Update ubuntu resolute to v0.4.6 - #44
Open
Kartik Nema (kartnema) wants to merge 65 commits into
Open
Conversation
Signed-off-by: Kartik Nema <[email protected]>
Signed-off-by: Kartik Nema <[email protected]>
Signed-off-by: Kartik Nema <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Fixes: #26 Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Drop defaults and adopt to package-split. Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Kartik Nema <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
- look-for-post-boot-script-in-usr-libexec.patch Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
allow upgrades. Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
This reverts commit 0226796. Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Removes an obsolete upstream workflow that is no longer part of the pkg supported model. No functional replacement is needed. Signed-off-by: Mark Matyas <[email protected]>
Addresses all 33 findings from the enterprise zizmor scan:
- template-injection (23x, High) in actions/aws_s3_helper: move all
attacker-controllable ${{ inputs.* }} (and github.workspace)
expansions out of the run: shell into env: vars and reference them
as quoted shell variables. Behavior is unchanged.
- artipacked (7x, Medium): set persist-credentials: false on all
checkouts in actions/sync, codeql.yml, doc_generator.yml and pr.yml.
None rely on the persisted git credential (doc_generator pushes to
gh-pages with an explicit token in the remote URL).
- excessive-permissions (2x, Medium): add least-privilege permissions
blocks (contents: read for pr.yml; contents: write scoped to the
gh-pages deploy job in doc_generator.yml).
- dependabot-cooldown (1x, Medium): add a 7-day cooldown to the
github-actions ecosystem in dependabot.yaml.
Assisted-by: Claude Opus 4.8 <[email protected]>
Signed-off-by: Mark Matyas <[email protected]>
- store-runtime-state-under-var-lib.patch Closes: #39 Signed-off-by: Lukas Märdian <[email protected]>
- de-conffile-test-fixtures.patch Closes: #39 Signed-off-by: Lukas Märdian <[email protected]>
* Move test fixtures out of /etc into /usr/share and /var/lib The test suite's fixtures were installed below /etc/urm/tests/, which made all 32 of them dpkg conffiles. That is wrong on two counts: they are not configuration an administrator is expected to edit, and being conffiles means dpkg prompts about local changes on every upgrade -- for files the test binaries themselves rewrite as they run. The fixtures are not all the same kind of data, so they do not all move to the same place: * Configs/*.yaml are read-only inputs parsed by the tests. Per Debian Policy 9.1.1 that is architecture-independent static data, so they move to /usr/share/urm/tests/configs/. * Configs/ResourceSysFsNodes/*.txt stand in for real sysfs nodes. The resource appliers write to them at runtime via AuxRoutines::writeToFile() (see ResourceRegistry.cpp and ResourceHooks.cpp), so they are variable state and move to /var/lib/urm/tests/nodes/. Rewrite the hardcoded paths in the test sources and fixtures to match, and point the corresponding CMake install() rules at CMAKE_INSTALL_DATADIR and CMAKE_INSTALL_LOCALSTATEDIR instead of CMAKE_INSTALL_SYSCONFDIR. Bug: #39 Assisted-by: Claude:claude-opus-5 Signed-off-by: Lukas Märdian <[email protected]>
…stead of /etc/urm (#290) Signed-off-by: Kartik Nema <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
- drop-unusual-wantedby-basic-target.patch Closes: #25 Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
This commit pulls in upstream changes from 'v0.4.6' into the Debian packaging branch. Since upstream project might have content of their own in their .github/ folder (because they have CI stuff on their side), it's important to NOT pick up .github/ folder from upstream, and only leave the .github/ folder from debian packaging branch. The same applies to debian/ folder if upstream has one (which is rare but possible). This commit was generated automatically by qcom-build-utils/scripts/merge_debian_packaging_upstream. Signed-off-by: GitHub Service Bot <[email protected]>
Signed-off-by: GitHub Service Bot <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Co-authored-by: Kartik Nema <[email protected]> Signed-off-by: Lukas Märdian <[email protected]>
…bols. - detect-libyaml-at-top-level.patch - link-classifier-against-restunecore.patch Signed-off-by: Lukas Märdian <[email protected]>
Signed-off-by: Lukas Märdian <[email protected]>
Promote to 0.4.6
userspace-resource-manager Debian release 0.4.6-0qli1 Signed-off-by: Agathe Porte <[email protected]>
Signed-off-by: Agathe Porte <[email protected]>
Signed-off-by: Agathe Porte <[email protected]>
…te-ubuntu-resolute-to-v0.4.6 Signed-off-by: Kartik Nema <[email protected]>
Simon Beaudoin (simonbeaudoin0935)
self-requested a review
August 27, 2026 13:56
|
Kartik Nema (@kartnema) I have updated the workflows of this packaging branch, as the content was stale. Now, you have the PR Build job which runs successfuly. |
Correct the changelog file to a minimal diff Signed-off-by: Simon Beaudoin <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.