Bug 1219873 - AUDIT-WHITELIST: libzypp-plugin-appdata: changes to script need updated whitelisting
Summary: AUDIT-WHITELIST: libzypp-plugin-appdata: changes to script need updated white...
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Matthias Gerstner
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-13 10:08 UTC by Dominique Leuenberger
Modified: 2024-02-21 14:46 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dominique Leuenberger 2024-02-13 10:08:29 UTC 
The appdata plugin for zypper needed be adjusted to be compatible to AppStream 1.0 and the updated data location.

The code has thus been changes, which resulted in a different digest - requiring whitelisting again:

[   10s] libzypp-plugin-appdata.noarch: E: zypperplugin-file-digest-mismatch (Badness: 10000) /usr/lib/zypp/plugins/appdata/InstallAppdata expected sha256:ba77e8dab356d70dfe0f38a63c9cced0b81d47c8af36b41f88fa30597330ff43, has:fa505770dbaae9bfbc456dcf3064b437d2b5740c030fdd7d22d320526b12da40
[   10s] A whitelisting related zypper plugin file changed in content. Packaging zypper
[   10s] plugins requires a review and whitelisting by the SUSE security team. If the
[   10s] package is intended for inclusion in any SUSE product please open a bug report
[   10s] to request review of the package by the security team. Please refer to
[   10s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   10s] more information.

The package can already be found in GNOME:Next/libzypp-plugin-appdata

The change that was merged can be easily reviewed at
  https://github.com/DimStar77/openSUSE-appstream/pull/4
Comment 1 Matthias Gerstner 2024-02-13 12:39:46 UTC 
I looked through the changes and this should be fine.
Comment 2 Matthias Gerstner 2024-02-14 13:55:09 UTC 
I will take care of the updated whitelisting
Comment 4 Matthias Gerstner 2024-02-21 14:46:41 UTC 
The whitelisting is in Factory now. Closing as fixed.