Note that I am trying to fix the FTBFS on the current rpms/ruby rawhide.
Below is the scratch build with the modification to print the output of the checksec command below. https://koji.fedoraproject.org/koji/taskinfo?taskID=105910607
``` diff --git a/ruby.spec b/ruby.spec index 51ada32..f61c3fe 100644 --- a/ruby.spec +++ b/ruby.spec @@ -855,6 +855,7 @@ rm -rf %{buildroot}%{gem_dir}/gems/rake-%{rake_version}/.github %check %if 0%{?with_hardening_test} # Check Ruby hardening. +checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" %endif ```
On only s390x build, there is another error in root.log. I am asking how to fix it on devel@ mailing list now.
https://kojipkgs.fedoraproject.org//work/tasks/753/105910753/root.log
``` DEBUG util.py:442: No matches found for the following disable plugin patterns: local, spacewalk, versionlock DEBUG util.py:442: Error:- DEBUG util.py:442: Problem: conflicting requests DEBUG util.py:442: - nothing provides nm needed by checksec-2.6.0-5.fc40.noarch from build DEBUG util.py:442: - nothing provides python3.12dist(unicorn) >= 1.0.2~rc1 needed by python3-pwntools-4.9.0-4.fc39.noarch from build ```
https://bugzilla.redhat.com/show_bug.cgi?id=2235760
V.
Dne 08. 09. 23 v 17:59 Jun Aruga (he / him) napsal(a):
Note that I am trying to fix the FTBFS on the current rpms/ruby rawhide.
Below is the scratch build with the modification to print the output of the checksec command below. https://koji.fedoraproject.org/koji/taskinfo?taskID=105910607
diff --git a/ruby.spec b/ruby.spec index 51ada32..f61c3fe 100644 --- a/ruby.spec +++ b/ruby.spec @@ -855,6 +855,7 @@ rm -rf %{buildroot}%{gem_dir}/gems/rake-%{rake_version}/.github %check %if 0%{?with_hardening_test} # Check Ruby hardening. +checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" %endifOn only s390x build, there is another error in root.log. I am asking how to fix it on devel@ mailing list now.
https://kojipkgs.fedoraproject.org//work/tasks/753/105910753/root.log
DEBUG util.py:442: No matches found for the following disable plugin patterns: local, spacewalk, versionlock DEBUG util.py:442: Error:- DEBUG util.py:442: Problem: conflicting requests DEBUG util.py:442: - nothing provides nm needed by checksec-2.6.0-5.fc40.noarch from build DEBUG util.py:442: - nothing provides python3.12dist(unicorn) >= 1.0.2~rc1 needed by python3-pwntools-4.9.0-4.fc39.noarch from build
Although, the dependency issue is new to me. Chm. Sorry for being to fast replying without reading carefully.
V.
Dne 08. 09. 23 v 18:05 Vít Ondruch napsal(a):
https://bugzilla.redhat.com/show_bug.cgi?id=2235760
V.
Dne 08. 09. 23 v 17:59 Jun Aruga (he / him) napsal(a):
Note that I am trying to fix the FTBFS on the current rpms/ruby rawhide.
Below is the scratch build with the modification to print the output of the checksec command below. https://koji.fedoraproject.org/koji/taskinfo?taskID=105910607
diff --git a/ruby.spec b/ruby.spec index 51ada32..f61c3fe 100644 --- a/ruby.spec +++ b/ruby.spec @@ -855,6 +855,7 @@ rm -rf %{buildroot}%{gem_dir}/gems/rake-%{rake_version}/.github %check %if 0%{?with_hardening_test} # Check Ruby hardening. +checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" %endifOn only s390x build, there is another error in root.log. I am asking how to fix it on devel@ mailing list now.
https://kojipkgs.fedoraproject.org//work/tasks/753/105910753/root.log
DEBUG util.py:442: No matches found for the following disable plugin patterns: local, spacewalk, versionlock DEBUG util.py:442: Error:- DEBUG util.py:442: Problem: conflicting requests DEBUG util.py:442: - nothing provides nm needed by checksec-2.6.0-5.fc40.noarch from build DEBUG util.py:442: - nothing provides python3.12dist(unicorn) >= 1.0.2~rc1 needed by python3-pwntools-4.9.0-4.fc39.noarch from build
But reading the ticket, it seems to be related after all :) It seems there was done some change, but properly not tested on Rawhide properly. Feel free to update the ticket.
V.
Dne 08. 09. 23 v 18:07 Vít Ondruch napsal(a):
Although, the dependency issue is new to me. Chm. Sorry for being to fast replying without reading carefully.
V.
Dne 08. 09. 23 v 18:05 Vít Ondruch napsal(a):
https://bugzilla.redhat.com/show_bug.cgi?id=2235760
V.
Dne 08. 09. 23 v 17:59 Jun Aruga (he / him) napsal(a):
Note that I am trying to fix the FTBFS on the current rpms/ruby rawhide.
Below is the scratch build with the modification to print the output of the checksec command below. https://koji.fedoraproject.org/koji/taskinfo?taskID=105910607
diff --git a/ruby.spec b/ruby.spec index 51ada32..f61c3fe 100644 --- a/ruby.spec +++ b/ruby.spec @@ -855,6 +855,7 @@ rm -rf %{buildroot}%{gem_dir}/gems/rake-%{rake_version}/.github %check %if 0%{?with_hardening_test} # Check Ruby hardening. +checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" %endifOn only s390x build, there is another error in root.log. I am asking how to fix it on devel@ mailing list now.
https://kojipkgs.fedoraproject.org//work/tasks/753/105910753/root.log
DEBUG util.py:442: No matches found for the following disable plugin patterns: local, spacewalk, versionlock DEBUG util.py:442: Error:- DEBUG util.py:442: Problem: conflicting requests DEBUG util.py:442: - nothing provides nm needed by checksec-2.6.0-5.fc40.noarch from build DEBUG util.py:442: - nothing provides python3.12dist(unicorn) >= 1.0.2~rc1 needed by python3-pwntools-4.9.0-4.fc39.noarch from build
Thanks for the info about the Bugzilla ticket.
I think that the situation is a bit different from the things reported on the ticket. For example, the checksec command is failing in x86_64 build below.
https://koji.fedoraproject.org/koji/taskinfo?taskID=105910750 https://kojipkgs.fedoraproject.org//work/tasks/750/105910750/build.log + checksec --file=redhat-linux-build/libruby.so.3.2.2 /var/tmp/rpm-tmp.GFaqBt: line 48: 85686 Aborted (core dumped) checksec --file=redhat-linux-build/libruby.so.3.2.2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.GFaqBt (%check)
I tried to check which RPM package version of the checksec is used. However it doesn't show the version of the installed checksec. It's not convenient. Maybe because it is already installed in the build environment? I think we can add the `rpm -q checksec` somewhere for debugging purposes in ruby.spec https://kojipkgs.fedoraproject.org//work/tasks/750/105910750/root.log
Anyway, I will consider commenting on the ticket.
Jun
On Fri, Sep 8, 2023 at 6:09 PM Vít Ondruch vondruch@redhat.com wrote:
But reading the ticket, it seems to be related after all :) It seems there was done some change, but properly not tested on Rawhide properly. Feel free to update the ticket.
V.
Dne 08. 09. 23 v 18:07 Vít Ondruch napsal(a):
Although, the dependency issue is new to me. Chm. Sorry for being to fast replying without reading carefully.
V.
Dne 08. 09. 23 v 18:05 Vít Ondruch napsal(a):
https://bugzilla.redhat.com/show_bug.cgi?id=2235760
V.
Dne 08. 09. 23 v 17:59 Jun Aruga (he / him) napsal(a):
Note that I am trying to fix the FTBFS on the current rpms/ruby rawhide.
Below is the scratch build with the modification to print the output of the checksec command below. https://koji.fedoraproject.org/koji/taskinfo?taskID=105910607
diff --git a/ruby.spec b/ruby.spec index 51ada32..f61c3fe 100644 --- a/ruby.spec +++ b/ruby.spec @@ -855,6 +855,7 @@ rm -rf %{buildroot}%{gem_dir}/gems/rake-%{rake_version}/.github %check %if 0%{?with_hardening_test} # Check Ruby hardening. +checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" %endifOn only s390x build, there is another error in root.log. I am asking how to fix it on devel@ mailing list now.
https://kojipkgs.fedoraproject.org//work/tasks/753/105910753/root.log
DEBUG util.py:442: No matches found for the following disable plugin patterns: local, spacewalk, versionlock DEBUG util.py:442: Error:- DEBUG util.py:442: Problem: conflicting requests DEBUG util.py:442: - nothing provides nm needed by checksec-2.6.0-5.fc40.noarch from build DEBUG util.py:442: - nothing provides python3.12dist(unicorn) >= 1.0.2~rc1 needed by python3-pwntools-4.9.0-4.fc39.noarch from build
ruby-sig mailing list -- ruby-sig@lists.fedoraproject.org To unsubscribe send an email to ruby-sig-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/ruby-sig@lists.fedoraproject.o... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hmmm, this is not nice:
~~~
$ sudo dnf4 repoquery -f /usr/bin/checksec Copr repo for mass-prebuild owned by fberat 3.4 kB/s | 1.8 kB 00:00 Fedora - Rawhide - Developmental packages for the next Fedora release 65 kB/s | 9.9 kB 00:00 Fedora - Rawhide - Developmental packages for the next Fedora release 885 kB/s | 6.3 MB 00:07 RCM Tools for Fedora rawhide (RPMs) 60 B/s | 291 B 00:04 Errors during downloading metadata for repository 'rcm-tools-fedora-rpms': - Status code: 404 for https://download.devel.redhat.com/rel-eng/RCMTOOLS/latest-RCMTOOLS-2-F-rawhi... (IP: 10.0.14.183) Error: Failed to download metadata for repo 'rcm-tools-fedora-rpms': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried RPM Fusion for Fedora Rawhide - Free 103 kB/s | 7.5 kB 00:00 RPM Fusion for Fedora Rawhide - Free 1.3 MB/s | 662 kB 00:00 RPM Fusion for Fedora Rawhide - Nonfree 96 kB/s | 7.8 kB 00:00 RPM Fusion for Fedora Rawhide - Nonfree 359 kB/s | 265 kB 00:00 Ignoring repositories: rcm-tools-fedora-rpms checksec-0:2.6.0-4.fc39.noarch python3-pwntools-0:4.9.0-4.fc39.noarch
~~~
IOW there are two packages providing `/usr/bin/checksec` executable.
Vít
Dne 08. 09. 23 v 18:23 Jun Aruga (he / him) napsal(a):
Thanks for the info about the Bugzilla ticket.
I think that the situation is a bit different from the things reported on the ticket. For example, the checksec command is failing in x86_64 build below.
https://koji.fedoraproject.org/koji/taskinfo?taskID=105910750 https://kojipkgs.fedoraproject.org//work/tasks/750/105910750/build.log
- checksec --file=redhat-linux-build/libruby.so.3.2.2
/var/tmp/rpm-tmp.GFaqBt: line 48: 85686 Aborted (core dumped) checksec --file=redhat-linux-build/libruby.so.3.2.2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.GFaqBt (%check)
I tried to check which RPM package version of the checksec is used. However it doesn't show the version of the installed checksec. It's not convenient. Maybe because it is already installed in the build environment? I think we can add the `rpm -q checksec` somewhere for debugging purposes in ruby.spec https://kojipkgs.fedoraproject.org//work/tasks/750/105910750/root.log
Anyway, I will consider commenting on the ticket.
Jun
On Fri, Sep 8, 2023 at 6:09 PM Vít Ondruch vondruch@redhat.com wrote:
But reading the ticket, it seems to be related after all :) It seems there was done some change, but properly not tested on Rawhide properly. Feel free to update the ticket.
V.
Dne 08. 09. 23 v 18:07 Vít Ondruch napsal(a):
Although, the dependency issue is new to me. Chm. Sorry for being to fast replying without reading carefully.
V.
Dne 08. 09. 23 v 18:05 Vít Ondruch napsal(a):
https://bugzilla.redhat.com/show_bug.cgi?id=2235760
V.
Dne 08. 09. 23 v 17:59 Jun Aruga (he / him) napsal(a):
Note that I am trying to fix the FTBFS on the current rpms/ruby rawhide.
Below is the scratch build with the modification to print the output of the checksec command below. https://koji.fedoraproject.org/koji/taskinfo?taskID=105910607
diff --git a/ruby.spec b/ruby.spec index 51ada32..f61c3fe 100644 --- a/ruby.spec +++ b/ruby.spec @@ -855,6 +855,7 @@ rm -rf %{buildroot}%{gem_dir}/gems/rake-%{rake_version}/.github %check %if 0%{?with_hardening_test} # Check Ruby hardening. +checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" %endifOn only s390x build, there is another error in root.log. I am asking how to fix it on devel@ mailing list now.
https://kojipkgs.fedoraproject.org//work/tasks/753/105910753/root.log
DEBUG util.py:442: No matches found for the following disable plugin patterns: local, spacewalk, versionlock DEBUG util.py:442: Error:- DEBUG util.py:442: Problem: conflicting requests DEBUG util.py:442: - nothing provides nm needed by checksec-2.6.0-5.fc40.noarch from build DEBUG util.py:442: - nothing provides python3.12dist(unicorn) >= 1.0.2~rc1 needed by python3-pwntools-4.9.0-4.fc39.noarch from build
ruby-sig mailing list -- ruby-sig@lists.fedoraproject.org To unsubscribe send an email to ruby-sig-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/ruby-sig@lists.fedoraproject.o... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
https://bugzilla.redhat.com/show_bug.cgi?id=2238038
V.
Dne 08. 09. 23 v 19:08 Vít Ondruch napsal(a):
Hmmm, this is not nice:
$ sudo dnf4 repoquery -f /usr/bin/checksec Copr repo for mass-prebuild owned by fberat 3.4 kB/s | 1.8 kB 00:00 Fedora - Rawhide - Developmental packages for the next Fedora release 65 kB/s | 9.9 kB 00:00 Fedora - Rawhide - Developmental packages for the next Fedora release 885 kB/s | 6.3 MB 00:07 RCM Tools for Fedora rawhide (RPMs) 60 B/s | 291 B 00:04 Errors during downloading metadata for repository 'rcm-tools-fedora-rpms': - Status code: 404 for https://download.devel.redhat.com/rel-eng/RCMTOOLS/latest-RCMTOOLS-2-F-rawhide/compose/Everything/x86_64/os/repodata/repomd.xml (IP: 10.0.14.183) Error: Failed to download metadata for repo 'rcm-tools-fedora-rpms': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried RPM Fusion for Fedora Rawhide - Free 103 kB/s | 7.5 kB 00:00 RPM Fusion for Fedora Rawhide - Free 1.3 MB/s | 662 kB 00:00 RPM Fusion for Fedora Rawhide - Nonfree 96 kB/s | 7.8 kB 00:00 RPM Fusion for Fedora Rawhide - Nonfree 359 kB/s | 265 kB 00:00 Ignoring repositories: rcm-tools-fedora-rpms checksec-0:2.6.0-4.fc39.noarch python3-pwntools-0:4.9.0-4.fc39.noarchIOW there are two packages providing `/usr/bin/checksec` executable.
Vít
Dne 08. 09. 23 v 18:23 Jun Aruga (he / him) napsal(a):
Thanks for the info about the Bugzilla ticket.
I think that the situation is a bit different from the things reported on the ticket. For example, the checksec command is failing in x86_64 build below.
https://koji.fedoraproject.org/koji/taskinfo?taskID=105910750 https://kojipkgs.fedoraproject.org//work/tasks/750/105910750/build.log
- checksec --file=redhat-linux-build/libruby.so.3.2.2
/var/tmp/rpm-tmp.GFaqBt: line 48: 85686 Aborted (core dumped) checksec --file=redhat-linux-build/libruby.so.3.2.2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.GFaqBt (%check)
I tried to check which RPM package version of the checksec is used. However it doesn't show the version of the installed checksec. It's not convenient. Maybe because it is already installed in the build environment? I think we can add the `rpm -q checksec` somewhere for debugging purposes in ruby.spec https://kojipkgs.fedoraproject.org//work/tasks/750/105910750/root.log
Anyway, I will consider commenting on the ticket.
Jun
On Fri, Sep 8, 2023 at 6:09 PM Vít Ondruch vondruch@redhat.com wrote:
But reading the ticket, it seems to be related after all :) It seems there was done some change, but properly not tested on Rawhide properly. Feel free to update the ticket.
V.
Dne 08. 09. 23 v 18:07 Vít Ondruch napsal(a):
Although, the dependency issue is new to me. Chm. Sorry for being to fast replying without reading carefully.
V.
Dne 08. 09. 23 v 18:05 Vít Ondruch napsal(a):
https://bugzilla.redhat.com/show_bug.cgi?id=2235760
V.
Dne 08. 09. 23 v 17:59 Jun Aruga (he / him) napsal(a):
Note that I am trying to fix the FTBFS on the current rpms/ruby rawhide.
Below is the scratch build with the modification to print the output of the checksec command below. https://koji.fedoraproject.org/koji/taskinfo?taskID=105910607
diff --git a/ruby.spec b/ruby.spec index 51ada32..f61c3fe 100644 --- a/ruby.spec +++ b/ruby.spec @@ -855,6 +855,7 @@ rm -rf %{buildroot}%{gem_dir}/gems/rake-%{rake_version}/.github %check %if 0%{?with_hardening_test} # Check Ruby hardening. +checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} checksec --file=%{_vpath_builddir}/libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" %endifOn only s390x build, there is another error in root.log. I am asking how to fix it on devel@ mailing list now.
https://kojipkgs.fedoraproject.org//work/tasks/753/105910753/root.log
DEBUG util.py:442: No matches found for the following disable plugin patterns: local, spacewalk, versionlock DEBUG util.py:442: Error:- DEBUG util.py:442: Problem: conflicting requests DEBUG util.py:442: - nothing provides nm needed by checksec-2.6.0-5.fc40.noarch from build DEBUG util.py:442: - nothing provides python3.12dist(unicorn) >= 1.0.2~rc1 needed by python3-pwntools-4.9.0-4.fc39.noarch from build
ruby-sig mailing list -- ruby-sig@lists.fedoraproject.org To unsubscribe send an email to ruby-sig-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/ruby-sig@lists.fedoraproject.o... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
ruby-sig@lists.fedoraproject.org
-
Jun Aruga (he / him) -
Vít Ondruch