We have two very similar checks in place: in some contexts we want to
know if *any* RootDirectory= is configured, in the other we want to
suppress if it is configured to our regular root. Let's add a helper for
both (even if we only need it once), to make the mirrored behaviour
clear.
Let's flush out all response state from the job, but let's keep the
request data previously configured, in particular the headers set. This
is useful to re-request a resource, just with a slightly modified or
identical URL.
Observed with the tpm2 provider and the tpm2tss engine was that the
auth process failed because the provider/engine could not ask for the
PIN through the callback, resulting in:
"Failed to load private key from ...: Input/output error"
Apparently the default UI method is not enough and the key setup
functions expect an explicit method.
Pass the existing UI method through as callback for the key setup.
The warning will still be reported if XAUTHORITY is set but not exported.
However, such scenario is unlikely for xinitrc.d scripts environment.
Fixes#40745
Signed-off-by: Dmytro Bagrii <dimich.dmb@gmail.com>
Follow-up to 02cab70acf. pe_hash(),
section_offset_cmp() and uki_hash() still had a bunch of raw accesses
to LE fields (e_lfanew, SizeOfHeaders, PointerToRawData, SizeOfRawData,
VirtualSize, certificate_table->Size) without le32toh(), so they'd
produce garbage on big-endian.
Also wrap VirtualSize in bootspec.c for consistency.
This was made a strv to handle either directories or raw images but
since we now handle that via multiple PickFilter instances, we don't
need suffixes to be a strv anymore.
Fixes failure on Rawhide:
TEST-88-UPGRADE.sh[512]: Transaction failed: Rpm transaction failed.
TEST-88-UPGRADE.sh[512]: Warning: skipped OpenPGP checks for 15 packages from repository: @commandline
TEST-88-UPGRADE.sh[512]: - package systemd-shared-260~devel-20260218150812.fc45.x86_64 does not verify: no signature
You can register whatever process you want in the user machined instance
that is running in the same namespace as pid 1 as machined won't be allowed
to do anything privileged anyway that could be dangerous when running as a user
instance.
We have to skip the check as we user machined instances don't have
privileges to inspect pid1's user namespaces.
Set `persist-credentials: false` for actions/checkout.
By default, using `actions/checkout` causes a credential to be persisted on
disk. Subsequent steps may accidentally publicly persist the credential, e.g.
by including it in a publicly accessible artifact via actions/upload-artifact.
However, even without this, persisting the credential on disk is non-ideal
unless actually needed.
Link: https://docs.zizmor.sh/audits/#artipacked
By default, Dependabot does not perform any cooldown on dependency updates.
In other words, a regularly scheduled Dependabot run may perform an update
on a dependency that was just released moments before the run began.
This presents both stability and supply-chain security risks.
To mitigate these risks, explicitly set Dependabot cooldown period to 7 days.
Link: https://docs.zizmor.sh/audits/#dependabot-cooldown
Otherwise, OOM error will never checked, and the "preferred" setting
always emits warning that the field is unknown.
Follow-up for 450e0dce02.
Fixes CID#1645063.
Lennart Poettering
Kai Lüke
Dmytro Bagrii
Oblivionsage
Daan De Meyer
David Santamaría Rogado
Luca Boccassi
Mario Limonciello (AMD)
Zbigniew Jędrzejewski-Szmek
dependabot[bot]
Luca Boccassi
Yu Watanabe
Jörg Behrmann
Yaping Li
Dmitry V. Levin