fedora-ci / general

#333 annocheck is called incorrectly in fedora-ci.koji-build.rpminspect.static-analysis leading to a FAILURE report
Closed by msrb. Opened by abbra.

Closed
Reopen Issue

annocheck is called with wrong option VERIFY which is treated as a file name and when tried to open, fails, causing the whole test to fail. The test, otherwise, passes:
https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/rpminspect-pipeline/job/master/88656/testReport/(root)/tests/_annocheck/

Standard Output
rpminspect version: 1.9-0.1.202202102106git.fc36 (with data package: 1.9-0.1.202202221922git.fc36)
rpminspect profile: none
new build: krb5-1.19.2-7.fc36
old build: krb5-1.19.2-6.fc36 (found in f36-updates koji tag)
Test description:
Perform annocheck tests defined in the configuration file on all ELF files in the build.  A single build specified will perform an analysis only.  Two builds specified will compare the test results between the before and after build.  If no annocheck tests are defined in the configuration file, this inspection is skipped.
======================================== Test Output ========================================
annocheck:
----------
1) annocheck 'failure_severity' test fails for /usr/lib/krb5/plugins/preauth/spake.so on armv7hl
Result: INFO
Waiver Authorization: Not Waivable
Details:
Command: annocheck VERIFY --debug-dir=/var/tmp/rpminspect/krb5-1.19.2.ty3mbA/before/armv7hl/krb5-libs-debuginfo-1.19.2-6.fc36.armv7hl /usr/lib/krb5/plugins/preauth/spake.so
Exit Code: 1
    compared with the output of:
Command: annocheck VERIFY --debug-dir=/var/tmp/rpminspect/krb5-1.19.2.ty3mbA/after/armv7hl/krb5-libs-debuginfo-1.19.2-7.fc36.armv7hl /usr/lib/krb5/plugins/preauth/spake.so
Exit Code: 1
annocheck: Version 10.53.
annocheck: Warning: 'VERIFY': No such file.
Hardened: spake.so: PASS.
Suggested Remedy:
See annocheck(1) for more information.

@msrb @dcantrell PTAL

Note that there are other failed tests in the same run, some of them are valid like property-note test because .note.gnu.property section not found (it is needed for branch protection support) but I am pointing specifically to the is issue with annocheck arguments.

Oh yeah, that looks definitely wrong. Can someone please file this at https://github.com/rpminspect/rpminspect? Thanks.

Let's try to update the version in CI first. There were some problem with quay.io that couldn't build the image, so there is an older rpminspect now.

Results look better with new rpminspect and annocheck:

https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/rpminspect-pipeline/job/master/88807/testReport/(root)/tests/_annocheck/

Metadata Update from @msrb:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.