Bug 1898986

Summary:	rpm verification fails because nss.config is generated as a file and not a symlink like it is defined in the rpm spec
Product:	Red Hat Enterprise Linux 8	Reporter:	Rajesh Dulhani <rdulhani>
Component:	crypto-policies	Assignee:	Alexander Sosedkin <asosedki>
Status:	CLOSED ERRATA	QA Contact:	Ondrej Moriš <omoris>
Severity:	low	Docs Contact:
Priority:	low
Version:	8.3	CC:	peter.vreman
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	crypto-policies-20210617-1.gitc776d3e.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 19:51:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rajesh Dulhani 2020-11-18 12:53:40 UTC

Description of problem:

Crypto-policies rpm verify fails because nss.config is generated as a file and not a symlink like it is defined in the rpm spec


Version-Release number of selected component (if applicable):

$ rpm -qf /etc/crypto-policies/back-ends/nss.config
crypto-policies

How reproducible:

--------

# The current file, note the timestamp that will change

# ls -l /etc/crypto-policies/back-ends/nss.config
-rw-r--r--. 1 root root 429 Nov 16 19:15 /etc/crypto-policies/back-ends/nss.config

# Update the policies

# update-crypto-policies --set FUTURE
Setting system policy to FUTURE
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies
to fully take place.

# Now the file is re-generated

# ls -l /etc/crypto-policies/back-ends/nss.config
-rw-r--r--. 1 root root 370 Nov 16 19:17 /etc/crypto-policies/back-ends/nss.config

# And it is again failing the rpm verify

# rpm -V crypto-policies
.M.......  c /etc/crypto-policies/back-ends/nss.config

# Because it is now a file and not a symlink anymore

# rpm -qlv crypto-policies | grep back-ends/nss.config
lrwxrwxrwx    1 root root 42 Jul 13 16:04 /etc/crypto-policies/back-ends/nss.config -> /usr/share/crypto-policies/DEFAULT/nss.txt

----------


Additional info:

Account : HILTI AG

Comment 1 Tomas Mraz 2020-11-18 16:08:02 UTC

Yes, the .spec file should mark this as noverify file, because it might be symlink or file depending on other circumstances.

Comment 13 errata-xmlrpc 2021-11-09 19:51:36 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (crypto-policies bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4460