Bug 2047954

Summary:	rpm -V / --verify mentions modified /usr/share/ibus-table/tables/yong.db
Product:	Red Hat Enterprise Linux 9	Reporter:	Jiri Jaburek <jjaburek>
Component:	ibus-table-chinese	Assignee:	Mike FABIAN <mfabian>
Status:	CLOSED ERRATA	QA Contact:	Sanket Saikia <ssaikia>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	bbarve, eng-i18n-bugs, mfabian, petersen, pwu
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ibus-table-chinese-1.8.3-10.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 13:58:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jiri Jaburek 2022-01-28 23:10:35 UTC

Description of problem:

After installing ibus-table-chinese-yong, rpm verify shows an error:

# rpm -V ibus-table-chinese-yong
..5....T.    /usr/share/ibus-table/tables/yong.db

This signals that the file was modified (different md5) compared to the packaged one, which is a warning that a malicious user might have tampered with it.

However in this case, the file seems to be created with

postinstall scriptlet (using /bin/sh):
ibus-table-createdb -i -n /usr/share/ibus-table/tables/yong.db

so please consider not installing it and marking it as %ghost in the spec file, indicating that the package owns it, but not included by default, to be created during runtime.

(See ie. how the rpm package itself uses %ghost on its own rpmdb.)


Version-Release number of selected component (if applicable):
ibus-table-chinese-yong-1.8.3-9.el9

Comment 1 Peng Wu 2022-01-29 05:58:20 UTC

The yong.db file is created when build the package, and only slightly modified when install the package.

I think I will use the following line in the spec file.

%verify(not size md5 mtime) %{ibus_tables_dir}/yong.db

Comment 2 Mike FABIAN 2022-01-29 10:13:39 UTC

I think the databases should not be indexed in the post install scripts at all. 

If any indexing is necessary, it should better be done at build time.
Currently no indexing is done anyway, i.e. the “indexing” currently done in post install scripts achieves nothing apart from changing the time stamps of the files.

Comment 3 Mike FABIAN 2022-01-30 09:58:20 UTC

Update for Fedora rawhide:  https://bodhi.fedoraproject.org/updates/FEDORA-2022-26d5e26723
https://src.fedoraproject.org/rpms/ibus-table-chinese/c/36aa7bd140443a4d7dfeeed8cc0ab9001c6768c7?branch=rawhide

Comment 4 Mike FABIAN 2022-02-03 13:08:29 UTC

https://gitlab.com/redhat/centos-stream/rpms/ibus-table-chinese/-/merge_requests/4

Comment 5 Mike FABIAN 2022-02-03 14:59:05 UTC

https://gitlab.com/redhat/centos-stream/rpms/ibus-table-chinese/-/merge_requests/4 is merged into the c9s branch now.

Comment 7 Mike FABIAN 2022-02-10 07:40:15 UTC

Building ibus-table-chinese-1.8.3-10.el9 for c9s-candidate
Created task: 947610
Task info: https://kojihub.stream.rdu2.redhat.com/koji/taskinfo?taskID=947610

Comment 8 Mike FABIAN 2022-02-10 08:21:26 UTC

https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=1882268

Comment 18 errata-xmlrpc 2022-05-17 13:58:18 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: ibus-table-chinese), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2627