Warning: Permanently added '34.233.121.66' (ED25519) to the list of known hosts. You can reproduce this build on your computer by running: sudo dnf install copr-rpmbuild /usr/bin/copr-rpmbuild --verbose --drop-resultdir --srpm --task-url https://copr.fedorainfracloud.org/backend/get-srpm-build-task/10714588 Version: 1.8 PID: 10469 Logging PID: 10471 Task: {'appstream': False, 'background': True, 'build_id': 10714588, 'chroot': None, 'distributions_in_build': ['centos-stream-10', 'epel-10', 'fedora-43', 'fedora-44', 'fedora-rawhide'], 'distributions_in_project': ['centos-stream-10', 'epel-10', 'fedora-43', 'fedora-44', 'fedora-rawhide'], 'package_name': 'dms', 'project_dirname': 'dms-git', 'project_name': 'dms-git', 'project_owner': 'avengemedia', 'repos': [], 'sandbox': 'avengemedia/dms-git--https://api.github.com/users/bbedward', 'source_json': {'clone_url': 'https://github.com/AvengeMedia/DankMaterialShell.git', 'committish': 'ca89e1296363d3e7f3aff7de5691f560d6d42975', 'spec': 'distro/fedora/dms-git.spec', 'srpm_build_method': 'rpkg', 'subdirectory': '', 'type': 'git'}, 'source_type': 8, 'submitter': 'https://api.github.com/users/bbedward', 'task_id': '10714588'} Running: git clone https://github.com/AvengeMedia/DankMaterialShell.git /var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell --depth 500 --no-single-branch --recursive cmd: ['git', 'clone', 'https://github.com/AvengeMedia/DankMaterialShell.git', '/var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell', '--depth', '500', '--no-single-branch', '--recursive'] cwd: . rc: 0 stdout: stderr: Cloning into '/var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell'... Running: git checkout ca89e1296363d3e7f3aff7de5691f560d6d42975 -- cmd: ['git', 'checkout', 'ca89e1296363d3e7f3aff7de5691f560d6d42975', '--'] cwd: /var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell rc: 0 stdout: stderr: Note: switching to 'ca89e1296363d3e7f3aff7de5691f560d6d42975'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by switching back to a branch. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -c with the switch command. Example: git switch -c Or undo this operation with: git switch - Turn off this advice by setting config variable advice.detachedHead to false HEAD is now at ca89e129 core: fix security and concurrency issues found in a backend audit (#2805) Generated rpkg config: [rpkg] preprocess_spec = True [git] anon_clone_url = https://github.com/%(repo_path)s [lookaside] download_url = https://${git_props:remote_netloc}/repo/pkgs/%(repo_path)s/%(filename)s/%(hashtype)s/%(hash)s/%(filename)s Writing config into /var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/.config/rpkg.conf Running: rpkg srpm --outdir /var/lib/copr-rpmbuild/results --spec /var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell/distro/fedora/dms-git.spec cmd: ['rpkg', 'srpm', '--outdir', '/var/lib/copr-rpmbuild/results', '--spec', '/var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell/distro/fedora/dms-git.spec'] cwd: /var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell rc: 0 stdout: Wrote: /var/lib/copr-rpmbuild/results/dms-git.spec Wrote: /var/lib/copr-rpmbuild/results/dms-0.0.git.4149.ca89e129-1.src.rpm RPM build warnings: stderr: git_repo_pack: archiving /var/lib/copr-rpmbuild/workspace/workdir-9nquk_q0/DankMaterialShell: commit ca89e1296363d3e7f3aff7de5691f560d6d42975 (HEAD, origin/master, origin/HEAD, master) Author: Rafi Date: Mon Jul 13 15:44:42 2026 -0400 core: fix security and concurrency issues found in a backend audit (#2805) * core: fix security and concurrency issues found in backend audit Security: - privesc: pipe the sudo password via stdin (sudo -S) instead of embedding it in the command string, so it no longer appears in argv (readable by any local user via /proc//cmdline or ps) - greeter: tokenize a session .desktop Exec= line into argv and execve directly instead of running it through /bin/sh -c, closing a command- injection path via user-writable ~/.local/share/wayland-sessions - plugins: reject path-separator/.. in plugin id/name before joining into a filesystem path, closing an arbitrary-directory-delete in the uninstall/update fallback - keybinds/hyprland: always quote unrecognized bind actions/keys when writing generated Lua; only re-emit genuine round-tripped custom Lua verbatim (tracked via an explicit flag), closing a Lua-injection path - desktop/mimeapps: reject newline/bracket in mime/desktop-id fields so they can't inject fake sections into the shared mimeapps.list Robustness / concurrency: - server: recover panics in the request-dispatch path so one bad handler can't crash the daemon and drop every client - go-wayland: recover panics in the shared dispatch choke point so a malformed compositor event can't crash CLI tools / the daemon - server: per-connection D-Bus client ID instead of a shared constant, fixing cross-client signal delivery and subscription teardown - network: guard the NetworkManager device maps with a mutex (a concurrent map read/write here is an unrecoverable fatal error) - cups: close the event channel on Stop() so Unsubscribe() of the last subscriber no longer deadlocks; allocate the fresh channel in Start() - freedesktop: reuse the shared session conn for the settings watcher and tear it down in Close(), fixing a per-Manager conn+goroutine leak - clipboard: mutex-guard lazy dbusConn creation - geolocation: use WithMatchMember for the GeoClue2 LocationUpdated signal (was WithMatchSender with an interface.member string, so the match never fired and live location updates never arrived) - screenshot: set failed=true on buffer/pool creation errors so the dispatch loop doesn't wait forever for a ready/failed that never comes * apply code review comments --------- Co-authored-by: bbedward git_repo_pack: Wrote: /var/lib/copr-rpmbuild/results/DankMaterialShell-ca89e129.tar.gz warning: Downloading https://go.dev/dl/go1.26.1.linux-amd64.tar.gz to /var/lib/copr-rpmbuild/results/go1.26.1.linux-amd64.tar.gz warning: Downloading https://go.dev/dl/go1.26.1.linux-arm64.tar.gz to /var/lib/copr-rpmbuild/results/go1.26.1.linux-arm64.tar.gz warning: %source_date_epoch_from_changelog is set, but %changelog has no entries to take a date from Downloading https://go.dev/dl/go1.26.1.linux-amd64.tar.gz to /var/lib/copr-rpmbuild/results/go1.26.1.linux-amd64.tar.gz Downloading https://go.dev/dl/go1.26.1.linux-arm64.tar.gz to /var/lib/copr-rpmbuild/results/go1.26.1.linux-arm64.tar.gz %source_date_epoch_from_changelog is set, but %changelog has no entries to take a date from Output: ['dms-0.0.git.4149.ca89e129-1.src.rpm', 'go1.26.1.linux-arm64.tar.gz', 'dms-git.spec', 'go1.26.1.linux-amd64.tar.gz', 'DankMaterialShell-ca89e129.tar.gz'] Running SRPMResults tool Using distributions_in_build for this build. Extracting arch-specific tags for centos-stream-10 Extracting arch-specific tags for epel-10 Extracting arch-specific tags for fedora-43 Extracting arch-specific tags for fedora-44 Extracting arch-specific tags for fedora-rawhide Package info: { "architecture_specific_tags": { "centos-stream-10": {}, "epel-10": {}, "fedora-43": {}, "fedora-44": {}, "fedora-rawhide": {} }, "name": "dms", "epoch": 2, "version": "0.0.git.4149.ca89e129", "release": "1" } SRPMResults finished