Bug 485825

Summary: yast2-add-on-creator: enable resigning of RPM packages causes checksum error
Product: [openSUSE] openSUSE 13.1 Reporter: Michael Andersson <mandersson>
Component: YaST2Assignee: Jiří Suchomel <jsuchome>
Status: RESOLVED FIXED QA Contact: Jiri Srain <jsrain>
Severity: Major    
Priority: P3 - Medium CC: dieter.kasper, heikki.ylipiessa, jsrain, jsuchome
Version: Final   
Target Milestone: Final   
Hardware: x86-64   
OS: Other   
Whiteboard:
Found By: Field Engineer Services Priority:
Business Priority: 1 Blocker: Yes
Marketing QA Status: --- IT Deployment: ---
Bug Depends on: 287447    
Bug Blocks:    
Attachments: patch for AddOnCreator.rb

Description Michael Andersson 2009-03-16 23:07:32 UTC
This new feature works, but it causes the add-on to fail when using autoyast2 or normal add_on_produc.xml.
The signing process should happen in different order.
No it creates MD5SUMS and then resigns the packages so the checksum is changed and it's different in MD5SUMS and the package itself.
So it should first resign the package and then make the checksum file with new checksum.

+++ This bug was initially created as a clone of Bug #287447 +++

Currently YaST2 AddOn Creator correctly signs all the meta data with the key choosen during the configuration run.

In addition to that it would be very usefull if the AddOn Creator was able to resign the RPM packages an AddOn will be built from.

Within projects it is not always possible to have the RPM packages all from one distributor and it would be great if the AddOn Creator would resign all packages with the given key (upon request).

We (FSC) are right now doing that within a script before running the AddOn Creator but would like to really concentrate on the AddOn Creator tool.
Comment 1 Jiří Suchomel 2009-03-17 06:09:14 UTC
bug 484695

*** This bug has been marked as a duplicate of bug 484695 ***
Comment 2 Heikki Ylipiessa 2014-01-27 14:43:17 UTC
This bug has been there like ever ?!?!?
Maybe it's time to fix this as the code is rewriten in ruby anyway.
The ruby version hangs during package signing process.
Comment 3 Arvin Schnell 2014-01-27 15:33:46 UTC
Reassigned to bugowner of yast2-add-on-creator.
Comment 4 Jiří Suchomel 2014-01-27 19:45:36 UTC
(In reply to comment #2)
> This bug has been there like ever ?!?!?

It's a shame you didn't complain earlier.
But which this should be a duplicate is marked as FIXED and original reporter did not complain.

> The ruby version hangs during package signing process.

Seems like the bug during ycp-ruby conversion.
Comment 5 Jiří Suchomel 2014-01-27 20:00:39 UTC
Created attachment 576021 [details]
patch for AddOnCreator.rb

Please patch your /usr/share/YaST2/modules/AddOnCreator.rb and try again.
Comment 6 Heikki Ylipiessa 2014-01-27 20:28:54 UTC
(In reply to comment #4)
> (In reply to comment #2)
> > This bug has been there like ever ?!?!?
> 
> It's a shame you didn't complain earlier.
> But which this should be a duplicate is marked as FIXED and original reporter
> did not complain.
> 
> > The ruby version hangs during package signing process.
> 
> Seems like the bug during ycp-ruby conversion.

Well the duplicate was marked as fixed but that bug report sadly handled more than one problem and this signing issue never got fixed ..
As summary of the problem with signing ...
If the resign option IS SELECTED the packages are signed correctly but the MD5SUMS file is not properly updated ..
If the resign option IS NOT SELECTED .. the MD5SUMS file is correctly updated.
Thus doing a proper add-on the add-on build needs to be done 2 cycles which is embarrassing.
As this should be happening in one go.
Comment 7 Heikki Ylipiessa 2014-01-27 20:30:58 UTC
(In reply to comment #5)
> Created an attachment (id=576021) [details]
> patch for AddOnCreator.rb
> 
> Please patch your /usr/share/YaST2/modules/AddOnCreator.rb and try again.

Ok .. that patch needed some manual labor to drop in place but that sorted out the hang issue so that's good .. but the signature/MD5SUMS problem still exist.
Comment 8 Jiří Suchomel 2014-01-27 20:55:39 UTC
Hm, the patch was meant for both issues. How are you testing, or what sum specifically is wrong for you?

Now, all MD5SUMS are created at the end, i.e. after the signing process.
Comment 9 Michael Andersson 2014-01-27 21:00:49 UTC
Long time no see :)

I tried the add-on-creator module and can confirm that the bug is still there!
Heikki is right this bug was closed too early without confirming that it was really fixed.
Comment 10 Heikki Ylipiessa 2014-01-27 21:42:06 UTC
(In reply to comment #8)
> Hm, the patch was meant for both issues. How are you testing, or what sum
> specifically is wrong for you?
> 
> Now, all MD5SUMS are created at the end, i.e. after the signing process.

Have you tried with the resign option enabled ?????????
Comment 11 Jiří Suchomel 2014-01-27 21:51:07 UTC
(In reply to comment #10)
> (In reply to comment #8)
> > Hm, the patch was meant for both issues. How are you testing, or what sum
> > specifically is wrong for you?
> > 
> > Now, all MD5SUMS are created at the end, i.e. after the signing process.
> 
> Have you tried with the resign option enabled ?????????

Of course. 
BTW, by "Now", I mean with the patch from comment 5
Comment 12 Michael Andersson 2014-01-28 13:20:03 UTC
Here's the rejected part of the patch:

--- AddOnCreator.rb
+++ AddOnCreator.rb
@@ -634,7 +634,7 @@
         "\teof {}\n" +
         "    }\n" +
         "    spawn -noecho rpm --define \"_signature gpg\" --define
         \"_gpg_name %1\" --define \"_gpgbin /usr/bin/gpg\" --resign $rpm\n"
         +
-        "    expect \"pass phrase:\" {send \"%2 \"}\n" +
+        "    expect \"pass phrase:\" {send \"%2\r\"}\n" +
         "    expect {\n" +


AddOnCreator version:
yast2-add-on-creator-3.0.1-2.1.noarch
Comment 13 Jiří Suchomel 2014-01-28 13:55:52 UTC
Hm, I also have yast2-add-on-creator-3.0.1-2.1.noarch and

patch /usr/share/YaST2/modules/AddOnCreator.rb < AddOnCreator.diff

worked without problems.

Anyway, even if it does not work for you, could you patch it manually? The part of comment 12 is to prevent the hang, the other part (moving CreateMD5SUMS function after the signing) is to fix the reported problem.
Comment 14 Michael Andersson 2014-01-28 14:37:33 UTC
Now it works, there was something wrong with the first download and the patch got screwed up. Made an new download and now it works perfectly both patching and the signing process.

Heikki: Have you tried re-downloading the patch ?
Comment 15 Jiří Suchomel 2014-01-31 15:46:37 UTC
Heikki, any news?
Comment 16 Jiří Suchomel 2014-01-31 15:47:50 UTC
BTW, I have testing build for 13 prepared:

https://build.opensuse.org/package/show/home:jsuchome:13.1/yast2-add-on-creator
Comment 17 Jiří Suchomel 2014-02-03 15:28:57 UTC
OK, original reported is fine with the change, so I'm closing the bug
Comment 18 Bernhard Wiedemann 2014-02-03 16:00:22 UTC
This is an autogenerated message for OBS integration:
This bug (485825) was mentioned in
https://build.opensuse.org/request/show/220710 13.1 / yast2-add-on-creator
Comment 19 Swamp Workflow Management 2014-02-12 11:04:41 UTC
openSUSE-RU-2014:0225-1: An update that has one recommended fix can now be installed.

Category: recommended (moderate)
Bug References: 485825
CVE References: 
Sources used:
openSUSE 13.1 (src):    yast2-add-on-creator-3.0.2-5.1