Skip to content

Commit 0bd8162

Browse files
jw3jw3
authored
Restructure RPM for subpackages (#1025)
Restructure the RPM build into separate CLI and GUI installations This does a few things: - builds separate GUI and CLI RPMs - separates the runtime dependency graph, greatly reducing the footprint for the CLI - updates the container builds to use mock - adds workflow for Fedora 42, because it's that time of the year The tdb tool is distributed as the initial CLI binary. It may be further refactored in function, name, and possibly location. Tested in Koji on Rawhide and EPEL 9. Closes #1024
1 parent d062c01 commit 0bd8162

13 files changed

+169
-104
lines changed

‎.github/rpm-matrix.json

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,20 @@
11
{
22
"props": [
3+
{
4+
"platform": "fedora",
5+
"dist": "fc42",
6+
"spec": "fapolicy-analyzer.spec",
7+
"image": "registry.fedoraproject.org/fedora:42",
8+
"chroot": "fedora-rawhide-x86_64",
9+
"version": "42",
10+
"prerelease": true
11+
},
312
{
413
"platform": "fedora",
514
"dist": "fc41",
615
"spec": "fapolicy-analyzer.spec",
716
"image": "registry.fedoraproject.org/fedora:41",
8-
"chroot": "fedora-rawhide-x86_64",
17+
"chroot": "fedora-41-x86_64",
918
"version": "41",
1019
"prerelease": true
1120
},

‎.github/workflows/rpm.yml

-2
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,6 @@ jobs:
109109

110110
- name: Adjust spec
111111
run: |
112-
# disable dev-tools crate
113-
sed -i '/tools/d' Cargo.toml
114112
# generate build deps with cargo2rpm
115113
cargo2rpm -p Cargo.toml buildrequires | while read line; do
116114
grep -n "BuildRequires:" fapolicy-analyzer.spec | head -n1 | cut -d: -f1 | xargs -I{} sed -i "{}iBuildRequires: $line" fapolicy-analyzer.spec

‎.github/workflows/tools.yml

-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ jobs:
4444
run: |
4545
mkdir /tmp/tools
4646
mv target/release/tdb /tmp/tools/tdb
47-
mv target/release/rulec /tmp/tools/rulec
4847
mv target/release/faprofiler /tmp/tools/faprofiler
4948
5049
- name: Archive Tools

‎Cargo.lock

-16
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Containerfile

+23-8
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,40 @@
1-
ARG image=registry.fedoraproject.org/fedora:39
2-
FROM $image AS build-stage
1+
ARG image=registry.fedoraproject.org/fedora:latest
2+
FROM $image AS fedorabuild
3+
ARG version
4+
ARG spec=fapolicy-analyzer.spec
35

4-
RUN dnf install -y rpm-build rpmdevtools dnf-plugins-core python3-pip nano
6+
# rpmbuild tools could be installed in the el stage
7+
# but caching them here ends up saving time on rebuilds
8+
RUN dnf install -y mock rpm-build rpmdevtools
59

610
RUN useradd -u 10001 -g 0 -d /home/default default
711

812
USER 10001
913
RUN mkdir -p /tmp/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
1014
WORKDIR /tmp/rpmbuild
1115

12-
COPY --chown=10001:0 fapolicy-analyzer.spec SPECS/
16+
COPY --chown=10001:0 $spec SPECS/fapolicy-analyzer.spec
1317

1418
USER root
1519
RUN dnf -y builddep SPECS/fapolicy-analyzer.spec
1620

1721
USER 10001
1822

19-
COPY --chown=10001:0 fapolicy-analyzer.tar.gz SOURCES/
20-
COPY --chown=10001:0 vendor-docs.tar.gz SOURCES/
21-
COPY --chown=10001:0 scripts/srpm/build.sh ./build.sh
23+
COPY --chown=10001:0 fapolicy-analyzer-$version.tar.gz SOURCES/
24+
COPY --chown=10001:0 vendor-docs-$version.tar.gz SOURCES/
25+
COPY --chown=10001:0 scripts/srpm/build.sh .
2226

23-
RUN spectool -g -C /tmp/rpmbuild/SOURCES/ SPECS/fapolicy-analyzer.spec
27+
USER root
2428

2529
ENTRYPOINT ["/tmp/rpmbuild/build.sh"]
30+
31+
FROM fedorabuild as elbuild
32+
ARG version
33+
34+
USER 10001
35+
36+
RUN spectool --list-files SPECS/fapolicy-analyzer.spec | grep pythonhosted | cut -d' ' -f2 | xargs -I{} curl -sLO --output-dir SOURCES {}
37+
38+
COPY --chown=10001:0 vendor-rs-$version.tar.gz SOURCES/
39+
40+
USER root

‎Makefile

+10-8
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ GRN=\033[0;32m
2323
RED=\033[0;31m
2424
NC=\033[0m # No Color
2525

26+
VERSION ?= $(shell sed -n 's/^Version: *//p' fapolicy-analyzer.spec)
27+
2628
# List the common developer targets
2729
list:
2830
@echo
@@ -139,17 +141,17 @@ build-info:
139141

140142
# Generate Fedora rawhide rpms
141143
fc-rpm:
142-
@echo -e "${GRN}--- Fedora RPM generation...${NC}"
143-
make -f .copr/Makefile vendor OS_ID=fedora
144-
podman build -t fapolicy-analyzer:39 -f Containerfile .
145-
podman run --rm -it --network=none -v /tmp:/v fapolicy-analyzer:39 /v
144+
@echo -e "${GRN}--- Fedora RPM generation v${VERSION}...${NC}"
145+
make -f .copr/Makefile vendor OS_ID=fedora VERSION=${VERSION}
146+
podman build -t fapolicy-analyzer:build --target fedorabuild --build-arg version=${VERSION} -f Containerfile .
147+
podman run --privileged --rm -it -v /tmp:/v fapolicy-analyzer:build fedora-39-x86_64 /v
146148

147149
# Generate RHEL 9 rpms
148150
el9-rpm:
149-
@echo -e "${GRN}--- el9 RPM generation...${NC}"
150-
make -f .copr/Makefile vendor OS_ID=rhel DIST=.el9 spec=scripts/srpm/fapolicy-analyzer.el9.spec
151-
podman build -t fapolicy-analyzer:el9 -f scripts/srpm/Containerfile.el9 .
152-
podman run --rm -it --network=none -v /tmp:/v fapolicy-analyzer:el9 /v
151+
@echo -e "${GRN}--- el9 RPM generation v${VERSION}...${NC}"
152+
make -f .copr/Makefile vendor vendor-rs OS_ID=rhel VERSION=${VERSION} DIST=.el9 spec=scripts/srpm/fapolicy-analyzer.el9.spec
153+
podman build -t fapolicy-analyzer:build --target elbuild --build-arg version=${VERSION} --build-arg spec=scripts/srpm/fapolicy-analyzer.el9.spec -f Containerfile .
154+
podman run --privileged --rm -it -v /tmp:/v fapolicy-analyzer:build rocky+epel-9-x86_64 /v
153155

154156
# Update embedded help documentation
155157
help-docs:

‎crates/tools/Cargo.toml

-5
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@ edition = "2021"
99
name = "tdb"
1010
path = "src/trust_db_util.rs"
1111

12-
[[bin]]
13-
name = "rulec"
14-
path = "src/rule_check.rs"
15-
1612
[[bin]]
1713
name = "faprofiler"
1814
path = "src/fapolicy_profiler.rs"
@@ -23,7 +19,6 @@ lmdb = "0.8"
2319
nom = "7.1"
2420
rayon = "1.5"
2521
thiserror = "1.0"
26-
ariadne = "0.1"
2722
log = "0.4"
2823

2924
fapolicy-analyzer = { path = "../analyzer" }

‎fapolicy-analyzer.spec

+53-7
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
%bcond_without check
2+
%bcond_without cli
3+
%bcond_without gui
24

35
Summary: File Access Policy Analyzer
46
Name: fapolicy-analyzer
@@ -41,6 +43,22 @@ BuildRequires: audit-libs-devel
4143
BuildRequires: cargo-rpm-macros
4244
BuildRequires: python3dist(setuptools-rust)
4345

46+
Requires: %{name}-cli
47+
Requires: %{name}-gui
48+
49+
%description
50+
Tools to assist with the configuration and management of fapolicyd.
51+
52+
53+
%package cli
54+
Summary: File Access Policy Analyzer CLI
55+
56+
%description cli
57+
CLI Tools to assist with the configuration and management of fapolicyd.
58+
59+
%package gui
60+
Summary: File Access Policy Analyzer GUI
61+
4462
Requires: python3
4563
Requires: python3-gobject
4664
Requires: python3-events
@@ -67,15 +85,22 @@ Requires: webkit2gtk4.1
6785
%global module_version %{lua: v = string.gsub(rpm.expand("%{?version}"), "~dev", ".dev"); \
6886
v = string.gsub(v, "~rc", "rc"); print(v) }
6987

70-
%description
71-
Tools to assist with the configuration and management of fapolicyd.
88+
%description gui
89+
GUI Tools to assist with the configuration and management of fapolicyd.
7290

7391
%prep
7492
%autosetup -n %{name}
7593
%cargo_prep
7694

77-
# disable dev-tools crate
95+
%if %{without cli}
96+
# disable tools crate
7897
sed -i '/tools/d' Cargo.toml
98+
%endif
99+
100+
%if %{without gui}
101+
# disable pyo3 crate
102+
sed -i '/pyo3/d' Cargo.toml
103+
%endif
79104

80105
# extract our doc sourcs
81106
tar xvzf %{SOURCE1}
@@ -96,6 +121,12 @@ echo "audit" > FEATURES
96121
%cargo_generate_buildrequires -a
97122

98123
%build
124+
125+
%if %{with cli}
126+
cargo build --bin tdb --release
127+
%endif
128+
129+
%if %{with gui}
99130
# ensure standard Rust compiler flags are set
100131
export RUSTFLAGS="%{build_rustflags}"
101132

@@ -105,8 +136,15 @@ export RUSTFLAGS="%{build_rustflags}"
105136

106137
%{cargo_license_summary}
107138
%{cargo_license} > LICENSE.dependencies
139+
%endif
108140

109141
%install
142+
143+
%if %{with cli}
144+
install -D target/release/tdb %{buildroot}/%{_sbindir}/%{name}-trust
145+
%endif
146+
147+
%if %{with gui}
110148
%{py3_install_wheel %{module}-%{module_version}*%{_target_cpu}.whl}
111149
%{python3} help install --dest %{buildroot}/%{_datadir}/help
112150
install -D bin/%{name} %{buildroot}/%{_sbindir}/%{name}
@@ -115,14 +153,17 @@ install -D data/config.toml -t %{buildroot}%{_sysconfdir}/%{name}/
115153
desktop-file-install data/%{name}.desktop
116154
find locale -name %{name}.mo -exec cp --parents -rv {} %{buildroot}/%{_datadir} \;
117155
%find_lang %{name} --with-gnome
156+
%endif
118157

119158
%check
159+
%if %{with gui}
120160
desktop-file-validate %{buildroot}/%{_datadir}/applications/%{name}.desktop
161+
%endif
121162

122-
%files -n %{name} -f %{name}.lang
123-
%doc scripts/srpm/README
124-
%license LICENSE
125-
%license LICENSE.dependencies
163+
%files cli
164+
%attr(755,root,root) %{_sbindir}/%{name}-trust
165+
166+
%files gui
126167
%{python3_sitearch}/%{module}
127168
%{python3_sitearch}/%{module}-%{module_version}*
128169
%attr(755,root,root) %{_sbindir}/%{name}
@@ -131,6 +172,11 @@ desktop-file-validate %{buildroot}/%{_datadir}/applications/%{name}.desktop
131172
%config(noreplace) %attr(644,root,root) %{_sysconfdir}/%{name}/config.toml
132173
%ghost %attr(640,root,root) %verify(not md5 size mtime) %{_localstatedir}/log/%{name}/%{name}.log
133174

175+
%files -f %{name}.lang
176+
%doc scripts/srpm/README
177+
%license LICENSE
178+
%license LICENSE.dependencies
179+
134180
%changelog
135181
* Sun Jul 28 2024 John Wass <[email protected]> 1.4.0-1
136182
- New release

‎news/1025.packaging.md

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Subpackaged RPM build to support separate CLI and GUI installations.

‎scripts/srpm/Containerfile.el9

-27
This file was deleted.

‎scripts/srpm/build.sh

+8-13
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,13 @@
1818
spec_file="fapolicy-analyzer.spec"
1919
rpmbuild_dir=/tmp/rpmbuild
2020

21-
if [[ "$ONLINE" -eq 1 ]]; then
22-
cd ${rpmbuild_dir}/SOURCES
23-
spectool -g "../SPECS/$spec_file"
24-
cd ${rpmbuild_dir}/SPECS
25-
dnf builddep "$spec_file" -y
26-
fi
27-
28-
cd ${rpmbuild_dir}/SPECS
29-
rpmbuild -ba "$spec_file" -D "_topdir ${rpmbuild_dir}"
21+
echo "[build.sh] mock $1"
22+
mock -r "$1" --init
23+
mock -r "$1" --resultdir ${rpmbuild_dir} --buildsrpm --sources ${rpmbuild_dir}/SOURCES/ --spec ${rpmbuild_dir}/SPECS/${spec_file}
24+
mock -r "$1" --resultdir ${rpmbuild_dir} --rebuild ${rpmbuild_dir}/*.src.rpm
3025

31-
if [[ ! -z "$1" ]]; then
32-
echo "[build.sh] exporting *rpms to ${1}"
33-
cp -v ${rpmbuild_dir}/RPMS/**/*.rpm ${1}
34-
cp -v ${rpmbuild_dir}/SRPMS/*.rpm ${1}
26+
if [[ -n "$2" ]]; then
27+
echo "[build.sh] exporting rpms to ${2}"
28+
cp -v ${rpmbuild_dir}/*.rpm ${2}
29+
cp -v ${rpmbuild_dir}/*.rpm ${2}
3530
fi

0 commit comments

Comments
 (0)