Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mksusecd for openSUSE:Factory checked in at 2025-05-13 20:07:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mksusecd (Old) and /work/SRC/openSUSE:Factory/.mksusecd.new.30101 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mksusecd" Tue May 13 20:07:21 2025 rev:91 rq:1277058 version:3.9 Changes: -------- --- /work/SRC/openSUSE:Factory/mksusecd/mksusecd.changes 2025-04-20 20:03:54.734939813 +0200 +++ /work/SRC/openSUSE:Factory/.mksusecd.new.30101/mksusecd.changes 2025-05-13 20:07:24.047704088 +0200 @@ -1,0 +2,12 @@ +Tue May 13 08:32:59 UTC 2025 - wfe...@opensuse.org + +- merge gh#openSUSE/mksusecd#87 +- create rh media in rh hybrid mode as default +- doc update +- add option to control efi image fs visibility +- verifymedia: check also alternative grub config for live option +- mksusecd: fix multi linux media signing (bsc#1243125) +- several bug fixes (bsc#1243125) +- 3.9 + +-------------------------------------------------------------------- Old: ---- mksusecd-3.8.tar.xz New: ---- mksusecd-3.9.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mksusecd.spec ++++++ --- /var/tmp/diff_new_pack.6Rx683/_old 2025-05-13 20:07:24.639728994 +0200 +++ /var/tmp/diff_new_pack.6Rx683/_new 2025-05-13 20:07:24.643729162 +0200 @@ -18,7 +18,7 @@ Name: mksusecd -Version: 3.8 +Version: 3.9 Release: 0 Summary: Tool to create SUSE Linux installation ISOs License: GPL-3.0+ ++++++ mksusecd-3.8.tar.xz -> mksusecd-3.9.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mksusecd-3.8/VERSION new/mksusecd-3.9/VERSION --- old/mksusecd-3.8/VERSION 2025-04-17 19:16:59.000000000 +0200 +++ new/mksusecd-3.9/VERSION 2025-05-13 10:32:59.000000000 +0200 @@ -1 +1 @@ -3.8 +3.9 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mksusecd-3.8/changelog new/mksusecd-3.9/changelog --- old/mksusecd-3.8/changelog 2025-04-17 19:16:59.000000000 +0200 +++ new/mksusecd-3.9/changelog 2025-05-13 10:32:59.000000000 +0200 @@ -1,3 +1,12 @@ +2025-05-13: 3.9 + - merge gh#openSUSE/mksusecd#87 + - create rh media in rh hybrid mode as default + - doc update + - add option to control efi image fs visibility + - verifymedia: check also alternative grub config for live option + - mksusecd: fix multi linux media signing (bsc#1243125) + - several bug fixes (bsc#1243125) + 2025-04-17: 3.8 - merge gh#openSUSE/mksusecd#86 - add red hat/fedora media support to verifymedia (bsc#1241374) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mksusecd-3.8/mksusecd new/mksusecd-3.9/mksusecd --- old/mksusecd-3.8/mksusecd 2025-04-17 19:16:59.000000000 +0200 +++ new/mksusecd-3.9/mksusecd 2025-05-13 10:32:59.000000000 +0200 @@ -218,6 +218,7 @@ sub new_products_xml; sub prepare_addon; sub check_mksquashfs_comp; +sub check_tagmedia_signature_tag; sub eval_size; sub add_linuxrc_option; sub wipe_iso; @@ -242,8 +243,8 @@ my $opt_joliet = 1; my $opt_verbose = 0; my $opt_efi = 1; -my $opt_hybrid = 1; -my $opt_hybrid_fs = 'iso'; +my $opt_hybrid; +my $opt_hybrid_fs; my $opt_hybrid_gpt; my $opt_hybrid_mbr; my $opt_no_prot_mbr; @@ -251,7 +252,7 @@ my $opt_no_mbr_chs; my $opt_zipl; my $opt_check; -my $opt_digest = 'sha256'; +my $opt_digest; my @opt_initrds; my @opt_instsys; my @opt_rescue; @@ -298,6 +299,7 @@ my $opt_no_compression; my $opt_instsys_size; my $opt_mount_iso; +my $opt_hide_efi_image; Getopt::Long::Configure("gnu_compat"); @@ -310,10 +312,14 @@ 'no-efi' => sub { $opt_efi = 0 }, 'uefi' => \$opt_efi, 'no-uefi' => sub { $opt_efi = 0 }, + 'efi-image' => sub { $opt_hide_efi_image = 0 }, + 'no-efi-image' => \$opt_hide_efi_image, + 'uefi-image' => sub { $opt_hide_efi_image = 0 }, + 'no-uefi-image' => \$opt_hide_efi_image, 'check' => \$opt_check, 'no-check' => sub { $opt_check = 0 }, 'digest=s' => \$opt_digest, - 'no-digest' => sub { $opt_digest = undef }, + 'no-digest' => sub { $opt_digest = "" }, 'sign' => \$opt_sign, 'no-sign' => sub { $opt_sign = 0 }, 'sign-image' => \$opt_sign_image, @@ -390,7 +396,7 @@ usage 1 unless $opt_create || $opt_list_repos; usage 1 if $opt_hybrid_fs !~ '^(|iso|fat)$'; -usage 1 if defined($opt_digest) && $opt_digest !~ '^(md5|sha1|sha224|sha256|sha384|sha512)$'; +usage 1 if defined($opt_digest) && $opt_digest !~ '^(|md5|sha1|sha224|sha256|sha384|sha512)$'; usage 1 if defined($opt_enable_repos) && $opt_enable_repos !~ /^(0|1|no|yes|auto|ask)$/i; for (keys %$opt_no_compression) { @@ -478,6 +484,7 @@ my $warned; my $read_write; my $mksquashfs_has_comp; +my $tagmedia_has_signature_tag; my $image_size; my $syslinux_config; my $linuxrc_options; @@ -499,6 +506,7 @@ die "mkisofs: command not found\n" if ! -x $mkisofs->{command}; $mksquashfs_has_comp = check_mksquashfs_comp; +$tagmedia_has_signature_tag = check_tagmedia_signature_tag; if(defined $opt_size) { $image_size = eval_size $opt_size; @@ -529,13 +537,6 @@ } if($opt_create || $opt_list_repos) { -# if(@opt_kernel_rpms) { -# die "Sorry, you must run mksusecd as root to replace kernel modules." if $>; -# } - - # we might need two mkisofs runs... - $two_runs = ($opt_hybrid && $opt_hybrid_fs) || $opt_crypto; - $iso_file = $opt_dst; die "$iso_file: block device not allowed\n" if -b $iso_file; @@ -584,6 +585,7 @@ if(`find $d -xdev \\! -readable`) { die "Some files in $_ are not user-readable; you need root privileges.\n"; } + # fixme: does not reliably work: with gpt+mbr, 'file' does not report a gpt if($iso_cnt == 1 && $t =~ /GPT partition table/) { if(!defined $opt_hybrid_gpt && !defined $opt_hybrid_mbr) { $opt_hybrid = 1; @@ -633,7 +635,23 @@ $media_style = get_media_style \@sources; $media_variant = get_media_variant \@sources; - print "media style $media_style, variant $media_variant\n" if $opt_verbose >= 1; + print "media style $media_style, variant $media_variant\n"; + + # default hybrid settings + if($media_style eq 'suse') { + $opt_hybrid = 1 if !defined($opt_hybrid); + $opt_hybrid_mbr = 1 if !defined($opt_hybrid_mbr) && !defined($opt_hybrid_gpt); + $opt_hybrid_fs = 'iso' if !defined($opt_hybrid_fs); + } + else { + # rh + $opt_hybrid = 1 if !defined($opt_hybrid); + $opt_hybrid_mbr = $opt_hybrid_gpt = 1 if !defined($opt_hybrid_mbr) && !defined($opt_hybrid_gpt); + $opt_hybrid_fs = '' if !defined($opt_hybrid_fs); + } + + # we might need two mkisofs runs... + $two_runs = ($opt_hybrid && $opt_hybrid_fs) || $opt_crypto; analyze_products \@sources; build_filelist \@sources; @@ -690,7 +708,7 @@ if($opt_sign && ( # we are going to change '/content' resp. '/CHECKSUMS' in one way or another @opt_initrds || @opt_instsys || @opt_rescue || @opt_kernel_rpms || $opt_boot_options || - $opt_new_boot_entry || $opt_include_repos || update_content_or_checksums + $opt_new_boot_entry || $opt_include_repos || update_content_or_checksums || $opt_sign_image ) ) { extract_installkeys; @@ -717,6 +735,7 @@ prepare_addon; + # FIXME: suse also has it... if($media_style eq 'rh') { update_treeinfo; } @@ -786,18 +805,30 @@ wipe_iso if $opt_no_iso; - if(defined $opt_digest) { + if(!defined $opt_digest) { + $opt_digest = $media_style eq 'rh' ? 'md5' : 'sha256'; + } + + if($opt_digest ne "") { my $chk = $opt_check ? "--check" : ""; my $digest = $opt_digest; my $pad = ""; + my $style = $media_style; if($media_style eq 'suse') { $pad = "--pad 150"; } else { - $digest = "md5"; - }; + if($opt_digest ne 'md5') { + $style = 'suse'; + print "Warning: embedding $opt_digest digest in SUSE format.\n"; + } + } print "calculating $digest..."; - system "tagmedia --style $media_style $chk $pad --digest '$digest' '$iso_file' >/dev/null"; + my $tag_sig_opt = ""; + if($tagmedia_has_signature_tag) { + $tag_sig_opt = "--signature-tag" if $opt_sign_image; + } + system "tagmedia --style $style $chk $pad $tag_sig_opt --digest '$digest' '$iso_file' >/dev/null"; print "\n"; if($opt_sign && $sign_key_dir && $opt_sign_image) { my $tmp_dir = $tmp->dir(); @@ -905,6 +936,8 @@ --uefi Make ISO UEFI bootable (default). --no-uefi Don't make ISO UEFI bootable. + --uefi-image Make UEFI boot image visible in ISO9660 file system (default if it exists). + --no-uefi-image Hide UEFI boot image in ISO9660 file system (default if it does not exist). --zipl Make image zIPL bootable (default on s390x). --no-zipl Don't make image zIPL bootable (default if not on s390x). --gpt Add GPT when in isohybrid mode. @@ -1233,7 +1266,7 @@ next if $boot->{$arch}{bl} && $boot->{$arch}{bl}{efi}; next unless $arch eq 'x86_64' || $arch eq 'i386' || $arch eq 'aarch64'; next unless -d fname("boot/$arch"); - if($media_variant eq 'live') { + if($media_variant ne 'install') { next unless -d fname("boot/$arch/loader"); $boot->{$arch}{bl}{efi} = { base => "boot/$arch/loader/efiboot.img", arch => $arch }; if(-f fname("boot/$arch/loader/boot_hybrid.img")) { @@ -1476,8 +1509,15 @@ } elsif($opt_efi && $t eq 'efi') { $has_efi = 1; - my $f = fname($_->{$t}{base}); - if(!$f || ! -s $f || rebuild_efi_image($_->{$t}{base})) { + my $efi_file = $_->{$t}{base}; + my $f = fname($efi_file); + + my $hide = $opt_hide_efi_image; + $hide = !defined($f) if !defined($hide); + + printf "UEFI image: %s%s\n", $efi_file, $hide ? " (hidden)" : ""; + + if(!$f || ! -s $f || rebuild_efi_image($efi_file)) { create_efi_image $_->{$t}{base}; $f = fname($_->{$t}{base}); } @@ -1487,6 +1527,11 @@ push @{$mkisofs->{sort}}, "$f 1000001"; $mkisofs->{options} .= " -eltorito-alt-boot -no-emul-boot -boot-load-size $s -b $_->{$t}{base}"; + if($hide) { + # First line is not sufficient - why? + $mkisofs->{options} .= " -hide $efi_file -hide-joliet $efi_file"; + $mkisofs->{options} .= " -hide $f -hide-joliet $f"; + } print "El-Torito UEFI bootable ($_->{$t}{arch})\n"; push @$iso_catalog, "UEFI ($_->{$t}{arch})"; $mkisofs->{fix_catalog} = $iso_catalog; @@ -3659,7 +3704,7 @@ # sub update_content_or_checksums { - return 0 if $media_style eq 'rh' || $media_variant eq 'live'; + return 0 unless $media_style eq 'suse' && $media_variant eq 'install'; return $has_content ? update_content : update_checksums; } @@ -4679,7 +4724,7 @@ $c = 'xz --quiet -dc'; } elsif($1 eq 'zst') { - $c = 'zstd --quiet -dc'; + $c = 'zstd --quiet --force -dc'; } elsif($1 eq 'bz2') { $c = 'bzip2 --quiet -dc'; @@ -5611,6 +5656,28 @@ # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# check_tagmedia_signature_tag() +# +# Return 1 if tagmedia supports '--signature-tag' option, else 0. +# +sub check_tagmedia_signature_tag +{ + my $sig_ok = 0; + + if(open my $f, "tagmedia --help 2>&1 |") { + while(<$f>) { + $sig_ok = 1, last if /^\s*--signature-tag\s/; + } + close $f; + } + + print "tagmedia has '--signature-tag': $sig_ok\n" if $opt_verbose >= 2; + + return $sig_ok; +} + + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # eval_size(size_string) # # Interpret size_string and return size in (512 byte)-blocks. @@ -5739,11 +5806,11 @@ my $style = 'suse'; for my $s (@$src) { - if(-d "$s->{dir}/isolinux" || -f "$s->{dir}/.discinfo") { + if(-f "$s->{dir}/.discinfo" || -f "$s->{dir}/Fedora-Legal-README.txt" ) { $style = 'rh'; last; } - for my $r (glob "$s->{dir}/*/Packages") { + for my $r (glob "$s->{dir}/*/Packages $s->{dir}/Packages $s->{dir}/isolinux") { if(-d $r) { $style = 'rh'; last; @@ -5760,7 +5827,7 @@ # # - sources: array_ref containing a list of directories # -# Look at sources and determine media variant (install vs. live). +# Look at sources and determine media variant (install, selfinstall, or live). # # Assume a Live medium if there's an '/LiveOS' dir. # @@ -5774,6 +5841,10 @@ $variant = 'live'; last; } + if(-f "$s->{dir}/config.isoclient") { + $variant = 'selfinstall'; + last; + } } return $variant; @@ -5896,7 +5967,7 @@ exit 0 if $opt_list_repos; - return if $media_style eq 'rh' || $media_variant eq 'live'; + return unless $media_style eq 'suse' && $media_variant eq 'install'; # don't merge repos if the user doesn't want to return if !$opt_merge_repos; @@ -6000,7 +6071,7 @@ open $f, "gzip --quiet -dc $xml[0] |" if $xml[0] =~ /\.gz$/; open $f, "xz --quiet -dc $xml[0] |" if $xml[0] =~ /\.xz$/; - open $f, "zstd --quiet -dc $xml[0] |" if $xml[0] =~ /\.zst$/; + open $f, "zstd --quiet --force -dc $xml[0] |" if $xml[0] =~ /\.zst$/; if(defined $f) { while(my $l = <$f>) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mksusecd-3.8/mksusecd_man.adoc new/mksusecd-3.9/mksusecd_man.adoc --- old/mksusecd-3.8/mksusecd_man.adoc 2025-04-17 19:16:59.000000000 +0200 +++ new/mksusecd-3.9/mksusecd_man.adoc 2025-05-13 10:32:59.000000000 +0200 @@ -236,6 +236,14 @@ Don't make ISO UEFI bootable. + See *UEFI boot notes* below. +*--uefi-image*:: +Make UEFI boot image visible in ISO9660 file system (default if it exists). + +See *UEFI boot notes* below. + +*--no-uefi-image*:: +Hide UEFI boot image in ISO9660 file system (default if it does not exist). + +See *UEFI boot notes* below. + *--zipl*:: Make image zIPL bootable (default on s390x). @@ -413,29 +421,45 @@ Hybrid mode means the image can be used both as an ISO for a DVD or directly as a disk image. In other words, there is a partition table -written on the ISO image, either GPT or MBR. +added to the ISO image, either GPT or MBR or both. -If you need UEFI support you will get two paritions: one for the UEFI -image, one for the entire DVD. If not, you get just one partition covering -all files. +If you need UEFI support, you will get two paritions: one for the UEFI +image (the EFI System Partition), one for the entire DVD. +Without UEFI support, you get only one partition covering all files. There are two variants this script supports: 1. Partition 1 is the data partition starting at offset 0 and covering -the entire ISO, partition 2 is the UEFI system partition pointing -somwhere inside the first partition. This produces an obviously -inconsistent partition table and partitioning tools really don't like it. - -2. Partition 1 is a data partition *not* starting at offset 0 but still -holding all data files. When you mount it, you see either an ISO9660 or -a FAT filesystem. If you need UEFI support this partition becomes -partition 2 and partition 1 points to the UEFI image. Partition 1 and 2 +the entire ISO. + +With UEFI support, partition 2 is the EFI System Partition pointing +somwhere inside the first partition to the UEFI boot image file. +This produces an obviously inconsistent partition table and partitioning +tools really don't like it. + +2. Without UEFI support, partition 1 is a data partition *not* starting +at offset 0 but still holding all data files. When you mount it, you see +either an ISO9660 or a FAT filesystem. + +With UEFI support, partition 1 is the EFI System Partition and points to +the UEFI boot image. Partition 2 is the data partition. Partition 1 and 2 don't overlap. In this variant a consistent partition table is written. -Normally the file system of the entire image and the file system of the main partition +Normally the file system of the whole image and the file system of the main partition have identical data and meta data. If you need to have separate labels (volume ids) for both file system variants you can use the **--volume1** option to set a different label -to be used for the entire image. +to be used for the whole image. + +For a detailed technical description of the ISO image layout in hybrid mode, +see https://github.com/openSUSE/mksusecd/blob/master/layout.md. + +There are several options to control the hybrid mode layout: + +- partition table type: + + use *--gpt* for a GPT, or *--mbr* for a MBR, or use both *--gpt --mbr* to get + a combined GPT and MBR +- *--hybrid-fs=* to get a partition at offset 0 (as described in point 1. above) +- *--hybrid-fs=iso* to get non-overlapping partitions (as described in point 2. above) +- *--no-hybrid* to get a regular ISO, not suitable to boot as disk image +- *--no-iso* to get a plain disk image, not usable as DVD image === Signing notes @@ -639,11 +663,13 @@ Not all options apply to media with Fedora/RHEL layout. It doesn't make sense to add a SUSE driver update to a RHEL iso, for example. -mksusecd will by default create media with a SUSE-like hybrid mode (MBR -partition table with non-overlapping partitions). You can change that to -create the Fedora/RHEL hybrid mode (hybrid GPT+MBR, partition starting at offset 0) -by adding these options: + -*--gpt --mbr --hybrid-fs ""*. +mksusecd will by default create media with a Fedora/RHEL hybrid mode +(hybrid GPT+MBR, data partition starting at offset 0). +You can change that to create a SUSE-like hybrid mode +(partition table with non-overlapping partitions) +by adding option *--hybrid-fs=iso*. + +See *Hybrid mode notes* above for more details. Notes @@ -652,7 +678,7 @@ embedded MD5 sums. - You can use other digests instead of MD5 using *--digest DIGEST* but -checkisomd5 cannot verify these images. +checkisomd5 cannot verify these images. You will have to use checkmedia instead. === UEFI boot notes @@ -667,9 +693,11 @@ Note that this FAT file system image might not be visible on the medium (e.g. KIWI produced media hide the file). If it is visible, it has names like '/boot/x86_64/efi', '/boot/x86_64/loader/efiboot.img', '/images/efiboot.img', or similar. -If this FAT file system image is missing or files in the '/EFI' directory (on the medium) have changed, +You can control the visibility of this image with option *--uefi-image* (to make it visible) or *--no-uefi-image* (to hide it). +If this option is not given, mksusecd will try to keep the visibility as it was on the source medium. + +If this FAT file system image is missing (or hidden) or files in the '/EFI' directory (on the medium) have changed, mksusecd will create a new FAT file system image based on the updated '/EFI' directory content. -This generated FAT file system image will always be visible on the medium. === Crypto notes diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/mksusecd-3.8/verifymedia new/mksusecd-3.9/verifymedia --- old/mksusecd-3.8/verifymedia 2025-04-17 19:16:59.000000000 +0200 +++ new/mksusecd-3.9/verifymedia 2025-05-13 10:32:59.000000000 +0200 @@ -205,9 +205,14 @@ my $opt_ignore; my $opt_ignore_list = [ "UEFI boot image exists", - "ISO digest is md5", + "ISO digest is sha256 or better", "boot partition type is EFI System Partition" ]; +my $opt_ignore_list_extra_rh = [ + "ISO data partition has non-zero offset", + "ISO is ready to be signed", + "ISO is signed" +]; my $tmp; my $media; @@ -300,6 +305,10 @@ print "- media:\n", Dumper($media) if $opt_verbose >= 2; die "failed to detect architecture\n" unless $media->{arch}; +if($media->{style} eq 'rh') { + $opt_ignore->{$_} = 1 for @$opt_ignore_list_extra_rh; +} + show $media->{style} ne "", "media style: $media->{style}", @@ -592,11 +601,14 @@ "ISO has digest", "There must be a digest stored in media tag data. Ideally sha256 or sha512.\n(check settings with 'tagmedia --show')."; -show_conditional - $sig->{block_digest}, - $sig->{block_digest} eq 'sha256' || $sig->{block_digest} eq 'sha512', - "ISO digest is $sig->{block_digest}", - "Prefer a secure digest like sha256 or sha512.\n(check settings with 'tagmedia --show')."; +if($sig->{block_digest}) { + my $digest_ok = $sig->{block_digest} =~ /sha(256|384|512)/; + $error_detail = "Digest is $sig->{block_digest}." if ! $digest_ok; + show + $digest_ok, + "ISO digest is sha256 or better", + "Prefer a secure digest like sha256, sha384, or sha512.\n(check settings with 'tagmedia --show')."; +} show_conditional $media->{expect_signature_file}, @@ -896,6 +908,8 @@ $sig->{block_digest} = 'md5' if get_tag($media->{tags}, 'md5sum') || get_tag($media->{tags}, 'iso md5sum'); $sig->{block_digest} = 'sha256' if get_tag $media->{tags}, 'sha256sum'; + $sig->{block_digest} = 'sha384' if get_tag $media->{tags}, 'sha384sum'; + $sig->{block_digest} = 'sha512' if get_tag $media->{tags}, 'sha512sum'; my $sig_block = get_tag $media->{tags}, 'signature'; if($sig_block) { @@ -2116,7 +2130,7 @@ $c = 'xz --quiet -dc'; } elsif($1 eq 'zst') { - $c = 'zstd --quiet -dc'; + $c = 'zstd --quiet --force -dc'; } elsif($1 eq 'bz2') { $c = 'bzip2 --quiet -dc'; @@ -2256,9 +2270,9 @@ { my $media = $_[0]; - my $grub_cfg = read_file($media->{grub_cfg} || $media->{efi_grub_cfg}); + my $grub_cfg = read_file($media->{grub_cfg}) || read_file($media->{efi_grub_cfg}); - return $1 if $grub_cfg =~ /^\s*\$?linux .* root=(\S+)/m; + return $1 if $grub_cfg =~ /^\s*\$?linux(?:efi)? .* root=(\S+)/m; return undef; }