Bug 19635 - please suppress the message that security.rpmnew was created, because it doesn't get created.
Summary: please suppress the message that security.rpmnew was created, because it does...
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: x86_64 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Nicolas Lécureuil
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-22 13:18 CEST by Bit Twister
Modified: 2016-10-30 22:10 CET (History)
1 user (show)

See Also:
Source RPM: java-1.8.0-openjdk-1.8.0.111-1.b16.1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description Bit Twister 2016-10-22 13:18:18 CEST
Description of problem:6_rc0:

 /java.security.rpmnew was not created

$ df -h /
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda4        40G   24G   15G  63% /

Snippet from my update.log

installing lib64tiff5-4.0.6-6.mga6.x86_64.rpm kdenlive-16.08.2-1.mga6.x86_64.rpm lib64rpmbuild7-4.13.0-0.rc2.2.mga6.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.111-1.b16.1.mga6.x86_64.rpm java-1.8.0-openjdk-1.8.0.111-1.b16.1.mga6.x86_64.rpm lib64sdl2.0_0-2.0.5-1.mga6.x86_64.rpm x11-driver-input-libinput-0.22.0-1.mga6.x86_64.rpm poedit-1.8.11-1.mga6.x86_64.rpm from /var/cache/urpmi/rpms
Preparing...                     #########################
     1/16: java-1.8.0-openjdk-headless
                                 ####################################warning: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-1.b16.1.mga6.x86_64/jre/lib/security/java.security created as /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-1.b16.1.mga6.x86_64/jre/lib/security/java.security.rpmnew
#
     2/16: java-1.8.0-openjdk    ######
Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. script -c "urpmi --download-all  --downloader wget --auto --auto-update --test"  update.log
2. grep warning: update.log
3. /etc/cron.daily/mlocate.cron
4. # locate rpmnew
/usr/lib/perl5/vendor_perl/5.22.2/Rpmdrake/rpmnew.pm


Note: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-1.b16.1.mga6.x86_64/jre/lib/security/java.security.rpmnew
was not created.
Comment 1 Bit Twister 2016-10-22 15:04:54 CEST
Oops, forgot to remove the --test argument for the above. Should have been:

Steps to Reproduce:
1. script -c "urpmi --download-all  --downloader wget --auto --auto-update"  update.log
Comment 2 Marja Van Waes 2016-10-22 23:10:38 CEST
The same happens when updating java-1.8.0-opendjk with dnf.


  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-1.b16.1.mga6.x86_64/ and everything below it didn't exist before this package was installed.

I assume before updating, that all resided in 
  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga6.x86_64/

Maybe an .rpmnew file can only get created when the previous config file is in the same directory?

CC: (none) => marja11
Assignee: bugsquad => mageia

Comment 3 David Walser 2016-10-23 19:57:52 CEST
That's intended behavior in this package.

Status: NEW => RESOLVED
Resolution: (none) => INVALID

Comment 4 Bit Twister 2016-10-23 21:14:06 CEST
Hot dang, nothing like sending the system administrator off on a snipe hunt with a bogus warning.
Comment 5 Marja Van Waes 2016-10-23 22:18:04 CEST
(In reply to Bit Twister from comment #4)
> Hot dang, nothing like sending the system administrator off on a snipe hunt
> with a bogus warning.

Indeed.

I don't know what's needed to suppress that message, but neoclust will know :-)

Status: RESOLVED => REOPENED
Resolution: INVALID => (none)
Summary: 6_rc0: /java.security.rpmnew was not created => please suppress the message that security.rpmnew was created, because it doesn't get created.

Comment 6 David Walser 2016-10-30 22:03:09 CET
Please don't reopen bugs that have been correctly closed.

Status: REOPENED => RESOLVED
Resolution: (none) => INVALID

Comment 7 David Walser 2016-10-30 22:10:54 CET
And yes, I know that it's annoying, but packages don't spit out warnings about .rpmnew files, RPM does that.

See line 228-254 in the Java spec file to see why the undesired .rpmnew file isn't left hanging around:
http://svnweb.mageia.org/packages/cauldron/java-1.8.0-openjdk/current/SPECS/java-1.8.0-openjdk.spec?view=markup&pathrev=1062734

As to why RPM is creating an .rpmnew file for an unmodified file, that's not clear.  Seems like an RPM bug, but RedHat obviously knows about it.

As to why a file in /usr is being marked as config(noreplace) (see line 536), and it's not the only one, and this fact has caused a security issue before, hence the existence of the code I mentioned above in the first place, this seems like bad packaging to me (and/or bad software that can't check for defaults in one place and configs in another), but again, obviously RedHat is aware of this and has done it this way for some reason.

So, feel free to complain upstream about this, but this isn't a bug on our end.

Note You need to log in before you can comment on or make changes to this bug.