{"action":"created","issue":{"url":"https://api.github.com/repos/lkardos/test/issues/249","labels_url":"https://api.github.com/repos/lkardos/test/issues/249/labels{/name}","comments_url":"https://api.github.com/repos/lkardos/test/issues/249/comments","events_url":"https://api.github.com/repos/lkardos/test/issues/249/events","html_url":"https://github.com/lkardos/test/issues/249","id":71643554,"number":249,"title":"Verify shows change when duplicate UID used","user":{"login":"lkardos","id":7781878,"avatar_url":"https://avatars.githubusercontent.com/u/7781878?v=3","gravatar_id":"","url":"https://api.github.com/users/lkardos","html_url":"https://github.com/lkardos","followers_url":"https://api.github.com/users/lkardos/followers","following_url":"https://api.github.com/users/lkardos/following{/other_user}","gists_url":"https://api.github.com/users/lkardos/gists{/gist_id}","starred_url":"https://api.github.com/users/lkardos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lkardos/subscriptions","organizations_url":"https://api.github.com/users/lkardos/orgs","repos_url":"https://api.github.com/users/lkardos/repos","events_url":"https://api.github.com/users/lkardos/events{/privacy}","received_events_url":"https://api.github.com/users/lkardos/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"lkardos","id":7781878,"avatar_url":"https://avatars.githubusercontent.com/u/7781878?v=3","gravatar_id":"","url":"https://api.github.com/users/lkardos","html_url":"https://github.com/lkardos","followers_url":"https://api.github.com/users/lkardos/followers","following_url":"https://api.github.com/users/lkardos/following{/other_user}","gists_url":"https://api.github.com/users/lkardos/gists{/gist_id}","starred_url":"https://api.github.com/users/lkardos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lkardos/subscriptions","organizations_url":"https://api.github.com/users/lkardos/orgs","repos_url":"https://api.github.com/users/lkardos/repos","events_url":"https://api.github.com/users/lkardos/events{/privacy}","received_events_url":"https://api.github.com/users/lkardos/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/lkardos/test/milestones/3","html_url":"https://github.com/lkardos/test/milestones/rpm-4.12.0","labels_url":"https://api.github.com/repos/lkardos/test/milestones/3/labels","id":1087475,"number":3,"title":"rpm-4.12.0","description":null,"creator":{"login":"lkardos","id":7781878,"avatar_url":"https://avatars.githubusercontent.com/u/7781878?v=3","gravatar_id":"","url":"https://api.github.com/users/lkardos","html_url":"https://github.com/lkardos","followers_url":"https://api.github.com/users/lkardos/followers","following_url":"https://api.github.com/users/lkardos/following{/other_user}","gists_url":"https://api.github.com/users/lkardos/gists{/gist_id}","starred_url":"https://api.github.com/users/lkardos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lkardos/subscriptions","organizations_url":"https://api.github.com/users/lkardos/orgs","repos_url":"https://api.github.com/users/lkardos/repos","events_url":"https://api.github.com/users/lkardos/events{/privacy}","received_events_url":"https://api.github.com/users/lkardos/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":5,"state":"open","created_at":"2015-04-28T13:37:54Z","updated_at":"2015-04-28T16:51:25Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2015-04-28T16:50:11Z","updated_at":"2015-04-28T16:51:25Z","closed_at":"2015-04-28T16:51:25Z","body":"On a system where:   * Two different usernames 'aaa' and 'bbb' are associated with the same UID 1234   * A package is installed with a file 'foo' owned by user 'aaa' in the package manifest    Then rpm -V will (sometimes?) incorrectly report a changed user for 'foo' from 'aaa' to 'bbb'.    As we all know_ file ownership in Linux is by UID_ not username_ so rpm is doing a reverse lookup from UID to username (probably using getpwnam(3)) and (perhaps by chance) getting the wrong answer ('bbb' instead of 'aaa') and then reporting this as a change_ when in fact there is no change.    The rpm verify algorithm for user (and similarly group) ownership should instead be:     1. Determine the UID associated with the installed file   2. Lookup the username corresponding to that UID (using getpwuid(3) etc)   3. Compare that with the username in the package manifest    "},"comment":{"url":"https://api.github.com/repos/lkardos/test/issues/comments/97135292","html_url":"https://github.com/lkardos/test/issues/249#issuecomment-97135292","issue_url":"https://api.github.com/repos/lkardos/test/issues/249","id":97135292,"user":{"login":"lkardos","id":7781878,"avatar_url":"https://avatars.githubusercontent.com/u/7781878?v=3","gravatar_id":"","url":"https://api.github.com/users/lkardos","html_url":"https://github.com/lkardos","followers_url":"https://api.github.com/users/lkardos/followers","following_url":"https://api.github.com/users/lkardos/following{/other_user}","gists_url":"https://api.github.com/users/lkardos/gists{/gist_id}","starred_url":"https://api.github.com/users/lkardos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lkardos/subscriptions","organizations_url":"https://api.github.com/users/lkardos/orgs","repos_url":"https://api.github.com/users/lkardos/repos","events_url":"https://api.github.com/users/lkardos/events{/privacy}","received_events_url":"https://api.github.com/users/lkardos/received_events","type":"User","site_admin":false},"created_at":"2015-04-28T16:51:24Z","updated_at":"2015-04-28T16:51:24Z","body":"_Trac comment by archie on 2014-06-06 16:02:43:_\n\nThanks.    Just to correct the record_ the original description of what the algorithm \"should be\" was wrong. It should have stated:     1. Determine the UID of the installed file   2. Determine the UID of the username that is supposed to own the file   3. Compare steps 1 and 2 for equality    "}}