Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package google-guest-agent for
openSUSE:Factory checked in at 2026-11-05 18:23:09
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/google-guest-agent (Old)
and /work/SRC/openSUSE:Factory/.google-guest-agent.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "google-guest-agent"
Thu Nov 5 18:23:09 2026 rev:75 rq:1395163 version:20261105.00
Changes:
--------
--- /work/SRC/openSUSE:Factory/google-guest-agent/google-guest-agent.changes
2026-11-02 16:41:11.875322146 +0100
+++
/work/SRC/openSUSE:Factory/.google-guest-agent.new.3759290/google-guest-agent.changes
2026-11-05 18:24:31.669227906 +0100
@@ -1,0 +2,8 @@
+Thu Nov 5 12:38:37 UTC 2026 - John Paul Adrian Glaubitz
<[email protected]>
+
+- Update to version 20261105.00
+ * Refuse Windows account changes on Active Directory domain
+ controllers. (#642)
+- Remove stale Go module version overrides in _service file
+
+-------------------------------------------------------------------
Old:
----
guest-agent-20261022.00.tar.gz
New:
----
guest-agent-20261105.00.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ google-guest-agent.spec ++++++
--- /var/tmp/diff_new_pack.jE8J4J/_old 2026-11-05 18:24:34.689353525 +0100
+++ /var/tmp/diff_new_pack.jE8J4J/_new 2026-11-05 18:24:34.691353608 +0100
@@ -19,7 +19,7 @@
%define shortname guest-agent
Name: google-guest-agent
-Version: 20261022.00
+Version: 20261105.00
Release: 0
Summary: Google Cloud Guest Agent
License: Apache-2.0
++++++ _service ++++++
--- /var/tmp/diff_new_pack.jE8J4J/_old 2026-11-05 18:24:34.726355064 +0100
+++ /var/tmp/diff_new_pack.jE8J4J/_new 2026-11-05 18:24:34.730355230 +0100
@@ -3,8 +3,8 @@
<param
name="url">https://github.com/GoogleCloudPlatform/guest-agent/</param>
<param name="scm">git</param>
<param name="exclude">.git</param>
- <param name="versionformat">20261022.00</param>
- <param name="revision">20261022.00</param>
+ <param name="versionformat">20261105.00</param>
+ <param name="revision">20261105.00</param>
<param name="changesgenerate">enable</param>
</service>
<service name="recompress" mode="disabled">
@@ -15,8 +15,7 @@
<param name="basename">guest-agent</param>
</service>
<service name="go_modules" mode="disabled">
- <param name="archive">guest-agent-20261022.00.tar.gz</param>
- <param
name="replace">github.com/go-jose/go-jose/v4=github.com/go-jose/go-jose/[email protected]</param>
+ <param name="archive">guest-agent-20261105.00.tar.gz</param>
</service>
</services>
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.jE8J4J/_old 2026-11-05 18:24:34.753356187 +0100
+++ /var/tmp/diff_new_pack.jE8J4J/_new 2026-11-05 18:24:34.757356353 +0100
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://github.com/GoogleCloudPlatform/guest-agent/</param>
- <param
name="changesrevision">b08d494b439c8ed3b521745438c43dd0662444f5</param></service></servicedata>
+ <param
name="changesrevision">f57de9fd09fbdfc6dab9e5e229d9cdf0432217fe</param></service></servicedata>
(No newline at EOF)
++++++ guest-agent-20261022.00.tar.gz -> guest-agent-20261105.00.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/guest-agent-20261022.00/google_guest_agent/accounts_windows.go
new/guest-agent-20261105.00/google_guest_agent/accounts_windows.go
--- old/guest-agent-20261022.00/google_guest_agent/accounts_windows.go
2026-10-21 06:49:24.000000000 +0200
+++ new/guest-agent-20261105.00/google_guest_agent/accounts_windows.go
2026-11-03 18:12:24.000000000 +0100
@@ -16,13 +16,27 @@
import (
"context"
+ "errors"
"fmt"
"syscall"
"unsafe"
+ "github.com/GoogleCloudPlatform/guest-agent/google_guest_agent/cfg"
"golang.org/x/sys/windows"
)
+// verNTDomainController is the VER_NT_DOMAIN_CONTROLLER product type, reported
+// by both writable and read-only domain controllers.
+//
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_osversioninfoexw
+const verNTDomainController = 0x2
+
+// ErrDomainController is returned when an account change is refused because
the
+// machine is an Active Directory domain controller. On a domain controller the
+// local account APIs change domain accounts instead of local ones. The message
+// is written to the serial port for password reset clients, so it says how to
+// opt in.
+var ErrDomainController = errors.New("refusing to change Windows accounts on
an Active Directory domain controller, where they would change domain accounts;
to allow it, set allow_on_domain_controller = true in the [Accounts] section of
instance_configs.cfg and restart the guest agent")
+
var (
netAPI32 = windows.NewLazySystemDLL("netapi32.dll")
procNetUserAdd = netAPI32.NewProc("NetUserAdd")
@@ -89,7 +103,24 @@
UF_USE_AES_KEYS = 0x8000000
)
+// checkDomainController returns ErrDomainController if version reports an
+// Active Directory domain controller and config doesn't allow account changes
+// on it. RtlGetVersion always succeeds, so non-DC machines have no error path
+// that could block account changes.
+func checkDomainController(version *windows.OsVersionInfoEx, config
*cfg.Sections) error {
+ if version.ProductType != verNTDomainController {
+ return nil
+ }
+ if config.Accounts.AllowOnDomainController {
+ return nil
+ }
+ return ErrDomainController
+}
+
func resetPwd(username, pwd string) error {
+ if err := checkDomainController(windows.RtlGetVersion(), cfg.Get());
err != nil {
+ return err
+ }
uPtr, err := syscall.UTF16PtrFromString(username)
if err != nil {
return fmt.Errorf("error encoding username to UTF16: %v", err)
@@ -112,6 +143,9 @@
}
func addUserToGroup(_ context.Context, username, group string) error {
+ if err := checkDomainController(windows.RtlGetVersion(), cfg.Get());
err != nil {
+ return err
+ }
gPtr, err := syscall.UTF16PtrFromString(group)
if err != nil {
return fmt.Errorf("error encoding group to UTF16: %v", err)
@@ -139,6 +173,9 @@
}
func createUser(_ context.Context, username, pwd, _ string) error {
+ if err := checkDomainController(windows.RtlGetVersion(), cfg.Get());
err != nil {
+ return err
+ }
uPtr, err := syscall.UTF16PtrFromString(username)
if err != nil {
return fmt.Errorf("error encoding username to UTF16: %v", err)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/guest-agent-20261022.00/google_guest_agent/accounts_windows_test.go
new/guest-agent-20261105.00/google_guest_agent/accounts_windows_test.go
--- old/guest-agent-20261022.00/google_guest_agent/accounts_windows_test.go
1970-01-01 01:00:00.000000000 +0100
+++ new/guest-agent-20261105.00/google_guest_agent/accounts_windows_test.go
2026-11-03 18:12:24.000000000 +0100
@@ -0,0 +1,96 @@
+//go:build windows
+
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+ "errors"
+ "testing"
+
+ "github.com/GoogleCloudPlatform/guest-agent/google_guest_agent/cfg"
+ "golang.org/x/sys/windows"
+)
+
+const (
+ // verNTWorkstation and verNTServer are the non-DC Windows
+ // RTL_OSVERSIONINFOEXW wProductType values.
+ //
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_osversioninfoexw
+ verNTWorkstation = 0x1
+ verNTServer = 0x3
+
+ allowOnDomainControllerConfig = "[Accounts]\nallow_on_domain_controller
= true\n"
+)
+
+func TestCheckDomainController(t *testing.T) {
+ tests := []struct {
+ name string
+ productType byte
+ config *cfg.Sections
+ wantErr error
+ }{
+ {
+ name: "workstation",
+ productType: verNTWorkstation,
+ config: &cfg.Sections{Accounts: &cfg.Accounts{}},
+ },
+ {
+ name: "member_or_standalone_server",
+ productType: verNTServer,
+ config: &cfg.Sections{Accounts: &cfg.Accounts{}},
+ },
+ {
+ name: "domain_controller_default_refused",
+ productType: verNTDomainController,
+ config: &cfg.Sections{Accounts: &cfg.Accounts{}},
+ wantErr: ErrDomainController,
+ },
+ {
+ name: "domain_controller_opt_in_allowed",
+ productType: verNTDomainController,
+ config: &cfg.Sections{Accounts:
&cfg.Accounts{AllowOnDomainController: true}},
+ },
+ }
+
+ for _, test := range tests {
+ t.Run(test.name, func(t *testing.T) {
+ version := &windows.OsVersionInfoEx{ProductType:
test.productType}
+ if err := checkDomainController(version, test.config);
!errors.Is(err, test.wantErr) {
+ t.Errorf("checkDomainController(%+v, %+v) = %v,
want %v", version, test.config, err, test.wantErr)
+ }
+ })
+ }
+}
+
+func TestCheckDomainControllerConfigFileOptIn(t *testing.T) {
+ t.Cleanup(func() {
+ if err := cfg.Load(nil); err != nil {
+ t.Errorf("cfg.Load(nil) cleanup failed: %v", err)
+ }
+ })
+ dcVersion := &windows.OsVersionInfoEx{ProductType:
verNTDomainController}
+ if err := cfg.Load(nil); err != nil {
+ t.Fatalf("cfg.Load(nil) failed: %v", err)
+ }
+ if err := checkDomainController(dcVersion, cfg.Get()); !errors.Is(err,
ErrDomainController) {
+ t.Errorf("checkDomainController() with default config = %v,
want %v", err, ErrDomainController)
+ }
+ if err := cfg.Load([]byte(allowOnDomainControllerConfig)); err != nil {
+ t.Fatalf("cfg.Load(%q) failed: %v",
allowOnDomainControllerConfig, err)
+ }
+ if err := checkDomainController(dcVersion, cfg.Get()); err != nil {
+ t.Errorf("checkDomainController() with opt-in config = %v, want
nil", err)
+ }
+}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/guest-agent-20261022.00/google_guest_agent/cfg/cfg.go
new/guest-agent-20261105.00/google_guest_agent/cfg/cfg.go
--- old/guest-agent-20261022.00/google_guest_agent/cfg/cfg.go 2026-10-21
06:49:24.000000000 +0200
+++ new/guest-agent-20261105.00/google_guest_agent/cfg/cfg.go 2026-11-03
18:12:24.000000000 +0100
@@ -45,6 +45,7 @@
cloud_logging_enabled = true
[Accounts]
+allow_on_domain_controller = false
deprovision_remove = false
gpasswd_add_cmd = gpasswd -a {user} {group}
gpasswd_remove_cmd = gpasswd -d {user} {group}
@@ -124,6 +125,7 @@
cloud_logging_enabled = true
[Accounts]
+allow_on_domain_controller = false
deprovision_remove = false
gpasswd_add_cmd = pw groupmod {group} -m {user}
gpasswd_remove_cmd = pw groupmod {group} -d {user}
@@ -217,7 +219,9 @@
// pointer is nil or not.
AccountManager *AccountManager `ini:"accountManager,omitempty"`
- // Accounts defines the non windows account management options,
behaviors and commands.
+ // Accounts defines the non windows account management options,
behaviors and commands,
+ // plus the Windows allow_on_domain_controller option. The default
configuration always
+ // defines this section.
Accounts *Accounts `ini:"Accounts,omitempty"`
// AddressManager defines the address management configurations. It
takes precedence over instance's
@@ -282,14 +286,18 @@
// Accounts contains the configurations of Accounts section.
type Accounts struct {
- DeprovisionRemove bool `ini:"deprovision_remove,omitempty"`
- GPasswdAddCmd string `ini:"gpasswd_add_cmd,omitempty"`
- GPasswdRemoveCmd string `ini:"gpasswd_remove_cmd,omitempty"`
- GroupAddCmd string `ini:"groupadd_cmd,omitempty"`
- Groups string `ini:"groups,omitempty"`
- ReuseHomedir bool `ini:"reuse_homedir,omitempty"`
- UserAddCmd string `ini:"useradd_cmd,omitempty"`
- UserDelCmd string `ini:"userdel_cmd,omitempty"`
+ // AllowOnDomainController allows Windows account changes on an Active
+ // Directory domain controller, where they change domain accounts. It
is only
+ // read from the config file, so it can't be turned on through metadata.
+ AllowOnDomainController bool
`ini:"allow_on_domain_controller,omitempty"`
+ DeprovisionRemove bool `ini:"deprovision_remove,omitempty"`
+ GPasswdAddCmd string `ini:"gpasswd_add_cmd,omitempty"`
+ GPasswdRemoveCmd string `ini:"gpasswd_remove_cmd,omitempty"`
+ GroupAddCmd string `ini:"groupadd_cmd,omitempty"`
+ Groups string `ini:"groups,omitempty"`
+ ReuseHomedir bool `ini:"reuse_homedir,omitempty"`
+ UserAddCmd string `ini:"useradd_cmd,omitempty"`
+ UserDelCmd string `ini:"userdel_cmd,omitempty"`
}
// AddressManager contains the configuration of addressManager section.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/guest-agent-20261022.00/google_guest_agent/cfg/cfg_test.go
new/guest-agent-20261105.00/google_guest_agent/cfg/cfg_test.go
--- old/guest-agent-20261022.00/google_guest_agent/cfg/cfg_test.go
2026-10-21 06:49:24.000000000 +0200
+++ new/guest-agent-20261105.00/google_guest_agent/cfg/cfg_test.go
2026-11-03 18:12:24.000000000 +0100
@@ -31,6 +31,10 @@
if cfg.Accounts.DeprovisionRemove == true {
t.Errorf("Expected Accounts.deprovision_remove to be: false,
got: true")
}
+
+ if cfg.Accounts.AllowOnDomainController == true {
+ t.Errorf("Expected Accounts.allow_on_domain_controller to be:
false, got: true")
+ }
}
func TestInvalidConfig(t *testing.T) {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/guest-agent-20261022.00/google_guest_agent/windows_accounts.go
new/guest-agent-20261105.00/google_guest_agent/windows_accounts.go
--- old/guest-agent-20261022.00/google_guest_agent/windows_accounts.go
2026-10-21 06:49:24.000000000 +0200
+++ new/guest-agent-20261105.00/google_guest_agent/windows_accounts.go
2026-11-03 18:12:24.000000000 +0100
@@ -125,21 +125,21 @@
if _, err := userExists(k.UserName); err == nil {
logger.Infof("Resetting password for user %s", k.UserName)
if err := resetPwd(k.UserName, pwd); err != nil {
- return nil, fmt.Errorf("error running resetPwd: %v",
err)
+ return nil, fmt.Errorf("error running resetPwd: %w",
err)
}
if k.AddToAdministrators != nil && *k.AddToAdministrators {
if err := addUserToGroup(ctx, k.UserName,
"Administrators"); err != nil {
- return nil, fmt.Errorf("error running
addUserToGroup: %v", err)
+ return nil, fmt.Errorf("error running
addUserToGroup: %w", err)
}
}
} else {
logger.Infof("Creating user %s", k.UserName)
if err := createUser(ctx, k.UserName, pwd, ""); err != nil {
- return nil, fmt.Errorf("error running createUser: %v",
err)
+ return nil, fmt.Errorf("error running createUser: %w",
err)
}
if k.AddToAdministrators == nil || *k.AddToAdministrators {
if err := addUserToGroup(ctx, k.UserName,
"Administrators"); err != nil {
- return nil, fmt.Errorf("error running
addUserToGroup: %v", err)
+ return nil, fmt.Errorf("error running
addUserToGroup: %w", err)
}
}
}
@@ -157,11 +157,11 @@
}
logger.Infof("Creating user %s", user)
if err := createUser(ctx, user, pwd, ""); err != nil {
- return fmt.Errorf("error running createUser: %v", err)
+ return fmt.Errorf("error running createUser: %w", err)
}
if err := addUserToGroup(ctx, user, "Administrators"); err != nil {
- return fmt.Errorf("error running addUserToGroup: %v", err)
+ return fmt.Errorf("error running addUserToGroup: %w", err)
}
return nil
}
++++++ vendor.tar.gz ++++++
/work/SRC/openSUSE:Factory/google-guest-agent/vendor.tar.gz
/work/SRC/openSUSE:Factory/.google-guest-agent.new.3759290/vendor.tar.gz
differ: char 14, line 1
