Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mkosi for openSUSE:Factory checked in at 2026-09-07 16:24:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mkosi (Old) and /work/SRC/openSUSE:Factory/.mkosi.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mkosi" Mon Sep 7 16:24:33 2026 rev:33 rq:1376075 version:27 Changes: -------- --- /work/SRC/openSUSE:Factory/mkosi/mkosi.changes 2026-09-02 17:14:08.765150837 +0200 +++ /work/SRC/openSUSE:Factory/.mkosi.new.1265/mkosi.changes 2026-09-07 16:24:36.166208396 +0200 @@ -1,0 +2,68 @@ +Fri Sep 4 11:31:18 UTC 2026 - Antonio Feijoo <[email protected]> + +- Add 0002-opensuse-tolerate-missing-RPM-keyring.patch: + * Backport upstream patch to fix build when there are no gpg-pubkey packages + installed, which is the case in OBS builds, as they use unsigned local + repositories with key verification disabled. + +- Add 0001-tests-skip-test_fork_and_wait-if-on-rc-1.patch: + * Backport upstream patch to fix test build in OBS. + +- Update to 27: + * Debug output (with --debug) will now show the duration of all steps. + * When booting an image it is always registered with user session machined + instance. + * gzip compressed outputs have been made reproducible. + * Generate locales configured in /etc/locale.gen. + * PORTABLE_PREFIXES= can be set via Environment=. + * The special value default is now understood for Initrds=, so that it can be + used in conjunction with custom initrds. + * Plugins for DNF can be configured via the environment variables + MKOSI_DNF_DISABLE_PLUGINS and MKOSI_DNF_ENABLE_PLUGINS. This is meant for + advanced use cases and is not supported further. + * A new option MakeScriptsExecutable= has been added to make scripts, that are + not executable, executable instead of exiting with an error. + * A new option OutputSize= has been added to resize output images to that size + after creation. + * Two new options OciLabels= and OciAnnotations= have been added to support + adding custom labels and annotations for images using the OCI output. + * Default initrds are no longer built by default for images using the + directory output. + * All cached images are removed when repository metadata will be synced to + avoid partial upgrade scenarios. + * When booting images the hostname is no longer set via the kernel command + line so as not to overwrite the hostname set via other means in the image. + * Support for using systemd-nsresourced's foreign UID range has been added for + directory images via the new ForeignUIDRange=. This is now the only + supported way for booting directory images unprivileged. Building images + unprivileged without a sufficiently new systemd-nsresourced is still + supported. + * If a mkosi/ directory exists and no output location is configured, the + .mkosi-private will be put there. + * LocalMirror= can now be set for tools trees. + * A new setting DriveType= has been added to configures the disk type to use + for the root disk when booting a virtual machine. + * Four new settings ElTorito=, ElToritoSystem=, ElToritoVolume=, and + ElToritoPublisher= for use with systemd-repart's El Torito support have been + added. + * mkosi box does not tint the background by itself anymore. + * The GitHub integration tests have been made runnable locally. + * Support for distribution-built UKIs have been fixed and they are picked up + as /usr/lib/modules/<kver>/vmlinuz*.efi if a signed bootloader or + UnifiedKernelImages=signed is requested. + * The update-grub trigger of APK is disabled for postmarketOS if + /etc/update-grub.conf does not exist. If you define the file yourself, you + must set disable_trigger=1 yourself, if you pull in the grub package. + * A new option ToolsTreeSnapshot was added, which defaults to the value of the + regular Snapshot= setting if the same distribution is used for the image and + the tools tree. + +- Remove 0001-distribution-do-not-default-to-release-VERSION_ID-fo.patch, merged + in version 27. + +------------------------------------------------------------------- +Wed Sep 2 16:09:23 UTC 2026 - Dirk Müller <[email protected]> + +- limit use of pandoc to Factory (jsc#PED-15770) + +------------------------------------------------------------------- Old: ---- 0001-distribution-do-not-default-to-release-VERSION_ID-fo.patch mkosi-26.tar.gz New: ---- 0001-tests-skip-test_fork_and_wait-if-on-rc-1.patch 0002-opensuse-tolerate-missing-RPM-keyring.patch mkosi-27.tar.gz ----------(Old B)---------- Old: - Remove 0001-distribution-do-not-default-to-release-VERSION_ID-fo.patch, merged in version 27. ----------(Old E)---------- ----------(New B)---------- New: - Add 0001-tests-skip-test_fork_and_wait-if-on-rc-1.patch: * Backport upstream patch to fix test build in OBS. New: - Add 0002-opensuse-tolerate-missing-RPM-keyring.patch: * Backport upstream patch to fix build when there are no gpg-pubkey packages ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mkosi.spec ++++++ --- /var/tmp/diff_new_pack.jh7YZM/_old 2026-09-07 16:24:37.557266705 +0200 +++ /var/tmp/diff_new_pack.jh7YZM/_new 2026-09-07 16:24:37.559266788 +0200 @@ -1,7 +1,7 @@ # # spec file for package mkosi # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,7 +18,7 @@ %define pythons python3 -%if 0%{?suse_version} > 1600 +%if 0%{?suse_version} >= 1699 %ifarch x86_64 aarch64 %bcond_without pandoc %else @@ -28,7 +28,7 @@ %endif Name: mkosi -Version: 26 +Version: 27 Release: 0 Summary: Build bespoke OS Images License: LGPL-2.1-or-later @@ -36,8 +36,10 @@ URL: https://github.com/systemd/mkosi Source0: https://github.com/systemd/mkosi/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz Source1: mkosi-initrd.conf -# PATCH-FIX-UPSTREAM https://github.com/systemd/mkosi/pull/4079 -Patch0: 0001-distribution-do-not-default-to-release-VERSION_ID-fo.patch +# PATCH-FIX-UPSTREAM https://github.com/systemd/mkosi/pull/4432 +Patch0: 0001-tests-skip-test_fork_and_wait-if-on-rc-1.patch +# PATCH-FIX-UPSTREAM https://github.com/systemd/mkosi/pull/4442 +Patch1: 0002-opensuse-tolerate-missing-RPM-keyring.patch BuildRequires: %{python_module pip} BuildRequires: %{python_module pytest} BuildRequires: %{python_module wheel} ++++++ 0001-tests-skip-test_fork_and_wait-if-on-rc-1.patch ++++++ >From 1da3299aecc56a1ba590a7fb7ae868275bb46d93 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Behrmann?= <[email protected]> Date: Thu, 27 Aug 2026 16:53:27 +0200 Subject: [PATCH] tests: skip test_fork_and_wait if on rc 1 This is relevant for restricted build environments where unshare could get an EPERM. Unfortunately we only get the rc from the child in fork_and_wait back and this could be any return code of 1, but anything but EPERM for unshare is unlikely here. --- tests/test_run.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/test_run.py b/tests/test_run.py index 52b43067..0d588a3a 100644 --- a/tests/test_run.py +++ b/tests/test_run.py @@ -8,6 +8,7 @@ from pathlib import Path import pytest from mkosi.run import fork_and_wait +from mkosi.sandbox import EPERM def test_fork_and_wait_returns_value() -> None: @@ -60,5 +61,10 @@ def test_fork_and_wait_sandbox(tmp_path: Path) -> None: def exists() -> bool: return Path("/abc").exists() - result = fork_and_wait(exists, sandbox=contextlib.nullcontext(["--bind", os.fspath(tmp_path), "/"])) + try: + result = fork_and_wait(exists, sandbox=contextlib.nullcontext(["--bind", os.fspath(tmp_path), "/"])) + except subprocess.CalledProcessError as e: + if e.returncode == EPERM or e.returncode == 28: + pytest.skip("CLONE_NEWUSER is not allowed in the test environment") + raise assert result -- 2.51.0 ++++++ 0002-opensuse-tolerate-missing-RPM-keyring.patch ++++++ >From af97d6ffef598baf5b2b5de3de718587012d7eb3 Mon Sep 17 00:00:00 2001 From: Luca Boccassi <[email protected]> Date: Thu, 3 Sep 2026 13:22:41 +0100 Subject: [PATCH] opensuse: tolerate missing RPM keyring 'rpm -q' exits with status 1 and writes a diagnostic to stdout when no gpg-pubkey packages are installed. This is expected for unsigned local repositories with key checking disabled, as used by OBS. Capture the output and only cache it when the query succeeds, so the diagnostic cannot be passed to 'rpm --import'. Fixes: https://github.com/systemd/mkosi/issues/4437 Follow-up for e6588afb45d32e096f647915c3273efedffe2509 --- mkosi/distribution/opensuse.py | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/mkosi/distribution/opensuse.py b/mkosi/distribution/opensuse.py index d4c27a7e..434c22d3 100644 --- a/mkosi/distribution/opensuse.py +++ b/mkosi/distribution/opensuse.py @@ -1,6 +1,7 @@ # SPDX-License-Identifier: LGPL-2.1-or-later import os +import subprocess import tempfile from collections.abc import Iterable, Sequence from pathlib import Path @@ -57,7 +58,7 @@ class Installer(DistributionInstaller, distribution=Distribution.opensuse): options = context.rootoptions() gpgkeys: Sequence[PathString] = [] - if (p := context.keyring_dir / "opensuse.gpg").exists(): + if (p := context.keyring_dir / "opensuse.gpg").exists() and p.stat().st_size > 0: gpgkeys = [workdir(p)] options += ["--bind", os.fspath(p), workdir(p)] else: @@ -76,14 +77,29 @@ class Installer(DistributionInstaller, distribution=Distribution.opensuse): return context.keyring_dir.mkdir(parents=True, exist_ok=True) - - with (context.keyring_dir / "opensuse.gpg").open("wb") as f: - run( - # TODO: Switch to rpmkeys --export once we can rely on rpm 6.0.0 or newer. - ["rpm", "--root=/buildroot", "-q", "gpg-pubkey", "--qf", "%{PUBKEYS:armor}\n"], - stdout=f, - sandbox=context.sandbox(options=context.rootoptions()), - ) + keyring = context.keyring_dir / "opensuse.gpg" + + result = run( + # TODO: Switch to rpmkeys --export once we can rely on rpm 6.0.0 or newer. + ["rpm", "--root=/buildroot", "-q", "gpg-pubkey", "--qf", "%{PUBKEYS:armor}\n"], + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + sandbox=context.sandbox(options=context.rootoptions()), + success_exit_status=(0, 1), + ) + + if result.returncode == 1: + expected = "package gpg-pubkey is not installed" + if expected not in result.stdout and expected not in result.stderr: + raise subprocess.CalledProcessError( + result.returncode, + result.args, + output=result.stdout, + stderr=result.stderr, + ) + keyring.unlink(missing_ok=True) + else: + keyring.write_text(result.stdout) @classmethod def install(cls, context: Context) -> None: -- 2.51.0 ++++++ mkosi-26.tar.gz -> mkosi-27.tar.gz ++++++ ++++ 13211 lines of diff (skipped)
