From 7a80a6ceb80bd1066e69bd83f0ba8f8a8f412f82 Mon Sep 17 00:00:00 2001
From: Vladimir Dubrovin <3proxy@3proxy.ru>
Date: Sat, 22 Aug 2026 12:09:25 +0300
Subject: [PATCH] Fix rpm signing: hand the built packages back to the runner
 user

The rpm build runs in a container as root, so the packages arrived in the
workspace owned by root. Renaming them still worked, since that only needs
write permission on the directory, but rpm --addsign rewrites the file in
place and failed:

    error: 3proxy-0.9.9.0.el9.x86_64.rpm: open failed: Permission denied

Restore the invoking user's ownership before leaving the container, falling
back to a mode change where the container cannot chown, as under a rootless
container runtime.
---
 .github/workflows/build-rpm-arm64.yml  | 5 +++--
 .github/workflows/build-rpm-x86-64.yml | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-rpm-arm64.yml b/.github/workflows/build-rpm-arm64.yml
index 80e0023..faa1770 100644
--- a/.github/workflows/build-rpm-arm64.yml
+++ b/.github/workflows/build-rpm-arm64.yml
@@ -49,7 +49,7 @@ jobs:
            -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \
            -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \
            -v "$PWD/rpmout:/out" \
-           -e RELEASE="$RELEASE" \
+           -e RELEASE="$RELEASE" -e HOSTUID="$(id -u)" -e HOSTGID="$(id -g)" \
            "almalinux:$EL" bash -c '
              set -e
              dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip
@@ -59,7 +59,8 @@ jobs:
              cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
              cd ~/rpmbuild/SPECS
              rpmbuild -ba 3proxy-$RELEASE.spec
-             cp ~/rpmbuild/RPMS/*/*.rpm /out/'
+             cp ~/rpmbuild/RPMS/*/*.rpm /out/
+             chown "$HOSTUID:$HOSTGID" /out/*.rpm || chmod 0666 /out/*.rpm'
        done
        for f in rpmout/*.rpm; do
          dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//')
diff --git a/.github/workflows/build-rpm-x86-64.yml b/.github/workflows/build-rpm-x86-64.yml
index 38a3d21..fd855e1 100644
--- a/.github/workflows/build-rpm-x86-64.yml
+++ b/.github/workflows/build-rpm-x86-64.yml
@@ -49,7 +49,7 @@ jobs:
            -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \
            -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \
            -v "$PWD/rpmout:/out" \
-           -e RELEASE="$RELEASE" \
+           -e RELEASE="$RELEASE" -e HOSTUID="$(id -u)" -e HOSTGID="$(id -g)" \
            "almalinux:$EL" bash -c '
              set -e
              dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip
@@ -59,7 +59,8 @@ jobs:
              cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
              cd ~/rpmbuild/SPECS
              rpmbuild -ba 3proxy-$RELEASE.spec
-             cp ~/rpmbuild/RPMS/*/*.rpm /out/'
+             cp ~/rpmbuild/RPMS/*/*.rpm /out/
+             chown "$HOSTUID:$HOSTGID" /out/*.rpm || chmod 0666 /out/*.rpm'
        done
        for f in rpmout/*.rpm; do
          dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//')