Bug 1579446
| Summary: | java-1.8.0-openjdk-headless rpm package fails the certified container rpm_verify_successful test | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Paul Christensen <pchriste> |
| Component: | java-1.8.0-openjdk | Assignee: | jiri vanek <jvanek> |
| Status: | CLOSED ERRATA | QA Contact: | zzambers |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.5 | CC: | ahughes, bcook, dbhole, jupierce, jvanek, pchriste, sdodson, zzambers |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | java-1.8.0-openjdk-1.8.0.172-10.b11.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 07:27:33 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Paul Christensen
2018-05-17 16:43:34 UTC
The file is for shared classes. it is supposed to be modified. Thats why it is marked as ghost only in the spec file. MAybe ths is casued by new rpm (rpm itself) in rhel 7.5? Hi Jiri. rpm -V isn't failing on other rpms in the container. So I don't think that rpm itself is the issue. If I build the container without that package and run rpm -v, it passes. Is there anything else I can try to debug this root cause? And are other rpms using the %ghost which can get modified in runtime? Imho rpm tool is to be blamed. Before, it was ignoring modified ghost in -V, but now it reports it... Hi jiri. Sorry for the late reply. There are other files that are using %ghost and rpm verify does not fail on them: For example, systemd has them and in my scan results, it does not fail. if I remove the java-1.8.0-openjdk-headless rpm, the image passes the scan. bash-4.2# rpm -V systemd-219-57.el7.x86_64 .M....... c /etc/machine-id .M....... g /etc/udev/hwdb.bin .M....... g /var/lib/systemd/random-seed bash-4.2# There is something else that is changing when installed on a container classes.jsa and I don't think that it's the rpm tool. How can I assist to troubleshoot the root cause? I really dont know. I personally never worked with conatainers, so I dont knwo what they cnabe doing. It can be container engine, it can be rpm... Many changed in 7.5 bash-4.2# rpm -V systemd-219-57.el7.x86_64 .M....... c /etc/machine-id .M....... g /etc/udev/hwdb.bin .M....... g /var/lib/systemd/random-seed bash-4.2# M stands for Modified? Of not, then.. Are theghosts really modified? I guess yes, but ensuring:( man 8 rpm says M Mode differs (includes permissions and file type) This happens even outside of a containerized environment. sdodson@t460: ~$ rpm -V java-1.8.0-openjdk-headless .M....... g /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.172-1.b11.el7.x86_64/jre/lib/amd64/server/classes.jsa The specfile says it should be 664 root,root but it's 444 -r--r--r--. 1 root root 22286336 May 22 11:26 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.172-1.b11.el7.x86_64/jre/lib/amd64/server/classes.jsa Ok. Then the cause is probaby this restriction: %attr(664, root, root) %ghost Is been removed in rhel8 in favor if simple "%ghost". By the chance, do you have chance to try rhel's openjdk8 build? *** Bug 1569564 has been marked as a duplicate of this bug. *** Sorry, no I can't test EL8 right now. https://src.fedoraproject.org/rpms/java-1.8.0-openjdk/c/75dc799865967a7a43c8cec6e07cffa9eceeffe6?branch=master https://src.fedoraproject.org/rpms/java-openjdk/c/88eeaff540e42b3b94659e05ab4f9002968893ca?branch=master https://koji.fedoraproject.org/koji/taskinfo?taskID=27750336 https://koji.fedoraproject.org/koji/taskinfo?taskID=27750524 Fixes the problem. Will move it to rhels *** Bug 1591400 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3017 |