3.9/mksusecd_man.adoc  2025-05-13 10:32:59.000000000 +0200
@@ -236,6 +236,14 @@
 Don't make ISO UEFI bootable. +
 See *UEFI boot notes* below.
 
+*--uefi-image*::
+Make UEFI boot image visible in ISO9660 file system (default if it exists). +
+See *UEFI boot notes* below.
+
+*--no-uefi-image*::
+Hide UEFI boot image in ISO9660 file system (default if it does not exist). +
+See *UEFI boot notes* below.
+
 *--zipl*::
 Make image zIPL bootable (default on s390x).
 
@@ -413,29 +421,45 @@
 
 Hybrid mode means the image can be used both as an ISO for a DVD or
 directly as a disk image. In other words, there is a partition table
-written on the ISO image, either GPT or MBR.
+added to the ISO image, either GPT or MBR or both.
 
-If you need UEFI support you will get two paritions: one for the UEFI
-image, one for the entire DVD. If not, you get just one partition covering
-all files.
+If you need UEFI support, you will get two paritions: one for the UEFI
+image (the EFI System Partition), one for the entire DVD.
+Without UEFI support, you get only one partition covering all files.
 
 There are two variants this script supports:
 
 1. Partition 1 is the data partition starting at offset 0 and covering
-the entire ISO, partition 2 is the UEFI system partition pointing
-somwhere inside the first partition. This produces an obviously
-inconsistent partition table and partitioning tools really don't like it.
-
-2. Partition 1 is a data partition *not* starting at offset 0 but still
-holding all data files. When you mount it, you see either an ISO9660 or
-a FAT filesystem. If you need UEFI support this partition becomes
-partition 2 and partition 1 points to the UEFI image. Partition 1 and 2
+the entire ISO. +
+With UEFI support, partition 2 is the EFI System Partition pointing
+somwhere inside the first partition to the UEFI boot image file.
+This produces an obviously inconsistent partition table and partitioning
+tools really don't like it.
+
+2. Without UEFI support, partition 1 is a data partition *not* starting
+at offset 0 but still holding all data files. When you mount it, you see
+either an ISO9660 or a FAT filesystem. +
+With UEFI support, partition 1 is the EFI System Partition and points to
+the UEFI boot image. Partition 2 is the data partition. Partition 1 and 2
 don't overlap. In this variant a consistent partition table is written.
 
-Normally the file system of the entire image and the file system of the main 
partition
+Normally the file system of the whole image and the file system of the main 
partition
 have identical data and meta data. If you need to have separate labels (volume 
ids) for
 both file system variants you can use the **--volume1** option to set a 
different label
-to be used for the entire image.
+to be used for the whole image.
+
+For a detailed technical description of the ISO image layout in hybrid mode,
+see https://github.com/openSUSE/mksusecd/blob/master/layout.md.
+
+There are several options to control the hybrid mode layout:
+
+- partition table type: +
+  use *--gpt* for a GPT, or *--mbr* for a MBR, or use both *--gpt --mbr* to get
+  a combined GPT and MBR
+- *--hybrid-fs=* to get a partition at offset 0 (as described in point 1. 
above)
+- *--hybrid-fs=iso* to get non-overlapping partitions (as described in point 
2. above)
+- *--no-hybrid* to get a regular ISO, not suitable to boot as disk image
+- *--no-iso* to get a plain disk image, not usable as DVD image
 
 === Signing notes
 
@@ -639,11 +663,13 @@
 Not all options apply to media with Fedora/RHEL layout. It doesn't make
 sense to add a SUSE driver update to a RHEL iso, for example.
 
-mksusecd will by default create media with a SUSE-like hybrid mode (MBR
-partition table with non-overlapping partitions). You can change that to
-create the Fedora/RHEL hybrid mode (hybrid GPT+MBR, partition starting at 
offset 0)
-by adding these options: +
-*--gpt --mbr --hybrid-fs ""*.
+mksusecd will by default create media with a Fedora/RHEL hybrid mode
+(hybrid GPT+MBR, data partition starting at offset 0).
+You can change that to create a SUSE-like hybrid mode
+(partition table with non-overlapping partitions)
+by adding option *--hybrid-fs=iso*.
+
+See *Hybrid mode notes* above for more details.
 
 Notes
 
@@ -652,7 +678,7 @@
 embedded MD5 sums.
 
 - You can use other digests instead of MD5 using *--digest DIGEST* but
-checkisomd5 cannot verify these images.
+checkisomd5 cannot verify these images. You will have to use checkmedia 
instead.
 
 === UEFI boot notes
 
@@ -667,9 +693,11 @@
 Note that this FAT file system image might not be visible on the medium (e.g. 
KIWI produced media hide the file).
 If it is visible, it has names like '/boot/x86_64/efi', 
'/boot/x86_64/loader/efiboot.img', '/images/efiboot.img', or similar.
 
-If this FAT file system image is missing or files in the '/EFI' directory (on 
the medium) have changed,
+You can control the visibility of this image with option *--uefi-image* (to 
make it visible) or *--no-uefi-image* (to hide it).
+If this option is not given, mksusecd will try to keep the visibility as it 
was on the source medium.
+
+If this FAT file system image is missing (or hidden) or files in the '/EFI' 
directory (on the medium) have changed,
 mksusecd will create a new FAT file system image based on the updated '/EFI' 
directory content.
-This generated FAT file system image will always be visible on the medium.
 
 === Crypto notes
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/mksusecd-3.8/verifymedia new/mksusecd-3.9/verifymedia
--- old/mksusecd-3.8/verifymedia        2025-04-17 19:16:59.000000000 +0200
+++ new/mksusecd-3.9/verifymedia        2025-05-13 10:32:59.000000000 +0200
@@ -205,9 +205,14 @@
 my $opt_ignore;
 my $opt_ignore_list = [
   "UEFI boot image exists",
-  "ISO digest is md5",
+  "ISO digest is sha256 or better",
   "boot partition type is EFI System Partition"
 ];
+my $opt_ignore_list_extra_rh = [
+  "ISO data partition has non-zero offset",
+  "ISO is ready to be signed",
+  "ISO is signed"
+];
 
 my $tmp;
 my $media;
@@ -300,6 +305,10 @@
 print "- media:\n", Dumper($media) if $opt_verbose >= 2;
 die "failed to detect architecture\n" unless $media->{arch};
 
+if($media->{style} eq 'rh') {
+  $opt_ignore->{$_} = 1 for @$opt_ignore_list_extra_rh;
+}
+
 show
   $media->{style} ne "",
   "media style: $media->{style}",
@@ -592,11 +601,14 @@
   "ISO has digest",
   "There must be a digest stored in media tag data. Ideally sha256 or 
sha512.\n(check settings with 'tagmedia --show').";
 
-show_conditional
-  $sig->{block_digest},
-  $sig->{block_digest} eq 'sha256' || $sig->{block_digest} eq 'sha512',
-  "ISO digest is $sig->{block_digest}",
-  "Prefer a secure digest like sha256 or sha512.\n(check settings with 
'tagmedia --show').";
+if($sig->{block_digest}) {
+  my $digest_ok = $sig->{block_digest} =~ /sha(256|384|512)/;
+  $error_detail = "Digest is $sig->{block_digest}." if ! $digest_ok;
+  show
+    $digest_ok,
+    "ISO digest is sha256 or better",
+    "Prefer a secure digest like sha256, sha384, or sha512.\n(check settings 
with 'tagmedia --show').";
+}
 
 show_conditional
   $media->{expect_signature_file},
@@ -896,6 +908,8 @@
 
   $sig->{block_digest} = 'md5' if get_tag($media->{tags}, 'md5sum') || 
get_tag($media->{tags}, 'iso md5sum');
   $sig->{block_digest} = 'sha256' if get_tag $media->{tags}, 'sha256sum';
+  $sig->{block_digest} = 'sha384' if get_tag $media->{tags}, 'sha384sum';
+  $sig->{block_digest} = 'sha512' if get_tag $media->{tags}, 'sha512sum';
 
   my $sig_block = get_tag $media->{tags}, 'signature';
   if($sig_block) {
@@ -2116,7 +2130,7 @@
           $c = 'xz --quiet -dc';
         }
         elsif($1 eq 'zst') {
-          $c = 'zstd --quiet -dc';
+          $c = 'zstd --quiet --force -dc';
         }
         elsif($1 eq 'bz2') {
           $c = 'bzip2 --quiet -dc';
@@ -2256,9 +2270,9 @@
 {
   my $media = $_[0];
 
-  my $grub_cfg = read_file($media->{grub_cfg} || $media->{efi_grub_cfg});
+  my $grub_cfg = read_file($media->{grub_cfg}) || 
read_file($media->{efi_grub_cfg});
 
-  return $1 if $grub_cfg =~ /^\s*\$?linux .* root=(\S+)/m;
+  return $1 if $grub_cfg =~ /^\s*\$?linux(?:efi)? .* root=(\S+)/m;
 
   return undef;
 }

Reply via email to