Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sdbootutil for openSUSE:Factory checked in at 2026-08-13 13:15:38 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sdbootutil (Old) and /work/SRC/openSUSE:Factory/.sdbootutil.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sdbootutil" Thu Aug 13 13:15:38 2026 rev:107 rq:1370978 version:1+git20260813.357956d Changes: -------- --- /work/SRC/openSUSE:Factory/sdbootutil/sdbootutil.changes 2026-07-14 13:46:32.840057529 +0200 +++ /work/SRC/openSUSE:Factory/.sdbootutil.new.17972/sdbootutil.changes 2026-08-13 13:15:57.545697265 +0200 @@ -1,0 +2,12 @@ +Thu Aug 13 08:48:44 UTC 2026 - Alberto Planas Dominguez <[email protected]> + +- Update to version 1+git20260813.357956d: + * Do not update the predictions without a TPM2 enrollment (bsc#1273384) + +------------------------------------------------------------------- +Wed Aug 12 13:48:52 UTC 2026 - Alberto Planas Dominguez <[email protected]> + +- Update to version 1+git20260812.305d9f2: + * Do not supplement if GRUB2-EFI is installed (bsc#1272525) + +------------------------------------------------------------------- Old: ---- sdbootutil-1+git20260714.d9bb736.obscpio New: ---- sdbootutil-1+git20260813.357956d.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sdbootutil.spec ++++++ --- /var/tmp/diff_new_pack.fle3lK/_old 2026-08-13 13:15:58.573742682 +0200 +++ /var/tmp/diff_new_pack.fle3lK/_new 2026-08-13 13:15:58.577742859 +0200 @@ -18,7 +18,7 @@ %global rustflags '-Clink-arg=-Wl,-z,relro,-z,now' Name: sdbootutil -Version: 1+git20260714.d9bb736 +Version: 1+git20260813.357956d Release: 0 Summary: Bootctl wrapper for BLS boot loaders License: MIT @@ -45,8 +45,8 @@ Requires: libtss2-tcti-device0 # For bootctl and systemd-pcrlock Requires: udev -Supplements: (grub2-x86_64-efi-bls and shim) -Supplements: (systemd-boot and shim) +Supplements: ((grub2-x86_64-efi-bls and shim) unless (grub2-x86_64-efi or grub2-arm64-efi or grub2-riscv64-efi)) +Supplements: ((systemd-boot and shim) unless (grub2-x86_64-efi or grub2-arm64-efi or grub2-riscv64-efi)) # Because uhmac it is not a noarch package # BuildArch: noarch ExclusiveArch: aarch64 %{arm} riscv64 x86_64 ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.fle3lK/_old 2026-08-13 13:15:58.645745863 +0200 +++ /var/tmp/diff_new_pack.fle3lK/_new 2026-08-13 13:15:58.653746217 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/openSUSE/sdbootutil.git</param> - <param name="changesrevision">d9bb73696fe3846dba12d18ba37360b3de8052e7</param></service></servicedata> + <param name="changesrevision">357956dc966d14297187be0a124953882a5c5ad0</param></service></servicedata> (No newline at EOF) ++++++ sdbootutil-1+git20260714.d9bb736.obscpio -> sdbootutil-1+git20260813.357956d.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260714.d9bb736/10-sdbootutil.snapper new/sdbootutil-1+git20260813.357956d/10-sdbootutil.snapper --- old/sdbootutil-1+git20260714.d9bb736/10-sdbootutil.snapper 2026-07-14 09:09:27.000000000 +0200 +++ new/sdbootutil-1+git20260813.357956d/10-sdbootutil.snapper 2026-08-13 10:41:14.000000000 +0200 @@ -55,10 +55,21 @@ # # * The same marker file is used to detect that there is a pending # update-predictions +# +# * If no device is unlocked with the TPM2 the predictions are a +# no-op, so no transient unit is created at all. This is the same +# condition that guards sdbootutil-update-predictions.service + +has_tpm2_unlock() +{ + [ -e /etc/crypttab ] && grep -q "tpm2-device" /etc/crypttab +} set_update_predictions_timer() { local to="${1:-2}" + + has_tpm2_unlock || return 0 # Reset transient timer to `to` seconds (find a better # estimator than a random number) mkdir -p /run/sdbootutil; chmod 700 /run/sdbootutil; touch /run/sdbootutil/update-predictions diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260714.d9bb736/sdbootutil-update-predictions.service new/sdbootutil-1+git20260813.357956d/sdbootutil-update-predictions.service --- old/sdbootutil-1+git20260714.d9bb736/sdbootutil-update-predictions.service 2026-07-14 09:09:27.000000000 +0200 +++ new/sdbootutil-1+git20260813.357956d/sdbootutil-update-predictions.service 2026-08-13 10:41:14.000000000 +0200 @@ -6,7 +6,15 @@ Type=oneshot KeyringMode=shared PrivateTmp=yes -ExecStartPre=/usr/bin/sh -c 'mkdir "/tmp/$INVOCATION_ID"; cp -a /var/lib/pcrlock.d /tmp/$INVOCATION_ID/pcrlock.d' +# Predictions are only needed when a device is unlocked with the TPM2. +# This is the same condition that sdbootutil checks before generating +# them, and it does not depend on the state under /var, so a system +# that lost the pcrlock components can still regenerate them +ExecCondition=/usr/bin/sh -c '[ -e /etc/crypttab ] && grep -q tpm2-device /etc/crypttab' +# Do not create /var/lib/pcrlock.d if it is missing, systemd-pcrlock +# creates it with the correct SELinux label. Without components there +# is nothing to back up +ExecStartPre=/usr/bin/sh -c 'mkdir -p "/tmp/$INVOCATION_ID"; [ ! -d /var/lib/pcrlock.d ] || cp -a /var/lib/pcrlock.d "/tmp/$INVOCATION_ID/pcrlock.d"' ExecStart=/usr/bin/sh -c '\ systemctl --quiet is-active sdbootutil-update-predictions-shutdown.service && systemctl stop sdbootutil-update-predictions-shutdown.service; \ while true; do \ @@ -15,10 +23,14 @@ [ -f /run/sdbootutil/update-predictions ] || break; \ done' ExecStopPost=/usr/bin/sh -c '\ - if [ "$SERVICE_RESULT" != "success" ]; then \ - echo "Command failed. Reason: $SERVICE_RESULT (Status: $EXIT_STATUS). Restoring backup..."; \ - rm -rf /var/lib/pcrlock.d/*; \ - cp -a "/tmp/$INVOCATION_ID/pcrlock.d/." /var/lib/pcrlock.d/; \ + if [ "$SERVICE_RESULT" != "success" ] && [ "$SERVICE_RESULT" != "exec-condition" ]; then \ + if [ -d "/tmp/$INVOCATION_ID/pcrlock.d" ]; then \ + echo "Command failed. Reason: $SERVICE_RESULT (Status: $EXIT_STATUS). Restoring backup..."; \ + rm -rf /var/lib/pcrlock.d/*; \ + cp -a "/tmp/$INVOCATION_ID/pcrlock.d/." /var/lib/pcrlock.d/; \ + else \ + echo "Command failed. Reason: $SERVICE_RESULT (Status: $EXIT_STATUS). No backup found, keeping the current predictions"; \ + fi; \ fi; \ rm -rf "/tmp/$INVOCATION_ID"' ImportCredential=sdbootutil-update-predictions.* diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260714.d9bb736/sdbootutil.spec new/sdbootutil-1+git20260813.357956d/sdbootutil.spec --- old/sdbootutil-1+git20260714.d9bb736/sdbootutil.spec 2026-07-14 09:09:27.000000000 +0200 +++ new/sdbootutil-1+git20260813.357956d/sdbootutil.spec 2026-08-13 10:41:14.000000000 +0200 @@ -45,8 +45,8 @@ Requires: libtss2-tcti-device0 # For bootctl and systemd-pcrlock Requires: udev -Supplements: (grub2-x86_64-efi-bls and shim) -Supplements: (systemd-boot and shim) +Supplements: ((grub2-x86_64-efi-bls and shim) unless (grub2-x86_64-efi or grub2-arm64-efi or grub2-riscv64-efi)) +Supplements: ((systemd-boot and shim) unless (grub2-x86_64-efi or grub2-arm64-efi or grub2-riscv64-efi)) # Because uhmac it is not a noarch package # BuildArch: noarch ExclusiveArch: aarch64 %{arm} riscv64 x86_64 ++++++ sdbootutil.obsinfo ++++++ --- /var/tmp/diff_new_pack.fle3lK/_old 2026-08-13 13:15:58.881756290 +0200 +++ /var/tmp/diff_new_pack.fle3lK/_new 2026-08-13 13:15:58.889756643 +0200 @@ -1,5 +1,5 @@ name: sdbootutil -version: 1+git20260714.d9bb736 -mtime: 1784012967 -commit: d9bb73696fe3846dba12d18ba37360b3de8052e7 +version: 1+git20260813.357956d +mtime: 1786610474 +commit: 357956dc966d14297187be0a124953882a5c5ad0
