Fix sysusers.d generator barfing on legit content (#2246236)

- a regression on uncompressing 7zip compressed sources (#2229984)
- a conflict with pre-existing scl-utils %_root_prefix macro (#2233454)

.gitignore

@@ -40,3 +40,24 @@
 /rpm-4.15.90-git14971.tar.bz2
 /rpm-4.16.0-beta1.tar.bz2
 /rpm-4.16.0-beta3.tar.bz2
+/rpm-4.16.0-rc1.tar.bz2
+/rpm-4.16.0.tar.bz2
+/rpm-4.16.1.tar.bz2
+/rpm-4.16.1.1.tar.bz2
+/rpm-4.16.1.2.tar.bz2
+/rpm-4.16.1.3.tar.bz2
+/rpm-4.16.90-git15395.tar.bz2
+/rpm-4.17.0-beta1.tar.bz2
+/rpm-4.17.0-rc1.tar.bz2
+/rpm-4.17.0.tar.bz2
+/rpm-4.18.0-alpha1.tar.bz2
+/rpm-4.18.0-alpha2.tar.bz2
+/rpm-4.18.0-beta1.tar.bz2
+/rpm-4.18.0-rc1.tar.bz2
+/rpm-4.18.0.tar.bz2
+/rpm-4.18.1.tar.bz2
+/rpm-4.18.90.tar.bz2
+/rpm-4.18.91.tar.bz2
+/rpm-4.18.92.tar.bz2
+/rpm-4.18.99.tar.bz2
+/rpm-4.19.0.tar.bz2

0001-Revert-Improve-ARM-detection.patch

@@ -1,95 +0,0 @@
-From 2426c2a066e44f4d9a342585e76cdbdb0a8a2db1 Mon Sep 17 00:00:00 2001
-From: Peter Robinson <pbrobinson@gmail.com>
-Date: Wed, 23 Oct 2019 20:22:19 +0100
-Subject: [PATCH] Revert "Improve ARM detection"
-
-This reverts commit 8c3a7b8fa92b49a811fe36b60857b12f5d7db8a8.
-
-This is the final piece in fixing rhbz 1691430. It's a clean revert
-so let's do that for F-31 and we can discuss the details later.
-
-Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
----
- lib/rpmrc.c | 37 +++++++++----------------------------
- 1 file changed, 9 insertions(+), 28 deletions(-)
-
-diff --git a/lib/rpmrc.c b/lib/rpmrc.c
-index 0806e1b07..cada3f788 100644
---- a/lib/rpmrc.c
-+++ b/lib/rpmrc.c
-@@ -82,7 +82,6 @@ struct rpmOption {
- static struct rpmat_s {
-     const char *platform;
-     uint64_t hwcap;
--    uint64_t hwcap2;
- } rpmat;
- 
- typedef struct defaultEntry_s {
-@@ -951,9 +950,6 @@ static int is_geode(void)
- 
- 
- #if defined(__linux__)
--#ifndef AT_HWCAP2 /* glibc < 2.18 */
--#define AT_HWCAP2 26
--#endif
- /**
-  * Populate rpmat structure with auxv values
-  */
-@@ -967,7 +963,6 @@ static void read_auxv(void)
- 	if (!rpmat.platform)
- 	    rpmat.platform = "";
- 	rpmat.hwcap = getauxval(AT_HWCAP);
--	rpmat.hwcap2 = getauxval(AT_HWCAP2);
- #else
- 	rpmat.platform = "";
- 	int fd = open("/proc/self/auxv", O_RDONLY);
-@@ -989,9 +984,6 @@ static void read_auxv(void)
-                     case AT_HWCAP:
-                         rpmat.hwcap = auxv.a_un.a_val;
-                         break;
--		    case AT_HWCAP2:
--			rpmat.hwcap2 = auxv.a_un.a_val;
--			break;
-                 }
- 	    }
- 	    close(fd);
-@@ -1225,27 +1217,16 @@ static void defaultMachine(rpmrcCtx ctx, const char ** arch, const char ** os)
- #	if !defined(HWCAP_ARM_VFPv3)
- #	    define HWCAP_ARM_VFPv3	(1 << 13)
- #	endif
--#	if !defined(HWCAP2_AES)
--#	    define HWCAP2_AES		(1 << 0)
--#	endif
--	/*
--	 * un.machine is armvXE, where X is version number and E is
--	 * endianness (b or l)
--	 */
--	if (rstreqn(un.machine, "armv", 4)) {
--		char endian = un.machine[strlen(un.machine)-1];
--		char *modifier = un.machine + 5;
--		/* keep armv7, armv8, armv9, armv10, ... */
--		while(risdigit(*modifier)) 
--			modifier++;
--		if (rpmat.hwcap & HWCAP_ARM_VFPv3)
--			*modifier++ = 'h';
--		if (rpmat.hwcap2 & HWCAP2_AES)
--			*modifier++ = 'c';
-+	if (rstreq(un.machine, "armv7l")) {
-+	    if (rpmat.hwcap & HWCAP_ARM_VFPv3) {
- 		if (rpmat.hwcap & HWCAP_ARM_NEON)
--			*modifier++ = 'n';
--		*modifier++ = endian;
--		*modifier++ = 0;
-+		    strcpy(un.machine, "armv7hnl");
-+		else
-+		    strcpy(un.machine, "armv7hl");
-+	    }
-+	} else if (rstreq(un.machine, "armv6l")) {
-+	    if (rpmat.hwcap & HWCAP_ARM_VFP)
-+		strcpy(un.machine, "armv6hl");
- 	}
- #	endif	/* arm*-linux */
- 
--- 
-2.23.0
-

0001-find-debuginfo.sh-decompress-DWARF-compressed-ELF-se.patch

@@ -1,30 +0,0 @@
-From f2bc669cd0a080792522dd1bb7f50ef7025f16f0 Mon Sep 17 00:00:00 2001
-From: Mark Wielaard <mark@klomp.org>
-Date: Sat, 21 Jul 2018 10:13:04 +0200
-Subject: [PATCH] find-debuginfo.sh: decompress DWARF compressed ELF sections
-
-debugedit and dwz do not support DWARF compressed ELF sections, let's
-just decompress those before extracting debuginfo.
-
-Tested-by: Igor Gnatenko <i.gnatenko.brain@gmail.com>
----
- scripts/find-debuginfo.sh | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/scripts/find-debuginfo.sh b/scripts/find-debuginfo.sh
-index 90a44942d..7b01bc036 100755
---- a/scripts/find-debuginfo.sh
-+++ b/scripts/find-debuginfo.sh
-@@ -357,6 +357,9 @@ do_file()
-   get_debugfn "$f"
-   [ -f "${debugfn}" ] && return
- 
-+  echo "explicitly decompress any DWARF compressed ELF sections in $f"
-+  eu-elfcompress -q -p -t none "$f"
-+
-   echo "extracting debug info from $f"
-   # See also cpio SOURCEFILE copy. Directories must match up.
-   debug_base_name="$RPM_BUILD_DIR"
--- 
-2.18.0
-

rpm-4.12.0-rpm2cpio-hack.patch

@@ -1,18 +0,0 @@
-diff --git a/rpm2cpio.c b/rpm2cpio.c
-index 89ebdfa..ae999ff 100644
---- a/rpm2cpio.c
-+++ b/rpm2cpio.c
-@@ -84,7 +84,12 @@ int main(int argc, char *argv[])
- 	exit(EXIT_FAILURE);
-     }
- 
--    rc = (ufdCopy(gzdi, fdo) == payload_size) ? EXIT_SUCCESS : EXIT_FAILURE;
-+    /*
-+     * XXX HACK for #1142949: should be equality test, but archive size
-+     * short by cpio trailer size in packages built with rpm 4.12.0
-+     * and its pre-releases.
-+     */
-+    rc = (ufdCopy(gzdi, fdo) >= payload_size) ? EXIT_SUCCESS : EXIT_FAILURE;
- 
-     Fclose(fdo);
- 

rpm-4.15.x-ldflags.patch

@@ -1,15 +0,0 @@
-diff -up rpm-4.9.1.1/macros.in.jx rpm-4.9.1.1/macros.in
---- rpm-4.9.1.1/macros.in.jx	2011-08-03 16:19:05.000000000 -0400
-+++ rpm-4.9.1.1/macros.in	2011-08-08 09:41:52.981064316 -0400
-@@ -674,9 +674,10 @@ print (t)\
-   RPM_BUILD_DIR=\"%{u2p:%{_builddir}}\"\
-   RPM_OPT_FLAGS=\"%{optflags}\"\
-+  RPM_LD_FLAGS=\"%{?build_ldflags}\"\
-   RPM_ARCH=\"%{_arch}\"\
-   RPM_OS=\"%{_os}\"\
-   RPM_BUILD_NCPUS=\"%{_smp_build_ncpus}\"\
--  export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_BUILD_NCPUS\
-+  export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_LD_FLAGS RPM_ARCH RPM_OS RPM_BUILD_NCPUS RPM_LD_FLAGS\
-   RPM_DOC_DIR=\"%{_docdir}\"\
-   export RPM_DOC_DIR\
-   RPM_PACKAGE_NAME=\"%{NAME}\"\

rpm-4.15.x-siteconfig.patch

@@ -1,12 +0,0 @@
-diff -up rpm-4.11.1-rc1/macros.in.siteconfig rpm-4.11.1-rc1/macros.in
---- rpm-4.11.1-rc1/macros.in.siteconfig	2013-06-07 13:19:21.000000000 +0300
-+++ rpm-4.11.1-rc1/macros.in	2013-06-11 15:06:59.525747503 +0300
-@@ -647,6 +647,8 @@ package or when debugging this package.\
-   export CLASSPATH}\
-   PKG_CONFIG_PATH=\"${PKG_CONFIG_PATH}:%{_libdir}/pkgconfig:%{_datadir}/pkgconfig\"\
-   export PKG_CONFIG_PATH\
-+  CONFIG_SITE=${CONFIG_SITE:-NONE}\
-+  export CONFIG_SITE\
-   \
-   %{verbose:set -x}\
-   umask 022\

rpm-4.17.x-rpm_dbpath.patch

@@ -0,0 +1,12 @@
+diff '--color=auto' -rup rpm-4.17.0-orig/macros.in rpm-4.17.0/macros.in
+--- rpm-4.17.0-orig/macros.in	2021-08-20 04:44:56.264259007 -0400
++++ rpm-4.17.0/macros.in	2022-01-26 20:11:26.864195884 -0500
+@@ -140,7 +140,7 @@
+ %_buildshell		/bin/sh
+ 
+ #	The location of the rpm database file(s).
+-%_dbpath		%{_var}/lib/rpm
++%_dbpath		%{_usr}/lib/sysimage/rpm
+ 
+ #	The location of the rpm database file(s) after "rpm --rebuilddb".
+ %_dbpath_rebuild	%{_dbpath}

rpm-4.18.90-weak-user-group.patch

@@ -0,0 +1,11 @@
+--- rpm-4.18.90/macros.in.orig	2023-04-17 14:48:14.802719586 +0200
++++ rpm-4.18.90/macros.in	2023-04-17 14:48:25.268852972 +0200
+@@ -236,7 +236,7 @@
+ %clamp_mtime_to_source_date_epoch 0
+ 
+ #	If enabled, dilute user() and group() requires into recommends
+-#%_use_weak_usergroup_deps 1
++%_use_weak_usergroup_deps 1
+ 
+ #	The directory where newly built binary packages will be written.
+ %_rpmdir		%{_topdir}/RPMS

rpm-4.18.92-disable-sysusers.patch

@@ -0,0 +1,12 @@
+diff -up rpm-4.18.92/macros.in.orig rpm-4.18.92/macros.in
+--- rpm-4.18.92/macros.in.orig	2023-08-02 17:56:49.858065935 +0200
++++ rpm-4.18.92/macros.in	2023-08-02 17:57:01.967988065 +0200
+@@ -138,7 +138,7 @@
+ 
+ # sysusers helper binary (or a replacement script), uncomment to disable
+ #%__systemd_sysusers	@__SYSTEMD_SYSUSERS@
+-%__systemd_sysusers	%{_rpmconfigdir}/sysusers.sh
++#%__systemd_sysusers	%{_rpmconfigdir}/sysusers.sh
+ 
+ #
+ #	Path to script that creates debug symbols in a /usr/lib/debug

rpm-4.18.x-siteconfig.patch

@@ -0,0 +1,14 @@
+diff -up rpm-4.18.1/macros.in.orig rpm-4.18.1/macros.in
+--- rpm-4.18.1/macros.in.orig	2023-03-15 13:52:55.211928040 +0100
++++ rpm-4.18.1/macros.in	2023-03-15 13:55:04.113129930 +0100
+@@ -746,7 +746,9 @@ package or when debugging this package.\
+   %{?_javaclasspath:CLASSPATH=\"%{_javaclasspath}\"\
+   export CLASSPATH}\
+   PKG_CONFIG_PATH=\"${PKG_CONFIG_PATH}:%{_libdir}/pkgconfig:%{_datadir}/pkgconfig\"\
+-  export PKG_CONFIG_PATH
++  export PKG_CONFIG_PATH\
++  CONFIG_SITE=${CONFIG_SITE:-NONE}\
++  export CONFIG_SITE
+ 
+ %___build_pre	\
+   %{___build_pre_env} \

rpm-4.19.0-sysusers-fixes.patch

@@ -0,0 +1,184 @@
+From fff4b0b2249223fccddcce9eea8658ddd12f30a0 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 3 Nov 2023 11:34:54 +0200
+Subject: [PATCH 1/4] Use macro error reporting for %add_sysuser errors
+
+Lua has error() but no warning() (obviously) which we'll want in the next
+step, so for consistency lets just use macro.error() instead.
+---
+ macros.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/macros.in b/macros.in
+index a047d1e388..1f6d8b252f 100644
+--- a/macros.in
++++ b/macros.in
+@@ -1325,14 +1325,14 @@ end
+         prefix = 'Provides: '
+     end
+     if #arg < 2 then
+-        error('not enough arguments')
++        macros.error({'not enough arguments'})
+     end
+     if arg[1] == 'g' then
+         type = 'group'
+     elseif arg[1] == 'u' then
+         type = 'user'
+     else
+-        error('invalid sysuser type: '..arg[1])
++        macros.error({'invalid sysuser type: '..arg[1]})
+     end
+     name = arg[2]
+     line = table.concat(arg, ' ')
+
+From 8e392aef642fba1f63b6d86b11fad85d63d94ba1 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 3 Nov 2023 11:51:11 +0200
+Subject: [PATCH 2/4] Fix an apparent thinko/typo in the sysusers test spec
+
+I'm quite sure I didn't really intend to test duplicate files behavior
+here...
+---
+ tests/data/SPECS/klang.spec | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tests/data/SPECS/klang.spec b/tests/data/SPECS/klang.spec
+index 7e917fdc7f..e6cce1add8 100644
+--- a/tests/data/SPECS/klang.spec
++++ b/tests/data/SPECS/klang.spec
+@@ -28,6 +28,7 @@ Summary: %{SUMMARY} server
+ 
+ %install
+ mkdir -p ${RPM_BUILD_ROOT}/var/lib/klangd
++mkdir -p ${RPM_BUILD_ROOT}/var/lib/plongd
+ mkdir -p ${RPM_BUILD_ROOT}/usr/bin/
+ mkdir -p ${RPM_BUILD_ROOT}/etc
+ mkdir -p ${RPM_BUILD_ROOT}/%{_sysusersdir}
+@@ -59,5 +60,5 @@ EOF
+ %{_sysusersdir}/klangd.conf
+ %{_sysusersdir}/plong.conf
+ %attr(-,klangd,klangd) /var/lib/klangd
+-%attr(-,plong,klong) /var/lib/klangd
++%attr(-,plong,klong) /var/lib/plongd
+ /usr/bin/klangd
+
+From 59a212dbe3cb19331582c9c022105ae47b9ace21 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 3 Nov 2023 11:53:11 +0200
+Subject: [PATCH 3/4] Handle unsupported 'r' and 'm' sysusers types more
+ gracefully
+
+People will want to use existing sysusers.d files through rpm and while
+we don't support 'r' and 'm' at this time, we shouldn't really call
+them "invalid" and error out. Issue a warning instead, and ignore.
+
+This is the first half of
+https://bugzilla.redhat.com/show_bug.cgi?id=2246236
+---
+ macros.in                   | 3 +++
+ tests/data/SPECS/klang.spec | 2 ++
+ tests/rpmi.at               | 7 +++++++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/macros.in b/macros.in
+index 1f6d8b252f..fefb351ac3 100644
+--- a/macros.in
++++ b/macros.in
+@@ -1331,6 +1331,9 @@ end
+         type = 'group'
+     elseif arg[1] == 'u' then
+         type = 'user'
++    elseif arg[1] == 'r' or arg[1] == 'm' then
++        macros.warn({'ignoring unsupported sysuser type: '..arg[1]})
++        return
+     else
+         macros.error({'invalid sysuser type: '..arg[1]})
+     end
+diff --git a/tests/data/SPECS/klang.spec b/tests/data/SPECS/klang.spec
+index e6cce1add8..e7c03cd7f8 100644
+--- a/tests/data/SPECS/klang.spec
++++ b/tests/data/SPECS/klang.spec
+@@ -47,6 +47,8 @@ EOF
+ cat << EOF > ${RPM_BUILD_ROOT}/%{_sysusersdir}/plong.conf
+ u plong - "Plong fu" /var/lib/plong /sbin/nologin
+ g klong -
++m ding dong
++r - 123-321
+ EOF
+ 
+ %files common
+diff --git a/tests/rpmi.at b/tests/rpmi.at
+index 6339a70a7c..94d8967b12 100644
+--- a/tests/rpmi.at
++++ b/tests/rpmi.at
+@@ -1481,7 +1481,14 @@ AT_SETUP([rpm -i sysusers])
+ AT_KEYWORDS([install build sysusers])
+ RPMDB_INIT
+ 
++RPMTEST_CHECK([
+ runroot rpmbuild -bb --quiet /data/SPECS/klang.spec
++],
++[0],
++[],
++[warning: ignoring unsupported sysuser type: m
++warning: ignoring unsupported sysuser type: r
++])
+ 
+ RPMTEST_CHECK([
+ runroot rpm -U /build/RPMS/noarch/klang-client-1.0-1.noarch.rpm
+
+From c47f71a72e7f885615c677e88ce92810ed1f00c8 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Fri, 3 Nov 2023 12:15:58 +0200
+Subject: [PATCH 4/4] Fix comment line handling in sysusers.d(8) files
+
+sysusers.d(8) format permits empty lines and commits, and so must we.
+Add some extra fluff to the test-case for this.
+
+This is the second half of
+https://bugzilla.redhat.com/show_bug.cgi?id=2246236
+
+Fixes: #2741
+---
+ fileattrs/sysusers.attr     | 4 ++++
+ tests/data/SPECS/klang.spec | 5 +++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/fileattrs/sysusers.attr b/fileattrs/sysusers.attr
+index f7a3e838d1..48d4caede9 100644
+--- a/fileattrs/sysusers.attr
++++ b/fileattrs/sysusers.attr
+@@ -6,6 +6,9 @@
+ # For groups created as a side-effect, only provide the group.
+ %__sysusers_provides() %{lua:
+     for line in io.lines(macros["1"]) do
++        if line:sub(1, 1) == '#' then
++            goto continue
++        end
+         fields = {}
+         for w in line:gmatch("%S+") do
+             table.insert(fields, w)
+@@ -14,5 +17,6 @@
+             table.insert(fields, 1, '-b')
+             print(macros.add_sysuser(fields))
+         end
++        ::continue::
+     end
+ }
+diff --git a/tests/data/SPECS/klang.spec b/tests/data/SPECS/klang.spec
+index e7c03cd7f8..64bd90c104 100644
+--- a/tests/data/SPECS/klang.spec
++++ b/tests/data/SPECS/klang.spec
+@@ -45,7 +45,12 @@ cat << EOF > ${RPM_BUILD_ROOT}/%{_sysusersdir}/klangd.conf
+ u klangd - "Klang server" /var/lib/klangd /sbin/nologin
+ EOF
+ cat << EOF > ${RPM_BUILD_ROOT}/%{_sysusersdir}/plong.conf
++
++# Real life files have all sorts of anomalies
+ u plong - "Plong fu" /var/lib/plong /sbin/nologin
++#...such as empty lines
++
++# and comments comments
+ g klong -
+ m ding dong
+ r - 123-321

rpm.spec

@@ -1,71 +1,49 @@
 # build against xz?
 %bcond_without xz
-# run internal testsuite?
-%bcond_without check
 # build with plugins?
 %bcond_without plugins
 # build with libarchive? (needed for rpm2archive)
 %bcond_without libarchive
 # build with libimaevm.so
 %bcond_without libimaevm
+# build with fsverity support?
+%if 0%{?rhel}
+%bcond_with fsverity
+%else
+%bcond_without fsverity
+%endif
 # build with zstd support?
 %bcond_without zstd
 # build with ndb backend?
 %bcond_without ndb
 # build with sqlite support?
 %bcond_without sqlite
-# build with bdb support?
-%bcond_without bdb
-# build with internal Berkeley DB?
-%bcond_with int_bdb
 # build with bdb_ro support?
 %bcond_without bdb_ro
+# build with sequoia crypto?
+%bcond_without sequoia
 
 %define rpmhome /usr/lib/rpm
 
-%global rpmver 4.16.0
-%global snapver beta3
-%global rel 2
+%global rpmver 4.19.0
+#global snapver rc1
+%global baserelease 2
+%global sover 10
 
 %global srcver %{rpmver}%{?snapver:-%{snapver}}
 %global srcdir %{?snapver:testing}%{!?snapver:rpm-%(echo %{rpmver} | cut -d'.' -f1-2).x}
 
-%if %{with bdb}
-%define bdbver 5.3.15
-
-# Build-dependency on systemd for the sake of one macro would be a bit much...
-%{!?_tmpfilesdir:%global _tmpfilesdir /usr/lib/tmpfiles.d}
-%endif
-
 Summary: The RPM package management system
 Name: rpm
 Version: %{rpmver}
-Release: %{?snapver:0.%{snapver}.}%{rel}%{?dist}.3
+Release: %{?snapver:0.%{snapver}.}%{baserelease}%{?dist}
 Url: http://www.rpm.org/
 Source0: http://ftp.rpm.org/releases/%{srcdir}/rpm-%{srcver}.tar.bz2
-%if %{with bdb} && %{with int_bdb}
-Source1: db-%{bdbver}.tar.gz
-%endif
 
 Source10: rpmdb-rebuild.service
 
-# Disable autoconf config.site processing (#962837)
-Patch1: rpm-4.15.x-siteconfig.patch
-# In current Fedora, man-pages pkg owns all the localized man directories
-Patch3: rpm-4.9.90-no-man-dirs.patch
-# Temporary band-aid for rpm2cpio whining on payload size mismatch (#1142949)
-Patch5: rpm-4.12.0-rpm2cpio-hack.patch
-# https://github.com/rpm-software-management/rpm/pull/473
-Patch6: 0001-find-debuginfo.sh-decompress-DWARF-compressed-ELF-se.patch
-
-# Patches already upstream:
-
-# These are not yet upstream
-Patch906: rpm-4.7.1-geode-i686.patch
-# Probably to be upstreamed in slightly different form
-Patch907: rpm-4.15.x-ldflags.patch
-
-Patch912: 0001-Revert-Improve-ARM-detection.patch
+Source20: rpmdb-migrate.service
+Source21: rpmdb_migrate
 
 # Partially GPL/LGPL dual-licensed and some bits with BSD
 # SourceLicense: (GPLv2+ and LGPLv2+ with exceptions) and BSD
@@ -74,26 +52,19 @@ License: GPLv2+
 Requires: coreutils
 Requires: popt%{_isa} >= 1.10.2.1
 Requires: curl
+Conflicts: systemd < 253.5-6
 Obsoletes: python2-rpm < %{version}-%{release}
 
-%if %{with bdb} && %{without int_bdb}
-BuildRequires: libdb-devel
-%endif
-
-%if %{with check}
-BuildRequires: fakechroot gnupg2
-%endif
-
 # XXX generally assumed to be installed but make it explicit as rpm
 # is a bit special...
 BuildRequires: redhat-rpm-config >= 94
 BuildRequires: systemd-rpm-macros
 BuildRequires: gcc make
+BuildRequires: cmake >= 3.18
 BuildRequires: gawk
 BuildRequires: elfutils-devel >= 0.112
 BuildRequires: elfutils-libelf-devel
 BuildRequires: readline-devel zlib-devel
-BuildRequires: openssl-devel
 # The popt version here just documents an older known-good version
 BuildRequires: popt-devel >= 1.10.2
 BuildRequires: file-devel
@@ -115,6 +86,24 @@ BuildRequires: libzstd-devel
 %if %{with sqlite}
 BuildRequires: sqlite-devel
 %endif
+
+# Needed for re-building the documentation and man pages
+# normally those are shipped in the tarball pre-build
+# but need re-building if sources are patched
+%if 0
+BuildRequires: pandoc
+BuildRequires: doxygen
+%endif
+
+
+%if %{with sequoia}
+%global crypto sequoia
+BuildRequires: rpm-sequoia-devel >= 1.4.0
+%else
+%global crypto openssl
+BuildRequires: openssl-devel
+%endif
+
 # Couple of patches change makefiles so, require for now...
 BuildRequires: automake libtool
 
@@ -128,6 +117,34 @@ BuildRequires: audit-libs-devel
 BuildRequires: ima-evm-utils-devel >= 1.0
 %endif
 
+%if %{with fsverity}
+BuildRequires: fsverity-utils-devel
+%endif
+
+# For the rpmdb migration scriptlet (#2055033)
+Requires(pre): coreutils
+Requires(pre): findutils
+Requires(pre): sed
+
+%patchlist
+# Set rpmdb path to /usr/lib/sysimage/rpm
+rpm-4.17.x-rpm_dbpath.patch
+# Disable autoconf config.site processing (#962837)
+rpm-4.18.x-siteconfig.patch
+# In current Fedora, man-pages pkg owns all the localized man directories
+rpm-4.9.90-no-man-dirs.patch
+# Disable new user/group handling
+
+rpm-4.18.92-disable-sysusers.patch
+rpm-4.18.90-weak-user-group.patch
+
+# Patches already upstream:
+# ...
+rpm-4.19.0-sysusers-fixes.patch
+
+# These are not yet upstream
+rpm-4.7.1-geode-i686.patch
+
 %description
 The RPM Package Manager (RPM) is a powerful command line driven
 package management system capable of installing, uninstalling,
@@ -138,7 +155,13 @@ the package like its version, a description, etc.
 %package libs
 Summary:  Libraries for manipulating RPM packages
 License: GPLv2+ and LGPLv2+ with exceptions
-Requires: %{name} = %{version}-%{release}
+Requires(meta): %{name} = %{version}-%{release}
+%if %{with sequoia}
+# >= 1.4.0 required for pgpVerifySignature2() and pgpPrtParams2()
+Requires: rpm-sequoia%{_isa} >= 1.4.0
+# Most systems should have a central package operations log
+Recommends: rpm-plugin-audit
+%endif
 
 %description libs
 This package contains the RPM shared libraries.
@@ -189,6 +212,7 @@ Requires: tar unzip gzip bzip2 cpio xz
 %if %{with zstd}
 Requires: zstd
 %endif
+Requires: debugedit >= 0.3
 Requires: pkgconfig >= 1:0.24
 Requires: /usr/bin/gdb-add-index
 # https://fedoraproject.org/wiki/Changes/Minimal_GDB_in_buildroot
@@ -217,7 +241,6 @@ BuildRequires: python3-devel
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Provides: %{name}-python3 = %{version}-%{release}
 Obsoletes: %{name}-python3 < %{version}-%{release}
-Obsoletes: platform-python-%{name} < %{version}-%{release}
 
 %description -n python3-%{name}
 The python3-rpm package contains a module that permits applications
@@ -248,7 +271,7 @@ packages on a system.
 %package plugin-selinux
 Summary: Rpm plugin for SELinux functionality
 Requires: rpm-libs%{_isa} = %{version}-%{release}
-Requires: selinux-policy-base
+Requires(meta): selinux-policy-base
 
 %description plugin-selinux
 %{summary}.
@@ -268,12 +291,14 @@ Requires: rpm-libs%{_isa} = %{version}-%{release}
 This plugin blocks systemd from entering idle, sleep or shutdown while an rpm
 transaction is running using the systemd-inhibit mechanism.
 
+%if %{with libimaevm}
 %package plugin-ima
 Summary: Rpm plugin ima file signatures
 Requires: rpm-libs%{_isa} = %{version}-%{release}
 
 %description plugin-ima
 %{summary}.
+%endif
 
 %package plugin-prioreset
 Summary: Rpm plugin for resetting scriptlet priorities for SysV init
@@ -292,74 +317,81 @@ Requires: rpm-libs%{_isa} = %{version}-%{release}
 %description plugin-audit
 %{summary}.
 
+%if %{with fsverity}
+%package plugin-fsverity
+Summary: Rpm plugin for fsverity file signatures
+Requires: rpm-libs%{_isa} = %{version}-%{release}
+
+%description plugin-fsverity
+%{summary}.
+%endif
+
+%package plugin-fapolicyd
+Summary: Rpm plugin for fapolicyd support
+Requires: rpm-libs%{_isa} = %{version}-%{release}
+Provides: fapolicyd-plugin = %{version}-%{release}
+# fapolicyd-dnf-plugin currently at 1.0.4
+Obsoletes: fapolicyd-dnf-plugin < 1.0.5
+
+%description plugin-fapolicyd
+%{summary}.
+
+See https://people.redhat.com/sgrubb/fapolicyd/ for information about
+the fapolicyd daemon.
+
+%package plugin-dbus-announce
+Summary: Rpm plugin for announcing transactions on the DBUS
+Requires: rpm-libs%{_isa} = %{version}-%{release}
+
+%description plugin-dbus-announce
+The plugin announces basic information about rpm transactions to the
+system DBUS - like packages installed or removed.  Other programs can
+subscribe to the signals to get notified when packages on the system
+change.
+
 # with plugins
 %endif
 
 %prep
-%autosetup -n rpm-%{srcver} %{?with_int_bdb:-a 1} -p1
-
-%if %{with bdb} && %{with int_bdb}
-ln -s db-%{bdbver} db
-%endif
-
-# switch to sqlite db by default, including during build-time tests
-%if %{with sqlite}
-sed -i -e "/_db_backend/ s/ bdb/ sqlite/g" macros.in
-%endif
+%autosetup -n rpm-%{srcver} -p1
 
 %build
 %set_build_flags
 
-autoreconf -i -f
-
-# Hardening hack taken from macro %%configure defined in redhat-rpm-config
-for i in $(find . -name ltmain.sh) ; do
-     %{__sed} -i.backup -e 's~compiler_flags=$~compiler_flags="%{_hardened_ldflags}"~' $i
-done;
-
-# Using configure macro has some unwanted side-effects on rpm platform
-# setup, use the old-fashioned way for now only defining minimal paths.
-./configure \
-    --prefix=%{_usr} \
-    --sysconfdir=%{_sysconfdir} \
-    --localstatedir=%{_var} \
-    --sharedstatedir=%{_var}/lib \
-    --libdir=%{_libdir} \
-    --build=%{_target_platform} \
-    --host=%{_target_platform} \
-    --with-vendor=redhat \
-    %{?with_bdb: --enable-bdb} \
-    %{!?with_int_bdb: --with-external-db} \
-    %{!?with_plugins: --disable-plugins} \
-    --with-lua \
-    --with-selinux \
-    --with-cap \
-    --with-acl \
-    %{?with_ndb: --enable-ndb} \
-    %{?with_libimaevm: --with-imaevm} \
-    %{?with_zstd: --enable-zstd} \
-    %{?with_sqlite: --enable-sqlite} \
-    %{?with_bdb_ro: --enable-bdb-ro} \
-    --enable-python \
-    --with-crypto=openssl
+mkdir _build
+cd _build
+cmake \
+      -DCMAKE_INSTALL_PREFIX=%{_usr} \
+      -DCMAKE_INSTALL_SHAREDSTATEDIR:PATH=%{_var}/lib \
+      %{?with_bdb_ro:-DENABLE_BDB_RO=ON} \
+      %{!?with_ndb:-DENABLE_NDB=OFF} \
+      %{!?with_sqlite:-DENABLE_SQLITE=OFF} \
+      %{!?with_plugins:-DENABLE_PLUGINS=OFF} \
+      %{?with_fsverity:-DWITH_FSVERITY=ON} \
+      %{?with_libimaevm:-DWITH_IMAEVM=ON} \
+      %{!?with_libarchive:-DWITH_ARCHIVE=OFF} \
+      %{!?with_check:-DENABLE_TESTSUITE=OFF} \
+      %{!?with_sequoia:-DWITH_INTERNAL_OPENPGP=ON} \
+      %{!?with_sequoia:-DWITH_OPENSSL=ON } \
+      -DRPM_VENDOR=redhat \
+  ..
 
 %make_build
 
-pushd python
-%py3_build
-popd
-
 %install
+cd _build
 %make_install
-
-# We need to build with --enable-python for the self-test suite, but we
-# actually package the bindings built with setup.py (#531543#c26)
-pushd python
-%py3_install
-popd
+cd ..
 
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
 install -m 644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}
+install -m 644 %{SOURCE20} $RPM_BUILD_ROOT/%{_unitdir}
+
+mkdir -p $RPM_BUILD_ROOT%{rpmhome}
+install -m 755 %{SOURCE21} $RPM_BUILD_ROOT/%{rpmhome}
+
+# Built-in replacement for systemd-sysusers(8)
+install -m 755 scripts/sysusers.sh $RPM_BUILD_ROOT/%{rpmhome}
 
 # Save list of packages through cron
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily
@@ -368,21 +400,21 @@ install -m 755 scripts/rpm.daily ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/rpm
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d
 install -m 644 scripts/rpm.log ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/rpm
 
-%if %{with bdb}
-mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
-echo "r /var/lib/rpm/__db.*" > ${RPM_BUILD_ROOT}%{_tmpfilesdir}/rpm.conf
-%endif
-
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/rpm
 mkdir -p $RPM_BUILD_ROOT%{rpmhome}/macros.d
-mkdir -p $RPM_BUILD_ROOT/var/lib/rpm
+mkdir -p $RPM_BUILD_ROOT/usr/lib/sysimage/rpm
+cd _build
 
 # init an empty database for %ghost'ing for all supported backends
-for be in %{?with_ndb:ndb} %{?with_sqlite:sqlite} %{?with_bdb:bdb}; do
-    ./rpmdb --define "_db_backend ${be}" --dbpath=${PWD}/${be} --initdb
-    cp -va ${be}/. $RPM_BUILD_ROOT/var/lib/rpm/
+for be in %{?with_ndb:ndb} %{?with_sqlite:sqlite}; do
+    mkdir ${be}
+    ./rpmdb --rcfile rpmrc --define "_db_backend ${be}" --dbpath=${PWD}/${be} --initdb
+    cp -va ${be}/. $RPM_BUILD_ROOT/usr/lib/sysimage/rpm/
 done
 
+# some packages invoke find-debuginfo directly, preserve compat for now
+ln -s ../../bin/find-debuginfo $RPM_BUILD_ROOT/usr/lib/rpm/find-debuginfo.sh
+
 %find_lang rpm
 
 find $RPM_BUILD_ROOT -name "*.la"|xargs rm -f
@@ -390,39 +422,49 @@ find $RPM_BUILD_ROOT -name "*.la"|xargs rm -f
 # These live in perl-generators and python-rpm-generators now
 rm -f $RPM_BUILD_ROOT/%{rpmhome}/{perldeps.pl,perl.*,pythond*}
 rm -f $RPM_BUILD_ROOT/%{_fileattrsdir}/{perl*,python*}
+rm -rf $RPM_BUILD_ROOT/var/tmp
 
-%if %{with check}
-%check
-make check || (cat tests/rpmtests.log; exit 1)
-%endif
+%pre
+# Symlink all rpmdb files to the new location if we're still using /var/lib/rpm
+if [ -d /var/lib/rpm ]; then
+    mkdir -p /usr/lib/sysimage/rpm
+    rpmdb_files=$(find /var/lib/rpm -maxdepth 1 -type f | sed 's|^/var/lib/rpm/||g' | sort)
+    for rpmdb_file in ${rpmdb_files[@]}; do
+        ln -sfr /var/lib/rpm/${rpmdb_file} /usr/lib/sysimage/rpm/${rpmdb_file}
+    done
+fi
 
-# Handle rpmdb rebuild service on erasure of old to avoid ordering issues
-# https://pagure.io/fesco/issue/2382
-%triggerun -- rpm < 4.15.90-0.git14971.10
+%triggerun -- rpm < 4.17.0-7
+# Handle rpmdb migrate service on erasure of old to avoid ordering issues
 if [ -x /usr/bin/systemctl ]; then
-    systemctl --no-reload preset rpmdb-rebuild ||:
+    systemctl --no-reload preset rpmdb-migrate ||:
 fi
 
 %posttrans
-if [ -f /var/lib/rpm/Packages ]; then
-    touch /var/lib/rpm/.rebuilddb
+if [ -d /var/lib/rpm ]; then
+    touch /var/lib/rpm/.migratedb
+fi
+if [ ! -d /var/lib/rpm ] && [ -d /usr/lib/sysimage/rpm ] && [ ! -f /usr/lib/sysimage/rpm/.rpmdbdirsymlink_created ]; then
+    ln -sfr /usr/lib/sysimage/rpm /var/lib/rpm
+    touch /usr/lib/sysimage/rpm/.rpmdbdirsymlink_created
 fi
 
-%files -f rpm.lang
+%files -f _build/rpm.lang
 %license COPYING
-%doc CREDITS doc/manual/[a-z]*
-
-%if %{with bdb}
-%{_tmpfilesdir}/rpm.conf
-%endif
+%doc CREDITS docs/manual/[a-z]*
+%doc %{_defaultdocdir}/rpm/CONTRIBUTING.md
+%doc %{_defaultdocdir}/rpm/COPYING
+%doc %{_defaultdocdir}/rpm/INSTALL
+%doc %{_defaultdocdir}/rpm/README
 
 %{_unitdir}/rpmdb-rebuild.service
+%{_unitdir}/rpmdb-migrate.service
 
 %dir %{_sysconfdir}/rpm
 
-%attr(0755, root, root) %dir /var/lib/rpm
-%attr(0644, root, root) %ghost %config(missingok,noreplace) /var/lib/rpm/*
-%attr(0644, root, root) %ghost /var/lib/rpm/.*.lock
+%attr(0755, root, root) %dir /usr/lib/sysimage/rpm
+%attr(0644, root, root) %ghost %config(missingok,noreplace) /usr/lib/sysimage/rpm/*
+%attr(0644, root, root) %ghost /usr/lib/sysimage/rpm/.*.lock
 
 %{_bindir}/rpm
 %{_bindir}/rpm2archive
@@ -431,6 +473,7 @@ fi
 %{_bindir}/rpmkeys
 %{_bindir}/rpmquery
 %{_bindir}/rpmverify
+%{_bindir}/rpmsort
 
 %{_mandir}/man8/rpm.8*
 %{_mandir}/man8/rpmdb.8*
@@ -438,16 +481,9 @@ fi
 %{_mandir}/man8/rpm2archive.8*
 %{_mandir}/man8/rpm2cpio.8*
 %{_mandir}/man8/rpm-misc.8*
+%{_mandir}/man8/rpmsort.8*
 %{_mandir}/man8/rpm-plugins.8*
 
-# XXX this places translated manuals to wrong package wrt eg rpmbuild
-%lang(fr) %{_mandir}/fr/man[18]/*.[18]*
-%lang(ko) %{_mandir}/ko/man[18]/*.[18]*
-%lang(ja) %{_mandir}/ja/man[18]/*.[18]*
-%lang(pl) %{_mandir}/pl/man[18]/*.[18]*
-%lang(ru) %{_mandir}/ru/man[18]/*.[18]*
-%lang(sk) %{_mandir}/sk/man[18]/*.[18]*
-
 %attr(0755, root, root) %dir %{rpmhome}
 %{rpmhome}/macros
 %{rpmhome}/macros.d
@@ -463,12 +499,15 @@ fi
 %{rpmhome}/tgpg
 
 %{rpmhome}/platform
+%{rpmhome}/sysusers.sh
 
 %dir %{rpmhome}/fileattrs
 
 %files libs
-%{_libdir}/librpmio.so.*
-%{_libdir}/librpm.so.*
+%{_libdir}/librpmio.so.%{sover}
+%{_libdir}/librpm.so.%{sover}
+%{_libdir}/librpmio.so.%{sover}.*
+%{_libdir}/librpm.so.%{sover}.*
 %if %{with plugins}
 %dir %{_libdir}/rpm-plugins
 
@@ -484,9 +523,20 @@ fi
 %{_libdir}/rpm-plugins/systemd_inhibit.so
 %{_mandir}/man8/rpm-plugin-systemd-inhibit.8*
 
+%if %{with libimaevm}
 %files plugin-ima
 %{_libdir}/rpm-plugins/ima.so
 %{_mandir}/man8/rpm-plugin-ima.8*
+%endif
+
+%if %{with fsverity}
+%files plugin-fsverity
+%{_libdir}/rpm-plugins/fsverity.so
+%endif
+
+%files plugin-fapolicyd
+%{_libdir}/rpm-plugins/fapolicyd.so
+%{_mandir}/man8/rpm-plugin-fapolicyd.8*
 
 %files plugin-prioreset
 %{_libdir}/rpm-plugins/prioreset.so
@@ -496,51 +546,66 @@ fi
 %{_libdir}/rpm-plugins/audit.so
 %{_mandir}/man8/rpm-plugin-audit.8*
 # with plugins
+
+%files plugin-dbus-announce
+%{_libdir}/rpm-plugins/dbus_announce.so
+%{_mandir}/man8/rpm-plugin-dbus-announce.8*
+%{_datadir}/dbus-1/system.d/org.rpm.conf
 %endif
 
 %files build-libs
-%{_libdir}/librpmbuild.so.*
+%{_libdir}/librpmbuild.so.%{sover}
+%{_libdir}/librpmbuild.so.%{sover}.*
 
 %files sign-libs
-%{_libdir}/librpmsign.so.*
+%{_libdir}/librpmsign.so.%{sover}
+%{_libdir}/librpmsign.so.%{sover}.*
 
 %files build
 %{_bindir}/rpmbuild
 %{_bindir}/gendiff
 %{_bindir}/rpmspec
+%{_bindir}/rpmlua
 
 %{_mandir}/man1/gendiff.1*
 %{_mandir}/man8/rpmbuild.8*
 %{_mandir}/man8/rpmdeps.8*
 %{_mandir}/man8/rpmspec.8*
+%{_mandir}/man8/rpmlua.8*
 
 %{rpmhome}/brp-*
 %{rpmhome}/check-*
-%{rpmhome}/debugedit
-%{rpmhome}/sepdebugcrcfix
-%{rpmhome}/find-debuginfo.sh
 %{rpmhome}/find-lang.sh
 %{rpmhome}/*provides*
 %{rpmhome}/*requires*
 %{rpmhome}/*deps*
 %{rpmhome}/*.prov
 %{rpmhome}/*.req
-%{rpmhome}/mkinstalldirs
 %{rpmhome}/fileattrs/*
+%{rpmhome}/find-debuginfo.sh
+%{rpmhome}/rpmuncompress
 
 %files sign
 %{_bindir}/rpmsign
 %{_mandir}/man8/rpmsign.8*
 
 %files -n python3-%{name}
-%{python3_sitearch}/rpm/
+%dir %{python3_sitearch}/rpm
 %{python3_sitearch}/rpm-%{rpmver}*.egg-info
+%{python3_sitearch}/rpm/__init__.py
+%{python3_sitearch}/rpm/transaction.py
+%{python3_sitearch}/rpm/_rpm.so
+%artifact %{python3_sitearch}/rpm/__pycache__/
+
+# Python examples
+%{_defaultdocdir}/rpm/examples/*.py
 
 %files devel
 %{_mandir}/man8/rpmgraph.8*
 %{_bindir}/rpmgraph
 %{_libdir}/librp*[a-z].so
 %{_libdir}/pkgconfig/rpm.pc
+%{_libdir}/cmake/rpm/
 %{_includedir}/rpm/
 
 %files cron
@@ -549,9 +614,316 @@ fi
 
 %files apidocs
 %license COPYING
-%doc doc/librpm/html/*
+%doc %{_defaultdocdir}/rpm/API/
 
 %changelog
+* Mon Nov 13 2023 Panu Matilainen <pmatilai@redhat.com> - 4.19.0-2
+- Ensure central package ops log via rpm-plugin-audit recommends (#1476926)
+- Own our Python module directory (#2248555)
+- Fix sysusers.d generator barfing on legit content (#2246236)
+
+* Tue Sep 19 2023 Michal Domonkos <mdomonko@redhat.com> - 4.19.0-1
+- Update to 4.19.0
+
+* Mon Sep 04 2023 Michal Domonkos <mdomonko@redhat.com> - 4.18.99-1
+- Update to 4.19 rc1
+
+* Tue Aug 22 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.92-3
+- Fix regression on uncompressing 7zip compressed sources (#2229984)
+- Fix a conflict with pre-existing scl-utils %_root_prefix macro (#2233454)
+
+* Mon Aug 21 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.92-2
+- Behave more consistently when target %%optflags are not defined (#2231727)
+
+* Wed Aug 02 2023 Michal Domonkos <mdomonko@redhat.com> - 4.18.92-1
+- Update to 4.19 beta
+
+* Tue Jul 25 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 4.18.91-9
+- Drop fsverity plugin from RHEL builds
+
+* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.18.91-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed Jun 28 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.91-7
+- Rebuilt for Python 3.12
+
+* Wed Jun 28 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.91-6
+- Fix a spec parsing error handling regression
+- Fix a per-file plugin hook regression
+
+* Tue Jun 27 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.91-5
+- Fix potential crash with multiple in-process sqlite uses
+
+* Mon Jun 26 2023 Python Maint <python-maint@redhat.com> - 4.18.91-4
+- Rebuilt for Python 3.12
+
+* Wed Jun 21 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.91-3
+- Enable user/group provide generation
+- Add a conflict for systemd versions carrying their own
+
+* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 4.18.91-2
+- Rebuilt for Python 3.12
+
+* Fri Jun 09 2023 Michal Domonkos <mdomonko@redhat.com> - 4.18.91-1
+- Update to 4.19 alpha2
+
+* Thu Jun 08 2023 Peter Robinson <pbrobinson@fedoraproject.org> - 4.18.90-10
+- Rebuild for ima-evm-utils 1.5 soname bump
+
+* Mon May 29 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.90-9
+- Revert %%_smp_build_ncpus macro changing to parametric (#2210347)
+
+* Thu May 25 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-8
+- Set %_sharedstatedir to /var/lib (#2209989)
+
+* Thu May 25 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-7
+- Remove compat links for old so name of the libraries
+- Remove compat forward ports for libdnf
+
+* Mon May 22 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-6
+- Fix undefined symbols from plugins
+
+* Wed May 17 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-5
+- Use mkdir -p for creating SPECPARTS dir
+
+* Wed May 17 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-4
+- Enable large file support on 32-bit systems again
+
+* Mon May 15 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-3
+- Fix libbzip2 detection
+
+* Thu May 11 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-2
+- Add compat links for building dnf and friends
+
+* Thu May 04 2023 Florian Festi <ffesti@redhat.com> - 4.18.90-1
+- Update to 4.19 alpha
+
+* Tue Apr 25 2023 Miro Hrončok <mhroncok@redhat.com> - 4.18.1-3
+- Explicitly require rpm-sequoia >= 1.4.0 on runtime to avoid
+  rpm: symbol lookup error: /lib64/librpmio.so.9: undefined symbol: _pgpVerifySignature2
+
+* Thu Apr 20 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.1-2
+- Backport improved crypto error messages from upstream
+
+* Wed Mar 15 2023 Michal Domonkos <mdomonko@redhat.com> - 4.18.1-1
+- Rebase to rpm 4.18.1 (https://rpm.org/wiki/Releases/4.18.1)
+
+* Thu Feb 16 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-11
+- Disable debuginfod lookups in rpmbuild scripts
+- Exclude kernel modules from ELF dependency generation
+
+* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.18.0-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Mon Jan 09 2023 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-9
+- Generate Python egg-info from automake (#2135561)
+- Drop setup.py-based Python build (#2135719)
+
+* Wed Dec 07 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-8
+- Fix hang-up on failed key import (related to #2149762)
+
+* Thu Nov 24 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-7
+- Require rpm-sequoia >= 1.2.0 for V3 signature support, re-enable (#2141686)
+
+* Thu Nov 10 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-6
+- Revert back to internal OpenPGP parser for V3 signature support (#2141686)
+
+* Tue Nov 01 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-5
+- Switch to Sequoia crypto (https://fedoraproject.org/wiki/Changes/RpmSequoia)
+
+* Fri Oct 14 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-4
+- Add an option for building with Sequoia crypto
+
+* Wed Oct 05 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-3
+- Break ancient rpm <-> rpm-libs ordering loop
+
+* Mon Oct 03 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-2
+- Drop the temporary build-dependency on pandoc before it grows a beard
+- Start utilizing %%patchlist, finally
+
+* Wed Sep 21 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-1
+- Rebase to rpm 4.18.0 (https://rpm.org/wiki/Releases/4.18.0)
+
+* Wed Sep 14 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.rc1.4
+- Fix a largish directory walk related memory leak in transactions
+
+* Wed Sep 07 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.rc1.3
+- Fix buffer overrun on rpmdb queries involving ^ in version
+
+* Wed Sep 07 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.rc1.2
+- Break selinux-policy <-> rpm-plugin-selinux ordering loop (#1851266)
+
+* Fri Sep 02 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.rc1.1
+- Rebase to 4.18.0-rc1 (https://rpm.org/wiki/Releases/4.18.0)
+
+* Tue Aug 02 2022 Michal Domonkos <mdomonko@redhat.com> - 4.18.0-0.beta1.4
+- Revert %%autosetup -S git patch due to another regression
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.18.0-0.beta1.3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Jul 11 2022 Michal Domonkos <mdomonko@redhat.com> - 4.18.0-0.beta1.2
+- Fix check-buildroot regression wrt bundled SRPM (#2104150)
+- Fix %%autosetup -S git regression wrt default git branch
+
+* Tue Jun 28 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.beta1.1
+- Rebase to 4.18.0-beta1 (https://rpm.org/wiki/Releases/4.18.0)
+
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 4.18.0-0.alpha2.2
+- Rebuilt for Python 3.11
+
+* Mon May 23 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.alpha2.1
+- Rebase to 4.18.0-0.alpha2
+- Prevent uncontrolled sqlite WAL growth during large transactions
+
+* Thu Apr 28 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.alpha1.6
+- Fix rubygem unpack regression, causing rubygem builds to fail
+
+* Wed Apr 27 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.alpha1.5
+- Fix verbose source uncompress regression (#2079127)
+
+* Tue Apr 26 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.alpha1.4
+- Further dynamic buildrequires cli switch regression fixes (#2078744)
+
+* Tue Apr 26 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.alpha1.3
+- Fix rpmbuild -ba --nodeps regression wrt dynamic buildrequires (#2078744)
+
+* Tue Apr 26 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.alpha1.2
+- Fix rpmbuild -br not producing a src.rpm regression (#2078744)
+
+* Mon Apr 25 2022 Panu Matilainen <pmatilai@redhat.com> - 4.18.0-0.alpha1.1
+- Rebase to 4.18.0 alpha (https://fedoraproject.org/wiki/Changes/RPM-4.18)
+- Add patches for two late discovered regressions
+
+* Mon Mar 21 2022 Neal Gompa <ngompa@fedoraproject.org> - 4.17.0-10
+- Create rpmdb directory symlink in posttrans by default (#2066427)
+
+* Wed Feb 16 2022 Neal Gompa <ngompa@fedoraproject.org> - 4.17.0-9
+- Add dependencies for the rpmdb migration scriptlet (#2055033)
+
+* Wed Feb 02 2022 Panu Matilainen <pmatilai@redhat.com> - 4.17.0-8
+- Really fix spurious %%transfiletriggerpostun execution (#2023311, #2048168)
+
+* Wed Jan 26 2022 Neal Gompa <ngompa@fedoraproject.org> - 4.17.0-7
+- Migrate rpmdb to /usr/lib/sysimage/rpm (#2042099)
+  https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr
+
+* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.17.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Jan 20 2022 Björn Esser <besser82@fedoraproject.org> - 4.17.0-5
+- Rebuild (ima-evm-utils)
+- Use baserelease for rpm release tag to make rpmdev-bumpspec work
+
+* Fri Jan 14 2022 Panu Matilainen <pmatilai@redhat.com> - 4.17.0-4
+- Fix spurious %%transfiletriggerpostun execution (#2023311)
+
+* Fri Jan 14 2022 Panu Matilainen <pmatilai@redhat.com> - 4.17.0-3
+- Fix fapolicyd plugin dependencies to replace fapolicyd-dnf-plugin (#2007639)
+
+* Mon Nov 08 2021 Peter Robinson <pbrobinson@fedoraproject.org> - 4.17.0-2
+- Rebuils for ima-evm-utils 1.4 soname bump
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 4.17.0-1.1
+- Rebuilt with OpenSSL 3.0.0
+
+* Fri Sep 03 2021 Panu Matilainen <pmatilai@redhat.com> - 4.17.0-1
+- Rebase to 4.17.0 final (https://rpm.org/wiki/Releases/4.17.0)
+
+* Thu Aug 19 2021 Panu Matilainen <pmatilai@redhat.com> - 4.17.0-0.rc1.1
+- Rebase to 4.17.0 rc1
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.17.0-0.beta1.0.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Jun 22 2021 Panu Matilainen <pmatilai@redhat.com> - 4.17.0-0.beta1.1
+- Rebase to 4.17.0 beta1
+- Add back /usr/lib/rpm/find-debuginfo.sh as a compat symlink
+- Add temporary buildrequire on pandoc due to makefile bugs in beta1
+
+* Wed Jun 02 2021 Python Maint <python-maint@redhat.com> - 4.16.90-0.git15395.8.1
+- Rebuilt for Python 3.10
+
+* Mon May 17 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.8
+- Switch to external debugedit
+
+* Mon May 17 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.7
+- Handle different find-debuginfo.sh location with external debugedit
+
+* Fri May 07 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.6
+- Fix regression causing a crash on Lua state reset (#1958095)
+
+* Thu Apr 29 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.5
+- Proper fix for comments affecting macro file parsing (#1953910)
+
+* Tue Apr 27 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.4
+- Enable fapolicyd plugin build
+
+* Tue Apr 27 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.3
+- Temporarily revert macro file loading fix due to regression #1953910
+
+* Mon Apr 26 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.2
+- Add a bcond to build with external debugedit
+
+* Mon Apr 26 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.90-0.git15395.1
+- Rebase to rpm 4.17.0 alpha (https://rpm.org/wiki/Releases/4.17.0)
+- Drop a local hack for a cosmetic Fedora 22 era rpm2cpio issue
+- Drop BDB support leftovers from the spec
+- Add build conditional for fsverity plugin
+
+* Mon Mar 22 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.1.3-1
+- Rebase to rpm 4.16.1.3 (https://rpm.org/wiki/Releases/4.16.1.3)
+
+* Wed Feb 03 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.1.2-6
+- Drop support for read-write Berkeley DB format (#1787311)
+
+* Wed Feb 03 2021 Panu Matilainen <pmatilai@redhat.com> - 4.16.1.2-5
+- Make with/without bdb build option actually work
+- Clean up unpackaged /var/tmp from the build root
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.16.1.2-4.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Fri Jan 22 2021 Mark Wielaard <mjw@fedoraproject.org> - 4.16.1.2-4
+- Fix edit_attributes_str_comp_dir in Patch916 (#1919107)
+
+* Tue Jan 19 2021 Jeff Law <law@redhat.com> - 4.16.1.2-3
+- Fix typo in test for F33 or newer
+
+* Tue Jan 19 2021 Mark Wielaard <mjw@fedoraproject.org> - 4.16.1.2-2
+- Add debugedit DWARF5 support
+
+* Wed Dec 16 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.1.2-1
+- Rebase to rpm 4.16.1.2 (http://rpm.org/wiki/Releases/4.16.1.2)
+- Add a spec safeguard for accidental soname bumps
+
+* Wed Dec 16 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.1.1-1
+- Rebase to rpm 4.16.1.1 (http://rpm.org/wiki/Releases/4.16.1.1)
+
+* Thu Dec 10 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.1-1
+- Rebase to rpm 4.16.1 (http://rpm.org/wiki/Releases/4.16.1)
+
+* Mon Nov 30 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.0-5
+- Only disable test-suite where it's actually broken
+
+* Mon Nov 30 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.0-4
+- Fix BDB crashing on failed open attempts (#1902395, #1898299, #1900407)
+- Fix unnecessary double failure on lazy keyring open
+
+* Wed Oct 28 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.0-3
+- Issue deprecation warning when creating BDB databases (#1787311)
+- Temporarily disable test-suite due to massive fakechroot breakage
+
+* Mon Oct 05 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.0-2
+- Clean up after test-suite which leaves a read-only tree behind
+
+* Wed Sep 30 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.0-1
+- Rebase to 4.16.0 final (https://rpm.org/wiki/Releases/4.16.0)
+
+* Mon Aug 31 2020 Panu Matilainen <pmatilai@redhat.com> - 4.16.0-0.rc1.1
+- Rebase to 4.16.0-rc1
+- Run test-suite in parallel
+
 * Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.16.0-0.beta3.2.3
 - Second attempt - Rebuilt for
   https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

rpmdb-migrate.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=RPM database migration to /usr
+ConditionPathExists=/var/lib/rpm/.migratedb
+
+# This should run before any daemons that may open the rpmdb
+DefaultDependencies=no
+After=sysinit.target
+Before=basic.target shutdown.target
+Conflicts=shutdown.target
+# In case /var is remote-mounted
+RequiresMountsFor=/var
+
+[Service]
+Type=oneshot
+ExecStart=/usr/lib/rpm/rpmdb_migrate
+
+[Install]
+WantedBy=basic.target

rpmdb-rebuild.service

@@ -1,19 +1,19 @@
 [Unit]
 Description=RPM database rebuild
-ConditionPathExists=/var/lib/rpm/.rebuilddb
+ConditionPathExists=/usr/lib/sysimage/rpm/.rebuilddb
 
 # This should run before any daemons that may open the rpmdb
 DefaultDependencies=no
 After=sysinit.target
 Before=basic.target shutdown.target
 Conflicts=shutdown.target
-# In case /var is remote-mounted
-RequiresMountsFor=/var
+# In case /usr is remote-mounted
+RequiresMountsFor=/usr
 
 [Service]
 Type=oneshot
 ExecStart=/usr/bin/rpmdb --rebuilddb
-ExecStartPost=rm -f /var/lib/rpm/.rebuilddb
+ExecStartPost=rm -f /usr/lib/sysimage/rpm/.rebuilddb
 
 [Install]
 WantedBy=basic.target

rpmdb_migrate

@@ -0,0 +1,40 @@
+#!/bin/bash
+# Script to migrate rpmdb from /var/lib/rpm to new rpmdb path in /usr
+
+# Copyright (C) 2022 Neal Gompa <ngompa@fedoraproject.org>.
+#
+# Fedora-License-Identifier: GPLv2+
+# SPDX-2.0-License-Identifier: GPL-2.0+
+# SPDX-3.0-License-Identifier: GPL-2.0-or-later
+#
+# This program is free software.
+# For more information on the license, see COPYING or
+# <https://www.gnu.org/licenses/gpl-2.0.en.html>.
+# For more information on free software, see
+# <https://www.gnu.org/philosophy/free-sw.en.html>.
+
+
+set -euo pipefail
+
+# Script to migrate the rpmdb to /usr
+rpmdb_path="$(rpm --eval '%_dbpath')"
+rpmdb_path_old="/var/lib/rpm"
+rpmdb_path_new="${rpmdb_path}"
+
+
+if [ "${rpmdb_path}" = "${rpmdb_path_old}" ]; then
+	echo "The rpmdb path is still in /var, exiting!"
+	exit 0
+fi
+
+if [ -L "${rpmdb_path_old}" ]; then
+	echo "The rpmdb has already been migrated, exiting!"
+	rm -v "${rpmdb_path_old}/.migratedb"
+	exit 0
+fi
+
+rpm --verbose --rebuilddb
+
+rm -rfv ${rpmdb_path_old}
+
+ln -srv ${rpmdb_path_new} ${rpmdb_path_old}

sources

@@ -1 +1 @@
-SHA512 (rpm-4.16.0-beta3.tar.bz2) = 20efa638a7fe85b1b4d3d42fb07172c20a1f3c62024a29e4184b67a2d52ff3f94a186f178e9a5bfee9bf6c826a1023995d970b5c0ddaffe8b61fd2c888b44032
+SHA512 (rpm-4.19.0.tar.bz2) = 84801954eab8390af86388c96e0a446b0924bc3791dabcb8641dbaa53586ca852400c0b53c969c06e716949aa36ce337de7d6ba1ffc09eca31900af250f205cb

tests/tests.yml

@@ -0,0 +1,26 @@
+---
+- hosts: localhost
+  tags:
+    - classic
+  tasks:
+    - dnf:
+        name: "*"
+        state: latest
+
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    repositories:
+    - repo: "https://src.fedoraproject.org/rpms/pyproject-rpm-macros.git"
+      dest: "pyproject-rpm-macros"
+    tests:
+    # regression test for https://bugzilla.redhat.com/show_bug.cgi?id=2078744
+    - pyproject_rpm_macros:
+        dir: pyproject-rpm-macros/tests
+        run: ./mocktest.sh python-pluggy
+    required_packages:
+    - mock
+    - rpmdevtools
+    - rpm-build