Accepting request 1307312 from security:SELinux

- Fix test multibuild flavor
  - Change the test flavor so that it does not produce any RPMs, avoiding
    duplicate binaries across the setools and setools-test packages
  - Disable debuginfo generation for the test flavor, so that it does not break
    due to the missing files.

OBS-URL: https://build.opensuse.org/request/show/1307312
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/setools?expand=0&rev=55

_multibuild

@@ -0,0 +1,3 @@
+<multibuild>
+  <package>test</package>
+</multibuild>

setools-4.5.1.tar.bz2.sha256.asc

@@ -1,11 +0,0 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA512
-
-25e47d00bbffd6046f55409c9ba3b08d9b1d5788cc159ea247d9e0ced8e482e7  setools-4.5.1.tar.bz2
------BEGIN PGP SIGNATURE-----
-
-iHUEARYKAB0WIQSFZJCJyfOFs19AVo0haY/SnUNVpAUCZuhwhAAKCRAhaY/SnUNV
-pPFLAQCxeYSAb83UT/lCMuJqInvnq/n9FfmfniCgu1HuLEmvKgEAkCGSVFtSAe6C
-q+Mu17dAOACwnCYo+aK6eXXuJd3ABQo=
-=S2WE
------END PGP SIGNATURE-----

setools-4.6.0.tar.bz2

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:97319aabaf9d4237841ee60dcc9b2f291e73a761f317fd13e293ea2367d5806c
+size 262758

setools-4.6.0.tar.bz2.sha256.asc

@@ -0,0 +1,11 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+97319aabaf9d4237841ee60dcc9b2f291e73a761f317fd13e293ea2367d5806c  setools-4.6.0.tar.bz2
+-----BEGIN PGP SIGNATURE-----
+
+iHUEARYKAB0WIQTExisWcMLfMxRI8obGNj7xyWl7FAUCaL8hiAAKCRDGNj7xyWl7
+FKNMAP9gi650en7mZv0t4npoI8rF3fohiFeF/kBCXqB/kAGDAgEA/gmLm6Tpp1ym
+bEgRfQlPWCxg6AhIxmn3J0fhDcvnZAc=
+=F6mP
+-----END PGP SIGNATURE-----

setools.changes

@@ -1,3 +1,46 @@
+-------------------------------------------------------------------
+Thu Sep 25 14:47:35 UTC 2025 - Filippo Bonazzi <filippo.bonazzi@suse.com>
+
+- Fix test multibuild flavor
+  - Change the test flavor so that it does not produce any RPMs, avoiding
+    duplicate binaries across the setools and setools-test packages
+  - Disable debuginfo generation for the test flavor, so that it does not break
+    due to the missing files.
+
+-------------------------------------------------------------------
+Mon Sep 22 15:01:38 UTC 2025 - Filippo Bonazzi <filippo.bonazzi@suse.com>
+
+- Simplify test multibuild flavor to fix broken build in Factory due to
+  debuginfo generation
+
+-------------------------------------------------------------------
+Thu Sep 11 08:19:16 UTC 2025 - Filippo Bonazzi <filippo.bonazzi@suse.com>
+
+- Move tests to a test multibuild flavor
+
+-------------------------------------------------------------------
+Tue Sep  9 09:23:10 UTC 2025 - Filippo Bonazzi <filippo.bonazzi@suse.com>
+
+- Update to version 4.6.0:
+  - User Visible Changes
+    * Add seinfo option to see roles allowed for a specified type.
+    * Add sechecker module for asserting kernel modules are read-only.
+    * Add support for the nlmsg extended permission.
+  - Under The Hood Changes
+    * Significant code quality and unit testing improvements.
+    * Drop methods marked for deprecation.
+  - Packaging Changes
+    * Refactor packaging to use pyproject.toml.
+- Add %check section and run tests (Factory only)
+- Fix %fdupes call to clean up duplicates for all Python versions
+- Add minimum required dependency versions
+
+-------------------------------------------------------------------
+Mon Jun 30 13:54:20 UTC 2025 - Cathy Hu <cathy.hu@suse.com>
+
+- Drop legacy %python_build and %python_install macros and 
+  switch to pyproject macros instead as requested by packaging team
+
 -------------------------------------------------------------------
 Wed Sep 18 14:17:31 UTC 2024 - Filippo Bonazzi <filippo.bonazzi@suse.com>
 

setools.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package setools
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,6 +16,15 @@
 #
 
 
+%define software_name setools
+
+%define flavor @BUILD_FLAVOR@%{nil}
+%if "%{flavor}" == ""
+%define name_suffix %{nil}
+%else
+%define name_suffix -%{flavor}
+%endif
+
 %{?sle15_python_module_pythons}
 %if 0%{?suse_version} < 1600
 # set python_for_executables from python macros to python311
@@ -23,30 +32,60 @@
 %define python_for_executables python311
 %endif
 
-Name:           setools
+%if "%{flavor}" == "test"
-Version:        4.5.1
+# The test flavor does not package any files, it only builds the software and
+# runs the tests. To simplify test execution, the software is actually
+# installed in the buildroot first. After the tests have passed, the buildroot
+# is deleted. As debuginfo generation is done based on the contents of the
+# buildroot after the install section, and before the check section, the final
+# debuginfo step will expect to find the now deleted files in the buildroot.
+# Disable debuginfo generation in the test flavor to avoid these issues.
+# Since the test flavor does not produce any RPMs, this is not a problem.
+%define debug_package %{nil}
+%if 0%{?suse_version} <= 1600
+# Test dependencies such as python-PyQt6, python-NetworkX, python-pytest-qt
+# are not found in other distributions.
+# Do not build test flavor for distributions which cannot run tests.
+ExclusiveArch:  do_not_build
+%endif
+%endif
+
+Name:           setools%{name_suffix}
+Version:        4.6.0
 Release:        0
 URL:            https://github.com/SELinuxProject/setools
 Summary:        Policy analysis tools for SELinux
 License:        GPL-2.0-only
 Group:          System/Management
-Source:         https://github.com/SELinuxProject/setools/releases/download/%{version}/%{name}-%{version}.tar.bz2
+Source:         https://github.com/SELinuxProject/setools/releases/download/%{version}/%{software_name}-%{version}.tar.bz2
-Source2:        https://github.com/SELinuxProject/setools/releases/download/%{version}/%{name}-%{version}.tar.bz2.sha256.asc
+Source2:        https://github.com/SELinuxProject/setools/releases/download/%{version}/%{software_name}-%{version}.tar.bz2.sha256.asc
 Source3:        setools.keyring
 Source4:        README.SUSE
 BuildRequires:  %{python_module Cython >= 0.29.14}
 BuildRequires:  %{python_module devel >= 3.10}
+BuildRequires:  %{python_module pip}
 BuildRequires:  %{python_module setuptools}
+BuildRequires:  %{python_module wheel}
 BuildRequires:  fdupes
 BuildRequires:  libselinux-devel
-BuildRequires:  libsepol-devel
+BuildRequires:  libsepol-devel >= 3.2
 BuildRequires:  python-rpm-macros
+%if "%{flavor}" == "test"
+BuildRequires:  %{python_module PyQt6}
+BuildRequires:  %{python_module networkx >= 2.6}
+BuildRequires:  %{python_module pytest-qt}
+BuildRequires:  %{python_module pytest}
+BuildRequires:  %{python_module tox}
+BuildRequires:  checkpolicy
+%endif
+%if "%{flavor}" != "test"
 Requires:       setools-console = %{version}-%{release}
 Requires:       setools-gui = %{version}-%{release}
 # needed since setools is not a python-main package, see
 # https://github.com/openSUSE/python-rpm-macros
 %define python_subpackage_only 1
 %python_subpackages
+%endif
 
 %description
 SETools is a collection of graphical tools, command-line tools, and
@@ -55,6 +94,7 @@ libraries designed to facilitate SELinux policy analysis.
 This meta-package depends upon the main packages necessary to run
 SETools.
 
+%if "%{flavor}" != "test"
 %package console
 Summary:        Policy analysis command-line tools for SELinux
 License:        GPL-2.0-only
@@ -107,19 +147,34 @@ libraries designed to facilitate SELinux policy analysis.
 This package includes the following graphical tools:
 
   apol          policy analysis tool
+%endif
 
 %prep
-%setup -q -n %{name}
+%setup -q -n %{software_name}
 %autopatch -p1
 
 %build
-%python_build
+%pyproject_wheel
 
 %install
-%python_install
+%pyproject_install
-install -m 644 -D %{SOURCE2} %{buildroot}%{_docdir}/%{name}/README.SUSE
+%if "%{flavor}" != "test"
-%fdupes -s %{buildroot}%{python_sitearch}
+install -m 644 -D %{SOURCE2} %{buildroot}%{_docdir}/%{software_name}/README.SUSE
+%python_expand %fdupes -s %{buildroot}%{$python_sitearch}
+%endif
 
+%check
+%if "%{flavor}" == "test"
+# Remove the module directories to prevent Python loading the modules from CWD.
+# This way, the modules are actually loaded from the buildroot, which is
+# inserted on the PATH by the pytest macros
+rm -rf setools setoolsgui
+%pytest_arch -v
+# The test flavor should not package any files
+rm -rf %{buildroot}
+%endif
+
+%if "%{flavor}" != "test"
 %files %{python_files setools}
 %defattr(-,root,root,-)
 %{python_sitearch}/setools
@@ -146,12 +201,13 @@ install -m 644 -D %{SOURCE2} %{buildroot}%{_docdir}/%{name}/README.SUSE
 %{_mandir}/ru/man1/seinfo.1.gz
 %{_mandir}/ru/man1/seinfoflow.1.gz
 %{_mandir}/ru/man1/sesearch.1.gz
-%dir %{_docdir}/%{name}/
+%dir %{_docdir}/%{software_name}/
-%{_docdir}/%{name}/*
+%{_docdir}/%{software_name}/*
 
 %files gui
 %defattr(-,root,root,-)
 %{_bindir}/apol
 %{_mandir}/man1/apol.1.gz
+%endif
 
 %changelog