saving uncommitted changes in /etc prior to dnf run

Package changes:

.etckeeper

@@ -918,7 +918,6 @@ maybe chmod 0644 'httpd/conf.d/perl.conf'
 maybe chmod 0644 'httpd/conf.d/php.conf'
 maybe chmod 0644 'httpd/conf.d/phpmyadmin.conf'
 maybe chmod 0644 'httpd/conf.d/squid.conf'
-maybe chmod 0644 'httpd/conf.d/ssl.conf'
 maybe chmod 0644 'httpd/conf.d/ssl.conf_disabled'
 maybe chmod 0644 'httpd/conf.d/userdir.conf'
 maybe chmod 0644 'httpd/conf.d/welcome.conf'
@@ -4974,8 +4973,6 @@ maybe chmod 0640 'nginx/conf.d/mully.go.ro.conf'
 maybe chown 'nginx' 'nginx/conf.d/padmin.club3d.ro.conf'
 maybe chgrp 'nginx' 'nginx/conf.d/padmin.club3d.ro.conf'
 maybe chmod 0640 'nginx/conf.d/padmin.club3d.ro.conf'
-maybe chown 'nginx' 'nginx/conf.d/php-fpm.conf'
-maybe chgrp 'nginx' 'nginx/conf.d/php-fpm.conf'
 maybe chmod 0644 'nginx/conf.d/php-fpm.conf'
 maybe chown 'nginx' 'nginx/conf.d/rspamd.club3d.ro.conf'
 maybe chgrp 'nginx' 'nginx/conf.d/rspamd.club3d.ro.conf'
@@ -6306,7 +6303,6 @@ maybe chmod 0644 'yum.repos.d/almalinux-saphana.repo'
 maybe chmod 0644 'yum.repos.d/almalinux.repo'
 maybe chmod 0640 'yum.repos.d/atomic.repo'
 maybe chmod 0640 'yum.repos.d/bestcrypt.repo'
-maybe chmod 0644 'yum.repos.d/cert-forensics-tools.repo'
 maybe chmod 0640 'yum.repos.d/crowdsec_crowdsec.repo'
 maybe chmod 0644 'yum.repos.d/docker-ce.repo'
 maybe chmod 0644 'yum.repos.d/elrepo.repo'

httpd/conf.d/ssl.conf

@@ -1,203 +0,0 @@
-#
-# When we also provide SSL we have to listen to the 
-# standard HTTPS port in addition.
-#
-Listen 443 https
-
-##
-##  SSL Global Context
-##
-##  All SSL configuration in this context applies both to
-##  the main server and all SSL-enabled virtual hosts.
-##
-
-#   Pass Phrase Dialog:
-#   Configure the pass phrase gathering process.
-#   The filtering dialog program (`builtin' is a internal
-#   terminal dialog) has to provide the pass phrase on stdout.
-SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
-
-#   Inter-Process Session Cache:
-#   Configure the SSL Session Cache: First the mechanism 
-#   to use and second the expiring timeout (in seconds).
-SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
-SSLSessionCacheTimeout  300
-
-#
-# Use "SSLCryptoDevice" to enable any supported hardware
-# accelerators. Use "openssl engine -v" to list supported
-# engine names.  NOTE: If you enable an accelerator and the
-# server does not start, consult the error logs and ensure
-# your accelerator is functioning properly. 
-#
-SSLCryptoDevice builtin
-#SSLCryptoDevice ubsec
-
-##
-## SSL Virtual Host Context
-##
-
-<VirtualHost _default_:443>
-
-# General setup for the virtual host, inherited from global configuration
-#DocumentRoot "/var/www/html"
-#ServerName www.example.com:443
-
-# Use separate log files for the SSL virtual host; note that LogLevel
-# is not inherited from httpd.conf.
-ErrorLog logs/ssl_error_log
-TransferLog logs/ssl_access_log
-LogLevel warn
-
-#   SSL Engine Switch:
-#   Enable/Disable SSL for this virtual host.
-SSLEngine on
-
-#   List the protocol versions which clients are allowed to connect with.
-#   The OpenSSL system profile is used by default.  See
-#   update-crypto-policies(8) for more details.
-#SSLProtocol all -SSLv3
-#SSLProxyProtocol all -SSLv3
-
-#   User agents such as web browsers are not configured for the user's
-#   own preference of either security or performance, therefore this
-#   must be the prerogative of the web server administrator who manages
-#   cpu load versus confidentiality, so enforce the server's cipher order.
-SSLHonorCipherOrder on
-
-#   SSL Cipher Suite:
-#   List the ciphers that the client is permitted to negotiate.
-#   See the mod_ssl documentation for a complete list.
-#   The OpenSSL system profile is configured by default.  See
-#   update-crypto-policies(8) for more details.
-SSLCipherSuite PROFILE=SYSTEM
-SSLProxyCipherSuite PROFILE=SYSTEM
-
-#   Point SSLCertificateFile at a PEM encoded certificate.  If
-#   the certificate is encrypted, then you will be prompted for a
-#   pass phrase.  Note that restarting httpd will prompt again.  Keep
-#   in mind that if you have both an RSA and a DSA certificate you
-#   can configure both in parallel (to also allow the use of DSA
-#   ciphers, etc.)
-#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
-#   require an ECC certificate which can also be configured in
-#   parallel.
-SSLCertificateFile /etc/pki/tls/certs/localhost.crt
-
-#   Server Private Key:
-#   If the key is not combined with the certificate, use this
-#   directive to point at the key file.  Keep in mind that if
-#   you've both a RSA and a DSA private key you can configure
-#   both in parallel (to also allow the use of DSA ciphers, etc.)
-#   ECC keys, when in use, can also be configured in parallel
-SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
-
-#   Server Certificate Chain:
-#   Point SSLCertificateChainFile at a file containing the
-#   concatenation of PEM encoded CA certificates which form the
-#   certificate chain for the server certificate. Alternatively
-#   the referenced file can be the same as SSLCertificateFile
-#   when the CA certificates are directly appended to the server
-#   certificate for convenience.
-#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
-
-#   Certificate Authority (CA):
-#   Set the CA certificate verification path where to find CA
-#   certificates for client authentication or alternatively one
-#   huge file containing all of them (file must be PEM encoded)
-#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
-
-#   Client Authentication (Type):
-#   Client certificate verification type and depth.  Types are
-#   none, optional, require and optional_no_ca.  Depth is a
-#   number which specifies how deeply to verify the certificate
-#   issuer chain before deciding the certificate is not valid.
-#SSLVerifyClient require
-#SSLVerifyDepth  10
-
-#   Access Control:
-#   With SSLRequire you can do per-directory access control based
-#   on arbitrary complex boolean expressions containing server
-#   variable checks and other lookup directives.  The syntax is a
-#   mixture between C and Perl.  See the mod_ssl documentation
-#   for more details.
-#<Location />
-#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
-#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
-#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
-#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
-#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
-#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
-#</Location>
-
-#   SSL Engine Options:
-#   Set various options for the SSL engine.
-#   o FakeBasicAuth:
-#     Translate the client X.509 into a Basic Authorisation.  This means that
-#     the standard Auth/DBMAuth methods can be used for access control.  The
-#     user name is the `one line' version of the client's X.509 certificate.
-#     Note that no password is obtained from the user. Every entry in the user
-#     file needs this password: `xxj31ZMTZzkVA'.
-#   o ExportCertData:
-#     This exports two additional environment variables: SSL_CLIENT_CERT and
-#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
-#     server (always existing) and the client (only existing when client
-#     authentication is used). This can be used to import the certificates
-#     into CGI scripts.
-#   o StdEnvVars:
-#     This exports the standard SSL/TLS related `SSL_*' environment variables.
-#     Per default this exportation is switched off for performance reasons,
-#     because the extraction step is an expensive operation and is usually
-#     useless for serving static content. So one usually enables the
-#     exportation for CGI and SSI requests only.
-#   o StrictRequire:
-#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
-#     under a "Satisfy any" situation, i.e. when it applies access is denied
-#     and no other module can change it.
-#   o OptRenegotiate:
-#     This enables optimized SSL connection renegotiation handling when SSL
-#     directives are used in per-directory context. 
-#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
-<FilesMatch "\.(cgi|shtml|phtml|php)$">
-    SSLOptions +StdEnvVars
-</FilesMatch>
-<Directory "/var/www/cgi-bin">
-    SSLOptions +StdEnvVars
-</Directory>
-
-#   SSL Protocol Adjustments:
-#   The safe and default but still SSL/TLS standard compliant shutdown
-#   approach is that mod_ssl sends the close notify alert but doesn't wait for
-#   the close notify alert from client. When you need a different shutdown
-#   approach you can use one of the following variables:
-#   o ssl-unclean-shutdown:
-#     This forces an unclean shutdown when the connection is closed, i.e. no
-#     SSL close notify alert is sent or allowed to be received.  This violates
-#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
-#     this when you receive I/O errors because of the standard approach where
-#     mod_ssl sends the close notify alert.
-#   o ssl-accurate-shutdown:
-#     This forces an accurate shutdown when the connection is closed, i.e. a
-#     SSL close notify alert is sent and mod_ssl waits for the close notify
-#     alert of the client. This is 100% SSL/TLS standard compliant, but in
-#     practice often causes hanging connections with brain-dead browsers. Use
-#     this only for browsers where you know that their SSL implementation
-#     works correctly. 
-#   Notice: Most problems of broken clients are also related to the HTTP
-#   keep-alive facility, so you usually additionally want to disable
-#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
-#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
-#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
-#   "force-response-1.0" for this.
-BrowserMatch "MSIE [2-5]" \
-         nokeepalive ssl-unclean-shutdown \
-         downgrade-1.0 force-response-1.0
-
-#   Per-Server Logging:
-#   The home of a custom SSL log file. Use this when you want a
-#   compact non-error SSL logfile on a virtual host basis.
-CustomLog logs/ssl_request_log \
-          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
-
-</VirtualHost>
-

mock/templates/fedora-eln.tpl

@@ -17,6 +17,8 @@ config_opts['package_manager'] = 'dnf'
 # Per https://github.com/fedora-eln/eln/issues/164 updated up to 4 times a day.
 # Docs: https://docs.fedoraproject.org/en-US/eln/deliverables/#_container_image
 config_opts['bootstrap_image'] = 'quay.io/fedoraci/fedora:eln'
+# Per https://github.com/fedora-eln/eln/issues/166
+config_opts['bootstrap_image_ready'] = True
 
 config_opts['dnf.conf'] = """
 [main]

mock/templates/fedora-rawhide.tpl

@@ -8,8 +8,16 @@ config_opts['chroot_setup_cmd'] = 'install @{% if mirrored %}buildsys-{% endif %
 config_opts['dist'] = 'rawhide'  # only useful for --resultdir variable subst
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['releasever'] = '40'
-config_opts['package_manager'] = 'dnf'
+
+# https://fedoraproject.org/wiki/Changes/BuildWithDNF5
+config_opts['package_manager'] = 'dnf5'
+
 config_opts['bootstrap_image'] = 'registry.fedoraproject.org/fedora:rawhide'
+
+# For F41+ there's https://fedoraproject.org/wiki/Changes/ReplaceDnfWithDnf5 so
+# once done, re-revert https://pagure.io/fedora-kickstarts/c/f7bf98d3af6d655c6d64ba9c8d2f88cbffbbb06d?branch=main
+#config_opts['bootstrap_image_ready'] = True
+
 config_opts['description'] = 'Fedora Rawhide'
 
 config_opts['dnf.conf'] = """

mock/templates/openmandriva-cooker.tpl

@@ -4,6 +4,7 @@ config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['releasever'] = '5.0'
 config_opts['macros']['%cross_compiling'] = '0' # Mock should generally be considered native builds
 config_opts['package_manager'] = 'dnf'
+config_opts['dnf_install_command'] = 'install python-dnf python-dnf-plugins-core'
 config_opts['description'] = 'OpenMandriva Cooker {{ releasever }}'
 config_opts['bootstrap_image'] = 'docker.io/openmandriva/cooker:latest'
 

mock/templates/openmandriva-rolling.tpl

@@ -4,6 +4,7 @@ config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['releasever'] = '5.0'
 config_opts['macros']['%cross_compiling'] = '0' # Mock should generally be considered native builds
 config_opts['package_manager'] = 'dnf'
+config_opts['dnf_install_command'] = 'install python-dnf python-dnf-plugins-core'
 config_opts['description'] = 'OpenMandriva Rolling'
 
 # Is there a corresponding rolling image? #1171

ssh/sshd_config

@@ -21,8 +21,8 @@ HostKey /etc/ssh/ssh_host_rsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 
 KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+MACs hmac-sha2-512,hmac-sha2-256
 
 # Ciphers and keying
 RekeyLimit default none

yum.repos.d/cert-forensics-tools.repo

@@ -1,27 +0,0 @@
-[forensics]
-name=CERT Forensics Tools Repository 
-baseurl=http://www.cert.org/forensics/repository/centos/cert/$releasever/$basearch
-enabled=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-cert-forensics-2025-03-24
-gpgcheck=1
-
-[forensics-test]
-name=CERT Forensics Tools Test Repository 
-baseurl=http://www.cert.org/forensics/repository/centos/cert-test/$releasever/$basearch
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-cert-forensics-2025-03-24
-gpgcheck=1
-
-[forensics-splunk]
-name=CERT Forensics Tools Repository - Splunk
-baseurl=http://www.cert.org/forensics/repository/centos/splunk/$releasever/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-splunk
-enabled=1
-gpgcheck=1
-
-[forensics-sip]
-name=CERT Forensics Tools Repository - SiLK, IPA, and Postgresql
-baseurl=http://www.cert.org/forensics/repository/centos/sip/$releasever/$basearch
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-cert-forensics-2025-03-24
-gpgcheck=1