Skip to content

Commit e57a862

Browse files
DrDaveDDrDaveD
authored
Merge pull request #47 from DrDaveD/more-fedora-comments
respond to more fedora review comments
2 parents fb188c5 + c8945f7 commit e57a862

File tree

6 files changed

+133
-49
lines changed

6 files changed

+133
-49
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,20 @@ jobs:
5757
OS_VERSION: latest
5858
run: ./ci/docker-run
5959

60+
rpmbuild-fedora41:
61+
name: rpmbuild-fedora41
62+
runs-on: ubuntu-latest
63+
steps:
64+
- uses: actions/checkout@v2
65+
# fetch tags as checkout@v2 doesn't do that by default
66+
- run: git fetch --prune --unshallow --tags --force
67+
68+
- name: Build rpm under docker
69+
env:
70+
OS_TYPE: quay.io/fedora/fedora-bootc
71+
OS_VERSION: 41
72+
run: ./ci/docker-run
73+
6074
rpmbuild-fedora42:
6175
name: rpmbuild-fedora42
6276
runs-on: ubuntu-latest

‎ci/docker-run‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ DOCKER_CONTAINER_NAME="test_${OS_TYPE##*/}_${OS_VERSION//./_}"
1212
set -x
1313

1414
# start the container running systemd
15-
docker run --privileged -d -it -v "$(pwd):/build/src:rw" -e OS_TYPE=$OS_TYPE \
15+
docker run --privileged -d -it -v "$(pwd):/build/src:rw" \
1616
--name "$DOCKER_CONTAINER_NAME" "$DOCKER_HUB_URI" /usr/sbin/init
1717
RET=$?
1818
# leave some time for systemd network setup and interesting logs

‎ci/rpm-build‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,19 @@
33

44
# install dependencies
55

6-
dnf -y install git gpg golang wget
7-
dnf install -y rpm-build
8-
if [[ "$OS_TYPE" = rocky* ]] || [[ "$OS_TYPE" = alma* ]]; then
9-
dnf install -y epel-release
6+
dnf -y install git gpg golang wget rpm-build
7+
. /etc/os-release
8+
OS_VERSION="${VERSION_ID%.*}"
9+
if [ "$OS_VERSION" -le 9 ]; then
10+
dnf install -y epel-release
11+
if [ "$OS_VERSION" == 8 ]; then
1012
dnf install -y epel-rpm-macros
13+
else
14+
dnf install -y rpmautospec-rpm-macros
15+
fi
16+
fi
17+
if [ "$OS_VERSION" != 8 ]; then
18+
dnf install -y go-rpm-macros
1119
fi
1220

1321
# switch to an unprivileged user
@@ -23,7 +31,7 @@ su testuser -c '
2331
tar czhf openbao-rpm-$VERSION.tar.gz --exclude ".git*" openbao-rpm-$VERSION/
2432
mv openbao-rpm-$VERSION.tar.gz src
2533
cd src
26-
DISTURL="`sed -n "s/^Source1: //p" openbao.spec|sed -e "s/%{name}/openbao/g" -e "s/%{package_version}/$VERSION/g"`"
34+
DISTURL="`sed -n "s/^Source0: //p" openbao.spec|sed -e "s/%{name}/openbao/g" -e "s/%{package_version}/$VERSION/g"`"
2735
wget "$DISTURL"
2836
GOVERSION="`sed -n "s/%global go_version //p" openbao.spec`"
2937
GOURL="`sed -n "s/^Source2: //p" openbao.spec|sed "s/%{go_version}/$GOVERSION/"`"

‎make-spec‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ while IFS='' read -r LINE; do
3232
if [[ "$LINE" = *"bundled provides" ]]; then
3333
awk '{if (index($1, "/") != 0 && ($1 != "//")) {print "Provides: bundled(golang("$1")) = "$2}}' $GOMOD | sed -e 's/-/_/g' | sort | uniq
3434
elif [[ "$LINE" = "License:"* ]]; then
35-
DISTURL="$(sed -n "s/^Source1: //p" $PKG.spec.in|sed -e "s/%{name}/$PKG/g" -e "s/%{package_version}/$VERSION/g")"
35+
DISTURL="$(sed -n "s/^Source0: //p" $PKG.spec.in|sed -e "s/%{name}/$PKG/g" -e "s/%{package_version}/$VERSION/g")"
3636
DISTBALL="$(basename $DISTURL)"
3737
DIST="$(echo $DISTBALL|sed 's/\.tar.*//')"
3838
if [ ! -f "$DISTBALL" ]; then

‎openbao.spec‎

Lines changed: 52 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,28 @@ Release: %autorelease
1212
Summary: A tool for securely accessing secrets
1313
# See LICENSE for primary license
1414
# See LICENSE_DEPENDENCIES.md for bundled dependencies
15+
# CC0-1.0 is normally not permissible for code in Fedora. Because the vendored Go package
16+
# github.com/zeebo/blake3 it applies to has been available in Fedora as golang-github-zeebo-blake3
17+
# since before the cutoff date 2022-08-01, the exception to use it also applies here.
1518
License: MPL-2.0 AND AFL-2.0 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0 AND ISC AND MIT
16-
Source0: https://github.com/opensciencegrid/%{name}-rpm/releases/download/v%{package_version}/%{name}-rpm-%{package_version}.tar.gz
17-
Source1: https://github.com/openbao/%{name}/releases/download/v%{package_version}/%{name}-dist-%{package_version}.tar.xz
19+
Source0: https://github.com/openbao/%{name}/releases/download/v%{package_version}/%{name}-dist-%{package_version}.tar.xz
20+
# This includes extra files to include in the package and is used as a
21+
# single branch to track changes to them and a place where checks can be
22+
# automated using github actions.
23+
Source1: https://github.com/opensciencegrid/%{name}-rpm/releases/download/v%{package_version}/%{name}-rpm-%{package_version}.tar.gz
1824
Patch0: goversion.patch
1925

2026
BuildRequires: golang-bin
2127
BuildRequires: systemd-rpm-macros
28+
%if 0%{?el8}
29+
BuildRequires: epel-rpm-macros
30+
%endif
31+
%if 0%{?el9}
32+
BuildRequires: rpmautospec-rpm-macros
33+
%endif
34+
%if ! 0%{?el8}
35+
BuildRequires: go-rpm-macros
36+
%endif
2237
URL: https://openbao.org
2338

2439
Provides: bundled(golang(cel.dev/expr)) = v0.24.0
@@ -392,8 +407,8 @@ Provides a compatibility layer on top of OpenBao to emulate a Hashicorp
392407
Vault package.
393408

394409
%prep
395-
%setup -q -n %{name}-rpm-%{package_version}
396-
%setup -q -T -b 1 -n %{name}-dist-%{package_version}
410+
%setup -q -T -b 1 -n %{name}-rpm-%{package_version}
411+
%setup -q -n %{name}-dist-%{package_version}
397412
%autopatch
398413

399414
%build
@@ -402,32 +417,46 @@ Vault package.
402417
# this prevents it from complaining that ui assets are too old
403418
touch http/web_ui/index.html
404419

405-
GO_BUILD_MODE="-buildmode pie"
406-
GO_BUILD_GCFLAGS=
407-
GO_BUILD_LDFLAGS="-X github.com/%{name}/%{name}/version.fullVersion=%{version}-%{release}"
408-
GO_BUILD_LDFLAGS+=" -X github.com/%{name}/%{name}/version.GitCommit="
420+
GO_BUILDTAGS="ui"
421+
GO_LDFLAGS="-X github.com/%{name}/%{name}/version.fullVersion=%{version}-%{release}"
422+
GO_LDFLAGS+=" -X github.com/%{name}/%{name}/version.GitCommit="
409423
BUILD_DATE="$(date -d "@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)"
410-
GO_BUILD_LDFLAGS+=" -X github.com/%{name}/%{name}/version.BuildDate=${BUILD_DATE}"
411-
GO_BUILD_LDFLAGS+=" -B gobuildid"
412-
GO_BUILD_TAGS="ui"
424+
GO_LDFLAGS+=" -X github.com/%{name}/%{name}/version.BuildDate=${BUILD_DATE}"
425+
426+
%if 0%{?el8} || "%{?go_debug}" != ""
427+
# Define the %%gobuild macro on el8 because it is outdated and doesn't work.
428+
# Also redefine it if %%go_debug is set for now, until %%gobuild is updated
429+
# to accept setting -gcflags.
413430

414-
# These are from the %%gobuild macro which we can't use because it doesn't
415-
# allow for extra tags (nor extra gcflags for debug mode).
416-
GO_BUILD_TAGS+=" rpm_crashtraceback libtrust_openssl"
417-
GO_BUILD_LDFLAGS+=" -linkmode=external -compressdwarf=false"
418-
GO_BUILD_LDFLAGS+=" -extldflags '%__global_ldflags'"
431+
GO_LDFLAGS+=" -B gobuildid"
432+
GO_BUILDTAGS+=" rpm_crashtraceback libtrust_openssl"
433+
GO_LDFLAGS+=" -linkmode=external -compressdwarf=false"
434+
GO_LDFLAGS+=" -extldflags '%__global_ldflags'"
419435

436+
GO_BUILD_GCFLAGS=
420437
%if "%{?go_debug}" != ""
421438
# add debugging & testing flags
422439
GO_BUILD_GCFLAGS="all=-N -l"
423-
GO_BUILD_LDFLAGS+=" -X github.com/%{name}/%{name}/version.VersionMetadata=testonly"
440+
GO_LDFLAGS+=" -X github.com/%{name}/%{name}/version.VersionMetadata=testonly"
424441
# openbao documentation says testonly should not be used for production builds
425-
GO_BUILD_TAGS+=" testonly"
442+
GO_BUILDTAGS+=" testonly"
426443
%endif
427444

428-
# instructions from https://openbao.org/docs/contributing/packaging/#ui-release
429-
# The ui is pre-prepared in the source distribution tarball
430-
go build ${GO_BUILD_MODE} -gcflags "${GO_BUILD_GCFLAGS}" -ldflags "${GO_BUILD_LDFLAGS}" -buildvcs=false -o bin/bao -tags "${GO_BUILD_TAGS}"
445+
%define gobuild(o:) go build -compiler gc -buildmode pie -ldflags "${GO_LDFLAGS}" -gcflags "${GO_BUILD_GCFLAGS}" -tags "${GO_BUILDTAGS}" %{?**}
446+
447+
%else
448+
# Use more modern gobuild macro, which (except for el9) defaults to not use
449+
# go modules. Enable go modules because otherwise it fails to find even
450+
# the openbao/openbao source.
451+
%global gomodulesmode GO111MODULE=on
452+
453+
%if 0%{?el9}
454+
# the el9 gobuild macro only accepts LDFLAGS
455+
LDFLAGS=${GO_LDFLAGS}
456+
%endif
457+
%endif
458+
459+
%gobuild -o bin/bao
431460

432461
%install
433462
# starts out in %%{name}-dist-%%{package_version} directory
@@ -455,10 +484,12 @@ mkdir -p %{buildroot}%{_sysusersdir}
455484
cp %{name}.conf %{buildroot}%{_sysusersdir}/%{name}.conf
456485

457486
%pre
487+
%if 0%{?el8}
458488
getent group %{name} > /dev/null || groupadd -r %{name}
459489
getent passwd %{name} > /dev/null || \
460490
useradd -r -d %{_sharedstatedir}/%{name} -g %{name} \
461491
-s /sbin/nologin -c "%{name} secrets manager" %{name}
492+
%endif
462493

463494
%post
464495
setcap cap_ipc_lock=+ep %{_bindir}/bao

‎openbao.spec.in‎

Lines changed: 52 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,28 @@ Release: %autorelease
1212
Summary: A tool for securely accessing secrets
1313
# See LICENSE for primary license
1414
# See LICENSE_DEPENDENCIES.md for bundled dependencies
15+
# CC0-1.0 is normally not permissible for code in Fedora. Because the vendored Go package
16+
# github.com/zeebo/blake3 it applies to has been available in Fedora as golang-github-zeebo-blake3
17+
# since before the cutoff date 2022-08-01, the exception to use it also applies here.
1518
License: MPL-2.0
16-
Source0: https://github.com/opensciencegrid/%{name}-rpm/releases/download/v%{package_version}/%{name}-rpm-%{package_version}.tar.gz
17-
Source1: https://github.com/openbao/%{name}/releases/download/v%{package_version}/%{name}-dist-%{package_version}.tar.xz
19+
Source0: https://github.com/openbao/%{name}/releases/download/v%{package_version}/%{name}-dist-%{package_version}.tar.xz
20+
# This includes extra files to include in the package and is used as a
21+
# single branch to track changes to them and a place where checks can be
22+
# automated using github actions.
23+
Source1: https://github.com/opensciencegrid/%{name}-rpm/releases/download/v%{package_version}/%{name}-rpm-%{package_version}.tar.gz
1824
Patch0: goversion.patch
1925

2026
BuildRequires: golang-bin
2127
BuildRequires: systemd-rpm-macros
28+
%if 0%{?el8}
29+
BuildRequires: epel-rpm-macros
30+
%endif
31+
%if 0%{?el9}
32+
BuildRequires: rpmautospec-rpm-macros
33+
%endif
34+
%if ! 0%{?el8}
35+
BuildRequires: go-rpm-macros
36+
%endif
2237
URL: https://openbao.org
2338

2439
# This line gets replaced by bundled provides
@@ -42,8 +57,8 @@ Provides a compatibility layer on top of OpenBao to emulate a Hashicorp
4257
Vault package.
4358

4459
%prep
45-
%setup -q -n %{name}-rpm-%{package_version}
46-
%setup -q -T -b 1 -n %{name}-dist-%{package_version}
60+
%setup -q -T -b 1 -n %{name}-rpm-%{package_version}
61+
%setup -q -n %{name}-dist-%{package_version}
4762
%autopatch
4863

4964
%build
@@ -52,32 +67,46 @@ Vault package.
5267
# this prevents it from complaining that ui assets are too old
5368
touch http/web_ui/index.html
5469

55-
GO_BUILD_MODE="-buildmode pie"
56-
GO_BUILD_GCFLAGS=
57-
GO_BUILD_LDFLAGS="-X github.com/%{name}/%{name}/version.fullVersion=%{version}-%{release}"
58-
GO_BUILD_LDFLAGS+=" -X github.com/%{name}/%{name}/version.GitCommit="
70+
GO_BUILDTAGS="ui"
71+
GO_LDFLAGS="-X github.com/%{name}/%{name}/version.fullVersion=%{version}-%{release}"
72+
GO_LDFLAGS+=" -X github.com/%{name}/%{name}/version.GitCommit="
5973
BUILD_DATE="$(date -d "@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)"
60-
GO_BUILD_LDFLAGS+=" -X github.com/%{name}/%{name}/version.BuildDate=${BUILD_DATE}"
61-
GO_BUILD_LDFLAGS+=" -B gobuildid"
62-
GO_BUILD_TAGS="ui"
74+
GO_LDFLAGS+=" -X github.com/%{name}/%{name}/version.BuildDate=${BUILD_DATE}"
75+
76+
%if 0%{?el8} || "%{?go_debug}" != ""
77+
# Define the %%gobuild macro on el8 because it is outdated and doesn't work.
78+
# Also redefine it if %%go_debug is set for now, until %%gobuild is updated
79+
# to accept setting -gcflags.
6380

64-
# These are from the %%gobuild macro which we can't use because it doesn't
65-
# allow for extra tags (nor extra gcflags for debug mode).
66-
GO_BUILD_TAGS+=" rpm_crashtraceback libtrust_openssl"
67-
GO_BUILD_LDFLAGS+=" -linkmode=external -compressdwarf=false"
68-
GO_BUILD_LDFLAGS+=" -extldflags '%__global_ldflags'"
81+
GO_LDFLAGS+=" -B gobuildid"
82+
GO_BUILDTAGS+=" rpm_crashtraceback libtrust_openssl"
83+
GO_LDFLAGS+=" -linkmode=external -compressdwarf=false"
84+
GO_LDFLAGS+=" -extldflags '%__global_ldflags'"
6985

86+
GO_BUILD_GCFLAGS=
7087
%if "%{?go_debug}" != ""
7188
# add debugging & testing flags
7289
GO_BUILD_GCFLAGS="all=-N -l"
73-
GO_BUILD_LDFLAGS+=" -X github.com/%{name}/%{name}/version.VersionMetadata=testonly"
90+
GO_LDFLAGS+=" -X github.com/%{name}/%{name}/version.VersionMetadata=testonly"
7491
# openbao documentation says testonly should not be used for production builds
75-
GO_BUILD_TAGS+=" testonly"
92+
GO_BUILDTAGS+=" testonly"
7693
%endif
7794

78-
# instructions from https://openbao.org/docs/contributing/packaging/#ui-release
79-
# The ui is pre-prepared in the source distribution tarball
80-
go build ${GO_BUILD_MODE} -gcflags "${GO_BUILD_GCFLAGS}" -ldflags "${GO_BUILD_LDFLAGS}" -buildvcs=false -o bin/bao -tags "${GO_BUILD_TAGS}"
95+
%define gobuild(o:) go build -compiler gc -buildmode pie -ldflags "${GO_LDFLAGS}" -gcflags "${GO_BUILD_GCFLAGS}" -tags "${GO_BUILDTAGS}" %{?**}
96+
97+
%else
98+
# Use more modern gobuild macro, which (except for el9) defaults to not use
99+
# go modules. Enable go modules because otherwise it fails to find even
100+
# the openbao/openbao source.
101+
%global gomodulesmode GO111MODULE=on
102+
103+
%if 0%{?el9}
104+
# the el9 gobuild macro only accepts LDFLAGS
105+
LDFLAGS=${GO_LDFLAGS}
106+
%endif
107+
%endif
108+
109+
%gobuild -o bin/bao
81110

82111
%install
83112
# starts out in %%{name}-dist-%%{package_version} directory
@@ -105,10 +134,12 @@ mkdir -p %{buildroot}%{_sysusersdir}
105134
cp %{name}.conf %{buildroot}%{_sysusersdir}/%{name}.conf
106135

107136
%pre
137+
%if 0%{?el8}
108138
getent group %{name} > /dev/null || groupadd -r %{name}
109139
getent passwd %{name} > /dev/null || \
110140
useradd -r -d %{_sharedstatedir}/%{name} -g %{name} \
111141
-s /sbin/nologin -c "%{name} secrets manager" %{name}
142+
%endif
112143

113144
%post
114145
setcap cap_ipc_lock=+ep %{_bindir}/bao

0 commit comments

Comments
 (0)