standard_build_layout.patch

--- cli/Makefile	2025-10-14 11:32:51.152782132 -0700
+++ debian/Makefile	2025-10-10 18:28:49.581238914 -0700
@@ -1,195 +1,163 @@
-SHELL := /bin/bash
-GORELEASER_VERSION := v1.21.2
+SHELL=/bin/bash
 
-# Compile natively based on the current system
-.PHONY: build
-build:
-ifneq "" "$(findstring NT,$(shell uname))" # windows
-	CC=gcc CXX=g++ $(MAKE) cli-builder
-else ifneq (,$(findstring Linux,$(shell uname)))
-    # Warning: make won't treat nested ifs as makefile directives if you use tabs instead of spaces
-    ifneq (,$(findstring musl,$(shell ldd --version))) # linux (musl)
-		CC=gcc CXX=g++ TAGS=musl $(MAKE) cli-builder
-    else # linux (glibc)
-		CC=gcc CXX=g++ $(MAKE) cli-builder
-    endif
-else # darwin
-	$(MAKE) cli-builder
-endif
-
-# Cross-compile from darwin to any of the OS/Arch pairs below
-.PHONY: cross-build
-cross-build:
-ifeq ($(GOARCH),arm64)
-    ifeq ($(GOOS),linux) # linux/arm64
-		CC=aarch64-linux-musl-gcc CXX=aarch64-linux-musl-g++ CGO_LDFLAGS="-static" TAGS=musl $(MAKE) cli-builder
-    else # darwin/arm64
-		$(MAKE) cli-builder
-    endif
-else
-    ifeq ($(GOOS),windows) # windows/amd64
-		CC=x86_64-w64-mingw32-gcc CXX=x86_64-w64-mingw32-g++ CGO_LDFLAGS="-fstack-protector -static" $(MAKE) cli-builder
-    else ifeq ($(GOOS),linux) # linux/amd64
-		CC=x86_64-linux-musl-gcc CXX=x86_64-linux-musl-g++ CGO_LDFLAGS="-static" TAGS=musl $(MAKE) cli-builder
-    else # darwin/amd64
-		$(MAKE) cli-builder
-    endif
-endif
-
-.PHONY: cli-builder
-cli-builder:
-	GOOS="" GOARCH="" CC="" CXX="" CGO_LDFLAGS="" go install github.com/goreleaser/goreleaser@$(GORELEASER_VERSION)
-
-ifeq ($(GOLANG_FIPS),1)
-	wget "https://go.dev/dl/go$$(cat .go-version).src.tar.gz" && \
-	tar -xf go$$(cat .go-version).src.tar.gz && \
-	git clone --branch go$$(cat .go-version)-1-openssl-fips --depth 1 https://github.com/golang-fips/go.git go-openssl && \
-	cd go/ && \
-	cat ../go-openssl/patches/*.patch | patch -p1 && \
-	sed -i '' 's/linux/darwin/' src/crypto/internal/backend/nobackend.go && \
-	sed -i '' 's/linux/darwin/' src/crypto/internal/backend/openssl.go && \
-	sed -i '' 's/"libcrypto.so.%s"/"libcrypto.%s.dylib"/' src/crypto/internal/backend/openssl.go && \
-	cd src/ && \
-	./make.bash && \
-	cd ../../
-	PATH=$$(pwd)/go/bin:$$PATH GOROOT=$$(pwd)/go TAGS=$(TAGS) CC=$(CC) CXX=$(CXX) CGO_LDFLAGS=$(CGO_LDFLAGS) goreleaser build --clean --single-target --snapshot
-	rm -rf go go-openssl go$$(cat .go-version).src.tar.gz
-else
-	TAGS=$(TAGS) CC=$(CC) CXX=$(CXX) CGO_LDFLAGS=$(CGO_LDFLAGS) goreleaser build --clean --single-target --snapshot
+ifndef VERSION
+	VERSION=$(CLI_VERSION)
 endif
 
+export PACKAGE_TITLE=cli
+export FULL_PACKAGE_TITLE=confluent-$(PACKAGE_TITLE)
+export PACKAGE_NAME=$(FULL_PACKAGE_TITLE)-$(VERSION)
+
+# Defaults that are likely to vary by platform. These are cleanly separated so
+# it should be easy to maintain altered values on platform-specific branches
+# when the values aren't overridden by the script invoking the Makefile
+
+APPLY_PATCHES?=yes
+
+# DESTDIR may be overridden by e.g. debian packaging
+ifeq ($(DESTDIR),)
+DESTDIR=$(CURDIR)/BUILD/
+endif
+
+ifeq ($(PACKAGE_TYPE),archive)
+PREFIX=$(PACKAGE_NAME)
+SYSCONFDIR=$(PREFIX)/etc/$(PACKAGE_TITLE)
+else
+PREFIX=/usr
+SYSCONFDIR=/etc/$(PACKAGE_TITLE)
+endif
+
+_empty :=
+_space := $(_empty) $(empty)
+split_version := $(subst .,$(_space),$(CLI_VERSION))
+
+all: install
+
+archive: install
+	rm -f $(CURDIR)/$(PACKAGE_NAME).tar.gz && cd $(DESTDIR) && tar -czf $(CURDIR)/$(PACKAGE_NAME).tar.gz $(PREFIX)
+	rm -f $(CURDIR)/$(PACKAGE_NAME).zip && cd $(DESTDIR) && zip -r $(CURDIR)/$(PACKAGE_NAME).zip $(PREFIX)
+
+apply-patches: $(wildcard debian/patches/*)
+ifeq ($(APPLY_PATCHES),yes)
+	git reset --hard HEAD
+	cat debian/patches/series | xargs -iPATCH bash -c 'patch -p1 < debian/patches/PATCH'
+endif
+
+BINPATH=$(PREFIX)/bin
+LIBPATH=$(PREFIX)/libexec/$(PACKAGE_TITLE)
+DOCPATH=$(PREFIX)/share/doc/$(PACKAGE_TITLE)
+
+# Notes on the archive download links:
+# As of v3.0.0, the version number no longer has the 'v' prefix
+# As of v3.43.0, we download the '_disableupdates' variant
+# As of v4.1.0, the base URL is 'packages.confluent.io' and there is no version in the archive/binary name
+install: apply-patches
+	rm -rf $(DESTDIR)$(PREFIX)
+	mkdir -p $(DESTDIR)$(PREFIX)
+
+	mkdir -p $(DESTDIR)$(BINPATH)
+	mkdir -p $(DESTDIR)$(LIBPATH)
+	mkdir -p $(DESTDIR)$(DOCPATH)
+	mkdir -p $(DESTDIR)$(SYSCONFDIR)
+
+	cp packaging/confluent.sh $(DESTDIR)$(BINPATH)/confluent
+	chmod 755 $(DESTDIR)$(BINPATH)/confluent
+
+	cd $(DESTDIR)$(LIBPATH); \
+	v=""; if [[ $(word 1,$(split_version)) -eq 2 ]]; then v="v"; fi; \
+	disableupdates=""; if [[ $(word 1,$(split_version)) -ge 3 && $(word 2,$(split_version)) -ge 43 ]]; then disableupdates="_disableupdates"; fi; \
+	baseurl="s3-us-west-2.amazonaws.com/confluent.cloud"; if [[ $(word 1,$(split_version)) -ge 4 && $(word 2,$(split_version)) -ge 1 ]]; then baseurl="packages.confluent.io"; fi; \
+	version="_$${v}$(CLI_VERSION)"; if [[ $(word 1,$(split_version)) -ge 4 && $(word 2,$(split_version)) -ge 1 ]]; then version=""; fi; \
+	for dir in darwin_amd64 darwin_arm64 linux_amd64 linux_arm64; do \
+		archive=confluent$${version}_$${dir}$${disableupdates}.tar.gz; \
+		curl -fs https://$${baseurl}/confluent-cli/archives/$(CLI_VERSION)/$${archive} -o $${archive}; \
+		mkdir -p $${dir} $${dir}-temp; \
+		tar -xzf $${archive} -C $${dir}-temp confluent/confluent; \
+		mv $${dir}-temp/confluent/confluent $${dir}/confluent; \
+		rm -rf $${archive} $${dir}-temp; \
+		chmod 755 $${dir}/confluent; \
+	done; \
+	mkdir -p windows_amd64; \
+	version="_$(CLI_VERSION)"; if [[ $(word 1,$(split_version)) -ge 4 && $(word 2,$(split_version)) -ge 1 ]]; then version=""; fi; \
+	filepath=windows_amd64/confluent.exe; \
+	curl -fs https://$${baseurl}/confluent-cli/binaries/$(CLI_VERSION)/confluent$${version}_windows_amd64.exe -o $${filepath}; \
+	chmod 755 $${filepath}
+
+	cp LICENSE $(DESTDIR)$(DOCPATH)/LICENSE
+	$(DESTDIR)$(BINPATH)/confluent --version | awk -F' ' '{ print $3 }' > $(DESTDIR)$(DOCPATH)/version.txt
 
+	chown -R root:root $(DESTDIR)$(PREFIX)
 
-.PHONY: clean
 clean:
-	for dir in bin dist docs legal prebuilt release-notes; do \
-		[ -d $$dir ] && rm -r $$dir || true; \
-	done
-
-.PHONY: lint
-lint: lint-go lint-cli
-
-.PHONY: lint-go
-lint-go:
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 && \
-	golangci-lint run --timeout 10m
-	@echo "✅  golangci-lint"
-
-.PHONY: lint-cli
-lint-cli: cmd/lint/en_US.aff cmd/lint/en_US.dic
-	go run cmd/lint/main.go -aff-file $(word 1,$^) -dic-file $(word 2,$^) $(ARGS)
-	@echo "✅  cmd/lint/main.go"
-
-cmd/lint/en_US.aff:
-	curl -s "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries/+/master/en_US.aff?format=TEXT" | base64 -D > $@
-
-cmd/lint/en_US.dic:
-	curl -s "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries/+/master/en_US.dic?format=TEXT" | base64 -D > $@
-
-.PHONY: unit-test
-unit-test:
-ifdef CI
-	go install gotest.tools/gotestsum@v1.12.1 && \
-	gotestsum --junitfile unit-test-report.xml -- -timeout 0 -v -race -coverprofile=coverage.unit.out -covermode=atomic $$(go list ./... | grep -v github.com/confluentinc/cli/v4/test)
-else
-	go test -timeout 0 -v -coverprofile=coverage.unit.out -covermode=atomic $$(go list ./... | grep -v github.com/confluentinc/cli/v4/test) $(UNIT_TEST_ARGS)
-endif
+	rm -rf $(CURDIR)/$(PACKAGE_NAME)*
+	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)*rpm
+	rm -rf RPM_BUILDING
+
+distclean: clean
+ifneq ($(PACKAGE_TYPE),deb)
+	git reset --hard HEAD
+	git status --ignored --porcelain | cut -d ' ' -f 2 | xargs rm -rf
+endif
+
+RPM_VERSION=$(shell echo $(VERSION) | sed -e 's/-alpha[0-9]*//' -e 's/-beta[0-9]*//' -e 's/-rc[0-9]*//' -e 's/-SNAPSHOT//' -e 's/-cp[0-9]*//' -e 's/-hotfix[0-9]*//' -e 's/-[0-9]*//')
+
+# Get any -alpha, -beta (preview), -rc (release candidate), -SNAPSHOT (nightly), -cp (confluent patch), -hotfix piece that we need to put into the Release part of
+# the version since RPM versions don't support non-numeric
+# characters. Ultimately, for something like 0.8.2-beta, we want to end up with
+# Version=0.8.2 Release=0.X.beta
+# where X is the RPM release # of 0.8.2-beta (the prefix 0. forces this to be
+# considered earlier than any 0.8.2 final releases since those will start with
+# Version=0.8.2 Release=1)
+RPM_RELEASE_POSTFIX=$(subst -,,$(subst $(RPM_VERSION),,$(VERSION)))
+ifneq ($(RPM_RELEASE_POSTFIX),)
+	RPM_RELEASE_POSTFIX_UNDERSCORE=_$(RPM_RELEASE_POSTFIX)
+	RPM_RELEASE_ID=0.$(REVISION).$(RPM_RELEASE_POSTFIX)
+else
+	RPM_RELEASE_ID=$(REVISION)
+endif
+
+rpm: rpm-amd64-build rpm-arm64-build
+
+rpm-amd64-build: rpm-amd64-spec
+	echo "Building the amd64 RPM"
+	rpmbuild --define="_topdir `pwd`/RPM_BUILDING" --nodebuginfo -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz || rpmbuild --define="_topdir `pwd`/RPM_BUILDING" -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz
+
+rpm-arm64-build: rpm-arm64-spec
+	echo "Building the arm64 RPM"
+	rpmbuild --target=aarch64 --define="_topdir `pwd`/RPM_BUILDING" --nodebuginfo -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz || rpmbuild --target=aarch64 --define="_topdir `pwd`/RPM_BUILDING" -tb RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz
+	find RPM_BUILDING/{,S}RPMS/ -type f | xargs -n1 -iXXX mv XXX .
+	echo
+	echo "================================================="
+	echo "The RPMs have been created and can be found here:"
+	@ls -laF $(FULL_PACKAGE_TITLE)*rpm
+	echo "================================================="
+
+# Unfortunately, because of version naming issues and the way rpmbuild expects
+# the paths in the tar file to be named, we need to rearchive the package. So
+# instead of depending on archive, this target just uses the unarchived,
+# installed version to generate a new archive. Note that we always regenerate
+# the symlink because the RPM_VERSION doesn't include all the version info -- it
+# can leave of things like -beta, -rc1, etc.
+rpm-amd64-spec: rpm-build-area install debian/$(FULL_PACKAGE_TITLE).spec.in RELEASE_$(RPM_VERSION)$(RPM_RELEASE_POSTFIX_UNDERSCORE)
+	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	mkdir $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	cp -R $(DESTDIR)/* $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	sed "s/##RPMVERSION##/$(RPM_VERSION)/g; s/##RPMRELEASE##/$(RPM_RELEASE_ID)/g; s/##EXCLUDEARCH##/arm64/g" < debian/$(FULL_PACKAGE_TITLE).spec.in > $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)/$(FULL_PACKAGE_TITLE).spec
+	rm -f $@ && tar -czf RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+
+rpm-arm64-spec:
+	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	mkdir $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	cp -R $(DESTDIR)/* $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	sed "s/##RPMVERSION##/$(RPM_VERSION)/g; s/##RPMRELEASE##/$(RPM_RELEASE_ID)/g; s/##EXCLUDEARCH##/amd64/g" < debian/$(FULL_PACKAGE_TITLE).spec.in > $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)/$(FULL_PACKAGE_TITLE).spec
+	rm -f $@ && tar -czf RPM_BUILDING/SOURCES/$(FULL_PACKAGE_TITLE)-$(RPM_VERSION).tar.gz $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
+	rm -rf $(FULL_PACKAGE_TITLE)-$(RPM_VERSION)
 
-.PHONY: build-for-integration-test
-build-for-integration-test:
-ifdef CI
-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent ./cmd/confluent
-else
-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent ./cmd/confluent
-endif
+rpm-build-area: RPM_BUILDING/BUILD RPM_BUILDING/RPMS RPM_BUILDING/SOURCES RPM_BUILDING/SPECS RPM_BUILDING/SRPMS
 
-.PHONY: build-for-integration-test-windows
-build-for-integration-test-windows:
-ifdef CI
-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent.exe ./cmd/confluent
-else
-	go build -cover -ldflags="-s -w -X main.commit="00000000" -X main.date="1970-01-01T00:00:00Z" -X main.isTest=true" -o test/bin/confluent.exe ./cmd/confluent
-endif
+RPM_BUILDING/%:
+	mkdir -p $@
 
-.PHONY: integration-test
-integration-test:
-ifdef CI
-	go install gotest.tools/gotestsum@v1.12.1 && \
-	export GOCOVERDIR=test/coverage && \
-	rm -rf $${GOCOVERDIR} && mkdir $${GOCOVERDIR} && \
-	gotestsum --junitfile integration-test-report.xml -- -timeout 0 -v -race $$(go list ./... | grep github.com/confluentinc/cli/v4/test) && \
-	go tool covdata textfmt -i $${GOCOVERDIR} -o coverage.integration.out
-else
-	export GOCOVERDIR=test/coverage && \
-	rm -rf $${GOCOVERDIR} && mkdir $${GOCOVERDIR} && \
-	go test -timeout 0 -v $$(go list ./... | grep github.com/confluentinc/cli/v4/test) $(INTEGRATION_TEST_ARGS) && \
-	go tool covdata textfmt -i $${GOCOVERDIR} -o coverage.integration.out
-endif
-
-.PHONY: test
-test: unit-test integration-test
-
-.PHONY: generate-packaging-patch
-generate-packaging-patch:
-	diff -u Makefile debian/Makefile | sed "1 s_Makefile_cli/Makefile_" > debian/patches/standard_build_layout.patch
-
-.PHONY: coverage
-coverage: ## Merge coverage data from unit and integration tests into coverage.txt
-	@echo "Merging coverage data..."
-	@echo "mode: atomic" > coverage.txt
-	@tail -n +2 coverage.unit.out >> coverage.txt
-	@tail -n +2 coverage.integration.out >> coverage.txt
-	@echo "Coverage data saved to: coverage.txt"
-	@artifact push workflow coverage.txt
-
-.PHONY: muckrake-build-docker
-muckrake-build-docker:
-	@echo "Building CLI binary with Docker image for Muckrake Check..."
-	@echo "Target: $(GOOS)/$(GOARCH)"
-	@echo "Clean up any possible existing containers under same name..."
-	@docker rm -f confluent-muckrake-builder-container 2>/dev/null || true
-	@echo "Building Docker image..."
-	docker build -f docker/Dockerfile_muckrake \
-		--build-arg GOOS=$(GOOS) \
-		--build-arg GOARCH=$(GOARCH) \
-		-t confluent-muckrake-builder .
-	@echo "Creating a container from the image..."
-	docker create --name confluent-muckrake-builder-container confluent-muckrake-builder
-	@echo "Copy built binary from the container"
-	docker cp confluent-muckrake-builder-container:/workspace/dist/. dist/
-	@echo "Clean up container"
-	docker rm confluent-muckrake-builder-container
-	@echo "✅  Binary built successfully at dist/confluent_$(GOOS)_$(GOARCH)/confluent"
-
-.PHONY: muckrake-upload-s3
-muckrake-upload-s3:
-	@echo "Uploading CLI binary to S3..."
-	@if [ -z "$(BUILD_ID)" ]; then \
-		echo "❌  Error: BUILD_ID is not set"; \
-		exit 1; \
-	fi
-	@if [ -z "$(BINARY_PATH)" ]; then \
-		echo "❌  Error: BINARY_PATH is not set"; \
-		exit 1; \
-	fi
-	@if [ -z "$(S3_KEY)" ]; then \
-		echo "❌  Error: S3_KEY is not set"; \
-		exit 1; \
-	fi
-	@if [ ! -f "$(BINARY_PATH)" ]; then \
-		echo "❌  Error: Binary not found at $(BINARY_PATH)"; \
-		exit 1; \
-	fi
-	@echo "Build ID: $(BUILD_ID)"
-	@echo "Binary: $(BINARY_PATH)"
-	@echo "S3 Key: $(S3_KEY)"
-	@aws s3 cp $(BINARY_PATH) s3://confluent.cloud/confluent-cli/development-builds/$(BUILD_ID)/$(S3_KEY) \
-		--acl public-read --region us-west-2
-	@echo "✅  Binary uploaded to s3://confluent.cloud/confluent-cli/development-builds/$(BUILD_ID)/$(S3_KEY)"
-
-.PHONY: muckrake-clean
-muckrake-clean:
-	@echo "Cleaning up Muckrake Check artifacts..."
-	@docker rm -f confluent-muckrake-builder-container 2>/dev/null || true
-	@docker rmi -f confluent-muckrake-builder 2>/dev/null || true
-	@echo "✅  Cleanup complete"
\ No newline at end of file
+RELEASE_%:
+	echo 0 > $@