Fix _copy_decouple() for relative symlinks #1160

abadger · 2024-01-11T00:46:17Z

It was found in testing that absolute symlinks in /etc/pki are being preserved correctly but relative symlinks are causing a traceback. This PR will fix that.

Additional unittests for the desired behaviour:

Add some unittests that test symlink handling of copy_decouple with relative symlinks.
Enhance the temporary_directory fixture to handle creation of relative symlinks too.

If anyone has additional scenarios that they think should work feel free to add to the PR or mention them to me and I'll make a test for it.

The code to fix this is currently a draft. Not yet ready for review.

github-actions · 2024-01-11T00:46:28Z

Thank you for contributing to the Leapp project!

Please note that every PR needs to comply with the Leapp Guidelines and must pass all tests in order to be mergeable.
If you want to request a review or rebuild a package in copr, you can use following commands as a comment:

review please @oamg/developers to notify leapp developers of the review request
/packit copr-build to submit a public copr build using packit

Packit will automatically schedule regression tests for this PR's build and latest upstream leapp build. If you need a different version of leapp from PR#42, use /packit test oamg/leapp#42

It is possible to schedule specific on-demand tests as well. Currently 2 test sets are supported, beaker-minimal and kernel-rt, both can be used to be run on all upgrade paths or just a couple of specific ones.
To launch on-demand tests with packit:

/packit test --labels kernel-rt to schedule kernel-rt tests set for all upgrade paths
/packit test --labels beaker-minimal-8.9to9.3,kernel-rt-8.9to9.3 to schedule kernel-rt and beaker-minimal test sets for 8.9->9.3 upgrade path

[Deprecated] To launch on-demand regression testing public members of oamg organization can leave the following comment:

/rerun to schedule basic regression tests using this pr build and latest upstream leapp build as artifacts
/rerun 42 to schedule basic regression tests using this pr build and leapp*PR42* as artifacts
/rerun-sst to schedule sst tests using this pr build and latest upstream leapp build as artifacts
/rerun-sst 42 to schedule sst tests using this pr build and leapp*PR42* as artifacts

Please open ticket in case you experience technical problem with the CI. (RH internal only)

Note: In case there are problems with tests not being triggered automatically on new PR/commit or pending for a long time, please contact leapp-infra.

…ectories. * The previous code handled absolute symlinks fine but when there were relative symlinks it would traceback. Additionally, it did not handle symlinks to directories that occurred outside of /etc/pki. This should fix both of those cases. In order to handle symlinks to the /etc/pki directory, we need to introduce the concept of the canonical path. The canonical path is an absolute path that has had all symlinks dereferenced and doesn't contain any parent directories ("..") or self directories ("."). We have to use the canonical path for most file path comparisons since symlinks allow multiple paths that will point to a file but there is only one canonical path. The logic is somewhat tricky since we need to use the canonical path for comparisons but we have to use srcdir when constructing the paths that we will put into links we create (since we want to use /etc/pki in the container context even if /etc/pki is a symlink on the host system.) * Add some unittests that test symlink handling of copy_decouple with relative symlinks. * Enhance the temporary_directory fixture to handle creation of relative symlinks too. * Add better error messages to asserts in assert_firectory_structure_matches * Modify _copy_decouple() unittest to raise CalledProcessError() if run() encounters an error. If the command line executable that run() executes has a non-zero exit code, the real code will raise CalledProcessError() but the mock in the unittest would not. Change the unittest to match the actual code's behaviour. * Move explanation of the parametrize structure to traverse_structure's docstring. * Use pytest.param() and id for the parametrize on test_copy_decouple. The ids help to determine which tests have failed and allow us to select a specific test to rerun (with PYLINT_ARGS="-k '<ID>'" * If decouple_copy fails, then print out the entire directory structure that was created. That will help to debug the failed assertions.

pirat89 · 2024-01-12T13:26:17Z

Manual testing on RHEL 7:

[root@localhost el8userspace]# ls -l `find /etc/pki -type l`
lrwxrwxrwx. 1 root root 59 Jan 12 13:01 /etc/pki/ca-trust/source/ca-bundle.legacy.crt -> /usr/share/pki/ca-trust-legacy/ca-bundle.legacy.default.crt
lrwxrwxrwx. 1 root root 40 Jan 12 13:01 /etc/pki/java/cacerts -> /etc/pki/ca-trust/extracted/java/cacerts
lrwxrwxrwx. 1 root root 23 Jan 12 13:43 /etc/pki/mydir/oamg5073-custom-file-symlink-relative-in -> ../oamg5073-custom-file
lrwxrwxrwx. 1 root root 17 Jan 12 13:41 /etc/pki/oamg5073-broken-symlink-absolut -> /nonexistent-file
lrwxrwxrwx. 1 root root 25 Jan 12 13:41 /etc/pki/oamg5073-broken-symlink-relative-inside -> nonexistent-file-relative
lrwxrwxrwx. 1 root root 29 Jan 12 13:42 /etc/pki/oamg5073-custom-file-symlink-absolute -> /etc/pki/oamg5073-custom-file
lrwxrwxrwx. 1 root root 20 Jan 12 13:42 /etc/pki/oamg5073-custom-file-symlink-relative -> oamg5073-custom-file
lrwxrwxrwx. 1 root root 27 Jan 12 13:42 /etc/pki/oamg5073-custom-file-symlink-relative-out-in -> ../pki/oamg5073-custom-file
lrwxrwxrwx. 1 root root 49 Jan 12 13:01 /etc/pki/tls/cert.pem -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 49 Jan 12 13:01 /etc/pki/tls/certs/ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 55 Jan 12 13:01 /etc/pki/tls/certs/ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
[root@localhost el8userspace]# cd /var/lib/leapp/el8userspace
[root@localhost el8userspace]# ls -l `find etc/pki -type l`
lrwxrwxrwx. 1 root root 59 Jan 12 13:48 etc/pki/ca-trust/source/ca-bundle.legacy.crt -> /usr/share/pki/ca-trust-legacy/ca-bundle.legacy.default.crt
lrwxrwxrwx. 1 root root 40 Jan 12 13:48 etc/pki/java/cacerts -> /etc/pki/ca-trust/extracted/java/cacerts
lrwxrwxrwx. 1 root root 23 Jan 12 13:48 etc/pki/mydir/oamg5073-custom-file-symlink-relative-in -> ../oamg5073-custom-file
lrwxrwxrwx. 1 root root 29 Jan 12 13:48 etc/pki/oamg5073-custom-file-symlink-absolute -> /etc/pki/oamg5073-custom-file
lrwxrwxrwx. 1 root root 20 Jan 12 13:48 etc/pki/oamg5073-custom-file-symlink-relative -> oamg5073-custom-file
lrwxrwxrwx. 1 root root 20 Jan 12 13:48 etc/pki/oamg5073-custom-file-symlink-relative-out-in -> oamg5073-custom-file
lrwxrwxrwx. 1 root root 49 Jan 12 13:48 etc/pki/tls/cert.pem -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 49 Jan 12 13:48 etc/pki/tls/certs/ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 55 Jan 12 13:48 etc/pki/tls/certs/ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

It seems to be working as expected. For better overview of the results:

/etc/pki/ca-trust/source/ca-bundle.legacy.crt -> /usr/share/pki/ca-trust-legacy/ca-bundle.legacy.default.crt
 etc/pki/ca-trust/source/ca-bundle.legacy.crt -> /usr/share/pki/ca-trust-legacy/ca-bundle.legacy.default.crt

/etc/pki/java/cacerts -> /etc/pki/ca-trust/extracted/java/cacerts
 etc/pki/java/cacerts -> /etc/pki/ca-trust/extracted/java/cacerts

/etc/pki/mydir/oamg5073-custom-file-symlink-relative-in -> ../oamg5073-custom-file
 etc/pki/mydir/oamg5073-custom-file-symlink-relative-in -> ../oamg5073-custom-file

/etc/pki/oamg5073-broken-symlink-absolut -> /nonexistent-file
 --- nothing ---

/etc/pki/oamg5073-broken-symlink-relative-inside -> nonexistent-file-relative
 --- nothing ---

/etc/pki/oamg5073-custom-file-symlink-absolute -> /etc/pki/oamg5073-custom-file
 etc/pki/oamg5073-custom-file-symlink-absolute -> /etc/pki/oamg5073-custom-file

/etc/pki/oamg5073-custom-file-symlink-relative -> oamg5073-custom-file
 etc/pki/oamg5073-custom-file-symlink-relative -> oamg5073-custom-file

## this is what @abadger  noted in the chat
/etc/pki/oamg5073-custom-file-symlink-relative-out-in -> ../pki/oamg5073-custom-file
 etc/pki/oamg5073-custom-file-symlink-relative-out-in -> oamg5073-custom-file

/etc/pki/tls/cert.pem -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
 etc/pki/tls/cert.pem -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

/etc/pki/tls/certs/ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
 etc/pki/tls/certs/ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

/etc/pki/tls/certs/ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
 etc/pki/tls/certs/ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

And couple of "absolute symlinks" out of pki (done separately after test results presented above):

# echo 'heureka!' > /var/lib/leapp/oamg5073-custom-file-out-of-pki
# ln -s /var/lib/leapp/oamg5073-custom-file-out-of-pki-symlink /etc/pki/oamg5073-custom-file-out-of-pki-absolute-transitive
# ln -s /var/lib/leapp/oamg5073-custom-file-out-of-pki /var/lib/leapp/oamg5073-custom-file-out-of-pki-symlink
# ln -s /var/lib/leapp/oamg5073-custom-file-out-of-pki /etc/pki/oamg5073-custom-file-out-of-pki-absolute

.......
lrwxrwxrwx. 1 root root 54 Jan 12 14:14 /etc/pki/oamg5073-custom-file-out-of-pki-absolute-transitive -> /var/lib/leapp/oamg5073-custom-file-out-of-pki-symlink

[root@localhost el8userspace]# ls -l etc/pki/oamg5073-custom-file-out-of-pki-absolute-transitive
-rw-r--r--. 1 root root 9 Jan 12 14:15 etc/pki/oamg5073-custom-file-out-of-pki-absolute-transitive
[root@localhost el8userspace]# cat etc/pki/oamg5073-custom-file-out-of-pki-absolute-transitive
heureka!

....
[root@localhost el8userspace]# ls -l /etc/pki/oamg5073-custom-file-out-of-pki-absolute
lrwxrwxrwx. 1 root root 46 Jan 12 14:11 /etc/pki/oamg5073-custom-file-out-of-pki-absolute -> /var/lib/leapp/oamg5073-custom-file-out-of-pki
[root@localhost el8userspace]# ls -l etc/pki/oamg5073-custom-file-out-of-pki-absolute
-rw-r--r--. 1 root root 9 Jan 12 14:15 etc/pki/oamg5073-custom-file-out-of-pki-absolute
[root@localhost el8userspace]# cat etc/pki/oamg5073-custom-file-out-of-pki-absolute
heureka!

It seems to be working as expected based on that output!! The one difference, when a relative path is traversing out-of-pki dir & back

/etc/pki/oamg5073-custom-file-symlink-relative-out-in -> ../pki/oamg5073-custom-file
 etc/pki/oamg5073-custom-file-symlink-relative-out-in -> oamg5073-custom-file

I am considering ok still, as it's really corner-case and the changed relative path in this case is still pointing to the very same file. As this is an only exception - I believe without a negative impact - I am considering it ok to go. I will check yet the code and we can most likely to merge that.

@abadger thanks! 💯

pirat89 · 2024-01-12T13:30:44Z

repos/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py

+        if pointee_as_abspath in seen:
+            if symlink == pointee_as_abspath:
+                error_msg = ('File {} is a broken symlink that references'
+                             ' itself!'.format(pointee_as_abspath))
+            else:
+                error_msg = ('File {} references {} which is a broken symlink'
+                             ' that references itself!'.format(symlink, pointee_as_abspath))
+
+            raise BrokenSymlinkError(error_msg)


+1 for the seatbelt!

pirat89 · 2024-01-12T13:48:21Z

repos/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py

+        # Create all directories with proper permissions for security
+        # reasons (Putting private data into directories that haven't had their
+        # permissions set appropriately may leak the private information.)


It's good to thing about that. It's possible that such a function (or part of it) could be used for other things in future (cannot predict) and it's good to stay secure 💪 In case of content inside /var/lib/leapp we do not have to be so strict as:

# ls -lZd /var/lib/leapp/ drwx------. root root system_u:object_r:var_lib_t:s0 /var/lib/leapp/

so the content inside should be secured. It's e.g. becuase /var/lib/leapp/leapp.db contain all data about what's happening during the upgrade, obtaind data about the system, etc.

Similar about /var/log/leapp/

[root@localhost el8userspace]# ls -lZd /var/log/leapp drwx------. root root system_u:object_r:var_log_t:s0 /var/log/leapp

pirat89

based on tests & manual testing (comment above) it works as expected. The code is is great! Especially I love the way how tests are written - learned something new today. Thanks @abadger

Merging

## Packaging - Requires xfsprogs and e2fsprogs (oamg#1154) - Bump leapp-repository-dependencies to 10 (oamg#1154) ## Upgrade handling ### Fixes - Detect changes in openssl default configuration file and restore it to the default to the target default during the upgrade to reduce risk of potential issues (oamg#1131) - Do not try to download data files anymore when missing as the service is obsoleted since the data is part of installed packages (oamg#1120) - Drop the invalid `tuv` target channel (oamg#1130) - Fix handling of symlinks under /etc/pki when managing certificates (oamg#1135, oamg#1160, oamg#1166) - Fix semanage import issue (oamg#1164) - Fix the issue of going out of bounds in the isccfg parser (oamg#1124) - Fix traceback when saving the rhsm facts results and the /etc/rhsm/facts directory doesn’t exist yet (oamg#1132) - Handle the upgrade better when a proxy is configured in YUM/DNF configutations (oamg#1143) - Load all rpm repository substitutions that dnf knows about, not just releasever since repofiles may use the other substitutions too (oamg#1134) - Minor updates of generated reports (oamg#1151) - Print nice error msg when device and driver deprecation data is malformed (oamg#1168) - Report information about required manual steps after the upgrade when openssl-ibmca is installed (oamg#1131) - Update error messages and reports when installed upgrade data files are malformed or missing (oamg#1120) - [IPU 7 -> 8] Fix the upgrade of the RH Satellite server when tomcat is installed (oamg#1150) - [IPU 8 -> 9] Fix the upgrade from RHEL 8.9+ when the release is locked by subscription-manager (oamg#1136, oamg#1138) ### Enhancements - Update upgrade paths: (oamg#1146, oamg#1147, oamg#1175) - RHEL 7.9 -> 8.10, 8.8 (default: 8.10) - RHEL with SAPAHA 7.9 -> 8.10, 8.8 (default: 8.8) - RHEL w/o SAP HANA 8.8 -> 9.2 - RHEL w/o SAP HANA 8.10 -> 9.4 - Added possibility to define DNF configuration for the target system (oamg#1143) - Code cleaning: drop redundant and invalid NFS checks (oamg#1127) - Default to NO_RHSM mode when subscription-manager is not found (oamg#1133) - Detect customized configuration of dynamic linker (oamg#1118) - Detect possible unexpected RPM GPG keys has been installed during RPM transaction (oamg#1101) - Drop obsoleted upgrade paths that relates to releases: 8.6, 8.9, 9.0, 9.3 (oamg#1175) - Ignore Leapp related PES events (oamg#1153) - Introduce generic transition of systemd services states during the IPU (oamg#1060, oamg#1174) - Introduce possibility to upgrade with local repositories (oamg#1099) - Introduced some changes getting us closer to possibility of IPU for Centos (Stream) systems (oamg#1140) - Report the upgrade customisations and modifications of the upgrade tooling (oamg#1148) - Simplify handling of upgrades on systems using RHUI, reducing the maintenance burden for cloud providers (oamg#1057) - Update the leapp upgrade data files - bump data stream to "3.0" (oamg#1163, oamg#1165, oamg#1170) - [IPU 8 -> 9] Enable upgrades RHEL 8 -> 9 using RHUI on Alibaba cloud (oamg#1137, oamg#1165, oamg#1172) ## Additional changes interesting for devels - Introduced new functions returning a list of packages related to upgrade - see the rpms library (oamg#1156) - Make detection of installed signed packages distribution agnostic - covers RHEL & CentOS (oamg#876) - Model InstalledRedHatSignedRPM is deprecated, replaced by DistributionSignedRPM (oamg#876)

## Packaging - Requires xfsprogs and e2fsprogs (oamg#1154) - Bump leapp-repository-dependencies to 10 (oamg#1154) ## Upgrade handling ### Fixes - Detect changes in openssl default configuration file and restore it to the default to the target default during the upgrade to reduce risk of potential issues (oamg#1131) - Do not try to download data files anymore when missing as the service is obsoleted since the data is part of installed packages (oamg#1120) - Drop the invalid `tuv` target channel (oamg#1130) - Fix handling of symlinks under /etc/pki when managing certificates (oamg#1135, oamg#1160, oamg#1166) - Fix semanage import issue (oamg#1164) - Fix the issue of going out of bounds in the isccfg parser (oamg#1124) - Fix traceback when saving the rhsm facts results and the /etc/rhsm/facts directory doesn’t exist yet (oamg#1132) - Handle the upgrade better when a proxy is configured in YUM/DNF configutations (oamg#1143) - Load all rpm repository substitutions that dnf knows about, not just releasever since repofiles may use the other substitutions too (oamg#1134) - Minor updates of generated reports (oamg#1151) - Print nice error msg when device and driver deprecation data is malformed (oamg#1168) - Report information about required manual steps after the upgrade when openssl-ibmca is installed (oamg#1131) - Update error messages and reports when installed upgrade data files are malformed or missing (oamg#1120) - [IPU 7 -> 8] Fix the upgrade of the RH Satellite server when tomcat is installed (oamg#1150) - [IPU 8 -> 9] Fix the upgrade from RHEL 8.9+ when the release is locked by subscription-manager (oamg#1136, oamg#1138) ### Enhancements - Update upgrade paths: (oamg#1146, oamg#1147, oamg#1175) - RHEL 7.9 -> 8.10, 8.8 (default: 8.10) - RHEL with SAPAHA 7.9 -> 8.10, 8.8 (default: 8.8) - RHEL w/o SAP HANA 8.8 -> 9.2 - RHEL w/o SAP HANA 8.10 -> 9.4 - Added possibility to define DNF configuration for the target system (oamg#1143) - Code cleaning: drop redundant and invalid NFS checks (oamg#1127) - Default to NO_RHSM mode when subscription-manager is not found (oamg#1133) - Detect customized configuration of dynamic linker (oamg#1118) - Detect possible unexpected RPM GPG keys has been installed during RPM transaction (oamg#1101) - Drop obsoleted upgrade paths that relates to releases: 8.6, 8.9, 9.0, 9.3 (oamg#1175) - Ignore Leapp related PES events (oamg#1153) - Introduce generic transition of systemd services states during the IPU (oamg#1060, oamg#1174) - Introduce possibility to upgrade with local repositories (oamg#1099) - Introduced some changes getting us closer to possibility of IPU for Centos (Stream) systems (oamg#1140) - Report the upgrade customisations and modifications of the upgrade tooling (oamg#1148) - Simplify handling of upgrades on systems using RHUI, reducing the maintenance burden for cloud providers (oamg#1057) - Update the leapp upgrade data files - bump data stream to "3.0" (oamg#1163, oamg#1165, oamg#1170) - [IPU 8 -> 9] Enable upgrades RHEL 8 -> 9 using RHUI on Alibaba cloud (oamg#1137, oamg#1165, oamg#1172) - Unify breakpoints inside the upgrade initramfs for the easier troubleshooting (oamg#1157) ## Additional changes interesting for devels - Introduced new functions returning a list of packages related to upgrade - see the rpms library (oamg#1156) - Make detection of installed signed packages distribution agnostic - covers RHEL & CentOS (oamg#876) - Model InstalledRedHatSignedRPM is deprecated, replaced by DistributionSignedRPM (oamg#876)

## Packaging - Requires xfsprogs and e2fsprogs (#1154) - Bump leapp-repository-dependencies to 10 (#1154) ## Upgrade handling ### Fixes - Detect changes in openssl default configuration file and restore it to the default to the target default during the upgrade to reduce risk of potential issues (#1131) - Do not try to download data files anymore when missing as the service is obsoleted since the data is part of installed packages (#1120) - Drop the invalid `tuv` target channel (#1130) - Fix handling of symlinks under /etc/pki when managing certificates (#1135, #1160, #1166) - Fix semanage import issue (#1164) - Fix the issue of going out of bounds in the isccfg parser (#1124) - Fix traceback when saving the rhsm facts results and the /etc/rhsm/facts directory doesn’t exist yet (#1132) - Handle the upgrade better when a proxy is configured in YUM/DNF configutations (#1143) - Load all rpm repository substitutions that dnf knows about, not just releasever since repofiles may use the other substitutions too (#1134) - Minor updates of generated reports (#1151) - Print nice error msg when device and driver deprecation data is malformed (#1168) - Report information about required manual steps after the upgrade when openssl-ibmca is installed (#1131) - Update error messages and reports when installed upgrade data files are malformed or missing (#1120) - [IPU 7 -> 8] Fix the upgrade of the RH Satellite server when tomcat is installed (#1150) - [IPU 8 -> 9] Fix the upgrade from RHEL 8.9+ when the release is locked by subscription-manager (#1136, #1138) ### Enhancements - Update upgrade paths: (#1146, #1147, #1175) - RHEL 7.9 -> 8.10, 8.8 (default: 8.10) - RHEL with SAPAHA 7.9 -> 8.10, 8.8 (default: 8.8) - RHEL w/o SAP HANA 8.8 -> 9.2 - RHEL w/o SAP HANA 8.10 -> 9.4 - Added possibility to define DNF configuration for the target system (#1143) - Code cleaning: drop redundant and invalid NFS checks (#1127) - Default to NO_RHSM mode when subscription-manager is not found (#1133) - Detect customized configuration of dynamic linker (#1118) - Detect possible unexpected RPM GPG keys has been installed during RPM transaction (#1101) - Drop obsoleted upgrade paths that relates to releases: 8.6, 8.9, 9.0, 9.3 (#1175) - Ignore Leapp related PES events (#1153) - Introduce generic transition of systemd services states during the IPU (#1060, #1174) - Introduce possibility to upgrade with local repositories (#1099) - Introduced some changes getting us closer to possibility of IPU for Centos (Stream) systems (#1140) - Report the upgrade customisations and modifications of the upgrade tooling (#1148) - Simplify handling of upgrades on systems using RHUI, reducing the maintenance burden for cloud providers (#1057) - Update the leapp upgrade data files - bump data stream to "3.0" (#1163, #1165, #1170) - [IPU 8 -> 9] Enable upgrades RHEL 8 -> 9 using RHUI on Alibaba cloud (#1137, #1165, #1172) - Unify breakpoints inside the upgrade initramfs for the easier troubleshooting (#1157) ## Additional changes interesting for devels - Introduced new functions returning a list of packages related to upgrade - see the rpms library (#1156) - Make detection of installed signed packages distribution agnostic - covers RHEL & CentOS (#876) - Model InstalledRedHatSignedRPM is deprecated, replaced by DistributionSignedRPM (#876)

## Packaging - Requires xfsprogs and e2fsprogs (oamg#1154) - Bump leapp-repository-dependencies to 10 (oamg#1154) ## Upgrade handling ### Fixes - Detect changes in openssl default configuration file and restore it to the default to the target default during the upgrade to reduce risk of potential issues (oamg#1131) - Do not try to download data files anymore when missing as the service is obsoleted since the data is part of installed packages (oamg#1120) - Drop the invalid `tuv` target channel (oamg#1130) - Fix handling of symlinks under /etc/pki when managing certificates (oamg#1135, oamg#1160, oamg#1166) - Fix semanage import issue (oamg#1164) - Fix the issue of going out of bounds in the isccfg parser (oamg#1124) - Fix traceback when saving the rhsm facts results and the /etc/rhsm/facts directory doesn’t exist yet (oamg#1132) - Handle the upgrade better when a proxy is configured in YUM/DNF configutations (oamg#1143) - Load all rpm repository substitutions that dnf knows about, not just releasever since repofiles may use the other substitutions too (oamg#1134) - Minor updates of generated reports (oamg#1151) - Print nice error msg when device and driver deprecation data is malformed (oamg#1168) - Report information about required manual steps after the upgrade when openssl-ibmca is installed (oamg#1131) - Update error messages and reports when installed upgrade data files are malformed or missing (oamg#1120) - [IPU 7 -> 8] Fix the upgrade of the RH Satellite server when tomcat is installed (oamg#1150) - [IPU 8 -> 9] Fix the upgrade from RHEL 8.9+ when the release is locked by subscription-manager (oamg#1136, oamg#1138) ### Enhancements - Update upgrade paths: (oamg#1146, oamg#1147, oamg#1175) - RHEL 7.9 -> 8.10, 8.8 (default: 8.10) - RHEL with SAPAHA 7.9 -> 8.10, 8.8 (default: 8.8) - RHEL w/o SAP HANA 8.8 -> 9.2 - RHEL w/o SAP HANA 8.10 -> 9.4 - Added possibility to define DNF configuration for the target system (oamg#1143) - Code cleaning: drop redundant and invalid NFS checks (oamg#1127) - Default to NO_RHSM mode when subscription-manager is not found (oamg#1133) - Detect customized configuration of dynamic linker (oamg#1118) - Detect possible unexpected RPM GPG keys has been installed during RPM transaction (oamg#1101) - Drop obsoleted upgrade paths that relates to releases: 8.6, 8.9, 9.0, 9.3 (oamg#1175) - Ignore Leapp related PES events (oamg#1153) - Introduce generic transition of systemd services states during the IPU (oamg#1060, oamg#1174) - Introduce possibility to upgrade with local repositories (oamg#1099) - Introduced some changes getting us closer to possibility of IPU for Centos (Stream) systems (oamg#1140) - Report the upgrade customisations and modifications of the upgrade tooling (oamg#1148) - Simplify handling of upgrades on systems using RHUI, reducing the maintenance burden for cloud providers (oamg#1057) - Update the leapp upgrade data files - bump data stream to "3.0" (oamg#1163, oamg#1165, oamg#1170) - [IPU 8 -> 9] Enable upgrades RHEL 8 -> 9 using RHUI on Alibaba cloud (oamg#1137, oamg#1165, oamg#1172) - Unify breakpoints inside the upgrade initramfs for the easier troubleshooting (oamg#1157) ## Additional changes interesting for devels - Introduced new functions returning a list of packages related to upgrade - see the rpms library (oamg#1156) - Make detection of installed signed packages distribution agnostic - covers RHEL & CentOS (oamg#876) - Model InstalledRedHatSignedRPM is deprecated, replaced by DistributionSignedRPM (oamg#876) (cherry picked from commit 6421225)

abadger marked this pull request as draft January 11, 2024 00:46

abadger added the bug Something isn't working label Jan 11, 2024

abadger added this to the 8.10/9.4 milestone Jan 11, 2024

abadger mentioned this pull request Jan 11, 2024

[WIP] Fix _copy_decouple() for relative symlinks #1158

Closed

abadger force-pushed the fix-relative-symlink-issue branch 6 times, most recently from bdd6833 to f3efaff Compare January 12, 2024 05:17

abadger marked this pull request as ready for review January 12, 2024 05:18

abadger changed the title ~~[WIP] Fix _copy_decouple() for relative symlinks~~ Fix _copy_decouple() for relative symlinks Jan 12, 2024

abadger requested a review from pirat89 January 12, 2024 05:19

abadger force-pushed the fix-relative-symlink-issue branch from f3efaff to 6dca670 Compare January 12, 2024 05:39

pirat89 reviewed Jan 12, 2024

View reviewed changes

pirat89 approved these changes Jan 12, 2024

View reviewed changes

pirat89 added the changelog-checked The merger/reviewer checked the changelog draft document and updated it when relevant label Jan 12, 2024

pirat89 merged commit af50cfc into oamg:master Jan 12, 2024
22 of 38 checks passed

abadger deleted the fix-relative-symlink-issue branch January 12, 2024 17:34

pirat89 mentioned this pull request Jan 22, 2024

Fix another cornercase with symlink handling #1166

Merged

pirat89 mentioned this pull request Feb 13, 2024

Release 0.20.0 #1177

Merged

yuravk mentioned this pull request Aug 9, 2024

Update to version 0.20.0 AlmaLinux/leapp-repository#119

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix _copy_decouple() for relative symlinks #1160

Fix _copy_decouple() for relative symlinks #1160

abadger commented Jan 11, 2024

github-actions bot commented Jan 11, 2024

pirat89 commented Jan 12, 2024 •

edited

Loading

pirat89 Jan 12, 2024

pirat89 Jan 12, 2024 •

edited

Loading

pirat89 left a comment

Fix _copy_decouple() for relative symlinks #1160

Fix _copy_decouple() for relative symlinks #1160

Conversation

abadger commented Jan 11, 2024

github-actions bot commented Jan 11, 2024

Thank you for contributing to the Leapp project!

pirat89 commented Jan 12, 2024 • edited Loading

pirat89 Jan 12, 2024

Choose a reason for hiding this comment

pirat89 Jan 12, 2024 • edited Loading

Choose a reason for hiding this comment

pirat89 left a comment

Choose a reason for hiding this comment

pirat89 commented Jan 12, 2024 •

edited

Loading

pirat89 Jan 12, 2024 •

edited

Loading