Merge pull request #1 from law/rpm:rosa2014.1

Fix addsign check to skip PUBKEYS addition

rpm-5.4.10-fix-addsign-check.patch

@@ -0,0 +1,20 @@
+diff -ur rpm-5.4.10/build/pack.c rpm-5.4.10.new/build/pack.c
+--- rpm-5.4.10/build/pack.c	2012-05-20 00:24:58.000000000 +0400
++++ rpm-5.4.10.new/build/pack.c	2015-04-07 17:54:36.410943594 +0300
+@@ -649,7 +649,7 @@
+     char buf[BUFSIZ];
+     Header h;
+     Header sigh = NULL;
+-    int addsig = 0;
++    int addsig = (passPhrase && passPhrase[0]);
+     int isSource;
+     rpmRC rc = RPMRC_OK;
+     size_t nbr;
+@@ -859,7 +859,6 @@
+     (void) rpmAddSignature(sigh, sigtarget, RPMSIGTAG_MD5, passPhrase);
+ 
+     sigtag = RPMSIGTAG_GPG;
+-    addsig = (passPhrase && passPhrase[0]);
+ 
+     if (addsig) {
+ 	rpmlog(RPMLOG_NOTICE, _("Generating signature: %d\n"), sigtag);

rpm.spec

@@ -61,7 +61,7 @@ Summary:	The RPM package management system
 Name:		rpm
 Epoch:		1
 Version:	%{libver}.%{minorver}
-Release:	%{?prereldate:0.%{prereldate}.}56
+Release:	%{?prereldate:0.%{prereldate}.}57
 License:	LGPLv2.1+
 Group:		System/Configuration/Packaging
 Url:		http://rpm5.org/
@@ -492,6 +492,9 @@ Patch513:	rpm-5.4.10-payload-no-hashed-inode.patch
 # KDE5 support in find_lang
 Patch514:	rpm-5.4.10-find-lang-kde5.patch
 
+# Fix addsign check to skip PUBKEYS addition (to ensure reproducibility)
+Patch515:	rpm-5.4.10-fix-addsign-check.patch
+
 BuildRequires:	autoconf >= 2.57
 BuildRequires:	bzip2-devel
 BuildRequires:	automake >= 1.8
@@ -904,6 +907,7 @@ This package contains the RPM API documentation generated in HTML format.
 %patch512 -p1 -b .hardlink-segfault-fix
 %patch513 -p1 -b .payload-no-hashed-inode
 %patch514 -p1 -b .kde5-find-lang
+%patch515 -p1 -b .fix-addsign-check
 
 #required by P55, P80, P81, P94..
 ./autogen.sh