{"update": {"autokarma": false, "autotime": true, "stable_karma": 3, "stable_days": 0, "unstable_karma": -3, "require_bugs": false, "require_testcases": false, "display_name": "", "notes": "Automatic update for gnome-software-48.1-2.fc43.\n\n##### **Changelog**\n\n```\n* Tue Apr 29 2025 Milan Crha <mcrha@redhat.com> - 48.1-2\n- Switch from PackageKit to DNF5 plugin\n\n```", "type": "unspecified", "status": "testing", "request": null, "severity": "unspecified", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": true, "critpath_groups": "critical-path-gnome", "close_bugs": true, "date_submitted": "2025-04-29 09:19:05", "date_modified": null, "date_approved": null, "date_testing": "2025-04-29 09:21:01", "date_stable": null, "alias": "FEDORA-2025-4a9607a2d0", "test_gating_status": "failed", "from_tag": null, "date_pushed": "2025-04-29 09:21:01", "meets_testing_requirements": false, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-4a9607a2d0", "title": "gnome-software-48.1-2.fc43", "version_hash": "be0609e68f9b6c82f1f934f9dbb168547e3df32b", "release": {"name": "F43", "long_name": "Fedora 43", "version": "43", "id_prefix": "FEDORA", "branch": "rawhide", "dist_tag": "f43", "stable_tag": "f43", "testing_tag": "f43-updates-testing", "candidate_tag": "f43-updates-candidate", "pending_signing_tag": "f43-signing-pending", "pending_testing_tag": "f43-updates-testing-pending", "pending_stable_tag": "f43-updates-pending", "override_tag": "f43-override", "mail_template": "fedora_errata_template", "state": "pending", "composed_by_bodhi": false, "create_automatic_updates": true, "package_manager": "unspecified", "testing_repository": null, "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 0, "mandatory_days_in_testing": 0, "critpath_min_karma": 0, "min_karma": 0, "setting_status": "pre_beta"}, "user": {"name": "mcrha", "email": "mcrha@redhat.com", "id": 577, "avatar": "https://seccdn.libravatar.org/avatar/5a341501adf88ed99b314dbc588622ffbfa08d9c0992f580bb5f6f5f013ae6aa?s=24&d=retro", "openid": "mcrha.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "cla_redhat"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update was automatically created", "timestamp": "2025-04-29 09:19:05", "update_id": 713155, "user_id": 91, "id": 4065297, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'waiting'.", "timestamp": "2025-04-29 09:19:07", "update_id": 713155, "user_id": 91, "id": 4065298, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'failed'.", "timestamp": "2025-04-29 10:00:21", "update_id": 713155, "user_id": 91, "id": 4065326, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": -1, "karma_critpath": 0, "text": "So this fails because we now prompt for authentication to run an update. This doesn't happen with PackageKit because there's a polkit policy that allows wheel group members to install some packages via PackageKit without re-authenticating (it's something like \"packages signed with a trusted key\" or \"packages from an enabled repo\", we're not exactly sure what the rule is ATM).\n\nthat rule has always been a bit controversial, but every time it's come up for discussion we've ultimately kept it, I guess because we want operations like system updates and installing an app from GNOME Software or KDE Discover to be seamless.\n\nto preserve existing behaviour we could have a polkit rule for dnf which acts the same way. This would *still* be a change in some sense, though, because until now, if you didn't like this policy, you could remove PackageKit from your system entirely - that's plausible to do, especially on a non-desktop system. You can't really get by without dnf, though. So if we bake in such a rule for dnf, everybody is stuck with it unless they actually write an override policy. Perhaps we could package up an overriding policy for people who want tighter behaviour, or something.\n\nI don't know why we didn't catch this in the pre-testing we did, sorry. I was really sure I checked those logs to make sure the updated packages were tested, but something must have gone wrong...", "timestamp": "2025-04-29 16:51:55", "update_id": 713155, "user_id": 302, "id": 4066032, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "adamwill", "email": "awilliam@redhat.com", "id": 302, "avatar": "https://seccdn.libravatar.org/avatar/51720fbb2ec5dfd2bc005ac374a3bfd3190cb8f45f3bb8d6bdf35fb6a051d03b?s=24&d=retro", "openid": "adamwill.id.fedoraproject.org", "groups": [{"name": "proventesters"}, {"name": "provenpackager"}, {"name": "packager"}, {"name": "qa-tools-sig"}, {"name": "fedora-contributor"}, {"name": "news"}, {"name": "gittriage"}, {"name": "sysadmin"}, {"name": "gitspin-kickstarts"}, {"name": "signed_fpca"}, {"name": "gitgeneric-release"}, {"name": "yak_farmers"}, {"name": "triagers"}, {"name": "qa"}, {"name": "sysadmin-qa"}, {"name": "fedorabugs"}, {"name": "ipausers"}, {"name": "gitmkinitrd"}, {"name": "qa-admin"}, {"name": "aws-qa"}, {"name": "change-wranglers"}, {"name": "fedora-ci-admins"}, {"name": "common-issues-triage"}, {"name": "sysadmin-main"}, {"name": "program-management"}, {"name": "gitfedora-project-schedule"}]}}, {"karma": 0, "karma_critpath": 0, "text": "> I don't know why we didn't catch this in the pre-testing we did, sorry. \n\nThat's okay. I discuss this with the dnf5 folks and we'll come up with something soon. I do not want to drop this update for now, because the change will be elsewhere, but I can do it if needed.\n\nAlternatively, might gnome-software provide that policy (`wheel` can update without asking) instead of the dnf5 itself? Then one can drop gnome-software to get rid of that policy. I guess a 3rd-party package can add a polkit policy influencing the dnf5daemon-server.", "timestamp": "2025-04-30 06:11:34", "update_id": 713155, "user_id": 577, "id": 4067075, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "mcrha", "email": "mcrha@redhat.com", "id": 577, "avatar": "https://seccdn.libravatar.org/avatar/5a341501adf88ed99b314dbc588622ffbfa08d9c0992f580bb5f6f5f013ae6aa?s=24&d=retro", "openid": "mcrha.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "cla_redhat"}]}}, {"karma": 0, "karma_critpath": 0, "text": "I took the liberty of quickly writing a polkit rule here, and now gnome-software updates without requiring the user to authenticate again, as long as the user is in the \"wheel\" group.\n\n```\ncat << EOF > /etc/polkit-1/rules.d/00-gnome-software.rules\npolkit.addRule(function(action, subject) {\n    if (action.id == \"org.rpm.dnf.v0.rpm.execute_transaction\" &&\n        subject.isInGroup(\"wheel\")) {\n        return polkit.Result.YES;\n    }\n});\nEOF\n```\n", "timestamp": "2025-04-30 15:20:16", "update_id": 713155, "user_id": 7722, "id": 4067478, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "fernando-debian", "email": "fernandodebianbr@gmail.com", "id": 7722, "avatar": "https://seccdn.libravatar.org/avatar/b02a81affc8ba2335678448f502942a566fe36df7e3b7c2781520c9afeb89c2f?s=24&d=retro", "openid": "fernando-debian.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}, {"karma": 0, "karma_critpath": 0, "text": "Thanks for the rule. I'll check with the dnf5 folks. It can have side effects, as this can let the wheel user run any transaction, which may or may not be a problem. I'm not sure whether PackageKit did this too or not for the wheel user, I only believe it's not appreciated by some of the users. I'll let here know when I know more.", "timestamp": "2025-04-30 16:28:42", "update_id": 713155, "user_id": 577, "id": 4067540, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "mcrha", "email": "mcrha@redhat.com", "id": 577, "avatar": "https://seccdn.libravatar.org/avatar/5a341501adf88ed99b314dbc588622ffbfa08d9c0992f580bb5f6f5f013ae6aa?s=24&d=retro", "openid": "mcrha.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "cla_redhat"}]}}, {"karma": 0, "karma_critpath": 0, "text": "Looking at the polkit files on F42, which still uses PackageKit, I found a rule very similar to the one I created hahaha.\n\n```\ncat /usr/share/polkit-1/rules.d/org.freedesktop.packagekit.rules\npolkit.addRule(function(action, subject) {\n    if ((action.id == \"org.freedesktop.packagekit.package-install\" ||\n         action.id == \"org.freedesktop.packagekit.package-remove\") &&\n        subject.active == true && subject.local == true &&\n        subject.isInGroup(\"wheel\")) {\n            return polkit.Result.YES;\n    }\n});\n```", "timestamp": "2025-05-01 12:24:18", "update_id": 713155, "user_id": 7722, "id": 4068559, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "fernando-debian", "email": "fernandodebianbr@gmail.com", "id": 7722, "avatar": "https://seccdn.libravatar.org/avatar/b02a81affc8ba2335678448f502942a566fe36df7e3b7c2781520c9afeb89c2f?s=24&d=retro", "openid": "fernando-debian.id.fedoraproject.org", "groups": [{"name": "ipausers"}]}}], "builds": [{"nvr": "gnome-software-48.1-2.fc43", "signed": true, "release_id": 88, "type": "rpm", "epoch": 0}], "bugs": [], "updateid": "FEDORA-2025-4a9607a2d0", "karma": -1, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}