Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rpmlint for openSUSE:Factory checked in at 2026-11-11 16:23:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpmlint (Old) and /work/SRC/openSUSE:Factory/.rpmlint.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rpmlint" Wed Nov 11 16:23:40 2026 rev:556 rq:1396493 version:2.10.0+git20261110.ea50e74a Changes: -------- --- /work/SRC/openSUSE:Factory/rpmlint/rpmlint.changes 2026-10-23 20:20:54.452017132 +0200 +++ /work/SRC/openSUSE:Factory/.rpmlint.new.3759290/rpmlint.changes 2026-11-11 16:23:44.368870222 +0100 @@ -1,0 +2,39 @@ +Tue Nov 10 10:38:10 UTC 2026 - Filippo Bonazzi <[email protected]> + +- Update to version 2.10.0+git20261110.ea50e74a: + * dbus-services: add tukitd backward compatibility entry (bsc#1286924) + +------------------------------------------------------------------- +Mon Nov 09 11:45:18 UTC 2026 - Matthias Gerstner <[email protected]> + +- Update to version 2.10.0+git20261109.6cd551cd: + * whitelistings: reinstate systemd 261 entries for compat (bsc#1282497) + +------------------------------------------------------------------- +Fri Nov 06 12:18:21 UTC 2026 - Matthias Gerstner <[email protected]> + +- Update to version 2.10.0+git20261106.8eae64bd: + * dbus-services: adjust backintime Qt service digest (bsc#1288838) + * systemd-tmpfiles: whitelist flake-pilot /tmp/flakes (bsc#1285113) + * dbus-services: adjust systemd import1 D-Bus config digest (bsc#1282497) + +------------------------------------------------------------------- +Thu Oct 29 12:25:37 UTC 2026 - Matthias Gerstner <[email protected]> + +- Update to version 2.10.0+git20261029.7f24f179: + * FileDigestCheck: ignore symbolic links targeting other restricted files + * dbus-services: adjust tukitd whitelisting (bsc#1286924) + +------------------------------------------------------------------- +Mon Oct 26 09:29:10 UTC 2026 - Matthias Gerstner <[email protected]> + +- Update to version 2.10.0+git20261026.783e34a5: + * security.toml: allow symlinks in Varlink socket units (bsc#1287673) + +------------------------------------------------------------------- +Fri Oct 23 07:12:23 UTC 2026 - Mislav Bozicevic <[email protected]> + +- Update to version 2.10.0+git20261023.1f39d4f4: + * varlink-whitelist: added systemd v262 changes (bsc#1282497) + +------------------------------------------------------------------- Old: ---- rpmlint-2.10.0+git20261020.513f17e8.tar.xz New: ---- rpmlint-2.10.0+git20261110.ea50e74a.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rpmlint.spec ++++++ --- /var/tmp/diff_new_pack.DGWBDM/_old 2026-11-11 16:23:46.471958431 +0100 +++ /var/tmp/diff_new_pack.DGWBDM/_new 2026-11-11 16:23:46.474958557 +0100 @@ -23,7 +23,7 @@ %define name_suffix -%{flavor} %endif Name: rpmlint%{name_suffix} -Version: 2.10.0+git20261020.513f17e8 +Version: 2.10.0+git20261110.ea50e74a Release: 0 Summary: RPM file correctness checker License: GPL-2.0-or-later ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.DGWBDM/_old 2026-11-11 16:23:46.556961997 +0100 +++ /var/tmp/diff_new_pack.DGWBDM/_new 2026-11-11 16:23:46.559962122 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/rpm-software-management/rpmlint.git</param> - <param name="changesrevision">513f17e8aad7d0bece1be4e46316dc8e97bd1d65</param></service></servicedata> + <param name="changesrevision">ea50e74a673de7a62a0ec59013f9a7ed25c5bd19</param></service></servicedata> (No newline at EOF) ++++++ rpmlint-2.10.0+git20261020.513f17e8.tar.xz -> rpmlint-2.10.0+git20261110.ea50e74a.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/dbus-services.toml new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/dbus-services.toml --- old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/dbus-services.toml 2026-10-20 11:20:38.000000000 +0200 +++ new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/dbus-services.toml 2026-11-10 11:33:06.000000000 +0100 @@ -632,8 +632,8 @@ [[FileDigestGroup]] package = "systemd-container" type = "dbus" -note = "imported from rpmlint1 DBUSServices.WhiteList" -bugs = ["bsc#964935", "bsc#1259318"] +note = "TODO: backward compatibility entry for systemd 261, remove once 262 is in Factory" +bugs = ["bsc#964935", "bsc#1259318", "bsc#1282497"] [[FileDigestGroup.digests]] path = "/usr/share/dbus-1/system-services/org.freedesktop.import1.service" digester = "shell" @@ -644,6 +644,20 @@ hash = "426f75e9a68216b346ba6421a35b2d0645b3fb52a2865328e351959193ffddb3" [[FileDigestGroup]] +package = "systemd-container" +type = "dbus" +note = "imported from rpmlint1 DBUSServices.WhiteList" +bugs = ["bsc#964935", "bsc#1259318", "bsc#1282497"] +[[FileDigestGroup.digests]] +path = "/usr/share/dbus-1/system-services/org.freedesktop.import1.service" +digester = "shell" +hash = "7abbbe8d99e3134d7cb0e93f657671f80ab430cf06259a1bb07d0de0142e7e6f" +[[FileDigestGroup.digests]] +path = "/usr/share/dbus-1/system.d/org.freedesktop.import1.conf" +digester = "xml" +hash = "12487de8ce20c91469f55c0cb35fe6a8d41ab66504fad9167395b689882bddc1" + +[[FileDigestGroup]] package = "geoclue2" type = "dbus" note = "imported from rpmlint1 DBUSServices.WhiteList" @@ -923,7 +937,7 @@ package = "backintime-qt" type = "dbus" note = "manages udev rules for removable devices, allowing to automatically run backups once inserted" -bugs = ["bsc#1007723", "bsc#1032717", "bsc#1226446"] +bugs = ["bsc#1007723", "bsc#1032717", "bsc#1226446", "bsc#1288838"] [[FileDigestGroup.digests]] path = "/usr/share/dbus-1/system.d/net.launchpad.backintime.serviceHelper.conf" digester = "xml" @@ -931,7 +945,7 @@ [[FileDigestGroup.digests]] path = "/usr/share/dbus-1/system-services/net.launchpad.backintime.serviceHelper.service" digester = "shell" -hash = "0307c5d349fc33499c49b10eab1a76ffb2427955a5982525242208c368e63d6a" +hash = "876ceaec5396c69f8d80d53ad73a3994391aef53f79b1d00149b281eb45fe17b" [[FileDigestGroup]] package = "switcheroo-control" @@ -1448,8 +1462,8 @@ [[FileDigestGroup]] package = "tukitd" type = "dbus" -note = "openSUSE transactional updates" -bugs = ["bsc#1196149", "bsc#1215216"] +note = "TODO: backward compatibility entry for systemd 261, remove once 262 is in Factory" +bugs = ["bsc#1196149", "bsc#1215216", "bsc#1286924"] [[FileDigestGroup.digests]] path = "/usr/share/dbus-1/system.d/org.opensuse.tukit.conf" digester = "xml" @@ -1457,6 +1471,20 @@ [[FileDigestGroup.digests]] path = "/usr/share/dbus-1/system-services/org.opensuse.tukit.service" digester = "shell" +hash = "32bbd0895234c5ed4d952f437cc511cb95419304b1174069a2c84efab6b771e7" + +[[FileDigestGroup]] +package = "tukitd" +type = "dbus" +note = "openSUSE transactional updates" +bugs = ["bsc#1196149", "bsc#1215216", "bsc#1286924"] +[[FileDigestGroup.digests]] +path = "/usr/share/dbus-1/system.d/org.opensuse.tukit.conf" +digester = "xml" +hash = "1f696acccf643f556312d6fddac16daa72e090a1d684bc569acd8c13272d98f3" +[[FileDigestGroup.digests]] +path = "/usr/share/dbus-1/system-services/org.opensuse.tukit.service" +digester = "shell" hash = "32bbd0895234c5ed4d952f437cc511cb95419304b1174069a2c84efab6b771e7" [[FileDigestGroup]] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/security.toml new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/security.toml --- old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/security.toml 2026-10-20 11:20:38.000000000 +0200 +++ new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/security.toml 2026-11-10 11:33:06.000000000 +0100 @@ -19,9 +19,8 @@ ] [FileDigestLocation.varlink] -# At the moment there don't exist any symlinked socket units in Factory so -# let's be restrictive here. -FollowSymlinks = false +# A few packages like systemd use symbolic links (bsc#1287673). +FollowSymlinks = true # We are only looking for *.socket files in system service locations that # contain a "FileDescriptorName=varlink" directive. The ContentCheck will take # care of the latter limitation. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/systemd-tmpfiles.toml new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/systemd-tmpfiles.toml --- old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/systemd-tmpfiles.toml 2026-10-20 11:20:38.000000000 +0200 +++ new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/systemd-tmpfiles.toml 2026-11-10 11:33:06.000000000 +0100 @@ -225,3 +225,12 @@ "d /var/google-users.d", "d /var/google-sudoers.d" ] + +[[SystemdTmpfilesWhitelist]] +package = "flake-pilot" +bugs = ["bsc#1285113"] +note = "shared directory for container management" +path = "/usr/lib/tmpfiles.d/flake-pilot.conf" +entries = [ + "d /tmp/flakes 1777 root root -" +] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/varlink-whitelist.toml new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/varlink-whitelist.toml --- old/rpmlint-2.10.0+git20261020.513f17e8/configs/openSUSE/varlink-whitelist.toml 2026-10-20 11:20:38.000000000 +0200 +++ new/rpmlint-2.10.0+git20261110.ea50e74a/configs/openSUSE/varlink-whitelist.toml 2026-11-10 11:33:06.000000000 +0100 @@ -58,8 +58,8 @@ [[FileDigestGroup]] packages = ["udev", "udev-mini"] -note = "udev core varlink services, all accessible to root only" -bug = "bsc#1261919" +note = "TODO: backward compatibility entry for systemd 261, remove once 262 is in Factory" +bugs = ["bsc#1261919", "bsc#1282497"] type = "varlink" [[FileDigestGroup.digests]] path = "/usr/lib/systemd/system/systemd-bootctl.socket" @@ -79,6 +79,28 @@ hash = "9ca1632e762e1e3215c51b08b39b7660b5461072d82013ea3dca9193b0beada9" [[FileDigestGroup]] +packages = ["udev", "udev-mini"] +note = "udev core varlink services, all accessible to root only" +bugs = ["bsc#1261919", "bsc#1282497"] +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-bootctl.socket" +digester = "systemd-socket" +hash = "59762f891aca8eeacc6d8eb7a49571db21a2b4d1e272cb2443f2b65ad39c75df" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-pcrlock.socket" +digester = "systemd-socket" +hash = "ff85b2858b9e52e9c4bd872d88dfa12c96f195e55ae9ac3c5b86e27d902911ad" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-repart.socket" +digester = "systemd-socket" +hash = "c7fe65787140d96eea9c66745b3e909cebf20833aedfedace3eb6ce53fac7643" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-udevd-varlink.socket" +digester = "systemd-socket" +hash = "02ac2eb9d03b46df84651591772048885f45532434dc646739d86c289057f449" + +[[FileDigestGroup]] package = "systemd-container" note = "container image import API, analogous to its D-Bus twin" bugs = ["bsc#964935", "bsc#1259318", "bsc#1261919"] @@ -224,8 +246,8 @@ [[FileDigestGroup]] packages = ["systemd-experimental", "systemd-mini-experimental"] -note = "programmatic access to journalctl data" -bug = "bsc#1261919" +note = "TODO: backward compatibility for sytemd 261, remove once 262 is in Factory" +bugs = ["bsc#1261919", "bsc#1282497"] type = "varlink" [[FileDigestGroup.digests]] path = "/usr/lib/systemd/system/systemd-journalctl.socket" @@ -234,8 +256,18 @@ [[FileDigestGroup]] packages = ["systemd-experimental", "systemd-mini-experimental"] -note = "turn of pid1 / kernel messages on a console" -bug = "bsc#1261919" +note = "programmatic access to journalctl data" +bugs = ["bsc#1261919", "bsc#1282497"] +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-journalctl.socket" +digester = "systemd-socket" +hash = "89a3ca938781749d92ff2154b0bb761a1a1920e1ba64410501768406b5fde98a" + +[[FileDigestGroup]] +packages = ["systemd-experimental", "systemd-mini-experimental"] +note = "TODO: backward compatibility for sytemd 261, remove once 262 is in Factory" +bugs = ["bsc#1261919", "bsc#1282497"] type = "varlink" [[FileDigestGroup.digests]] path = "/usr/lib/systemd/system/systemd-mute-console.socket" @@ -243,9 +275,19 @@ hash = "58a95fcb09c8ab8e0c2f98a2495d14a6a1ef1d0c18aacb751cebc624c9ba41f8" [[FileDigestGroup]] +packages = ["systemd-experimental", "systemd-mini-experimental"] +note = "turn off pid1 / kernel messages on a console" +bugs = ["bsc#1261919", "bsc#1282497"] +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-mute-console.socket" +digester = "systemd-socket" +hash = "dda8e6be980de95fc8b3dcd4457ae7faf4ec54af01171551de08803f26d9746d" + +[[FileDigestGroup]] packages = ["systemd-experimental", "udev"] -note = "allows root to extend TPM PCR registers" -bugs = ["bsc#1261919", "bsc#1281962"] +note = "TODO: backward compatibility entry for systemd 261, remove once 262 is in Factory" +bugs = ["bsc#1261919", "bsc#1281962", "bsc#1282497"] type = "varlink" [[FileDigestGroup.digests]] path = "/usr/lib/systemd/system/systemd-pcrextend.socket" @@ -253,6 +295,16 @@ hash = "2cccfadaadd7c49d63a40f96ba899b590c77cab7e05fcb7824b58a425d064b71" [[FileDigestGroup]] +packages = ["systemd-experimental", "udev"] +note = "allows root to extend TPM PCR registers" +bugs = ["bsc#1261919", "bsc#1281962", "bsc#1282497"] +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-pcrextend.socket" +digester = "systemd-socket" +hash = "3f1286820b1d38bf6ec4fa6687ebcedce3fc99be3b59a6c29efe223163609a10" + +[[FileDigestGroup]] packages = ["systemd-experimental", "systemd-mini-experimental"] note = "systemd core metrics read-only access" bug = "bsc#1261919" @@ -301,3 +353,135 @@ path = "/usr/lib/systemd/system/systemd-networkd-varlink-metrics.socket" digester = "systemd-socket" hash = "d72edad2d2b60779094d1fad79353c330767a9ecd0e7d55f58dd0b686fa380cd" + +[[FileDigestGroup]] +package = "systemd-experimental" +note = "exposes IMDS details as structured metrics" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-imds-metrics.socket" +digester = "systemd-socket" +hash = "6d471d67be0f4b9cb3a2891b13b7abff07b418745cd02656eb4e97692dab8c32" + +[[FileDigestGroup]] +packages = ["systemd-experimental", "systemd-mini-experimental"] +note = "exposes log statistics" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-journalctl-metrics.socket" +digester = "systemd-socket" +hash = "155ef80541ca5fbbf890cdb9dba0ace6e7dbb82dfe6dd58f8372c21715b3c969" + +[[FileDigestGroup]] +packages = ["systemd-experimental", "systemd-mini-experimental"] +note = "allows querying of system config and report files" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-report-files.socket" +digester = "systemd-socket" +hash = "b1553a7c8510a0c5642bb61fe9b7cd57cd6954fc64e3bdb34baa27c6e9f75e75" + +[[FileDigestGroup]] +package = "systemd-experimental" +note = "allows requesting signatures for reports" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-report-sign-plain.socket" +digester = "systemd-socket" +hash = "4974c27ac4ca895bb6823df367cf4ebb7cd658bacf2484542d0705cfce03a7fa" + +[[FileDigestGroup]] +package = "systemd-experimental" +note = "allows requesting signatures for reports with TPM2" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-report-sign-tpm2.socket" +digester = "systemd-socket" +hash = "4663a42852336cb169395ce04e883d216861d2f5f76f5d24fddb3ec0878d5ca5" + +[[FileDigestGroup]] +packages = ["systemd-experimental", "systemd-mini-experimental"] +note = "allows requesting signatures for reports with TSM" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-report-sign-tsm.socket" +digester = "systemd-socket" +hash = "c0bc157bfd1c326c87014f6b362a8fd449344005da5764bbb268ffda27ea408e" + +[[FileDigestGroup]] +packages = ["systemd-experimental", "systemd-mini-experimental"] +note = "orchestrates collection, signing and submission of reports" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-report.socket" +digester = "systemd-socket" +hash = "912186cf9a74260eff7446fdbf5153018bbb50cb69bf53a813ad22fe5831f8d1" + +[[FileDigestGroup]] +package = "systemd-experimental" +note = "allows installation of unit files on disk images or mounts" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-sysinstall.socket" +digester = "systemd-socket" +hash = "94d2d986059bf5da962d93d77fdf80518adfd552a839ec4052fda56dc9f56291" + +[[FileDigestGroup]] +package = "systemd-experimental" +note = "allows notification of bootctl that updates are ready" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-sysupdate-notify-bootctl.socket" +digester = "systemd-socket" +hash = "acb7397d787980dd566868d76fdd77caeb300f8084ff56537c68c5b35e1bbd07" + +[[FileDigestGroup]] +package = "systemd-experimental" +note = "allows notification of systemd-pcrlock when updates are ready" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-sysupdate-notify-pcrlock.socket" +digester = "systemd-socket" +hash = "720cf129445b3ec3244968014ac5d74987260decd9e4f8711c449ac0a9f2b442" + +[[FileDigestGroup]] +packages = ["systemd-experimental", "systemd-mini-experimental"] +note = "allows notification of systemd-sysext managers when updates are ready" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-sysupdate-notify-sysext.socket" +digester = "systemd-socket" +hash = "0a7bc2042565f2adb6d6ba1ec50e944a32159adee932cb0590719f79e37d60ec" + +[[FileDigestGroup]] +package = "systemd-experimental" +note = "allows clients to check and apply system updates" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-sysupdate.socket" +digester = "systemd-socket" +hash = "f25a086335239ddf480451f321c758c333c5e369d845673955eb0471d8127b38" + +[[FileDigestGroup]] +package = "udev" +note = "allows clients to query and enroll key management mechanisms" +bug = "bsc#1282497" +type = "varlink" +[[FileDigestGroup.digests]] +path = "/usr/lib/systemd/system/systemd-cryptenroll.socket" +digester = "systemd-socket" +hash = "11040941d20e770d2bb74e7d865c52cea98e3dd0336a62711dc627a3cbf87174" + + diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.10.0+git20261020.513f17e8/rpmlint/checks/FileDigestCheck.py new/rpmlint-2.10.0+git20261110.ea50e74a/rpmlint/checks/FileDigestCheck.py --- old/rpmlint-2.10.0+git20261020.513f17e8/rpmlint/checks/FileDigestCheck.py 2026-10-20 11:20:38.000000000 +0200 +++ new/rpmlint-2.10.0+git20261110.ea50e74a/rpmlint/checks/FileDigestCheck.py 2026-11-10 11:33:06.000000000 +0100 @@ -572,6 +572,32 @@ return True return False + def is_loopback_link(self, check, pkg, pkgfile): + """Check if a symlink file points to another restricted file covered + by the same check. The caller needs to ensure that `pkgfile` is a + link before calling this function.""" + + # This is to catch the situation when a symbolic link points to + # another file in the same or another restricted directory covered by + # the same check. + # + # We don't want to maintain multiple whitelisting entries for the same + # files, thus consider these types of symlinks as not restricted. + targetfile = pkg.readlink(pkgfile) + if not targetfile: + # target is not in the same package + return False + + target = Path(targetfile.path) + + for restricted in check['Locations']: + # `target´ contains the extracted package dir prefix, so we need + # to check whether it ends with the restricted path. + if str(target.parent).endswith(str(restricted.absolute())): + return True + + return False + def has_restricted_content(self, check, pkg, path): """Check whether the given path, which is located in a restricted location, contains data which makes it subject to our whitelisting @@ -612,14 +638,17 @@ continue check_type = check['type'] + is_link = stat.S_ISLNK(pkgfile.mode) path = pkgfile.name if path in pkg.ghost_files: if not self._is_ghost_allowed(pkg, path): self.output.add_info('E', pkg, f'{check_type}-file-ghost', path) - elif stat.S_ISLNK(pkgfile.mode) and not check['FollowSymlinks']: + elif is_link and not check['FollowSymlinks']: if not self._is_symlink_allowed(pkg, path): self.output.add_info('E', pkg, f'{check_type}-file-symlink', path) + elif is_link and self.is_loopback_link(check, pkg, pkgfile): + continue elif not self.has_restricted_content(check, pkg, path): # the path is in a restricted location but the content is not # relevant to us. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.10.0+git20261020.513f17e8/test/configs/digests_varlink.config new/rpmlint-2.10.0+git20261110.ea50e74a/test/configs/digests_varlink.config --- old/rpmlint-2.10.0+git20261020.513f17e8/test/configs/digests_varlink.config 2026-10-20 11:20:38.000000000 +0200 +++ new/rpmlint-2.10.0+git20261110.ea50e74a/test/configs/digests_varlink.config 2026-11-10 11:33:06.000000000 +0100 @@ -1,5 +1,5 @@ [FileDigestLocation.varlinktest] -FollowSymlinks = false +FollowSymlinks = true Locations = [ "/sockets/", ] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.10.0+git20261020.513f17e8/test/test_file_digest.py new/rpmlint-2.10.0+git20261110.ea50e74a/test/test_file_digest.py --- old/rpmlint-2.10.0+git20261020.513f17e8/test/test_file_digest.py 2026-10-20 11:20:38.000000000 +0200 +++ new/rpmlint-2.10.0+git20261110.ea50e74a/test/test_file_digest.py 2026-11-10 11:33:06.000000000 +0100 @@ -454,9 +454,19 @@ output, test = get_digestcheck('digests_varlink.config') with FakePkg('socketpkg') as pkg: pkg.add_file_with_content('/sockets/the.socket', MATCHING_SOCKET_DATA) + # this symlink to the already whitelisted socket unit shuold not + # trigger an additional error + pkg.add_symlink_to('/sockets/linked.socket', '/sockets/the.socket') test.check(pkg) assert len(output.results) == 0 + # when adding a symbolic link to another file in the same package but + # placed in an unrelated directory then an error should be triggered. + pkg.add_file_with_content('/etc/hidden.socket', MATCHING_SOCKET_DATA) + pkg.add_symlink_to('/sockets/another-linked.socket', '/etc/hidden.socket') + test.check(pkg) + assert len(output.results) == 1 + # this contains duplicate keys for SocketMode, it should yield a different # digest than MATCHING_SOCKET_DATA. MISMATCHING_EXTRA_SOCKET_DATA = '[Socket]\nFileDescriptorName=varlink\nSocketMode=0111\nSocketMode=0777\n'
