[rpms/haveged] f44: Fix rpminspect.yaml: annocheck cannot be disabled as it is a security inspection

[rpms/haveged] f44: Fix rpminspect.yaml: annocheck cannot be disabled as it is a security inspection

[Jirka Hladky]

            A new commit has been pushed.

            Repo   : rpms/haveged
            Branch : f44
            Commit : c2b1a867ed6596b9b871ac7ae86636b1e99deb61
            Author : Jirka Hladky <jhladky@redhat.com>
            Date   : 2026-06-19T05:05:52+02:00
            Stats  : +13/-5 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/haveged/c/c2b1a867ed6596b9b871ac7ae86636b1e99deb61?branch=f44

            Log:
            Fix rpminspect.yaml: annocheck cannot be disabled as it is a security inspection

Use annocheck failure_severity: INFO instead of inspections: annocheck: off.
rpminspect silently ignores the inspections toggle for security inspections.

---
diff --git a/haveged.spec b/haveged.spec
index 6e4d7d9..a68383e 100644
--- a/haveged.spec
+++ b/haveged.spec
@@ -2,7 +2,7 @@
 Summary:        A Linux entropy source using the HAVEGE algorithm
 Name:           haveged
 Version:        1.9.23
-Release:        3%{?dist}
+Release:        4%{?dist}
 # Automatically converted from old format: GPLv3+ - review is highly recommended.
 License:        GPL-3.0-or-later
 URL:            https://github.com/jirka-h/haveged
@@ -119,6 +119,10 @@ fi
 
 
 %changelog
+* Thu Jun 19 2026 Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-4
+- Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
+  (annocheck is a security inspection and cannot be disabled via inspections section)
+
 * Thu Jun 19 2026 Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-3
 - Add SELinux policy module to allow semaphore creation in /dev/shm
 

diff --git a/rpminspect.yaml b/rpminspect.yaml
index 5a2de30..bfaf54c 100644
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -1,7 +1,11 @@
 ---
 # The cpuid inline assembly in libhavege.so triggers an annocheck
 # "optimization level too low" false positive that has been present
-# since the library was first packaged.  Waive the entire annocheck
-# inspection until upstream removes the bundled cpuid header.
-inspections:
-    annocheck: off
+# since the library was first packaged.
+#
+# annocheck is a security inspection and cannot be disabled via
+# "inspections: annocheck: off" — rpminspect silently ignores that.
+# Instead, lower the failure severity so findings are reported but
+# do not cause a non-zero exit.
+annocheck:
+    failure_severity: INFO