Why:
The archive policy document did not describe the supplemental main-package
files that the Fedora build injects.
Impact:
The documented Fedora deltas match the implemented policy.
Before/After:
The document claimed file ownership was unchanged; it now records the
segmented queue binary and manual-page manifest entries.
Technical Overview:
Describe the explicit autoconf-archive dependency and supplemental base-package
manifest entries together.
Retain the statement that Fedora's feature selection, package split,
configuration, documentation, and service unit are unchanged.
The supplemental entries cover rsyslog-segqueue and its manual page.
With the help of AI-Agents: Codex
Why:
Baseline specs can own files through RPM directives or globs, not only
an exact unadorned path.
Impact:
Daily RPM preparation preserves existing ownership and omits the
unavailable Leap segqueue manpage.
Before/After:
Adapters could add a duplicate path. They now recognize decorated and
globbed manifest entries before inserting missing files.
Technical Overview:
Normalize RPM manifest directives before comparing policy paths.
Treat a matching glob as existing ownership, so an explicit supplement
is not added twice.
Move EL10 segqueue manifest data into its policy and preserve the
executable mode with a policy entry.
Do not add the Leap manpage because its baseline does not enable its
generator.
With the help of AI-Agents: Codex
Why:
Daily RPM publication fails when vendor baseline specs omit files that
current upstream installs.
Impact:
Amazon Linux and openSUSE builds carry rsyslog-segqueue. Ubuntu avoids
an unnecessary package-index refresh.
Before/After:
Builds rejected missing installed files. Policies now add explicit
manifest entries, and Ubuntu uses ready runner tools.
Technical Overview:
Add policy-controlled main-package entries to the Amazon Linux and
openSUSE baseline adapters.
Validate each entry and inject it after its required spec anchor only
when it is absent.
Make Ubuntu install archive and signing packages only when the hosted
runner lacks the required command.
This avoids the canceled pre-publication apt update while retaining a
deterministic fallback for incomplete runners.
Closes https://github.com/rsyslog/rsyslog/issues/7493
Closes https://github.com/rsyslog/rsyslog/issues/7495
Closes https://github.com/rsyslog/rsyslog/issues/7512
With the help of AI-Agents: Codex
Why:
Fedora daily-stable RPM builds fail because the current Fedora spec
omits files installed by the segmented queue maintenance utility.
Impact:
Daily stable Fedora packages include the utility and its manual page.
Before/After:
The RPM build rejected unpackaged files; it now owns both installed files.
Technical Overview:
Add policy-controlled base-package file entries beside stable spec anchors.
Apply those entries while preparing the Fedora daily-stable source tree.
Use the shared baseline-patch policy validator, matching other RPM flows.
https://github.com/rsyslog/rsyslog/issues/7494
With the help of AI-Agents: Codex
Why
Daily builds replace distribution source archives with current upstream.
A stale downstream patch can therefore fail late or change packaged code.
Impact
EL10, Fedora, Amazon Linux, and openSUSE now reject unreviewed or changed
baseline patches before RPM package preparation continues.
Before/After
Before, patch skips were name-only and implemented separately by distro.
After, RPM families use one content-pinned, fail-closed patch contract.
Technical Overview
Validate the complete declared baseline patch set against the policy.
Require a SHA-256 digest and review reason for every patch.
Remove verified patch files and their explicit RPM applications safely.
Support both spaced and compact RPM patch macro forms plus autosetup specs.
Add a distributed regression test covering removal and rejection behavior.
closes https://github.com/rsyslog/rsyslog/issues/7490
With the help of AI-Agents: Codex
Why:
Leap's current rsyslog source package carries two fixes already
integrated into the source used by daily stable, stopping every run.
Impact:
The Leap daily archive can build current main without applying duplicate
patches, while unreviewed downstream changes still fail closed.
Before/After:
Before, any native Patch declaration stopped packaging.
After, only exact SHA-256-pinned reviewed patches are removed.
Technical Overview:
Declare the two reviewed integrated patch names and content hashes in policy.
Validate every baseline Patch declaration against that policy before removal.
Delete accepted patch sources as well as their spec declarations so autosetup
cannot apply them to current main.
Reject unknown, missing, duplicate, or content-changed patch declarations.
closes https://github.com/rsyslog/rsyslog/issues/7471
With the help of AI-Agents: Codex
Why:
The EL10 daily package build can fail inside Mock, but the failure
artifact discarded the helper and Mock logs needed to diagnose it.
Impact:
A future EL10 package-build failure carries its full diagnostic output.
Before/After:
Before, the generic collector overwrote the package failure details.
After, package diagnostics remain in phase-specific evidence storage.
Technical Overview:
Capture the outer container output with tee in the phase evidence log.
Preserve the Docker command status with PIPESTATUS before restoring errexit.
Append the helper log and Mock result logs only when the build fails.
Guard optional failure paths so absent files add context rather than masking
its original exit status.
Related: https://github.com/rsyslog/rsyslog/issues/7485
With the help of AI-Agents: Codex
Why:
The built-in syslog parsers process untrusted wire input, but they did not have a sanitizer-backed fuzz target or a bounded continuous campaign.
Impact:
Adds opt-in developer and CI fuzzing only. Normal rsyslog builds and parser behavior are unchanged.
Before:
Parser coverage relied on fixed regression inputs, with no mutation-based ASan/UBSan exercise of the real PRI, RFC 3164, and RFC 5424 paths.
After:
An opt-in libFuzzer target parses each input independently through both formats, checks parser offset invariants, runs a bounded PR smoke test, and runs a cached ten-minute daily campaign.
Technical Overview:
- expose narrow fuzz-only parser entry points and balanced teardown
- add seed corpora, local usage documentation, and Automake smoke registration
- add Clang ASan/UBSan PR and daily GitHub Actions jobs
- retain evolving corpora and skip daily work for an already-successful exact HEAD
- register fuzz test phases for flake-evidence collection
With the help of AI-Agents: Codex
Why:
Amazon Linux daily packages must implement the common GnuTLS
feature contract.
Impact:
Amazon Linux 2023 daily builds now produce rsyslog-gnutls and valid
standard and full profiles.
Before/After:
Before, Amazon's gnutls bcond disabled its RPM despite the profile
contract. After, the policy explicitly enables the native bcond.
Technical Overview:
Add a policy-controlled enabled_bconds list and validate its entries.
Transform each required baseline %bcond_with into %bcond_without during
source preparation. This activates the baseline GnuTLS package,
dependency, configure option, and file manifest together.
Closes https://github.com/rsyslog/rsyslog/issues/7466
With the help of AI-Agents: Codex
Why:
Failure evidence is useful only if the workflow reaches its collection path.
Impact:
EL10 Mock failures retain their original failed job result and now expose
all available rpmbuild logs.
Before/After:
The phase marker exited nonzero under set -e and prevented the evidence
aggregation branch from running.
Technical Overview:
Allow the failure-marker command to record its status without terminating the
step immediately.
Continue through ownership normalization and failure-log aggregation, then
exit with the original Mock build status.
With the help of AI-Agents: Codex
Why:
An EL10 package failure must be diagnosable from its workflow evidence.
Impact:
Failed daily-stable Mock builds now expose their direct and result-directory
logs to the existing failure-evidence upload action.
Before/After:
The workflow reported only Mock's final failed command; detailed rpmbuild
output remained inaccessible in the runner temporary directory.
Technical Overview:
Normalize ownership of the Mock result and aggregate build-log paths before
checking the build result.
On failure, write the primary log and every Mock result log to
failed-tests.log, which is already collected by upload-flake-evidence.
Keep the successful artifact path unchanged.
With the help of AI-Agents: Codex
Why:
Ensure published package verification detects unexpected as well as missing
profile dependencies.
Impact:
The full profile must now match its exact version-locked rsyslog closure.
Before/After:
Before: checks confirmed required dependencies by membership.
After: checks compare the complete normalized rsyslog dependency set.
Technical Overview:
Debian and Ubuntu normalize the full package Depends field.
RPM targets normalize direct rsyslog requirements.
Alpine normalizes the direct dependency atoms after its package header.
All comparisons retain exact package version requirements.
With the help of AI-Agents: Codex
Why:
Detect a full-profile dependency omission even after standard installed its
shared modules.
Impact:
Published archive verification now checks both profile dependency closures.
Before/After:
Before: standard could mask a missing full dependency.
After: full metadata must declare every version-locked module directly.
Technical Overview:
Debian and Ubuntu inspect the full package Depends field.
RPM targets inspect the full package Requires metadata.
Alpine inspects the full package dependency list.
Each target retains the independent standard installation verification.
With the help of AI-Agents: Codex
Why:
Ensure the profile proof detects incomplete dependency declarations and
ambiguous packaging-template changes.
Impact:
Published checks now validate standard before full on every target.
Before/After:
Before: a full-profile install could mask an incomplete standard profile.
After: standard dependencies must resolve before full is installed.
Technical Overview:
Configure-option anchors must now be unique before the overlay changes a
native template.
Module file paths are escaped before their regular-expression assertion.
Debian, RPM, openSUSE, and Alpine verify standard independently.
The contract documentation now describes all initial modules and profiles.
With the help of AI-Agents: Codex
Why:
Offer a consistent, version-locked rsyslog feature baseline across
the daily package archives.
Impact:
Daily packaging now creates and validates standard and full profiles.
Before/After:
Before: users selected distro-specific module package combinations.
After: standard/full profiles select a common initial module set.
Technical Overview:
The feature contract defines OpenSSL, GnuTLS, omotel, and the existing
omazuredce module package mappings.
The overlay preserves native module package definitions and creates
fileless profiles with exact package-version dependencies.
Debian, RPM, openSUSE, and Alpine helpers require the new artifacts.
Published-repository smoke checks install the profiles, verify module
ownership, and load every selected module.
EL10 now declares the protobuf-c build tools required by omotel.
With the help of AI-Agents: Codex
Why:
The first public ARM archive run exposed three workflow defects.
Impact:
Alpine verifies on ARM, openSUSE packaging proceeds, and every EL10 clone is tested.
Before:
Alpine checkout failed in its musl ARM job container, the openSUSE overlay matched two configure anchors, and EL10 verified only Oracle Linux.
After:
Alpine verification runs a native container from the Ubuntu host, openSUSE uses the unique omhttp anchor, and EL10 crosses four distros with both architectures.
Technical Overview:
Move Alpine public-install logic into the release helper and invoke it in a native Docker container. Narrow the RPM feature anchor to omhttp. Use independent distro and architecture axes for EL10 verification.
With the help of AI-Agents: Codex
Why:
Daily stable archives need native ARM packages alongside x86 packages.
Impact:
All current daily package workflows build, publish, and install-test ARM.
Before:
The package archives contained only amd64 or x86_64 binaries.
After:
Archives contain native arm64 or aarch64 binaries with signed metadata.
Technical Overview:
Add native GitHub ARM runners to every current daily package matrix.
Publish both architectures in one serialized repository update.
Keep immutable snapshots separated by architecture.
Filter APT indexes by architecture and advertise both architectures.
Make EL Mock validation accept the requested RPM architecture.
Verify each published package in a matching native distro container.
With the help of AI-Agents: Codex
Why:
Daily packages need a small, tested feature delta while retaining each target distribution's native package definitions.
Impact:
Daily stable base packages require YAML support, and omazuredce is built and published as a separate installable package.
Before:
Native baselines determined the complete feature set, and published-package smoke tests did not verify YAML parsing or optional module ownership.
After:
A shared contract overlays the native Debian, RPM, openSUSE, and Alpine definitions, asserts the module artifact, and smoke-tests exact published package versions.
Technical Overview:
Add a strict packaging overlay, native-family package naming, artifact assertions, and installed-package YAML/module validation to every current daily-stable workflow.
With the help of AI-Agents: Codex
Why:
Scheduled daily-package workflows read their enable switches before entering the protected publishing environment. Six switches were configured only on that environment, so scheduled jobs saw an empty value and silently skipped while reporting success.
Impact:
All seven daily-package schedules now use one repository-level switch model. Missing or malformed switches fail preflight and reach the existing scheduled failure-issue job instead of creating a false green run.
Before:
An unset schedule switch was treated as false, making a configuration mistake indistinguishable from an intentional disable.
After:
Each schedule accepts only true or false. True builds and publishes, false intentionally disables the schedule, and every other value fails with a variable-specific error. Documentation separates repository switches from protected archive configuration.
Technical Overview:
Apply the same case-based schedule guard to Debian 13, Ubuntu 26.04, EL10, Alpine 3.24, Amazon Linux 2023, Fedora 44, and openSUSE Leap 16.0.
With the help of AI-Agents: Codex
Why: Enterprise Linux 10 needs the same mock RPM CI
coverage already used for EL8/EL9 so packaging
regressions are caught before release.
Impact: PR CI now builds RPMs for epel-9 and epel-10,
and local platform lists include epel-10/rhel-10.
Before/After: Only epel-9 was exercised in package CI;
epel-10 is now a first-class mock target with EL10
BuildRequires name fixes.
Technical Overview:
- Add packaging/rpm/etc-mock/epel-10-x86_64.cfg using
upstream centos-stream-10 + epel-10 templates plus
Adiscon/Guardtime repo appends.
- Add packaging/rpm/etc-mock/rhel-10-x86_64.cfg based
on templates/rhel-10.tpl with project repos and the
same chroot_setup_cmd package append used by EL8/9.
- Register epel-10 and rhel-10 in packaging/rpm/config.sh
PLATOPTIONS.
- Matrix the run_checks.yml RPM job over epel-9-x86_64
and epel-10-x86_64; pass MOCK_CONFIG via step env.
- Replace mock symlink destinations before installing
custom configs so aliases are not overwritten.
- Update rsyslog-v8-stable.spec for EL10 package names:
libfastjson/liblognorm and mariadb-connector-c-devel.
Closes: https://github.com/rsyslog/rsyslog/issues/7447
Weekly macOS ASAN failed omfwd-rebind-tcp on an Apple
libsystem_trace interceptor false positive during
getaddrinfo/os_log init, not an rsyslog memory bug.
Add a narrow ASAN suppression for
_os_trace_get_image_info and wire it into the weekly
macOS ASAN job.
Closes: https://github.com/rsyslog/rsyslog/issues/7428
Why:
Broaden daily-stable coverage to a musl-based mainstream distribution while preserving Alpine's native packaging policy.
Impact:
Maintainers can build, retain, publish, and verify signed Alpine 3.24 x86_64 packages from current rsyslog main.
Before/After:
Before: the shared archive automated APT and RPM families only.
After: it also supports an immutable, signed APK repository with clean-container installation verification.
Technical Overview:
Use Alpine's 3.24-stable rsyslog APKBUILD as the packaging baseline.
Generate ordered daily versions and signed APK packages plus an incremental APKINDEX.
Publish immutable packages and snapshots to the shared DigitalOcean Space.
Verify the exact published version in a clean Alpine 3.24 container.
Keep scheduling disabled until the first manual end-to-end publication succeeds.
Open or update an issue when a scheduled build, publish, or verification fails.
With the help of AI-Agents: Codex
Why:
DigitalOcean Spaces CDN keeps its one-hour edge TTL unless its
provider-specific max-age object metadata is present. This allowed signed
but stale repository metadata to reach verification clients.
Impact:
Daily package publishers now expose mutable metadata within 60 seconds.
Before/After:
Before, stale signed metadata passed readiness; after, exact EVR is required.
Technical Overview:
Set the Spaces max-age metadata on Debian, Ubuntu, and EL uploads.
Keep immutable package and snapshot objects cached for one year.
Require EL verification metadata to contain the expected rsyslog EVR.
Bind the downloaded primary metadata to signed repomd.xml checksums.
Install Python explicitly in every EL10 verification container.
Document the one-time purge needed for existing one-hour cache entries.
With the help of AI-Agents: Codex
Why:
Provide unattended current-main packages for the newest Enterprise Linux
generation without maintaining duplicate repositories for each clone.
Impact:
Adds a disabled-by-default daily EL10 build, publish, and install flow.
Before/After:
Before, the archive covered Debian and Ubuntu; after, it also covers EL10.
Technical Overview:
Use the current CentOS Stream 10 spec as the distro packaging baseline.
Build current rsyslog main with Mock for the EL10 x86_64 target.
Apply explicit policy for upstreamed patches and new build requirements.
Sign RPMs and repository metadata with the existing archive key.
Publish clone-neutral x86_64 and SRPM repositories to DigitalOcean Spaces.
Merge prior metadata so every immutable daily package version remains usable.
Verify exact signed installs on CentOS Stream, Rocky, Alma, and Oracle Linux.
Create or update a GitHub issue when an enabled scheduled run fails.
With the help of AI-Agents: Codex
Why:
Ubuntu users need current main builds that retain the target release's
native package definitions.
Impact:
Adds an opt-in Ubuntu 26.04 daily build, publish, and verification flow.
Before/After:
Before: daily stable packages targeted Debian 13 only.
After: Ubuntu 26.04 can publish into its own signed archive namespace.
Technical Overview:
Build current main with Ubuntu 26.04's source-package debian directory.
Apply an explicit zero-fuzz policy for known upstream package drift.
Publish immutable packages and snapshots below the Ubuntu archive path.
Verify signed metadata and exact package installation on Ubuntu 26.04.
Register build and publication phases for flake evidence and failure issues.
Keep scheduled publishing disabled until the first production run passes.
With the help of AI-Agents: Codex
Why:
The Debian container executes workflow run steps with sh by default. The
published-package verifier used Bash pipeline status syntax after its smoke
tests, so a successful install was reported as a workflow failure.
Impact:
Published Debian packages can complete the end-to-end verification gate,
while genuine install or smoke-test failures still fail the workflow.
Before/After:
Before: the exact package installed and validated, then sh rejected a Bash
array assignment.
After: the verifier explicitly uses Bash and records the pipefail result as
a scalar status.
Technical Overview:
Set the verifier job run shell to Bash and preserve the pipeline result
without an unnecessary array.
With the help of AI-Agents: Codex
