release mock 6.8 and mock-core-configs 45.1

Assisted-By: Claude (anthropic.com)

Author: praiskup

.tito/packages/mock

@@ -1 +1 @@
-6.7-1 mock/
+6.8-1 mock/

.tito/packages/mock-core-configs

@@ -1 +1 @@
-44.4-1 mock-core-configs/
+45.1-1 mock-core-configs/

docs/Release-Notes-6.8.md

@@ -0,0 +1,188 @@
+---
+layout: default
+title: Release Notes - Mock 6.8
+---
+
+## [Release 6.8](https://rpm-software-management.github.io/mock/Release-Notes-6.8) - 2026-08-11
+
+
+### Breaking changes
+
+- The `%{pkgid}` field has been removed from the `package_state` plugin output
+  in both `available_pkgs.log` and `installed_pkgs.log`.
+
+### New features
+
+- New `separate_check` config option to run `%check` as a separate rpmbuild
+  phase (`-bk --short-circuit`).  This prevents `%check` scripts from modifying
+  already built RPM artifacts.  Supported values: `off` (default),
+  `best_effort`, and `enforce`.
+
+- New `system_monitor` plugin for collecting various statistics during the build
+  phase.
+
+- Build-time opt-in: Polkit support files can be included and installed with
+  Mock when built `--with=polkit`.
+
+- Bash completion for `--localrepo` now offers directory completions.
+
+- For AlmaLinux targets, Podman container image pulls now pass `--platform`
+  for x86_64 sub-architecture variants (x86_64_v2, x86_64_v3, x86_64_v4).
+  This is a temporary workaround for Podman not being able to auto-detect
+  sub-architecture variants in OCI images.  The `oci_platform_map` config
+  option is set unconditionally in the AlmaLinux templates; this means
+  that e.g. a v2 bootstrap image is unintuitively pulled even on a v4 host
+  when the target architecture is x86_64_v2 (normally bootstrap should be
+  host-native).
+
+- New `pivot_root_chroot` configuration option uses `pivot_root(2)` inside a
+  private mount namespace to atomically swap the mount-namespace root to the
+  chroot path.  This satisfies the kernel check that blocks
+  `unshare(CLONE_NEWUSER)` after plain `chroot()`, allowing tools like
+  pasta/passt that require user namespaces to work inside Mock buildroots.
+  This is the same approach used by bubblewrap and other container runtimes.
+  Requires `CAP_SYS_ADMIN` (available in `--privileged` containers); falls back
+  to plain `chroot()` on failure.
+  Set `config_opts['pivot_root_chroot'] = True` to enable.
+
+- On newer build hosts (Fedora 44+ and EL 11+), Mock uses the
+  [`useradd --root` option][issue#1285] instead of `--prefix` to better isolate
+  it from the host system.  Specifically, this correctly resolves
+  [subuid/subgid issues][issue#1354] (previously, we had to work around this
+  problem by using in-chroot shadow-utils).
+
+- The `unbreq` plugin now detects if a `BuildRequires` field is not installed on
+  the system and in that case does not report it as unused.  This can happen if
+  the `BuildRequires` field is a more complex logic formula (e.g. `(foo if bar)`
+  and `bar` is not installed on the system).  This scenario is no longer reported
+  as a warning but as info.
+
+- System architecture detection now prefers `python3-libdnf5` over the
+  deprecated `python3-dnf`.  If `python3-libdnf5` is not available, Mock falls
+  back to `python3-dnf`, preserving functionality on both modern and older
+  systems.
+
+### Bugfixes
+
+- Fix bash completion `--chain` handling — it is an option with no argument, not
+  a synonym for `--root` ([issue#1729][]).
+
+- The `buildroot_lock` plugin no longer crashes when the bootstrap image is
+  unavailable.  The lockfile is now only populated with bootstrap metadata when
+  `use_bootstrap_image` is enabled.  Also, `--calculate-build-dependencies` no
+  longer overrides an explicit `--disable-plugin buildroot_lock`
+  ([issue#1758][]).
+
+- Mock now decodes percent-escaped local `file://` repository paths before
+  checking them for bootstrap bind mounts.  This fixes bootstrap package-manager
+  access to host-local repositories whose paths contain characters such as `@`
+  and therefore appear escaped in file URIs ([PR#1728][]).
+
+- The existence of `repoquery` is now tested in the bootstrap image instead of
+  on the host.
+
+- The `--allowerasing` argument is no longer passed to the dnf5 `download`
+  command, which does not accept it.  This invalid argument is now excluded
+  when invoking dnf `download` operations using `--dnf-cmd` or `--pm-cmd`.
+
+- Fix the `package_state` plugin so `available_pkgs.log` is generated when
+  `package_manager` is set to `dnf5` or `dnf4`, not only `dnf` or `microdnf`
+  ([#1190][]).
+
+- Podman image pull now has a per-attempt timeout (configurable via
+  `bootstrap_image_pull_timeout` and `buildroot_image_pull_timeout`, default
+  120 seconds) to prevent indefinite hangs and allow the retry logic to work.
+
+- Mock now preserves the timestamp of `dnf.conf` and `yum.conf` inside the
+  chroot when their content has not changed.  Previously, every Mock invocation
+  rewrote these files unconditionally, which — combined with DNF's default
+  `check_config_file_age=True` — caused repository metadata to be re-downloaded
+  even when it was still valid ([issue#216][]).
+
+- The `uidManager` is now reloaded with `chrootuid`/`chrootgid` from
+  config after the configuration is loaded.  Previously, privilege
+  dropping always used the calling user's identity, ignoring the
+  configured chroot user ([#1731][]).
+
+- Consolidate NS resolver munging logic, which was previously scattered across
+  multiple locations.  This duplication made the logic difficult to follow and
+  led to bugs, such as the one addressed in [PR#1697][].
+
+- The `--spec` option now works with spec files that have restrictive
+  permissions (e.g. `0600`).  Previously, `shutil.copy2()` preserved the
+  source permissions inside the chroot, making the file unreadable by the
+  `mockbuild` user ([#1300][]).
+
+- The `unbreq` plugin no longer caches the mapping of a source RPM file to its
+  `BuildRequires` fields, fixing a logic error where it would ignore later
+  automatically generated `BuildRequires` fields when `BuildRequires`
+  autogeneration is used.  Source RPMs are now scanned after each installation
+  of `BuildRequires` fields.
+
+- The `--verbose` option no longer duplicates the build log output into the root
+  log.
+
+- Mock defaults were changed to not pass `--allowerasing` option to the
+  `dnf5 list` command.
+
+- The `mock-hermetic-repo` tool now retries HTTP 503 (Service Unavailable)
+  responses with exponential backoff, matching the existing retry handling for
+  other transient HTTP errors.  Previously, a single 503 from an upstream
+  repository (e.g. S3 throttling) would cause the entire RPM download to fail
+  ([PR#1769][]).
+
+### Mock Core Configs changes
+
+- Add the Extensions repo to the Fedora ELN config (disabled by default).
+
+- Use `cdn.opensuse.org` for baseurl repositories, matching the real
+  distribution.
+
+- Branch Fedora 45 configuration files from Rawhide, per the
+  [Fedora 45 Schedule](https://fedorapeople.org/groups/schedule/f-45/f-45-all-tasks.html).
+
+- Add configuration for Fedora 45 RISC-V.
+
+- Add Mageia 10 (stable) and Mageia 11 (development) configs.  Move Mageia 8
+  configs to EOL.
+
+- Update openEuler 24.03 LTS chroot to SP4 and fix the source and
+  update-source metalink repositories across all openEuler templates
+  (20.03, 22.03, 24.03): the `path=` metalink form does not translate the
+  `$releasever` dnf variable into the full mirror directory name, so it
+  resolved to a non-existent path and silently broke `mock --sources`.
+
+### Contributors
+
+Following contributors contributed to this release:
+
+ * Andrea Bolognani
+ * Andrew Lukoshko
+ * Chris Adams
+ * Jani Välimaa
+ * lichaoran
+ * Lukáš Lipinský
+ * Marian Koncek
+ * Miroslav Suchý
+ * Pavel Raiskup
+ * Rahman Ajibade
+ * Scott Hebert
+ * Scott K Logan
+ * Simone Caronni
+ * Tomas Kopecek
+ * Yaakov Selkowitz
+ * Yanko Kaneti
+
+Thank you!
+
+[#1190]: https://github.com/rpm-software-management/mock/issues/1190
+[#1300]: https://github.com/rpm-software-management/mock/issues/1300
+[#1731]: https://github.com/rpm-software-management/mock/issues/1731
+[issue#216]: https://github.com/rpm-software-management/mock/issues/216
+[issue#1285]: https://github.com/rpm-software-management/mock/issues/1285
+[issue#1354]: https://github.com/rpm-software-management/mock/issues/1354
+[issue#1729]: https://github.com/rpm-software-management/mock/issues/1729
+[issue#1758]: https://github.com/rpm-software-management/mock/issues/1758
+[PR#1697]: https://github.com/rpm-software-management/mock/pull/1697
+[PR#1728]: https://github.com/rpm-software-management/mock/pull/1728
+[PR#1769]: https://github.com/rpm-software-management/mock/pull/1769

docs/index.md

@@ -70,6 +70,7 @@ Versions in Linux distributions:
 
 
 ## Release Notes
+* [6.8 and Configs 45.1](Release-Notes-6.8) (2026-08-11) - System monitor plugin, polkit support, pivot_root_chroot, separate %check phase, bugfixes.
 * [Configs 44.4](Release-Notes-Configs-44.4) (2026-06-24) - Fedora Rawhide RISC-V, Azure Linux 4.0 beta
 * [Configs 44.3](Release-Notes-Configs-44.3) (2026-06-10) - AlmaLinux bootstrap_image_ready, ELN package rename, AlmaLinux x86_64_v2 bootstrap re-enabled, RISC-V 64-bit for Fedora 44.
 * [6.7 and Configs 44.2](Release-Notes-6.7) (2026-03-02) - New plugin `expand_spec`, yum support for `--calculate-dependencies`, bugfixes.

mock-core-configs/mock-core-configs.spec

@@ -3,7 +3,7 @@
 %endif
 
 Name:       mock-core-configs
-Version:    45.0
+Version:    45.1
 Release:    1%{?dist}
 Summary:    Mock core config files basic chroots
 
@@ -24,7 +24,7 @@ Provides: mock-configs
 # distribution-gpg-keys contains GPG keys used by mock configs
 Requires:   distribution-gpg-keys >= 1.121
 # specify minimal compatible version of mock
-Requires:   mock >= 6.1.test
+Requires:   mock >= 6.8
 Requires:   mock-filesystem
 
 Requires(post): coreutils
@@ -156,6 +156,15 @@ fi
 %ghost %config(noreplace,missingok) %{_sysconfdir}/mock/default.cfg
 
 %changelog
+* Tue Aug 11 2026 Pavel Raiskup <pavel@raiskup.cz> 45.1-1
+- branch Fedora 45 from Rawhide
+- Document oci_platform_map as a temporary workaround
+- update openEuler 24.03 LTS chroot to SP4 and fix source metalink (pkwarcraft@gmail.com)
+- add Extensions repos to ELN (yselkowi@redhat.com)
+- Add missing fedora-45-riscv64.cfg (abologna@redhat.com)
+- Use cdn.opensuse.org for openSUSE baseurls. (negativo17@gmail.com)
+- update Mageia configs (wally@mageia.org)
+
 * Wed Jun 24 2026 Pavel Raiskup <pavel@raiskup.cz> 44.4-1
 - Fixes #1761: Add Fedora Rawhide RISC-V (jmontleo@redhat.com)
 - configs: add Azure Linux 4.0 beta configuration (tobiasb@microsoft.com)

mock/mock.spec

@@ -19,7 +19,7 @@
 
 Summary: Builds packages inside chroots
 Name: mock
-Version: 6.7
+Version: 6.8
 Release: 1%{?dist}
 License: GPL-2.0-or-later
 # Source is created by
@@ -47,7 +47,7 @@ Requires: polkit
 
 # We know that the current version of mock isn't compatible with older variants,
 # and we want to enforce automatic upgrades.
-Conflicts: mock-core-configs < 33
+Conflicts: mock-core-configs < 45.1
 
 # Requires 'mock-core-configs', or replacement (GitHub PR#544).
 Requires: mock-configs
@@ -363,6 +363,37 @@ pylint-3 py/mockbuild/ py/*.py py/mockbuild/plugins/* || :
 
 
 %changelog
+* Tue Aug 11 2026 Pavel Raiskup <pavel@raiskup.cz> 6.8-1
+- bump Conflicts to mock-core-configs < 45.1
+- Document oci_platform_map as a temporary workaround
+- Allow --disable-plugin buildroot_lock with --calculate-build-dependencies
+- buildroot_lock: don't inspect bootstrap image when not used
+- No --allowerasing for `dnf5 list`
+- Include support for polkit (rajibade@amazon.com)
+- Add support for isolated %%check phase
+- Add pivot_root_chroot option to enable user namespaces (tkopecek@redhat.com)
+- fix: add HTTP 503 to retry status_forcelist in mock-hermetic-repo (scoheb@gmail.com)
+- unbreq plugin: disable SRPM caching (marian.koncek@mailbox.org)
+- unbreq plugin: do not treat not installed packages as unused (marian.koncek@mailbox.org)
+- Add system monitor plugin  (#1748) (yaneti@declera.com)
+- fix: reload uidManager with chrootuid/chrootgid from config
+- Don't use --allowerasing with 'dnf download' (logans@cottsay.net)
+- fix: add newline at the end of each line of available_pkgs.log (msuchy@redhat.com)
+- feat: remove pkgid from package_state plugin output (msuchy@redhat.com)
+- add rpm as deps to tox tests (msuchy@redhat.com)
+- fix: preserve readable permissions when copying spec files into chroot (#1300) (msuchy@redhat.com)
+- fix: add timeout to podman pull to prevent indefinite hangs (#1680) (msuchy@redhat.com)
+- bash-completion: localrepo takes a directory arg (linux@cmadams.net)
+- bash-completion: chain doesn't take an config arg (linux@cmadams.net)
+- fix: --verbose no longer duplicates build log into root log (#1302) (msuchy@redhat.com)
+- shadow_utils: useradd --root for newer systems (praiskup@redhat.com)
+- generate available_pkgs.log for dnf5/dnf4 package managers (msuchy@redhat.com)
+- fix: preserve dnf.conf/yum.conf timestamps when content is unchanged (msuchy@redhat.com)
+- feat: add OCI platform support for x86_64 sub-architecture containers (andrew.lukoshko@gmail.com)
+- Decode file:// repo paths before bootstrap bind mount (lukas.lipinsky@oracle.com)
+- Fix the tool check (tkopecek@redhat.com)
+- Refactor NS resolver logic for clarity and consistency
+
 * Tue Mar 03 2026 Pavel Raiskup <pavel@raiskup.cz> 6.7-1
 - mock: Use umask 0022 instead of 0002 to avoid strange permissions (ngompa@velocitylimitless.com)
 - expand_spec plugin: generating expanded-spec.txt in postdeps hook (yzhu@redhat.com)