Accepting request 1325359 from GNOME:Factory

- Use tmpfiles to create /var/lib/NetworkManager/ (PED-14769). (forwarded request 1325256 from JonathanKang)

OBS-URL: https://build.opensuse.org/request/show/1325359
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/NetworkManager?expand=0&rev=290

2298.patch

@@ -254,3 +254,15 @@ index 57e732264cf..c746e714972 100644
 -- 
 GitLab
 
+diff --git a/src/libnm-core-impl/nm-utils.c b/src/libnm-core-impl/nm-utils.c
+index 9a78e9471c..d935e63978 100644
+--- a/src/libnm-core-impl/nm-utils.c
++++ b/src/libnm-core-impl/nm-utils.c
+@@ -6444,6 +6444,7 @@ nm_utils_copy_cert_as_user(const char *filename, const char *user, GError **erro
+                                     0600,
+                                     NULL,
+                                     NULL,
++                                    NULL,
+                                     error)) {
+         return NULL;
+     }

2312.patch

@@ -0,0 +1,243 @@
+From 636fb5ef24640856515584977174fa44a986e374 Mon Sep 17 00:00:00 2001
+From: Antonio Alvarez Feijoo <antonio.feijoo@suse.com>
+Date: Fri, 14 Nov 2025 16:46:57 +0100
+Subject: [PATCH] systemd: install initrd services using a generator
+
+Since both `NetworkManager.service` and `NetworkManager-initrd.service` are
+allocated for the same bus name (`org.freedesktop.NetworkManager`) and this is
+not allowed, the best option is to use a systemd generator to install them only
+in the initrd, instead of setting fixed Install sections.
+
+Fixes #1814
+---
+ contrib/fedora/rpm/NetworkManager.spec        |  2 +
+ contrib/fedora/rpm/configure-for-system.sh    |  1 +
+ data/NetworkManager-config-initrd.service.in  |  5 +-
+ data/NetworkManager-initrd.service.in         | 10 +---
+ ...tworkManager-wait-online-initrd.service.in |  5 +-
+ meson.build                                   |  9 ++++
+ meson_options.txt                             |  1 +
+ src/nm-initrd-generator/meson.build           |  7 +++
+ .../nm-initrd-generator.sh                    | 50 +++++++++++++++++++
+ 9 files changed, 73 insertions(+), 17 deletions(-)
+ create mode 100755 src/nm-initrd-generator/nm-initrd-generator.sh
+
+diff --git a/contrib/fedora/rpm/NetworkManager.spec b/contrib/fedora/rpm/NetworkManager.spec
+index 0732fb495f2..820cfda607a 100644
+--- a/contrib/fedora/rpm/NetworkManager.spec
++++ b/contrib/fedora/rpm/NetworkManager.spec
+@@ -675,6 +675,7 @@ Preferably use nmcli instead.
+ 	-Dsession_tracking=systemd \
+ 	-Dsuspend_resume=systemd \
+ 	-Dsystemdsystemunitdir=%{_unitdir} \
++	-Dsystemdsystemgeneratordir=%{_systemdgeneratordir} \
+ 	-Dsystem_ca_path=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
+ 	-Ddbus_conf_dir=%{dbus_sys_dir} \
+ 	-Dtests=yes \
+@@ -747,6 +748,7 @@ rm -f %{buildroot}%{_libdir}/pppd/%{ppp_version}/*.la
+ rm -f %{buildroot}%{nmplugindir}/*.la
+ 
+ # Don't use the *-initrd.service files yet, wait dracut to support them
++rm -f %{buildroot}%{_systemdgeneratordir}/nm-initrd-generator.sh
+ rm -f %{buildroot}%{_unitdir}/NetworkManager-config-initrd.service
+ rm -f %{buildroot}%{_unitdir}/NetworkManager-initrd.service
+ rm -f %{buildroot}%{_unitdir}/NetworkManager-wait-online-initrd.service
+diff --git a/contrib/fedora/rpm/configure-for-system.sh b/contrib/fedora/rpm/configure-for-system.sh
+index 6bdf66825ab..bcf619c645a 100755
+--- a/contrib/fedora/rpm/configure-for-system.sh
++++ b/contrib/fedora/rpm/configure-for-system.sh
+@@ -398,6 +398,7 @@ meson setup\
+     -Dsession_tracking=systemd \
+     -Dsuspend_resume=systemd \
+     -Dsystemdsystemunitdir=/usr/lib/systemd/system \
++    -Dsystemdsystemgeneratordir=/usr/lib/systemd/system-generators \
+     -Dsystem_ca_path=/etc/pki/tls/cert.pem \
+     -Ddbus_conf_dir="$P_DBUS_SYS_DIR" \
+     -Dtests=yes \
+diff --git a/data/NetworkManager-config-initrd.service.in b/data/NetworkManager-config-initrd.service.in
+index 4baf0f648ec..4f038036589 100644
+--- a/data/NetworkManager-config-initrd.service.in
++++ b/data/NetworkManager-config-initrd.service.in
+@@ -1,10 +1,10 @@
+ [Unit]
+ Description=NetworkManager Configuration (initrd)
++AssertPathExists=/etc/initrd-release
+ DefaultDependencies=no
+ Wants=systemd-journald.socket
+ After=systemd-journald.socket
+ Before=systemd-udevd.service systemd-udev-trigger.service
+-ConditionPathExists=/etc/initrd-release
+ 
+ [Service]
+ Type=oneshot
+@@ -22,6 +22,3 @@ ExecStartPost=/bin/sh -c ' \
+     fi \
+ '
+ RemainAfterExit=yes
+-
+-[Install]
+-WantedBy=initrd.target
+diff --git a/data/NetworkManager-initrd.service.in b/data/NetworkManager-initrd.service.in
+index aef73a571da..f936ffd2380 100644
+--- a/data/NetworkManager-initrd.service.in
++++ b/data/NetworkManager-initrd.service.in
+@@ -1,11 +1,11 @@
+ [Unit]
+ Description=NetworkManager (initrd)
++AssertPathExists=/etc/initrd-release
+ DefaultDependencies=no
+ Wants=systemd-udev-trigger.service network.target
+ After=systemd-udev-trigger.service network-pre.target dbus.service NetworkManager-config-initrd.service
+ Before=network.target
+ BindsTo=dbus.service
+-ConditionPathExists=/etc/initrd-release
+ ConditionPathExists=/run/NetworkManager/initrd/neednet
+ ConditionPathExistsGlob=|/usr/lib/NetworkManager/system-connections/*
+ ConditionPathExistsGlob=|/run/NetworkManager/system-connections/*
+@@ -22,11 +22,3 @@ Environment=NM_CONFIG_ENABLE_TAG=initrd
+ Restart=on-failure
+ ProtectSystem=true
+ ProtectHome=read-only
+-
+-[Install]
+-WantedBy=initrd.target
+-# We want to enable NetworkManager-wait-online-initrd.service whenever this
+-# service is enabled. NetworkManager-wait-online-initrd.service has
+-# WantedBy=network-online.target, so enabling it only has an effect if
+-# network-online.target itself is enabled or pulled in by some other unit.
+-Also=NetworkManager-config-initrd.service NetworkManager-wait-online-initrd.service
+diff --git a/data/NetworkManager-wait-online-initrd.service.in b/data/NetworkManager-wait-online-initrd.service.in
+index da4a2522340..b89aa816578 100644
+--- a/data/NetworkManager-wait-online-initrd.service.in
++++ b/data/NetworkManager-wait-online-initrd.service.in
+@@ -1,10 +1,10 @@
+ [Unit]
+ Description=NetworkManager Wait Online (initrd)
++AssertPathExists=/etc/initrd-release
+ DefaultDependencies=no
+ Requires=NetworkManager-initrd.service
+ After=NetworkManager-initrd.service
+ Before=network-online.target
+-ConditionPathExists=/etc/initrd-release
+ ConditionPathExists=/run/NetworkManager/initrd/neednet
+ 
+ [Service]
+@@ -21,6 +21,3 @@ Type=oneshot
+ ExecStart=@bindir@/nm-online -s -q
+ RemainAfterExit=yes
+ Environment=NM_ONLINE_TIMEOUT=3600
+-
+-[Install]
+-WantedBy=initrd.target network-online.target
+diff --git a/meson.build b/meson.build
+index 2f9ab5c299a..56bbe281632 100644
+--- a/meson.build
++++ b/meson.build
+@@ -383,6 +383,14 @@ if install_systemdunitdir and systemd_systemdsystemunitdir == ''
+   systemd_systemdsystemunitdir = systemd_dep.get_variable(pkgconfig: 'systemdsystemunitdir', pkgconfig_define: ['rootprefix', nm_prefix])
+ endif
+ 
++systemd_systemdsystemgeneratordir = get_option('systemdsystemgeneratordir')
++install_systemdgeneratordir = (systemd_systemdsystemgeneratordir != 'no')
++
++if install_systemdgeneratordir and systemd_systemdsystemgeneratordir == ''
++  assert(systemd_dep.found(), 'systemd required but not found, please provide a valid systemd user generator dir or disable it')
++  systemd_systemdsystemgeneratordir = systemd_dep.get_variable(pkgconfig: 'systemdsystemgeneratordir', pkgconfig_define: ['rootprefix', nm_prefix])
++endif
++
+ enable_systemd_journal = get_option('systemd_journal')
+ if enable_systemd_journal
+   assert(libsystemd_dep.found(), 'Missing systemd-journald support')
+@@ -1059,6 +1067,7 @@ output = '\nSystem paths:\n'
+ output += '  prefix: ' + nm_prefix + '\n'
+ output += '  exec_prefix: ' + nm_prefix + '\n'
+ output += '  systemdunitdir: ' + systemd_systemdsystemunitdir + '\n'
++output += '  systemdgeneratordir: ' + systemd_systemdsystemgeneratordir + '\n'
+ output += '  udev_dir: ' + udev_udevdir + '\n'
+ output += '  nmbinary: ' + nm_pkgsbindir + '\n'
+ output += '  nmconfdir: ' + nm_pkgconfdir + '\n'
+diff --git a/meson_options.txt b/meson_options.txt
+index d28cc76fc89..8ec68a46bd3 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -1,5 +1,6 @@
+ # system paths
+ option('systemdsystemunitdir', type: 'string', value: '', description: 'Directory for systemd service files')
++option('systemdsystemgeneratordir', type: 'string', value: '', description: 'Directory for systemd generator files')
+ option('system_ca_path', type: 'string', value: '/etc/ssl/certs', description: 'path to system CA certificates')
+ option('udev_dir', type: 'string', value: '', description: 'Absolute path of the udev base directory. Set to \'no\' not to install the udev rule')
+ option('dbus_conf_dir', type: 'string', value: '', description: 'where D-Bus system.d directory is')
+diff --git a/src/nm-initrd-generator/meson.build b/src/nm-initrd-generator/meson.build
+index 6b02e0668df..2315ebe4f29 100644
+--- a/src/nm-initrd-generator/meson.build
++++ b/src/nm-initrd-generator/meson.build
+@@ -46,3 +46,10 @@ executable(
+   install: true,
+   install_dir: nm_libexecdir,
+ )
++
++if install_systemdgeneratordir
++  install_data(
++    'nm-initrd-generator.sh',
++    install_dir: systemd_systemdsystemgeneratordir,
++  )
++endif
+diff --git a/src/nm-initrd-generator/nm-initrd-generator.sh b/src/nm-initrd-generator/nm-initrd-generator.sh
+new file mode 100755
+index 00000000000..20ff78cca5f
+--- /dev/null
++++ b/src/nm-initrd-generator/nm-initrd-generator.sh
+@@ -0,0 +1,50 @@
++#!/bin/bash
++# SPDX-License-Identifier: LGPL-2.1-or-later
++
++# initrd-specific units
++initrd_units=(
++    NetworkManager-config-initrd.service
++    NetworkManager-initrd.service
++    NetworkManager-wait-online-initrd.service
++)
++
++# host-specific units
++host_units=(
++    NetworkManager.service
++    NetworkManager-dispatcher.service
++    NetworkManager-wait-online.service
++)
++
++# Get generator normal directory
++normal_dir=$1
++
++# Since NetworkManager-initrd.service and NetworkManager.service are allocated
++# for the same bus name org.freedesktop.NetworkManager, we should mask one of
++# them depending on if we are in the initrd or on the host.
++if [ "$SYSTEMD_IN_INITRD" != 1 ]; then
++    # Mask initrd units in the host
++    for unit in "${initrd_units[@]}"; do
++        ln -s /dev/null "$normal_dir"/"$unit" 2> /dev/null
++    done
++    # Nothing else to do
++    exit 0
++fi
++
++# Mask host units in the initrd
++for unit in "${host_units[@]}"; do
++    ln -s /dev/null "$normal_dir"/"$unit" 2> /dev/null
++done
++
++# Install initrd units in the unit file hierarchy
++mkdir -p "$normal_dir"/initrd.target.wants
++mkdir -p "$normal_dir"/network-online.target.wants
++for unit in "${initrd_units[@]}"; do
++    ln -s /usr/lib/systemd/system/"$unit" \
++        "$normal_dir"/initrd.target.wants/"$unit"
++    if [ "$unit" = "NetworkManager-wait-online-initrd.service" ]; then
++        ln -s /usr/lib/systemd/system/"$unit" \
++            "$normal_dir"/network-online.target.wants/"$unit"
++    fi
++done
++
++exit 0
+-- 
+GitLab
+

NetworkManager-1.54.1.obscpio

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:cf13fb6894ec4e99870e9ef55e31771c1252d3379e1a1d94b3b145e79c6d7146
-size 65561614

NetworkManager-1.54.3.obscpio

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6ec8a65bf3bbaec350e5eb79b75c372252119e049cafaffbc303b3fe222ce6fb
+size 65617934

NetworkManager-tmpfiles.conf

@@ -0,0 +1 @@
+d /var/lib/NetworkManager 0700 root root -

NetworkManager.changes

@@ -1,3 +1,34 @@
+-------------------------------------------------------------------
+Wed Dec 31 08:18:49 UTC 2025 - Jonathan Kang <songchuan.kang@suse.com>
+
+- Use tmpfiles to create /var/lib/NetworkManager/ (PED-14769).
+
+-------------------------------------------------------------------
+Mon Dec 29 11:45:09 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Update to version 1.54.3:
+  + For private connections (the ones that specify a user in the
+    "connection.permissions" property), verify that the user can
+    access the 802.1X certificates and keys set in the connection.
+  + Introduce a libnm function that can be used by VPN plugins to
+    check user permissions on certificate and keys.
+- Changes from version 1.54.2:
+  + Support reapplying the "sriov.vfs" property as long as
+    "sriov.total-vfs" is not changed.
+  + Support configuring the HSR protocol version via the
+    "hsr.protocol-version" property.
+  + Support configuring the HSR interlink port via the
+    "hsr.interlink" property.
+- Rebase 2298.patch
+
+-------------------------------------------------------------------
+Tue Nov 25 09:35:12 UTC 2025 - Antonio Feijoo <antonio.feijoo@suse.com>
+
+- Add patch 2312.patch to fix upstream issue
+  https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1814,
+  already fixed upstream for the next release via
+  https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2312
+
 -------------------------------------------------------------------
 Fri Oct 31 10:05:44 UTC 2025 - Johannes Segitz <jsegitz@suse.com>
 

NetworkManager.obsinfo

@@ -1,4 +1,4 @@
 name: NetworkManager
-version: 1.54.1
+version: 1.54.3
-mtime: 1757681816
+mtime: 1765553045
-commit: 2450d860c67a6a124a3a56d94bd54bfc7de295f7
+commit: 8caccc6bed0b56528ef3d880af1c217bb8d24419

NetworkManager.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package NetworkManager
 #
-# Copyright (c) 2025 SUSE LLC and contributors
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -64,7 +64,7 @@
 %endif
 
 Name:           NetworkManager
-Version:        1.54.1
+Version:        1.54.3
 Release:        0
 Summary:        Standard Linux network configuration tool suite
 License:        GPL-2.0-or-later AND LGPL-2.1-or-later
@@ -76,6 +76,7 @@ Source2:        NetworkManager.conf
 Source3:        baselibs.conf
 Source4:        conncheck-disabled.conf
 Source5:        00-server.conf
+Source6:        NetworkManager-tmpfiles.conf
 Source98:       macros.NetworkManager
 Source99:       NetworkManager-rpmlintrc
 
@@ -99,6 +100,8 @@ Patch9:         NetworkManager-dont-renew-bridge-dhcp-if-no-mac-on-wakeup.patch
 Patch11:        0001-man-document-static-ip-setup-differences-to-dracut-n.patch
 # PATCH-FIX-UPSTREAM https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2298.patch
 Patch12:        2298.patch
+# PATCH-FIX-UPSTREAM https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2312.patch
+Patch13:        2312.patch
 
 BuildRequires:  c++_compiler
 BuildRequires:  dnsmasq
@@ -325,6 +328,7 @@ This package is intended to be installed by default for server deployments.
 %endif
 %patch -P 11 -p1
 %patch -P 12 -p1
+%patch -P 13 -p1
 
 # Fix server.conf's location, to end up in %%{_defaultdocdir}/%%{name},
 # rather then %%{_datadir}/doc/%%{name}/examples:
@@ -337,6 +341,7 @@ export CFLAGS="%{optflags} -fno-strict-aliasing -fcommon"
 export PYTHON=%{_bindir}/python3
 %meson \
     -Dsystemdsystemunitdir=%{_unitdir} \
+    -Dsystemdsystemgeneratordir=%{_systemdgeneratordir} \
     -Dudev_dir=%{_udevdir} \
     -Ddbus_conf_dir=%{_dbusconfdir} \
     -Ddnsmasq=%{_sbindir}/dnsmasq \
@@ -380,16 +385,16 @@ export PYTHON=%{_bindir}/python3
 %fdupes %{buildroot}%{_datadir}/gtk-doc/
 mkdir -p %{buildroot}%{_bindir}
 mkdir -p %{buildroot}%{_sysconfdir}/NetworkManager/{VPN,conf.d}
-mkdir -p %{buildroot}%{_localstatedir}/log/
-mkdir -p %{buildroot}%{_localstatedir}/lib/NetworkManager/dispatcher.d
 mkdir -p %{buildroot}%{_prefix}/lib/NetworkManager/VPN
-touch %{buildroot}%{_localstatedir}/log/NetworkManager
 mkdir -p %{buildroot}%{_sysconfdir}/NetworkManager/system-connections
 install -m 0755 %{SOURCE1} %{buildroot}%{_prefix}/lib/NetworkManager/dispatcher.d/
 install -m 0644 %{SOURCE2} %{buildroot}%{_prefix}/lib/NetworkManager/
 chmod 0644 %{buildroot}%{_prefix}/lib/NetworkManager/NetworkManager.conf
 install -m 0644 %{SOURCE4} %{buildroot}%{_prefix}/lib/NetworkManager/conf.d
 install -m 0644 %{SOURCE5} %{buildroot}%{_prefix}/lib/NetworkManager/conf.d
+# tmpfiles.d
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 0644 %{SOURCE6} %{buildroot}%{_tmpfilesdir}/%{name}.conf
 # Install RPM macros to be consumed by plugins
 mkdir -p %{buildroot}%{_rpmmacrodir}
 install -m 0644 %{SOURCE98} %{buildroot}%{_rpmmacrodir}/
@@ -401,6 +406,7 @@ rm -f %{buildroot}%{_datadir}/dbus-1/system-services/org.freedesktop.NetworkMana
 %service_add_pre NetworkManager.service NetworkManager-dispatcher.service nm-priv-helper.service
 
 %post
+%tmpfiles_create %{_tmpfilesdir}/%{name}.conf
 %service_add_post NetworkManager.service NetworkManager-dispatcher.service nm-priv-helper.service
 
 %preun
@@ -434,7 +440,7 @@ rm -f %{buildroot}%{_datadir}/dbus-1/system-services/org.freedesktop.NetworkMana
 %{_datadir}/dbus-1/system-services/org.freedesktop.nm_dispatcher.service
 %{_datadir}/dbus-1/interfaces/org.freedesktop.NetworkManager.*
 %{_datadir}/polkit-1/actions/org.freedesktop.NetworkManager.policy
-%attr(0700,root,root) %{_localstatedir}/lib/NetworkManager
+%dir %attr(0700,root,root) %ghost %{_localstatedir}/lib/NetworkManager
 %{_mandir}/man1/nm-online.1%{?ext_man}
 %{_mandir}/man1/nmcli.1%{?ext_man}
 %{_mandir}/man5/nm-settings-keyfile.5%{?ext_man}
@@ -455,6 +461,7 @@ rm -f %{buildroot}%{_datadir}/dbus-1/system-services/org.freedesktop.NetworkMana
 %{_libexecdir}/nm-dhcp-helper
 %{_libexecdir}/nm-dispatcher
 %{_libexecdir}/nm-initrd-generator
+%{_libexecdir}/nm-libnm-helper
 %{_libexecdir}/nm-priv-helper
 %dir %{_sysconfdir}/NetworkManager
 %dir %{_sysconfdir}/NetworkManager/VPN
@@ -470,9 +477,10 @@ rm -f %{buildroot}%{_datadir}/dbus-1/system-services/org.freedesktop.NetworkMana
 %{_udevdir}/rules.d/85-nm-unmanaged.rules
 %{_udevdir}/rules.d/90-nm-thunderbolt.rules
 %{_unitdir}/nm-priv-helper.service
-%ghost %config(noreplace) %{_localstatedir}/log/NetworkManager
 %dir %{_prefix}/lib/NetworkManager
 %{_prefix}/lib/NetworkManager/NetworkManager.conf
+%dir %{_tmpfilesdir}
+%{_tmpfilesdir}/%{name}.conf
 %dir %{_prefix}/lib/NetworkManager/conf.d
 %dir %{_prefix}/lib/NetworkManager/dispatcher.d
 %dir %{_prefix}/lib/NetworkManager/dispatcher.d/no-wait.d
@@ -490,6 +498,8 @@ rm -f %{buildroot}%{_datadir}/dbus-1/system-services/org.freedesktop.NetworkMana
 %{_unitdir}/NetworkManager-config-initrd.service
 %{_unitdir}/NetworkManager-initrd.service
 %{_unitdir}/NetworkManager-wait-online-initrd.service
+%dir %{_systemdgeneratordir}
+%{_systemdgeneratordir}/nm-initrd-generator.sh
 
 %files devel
 %{_includedir}/libnm/

_service

@@ -3,7 +3,7 @@
   <service name="obs_scm" mode="manual">
     <param name="scm">git</param>
     <param name="url">https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git</param>
-    <param name="revision">1.54.1</param>
+    <param name="revision">1.54.3</param>
     <param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param>
     <param name="versionrewrite-pattern">(.*)\+0</param>
     <param name="versionrewrite-replacement">\1</param>