diff --git a/centos-packager.spec b/centos-packager.spec index fecbcf3..ba537f0 100644 --- a/centos-packager.spec +++ b/centos-packager.spec @@ -1,20 +1,14 @@ -%global centos_git_common_url https://git.centos.org/centos-git-common -%global centos_git_common_commit 28b610e9fb79594c49bc64c7c331d0aaab382e7e - Name: centos-packager Version: 0.7.0 -Release: 17%{?dist} +Release: 9%{?dist} Summary: Tools and files necessary for building CentOS packages Group: Applications/Productivity -License: GPL-2.0-or-later +License: GPLv2+ URL: https://git.centos.org/centos/centos-packager Source0: cbs-koji.conf Source1: COPYING Source2: centos-cert -Source3: %{centos_git_common_url}/raw/%{centos_git_common_commit}/f/lookaside_upload -Source4: %{centos_git_common_url}/raw/%{centos_git_common_commit}/f/lookaside_upload_sig -Source5: %{centos_git_common_url}/raw/%{centos_git_common_commit}/f/get_sources.sh Requires: koji Requires: rpm-build rpmdevtools rpmlint @@ -45,46 +39,14 @@ install -p -m 0644 %{SOURCE0} %{buildroot}%{_sysconfdir}/koji.conf.d/cbs-koji.co mkdir -p %{buildroot}/%{_bindir} ln -s koji %{buildroot}%{_bindir}/cbs install -p -m 0755 %{SOURCE2} %{buildroot}%{_bindir}/centos-cert -install -p -m 0755 %{SOURCE3} %{buildroot}%{_bindir}/centos-lookaside-upload -install -p -m 0755 %{SOURCE4} %{buildroot}%{_bindir}/centos-lookaside-upload-sig -install -p -m 0755 %{SOURCE5} %{buildroot}%{_bindir}/centos-get-sources %files %license COPYING %config(noreplace) %{_sysconfdir}/koji.conf.d/cbs-koji.conf %{_bindir}/cbs %{_bindir}/centos-cert -%{_bindir}/centos-lookaside-upload -%{_bindir}/centos-lookaside-upload-sig -%{_bindir}/centos-get-sources %changelog -* Wed Jul 23 2025 Fedora Release Engineering - 0.7.0-17 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Thu Jan 16 2025 Fedora Release Engineering - 0.7.0-16 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Jul 17 2024 Fedora Release Engineering - 0.7.0-15 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed May 29 2024 Davide Cavalca - 0.7.0-14 -- Import lookaside_upload, lookaside_upload_sig and get_sources.sh from - centos-git-common -- Convert license tag to SPDX - -* Tue Jan 23 2024 Fedora Release Engineering - 0.7.0-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Fri Jan 19 2024 Fedora Release Engineering - 0.7.0-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Jul 19 2023 Fedora Release Engineering - 0.7.0-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jan 18 2023 Fedora Release Engineering - 0.7.0-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - * Wed Jul 20 2022 Fedora Release Engineering - 0.7.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/get_sources.sh b/get_sources.sh deleted file mode 100644 index daa1bfc..0000000 --- a/get_sources.sh +++ /dev/null @@ -1,303 +0,0 @@ -#!/bin/bash -# -# Might want to drop this in ~/bin/ and chmod u+x it -# - -# Initial Author: Karanbir Singh -# Updates: -# Mike McLean -# Pat Riehecky -# Tyler Parsons -# Tuomo Soini -set -eux - - -##################################################################### -usage() { - echo '' >&2 - echo "$0 [-hcq] [-b branch] [--surl url]" >&2 - echo '' >&2 - echo 'Script to parse the non-text sources metadata file' >&2 - echo ' and download the required files from the lookaside' >&2 - echo ' cache.' >&2 - echo '' >&2 - echo 'PLEASE NOTE: this script is non-destructive, it wont' >&2 - echo ' replace files that already exist, regardless of' >&2 - echo ' their state, allowing you to have work-in-progress' >&2 - echo ' content that wont get overwritten.' >&2 - echo '' >&2 - echo 'You need to run this from inside a sources git repo' >&2 - echo '' >&2 - echo ' -h: This help message' >&2 - echo '' >&2 - echo " $0 -b c7" >&2 - echo " $0 -q -b c7" >&2 - echo " $0 -c -b remotes/origin/c7" >&2 - echo " $0 -c -b c7 --surl '$SURL'" >&2 - echo " $0" >&2 - exit 1 -} - -##################################################################### - -SURL="https://git.centos.org/sources" - -QUIET=0 -BRANCH='' -CHECK=0 - -# for setting any overrides, such as SURL, default BRANCH, or force CHECK -if [ -f /etc/centos-git-common ]; then - . /etc/centos-git-common -fi - -##################################################################### -# setup args in the right order for making getopt evaluation -# nice and easy. You'll need to read the manpages for more info -# utilizing 'while' construct rather than 'for arg' to avoid unnecessary -# shifting of program args -args=$(getopt -o hcqb: -l surl: -- "$@") -eval set -- "$args" - -while [[ 0 -eq 0 ]]; do - case $1 in - -- ) - # end of getopt args, shift off the -- and get out of the loop - shift - break - ;; - -c ) - # verify the sha1sum of the downloaded file - CHECK=1 - shift - ;; - -q ) - # suppress warnings - QUIET=1 - shift - ;; - -b ) - # Check this particular branch - BRANCH=$2 - shift - shift - ;; - --surl ) - # override sources url - SURL=$2 - shift - shift - ;; - -h ) - # get help - usage - ;; - esac -done - -# set curl options this way so defaults can be set in /etc/centos-git-common -# across multiple scripts -if [[ ${QUIET} -eq 1 ]]; then - QUIET='--silent' -else - QUIET='' -fi - -command -v git >/dev/null 2>&1 -if [[ $? -ne 0 ]]; then - echo 'You need git in PATH' >&2 - exit 1 -fi - -command -v curl >/dev/null 2>&1 -if [[ $? -ne 0 ]]; then - echo 'You need curl in PATH' >&2 - exit 1 -fi - -if [ ! -d .git ] && ([ ! -d SPECS ] || [[ ! -s sources ]] ); then - echo 'You need to run this from inside a sources git repo' >&2 - exit 1 - fi - -# sort out our branch -if [ -n "$BRANCH" ] -then - branches=("$BRANCH") -else - # generate a list of all branches containing current HEAD - branches=() - while IFS='' read -r line - do - # input from: git branch --contains HEAD - branch="${line:2}" - if [[ "$branch" =~ "detached from" ]] - then - # ignore detached heads - continue - fi - if [ ".${line:0:1}" = ".*" ] - then - # current branch, put it first - branches=("${branch}" ${branches[@]+"${branches[@]}"}) - else - branches=(${branches[@]+"${branches[@]}"} "${branch}") - fi - done <<< "$(git branch -r --contains HEAD | sed 's#origin/##g')" -fi - -if [[ -f sources ]]; then - echo "Flat layout style" - if [[ ! -s sources ]]; then - echo "Empty sources file -- nothing to check" - else - # This section is for the "flat" dist-git layout, where the spec file and - # patches are all present at the top level directory and the sha of the tarball - # present in a 'sources' file. - # This code was re-used from the fedpkg-pkg minimal project which is licensed - # under GPLv3 or any later version. - - pkgname=$(basename "$PWD") - # Read first word of first line. For old MD5 format it's the 32 character - # hash. Otherwise let's assume the sources have the BSD format where lines - # start with hash type. - hashtype="$(head -n1 sources | cut -d' ' -f1 | tr '[:upper:]' '[:lower:]')" - # The format is - # SHA512 (filename) = ABCDEF - # We don't care about the equals sign. We also assume all hashes are - # the same type, so we don't need to read it again for each line. - while read -r _ filename _ hash || [[ -n "$filename" && -n "$hash" ]]; do - if [ -z "$filename" ] || [ -z "$hash" ]; then - continue - fi - # Remove parenthesis around tarball name - filename=${filename#(} - tarball=${filename%)} - if [ ! -e "$tarball" ]; then - for br in "${branches[@]}" - do - br=$(echo ${br}| sed -e s'|remotes/origin/||') - # Try the branch-specific lookaside structure - url="${SURL}/$pkgname/${br}/$hash" - echo "Retrieving ${url}" - HTTP_CODE=$(curl -L ${QUIET} -H Pragma: -o "./$tarball" -R -S --fail --retry 5 "${url}" --write-out "%{http_code}" || true) - echo "Returned ${HTTP_CODE}" - if [[ ${HTTP_CODE} -gt 199 && ${HTTP_CODE} -lt 300 ]] ; then - echo "bailing" - break - fi - # Try the hash-specific lookaside structure - url="${SURL}/$pkgname/$tarball/$hashtype/$hash/$tarball" - echo "Retrieving ${url}" - curl -L ${QUIET} -H Pragma: -o "./$tarball" -R -S --fail --retry 5 "${url}" && break - done - else - echo "$filename exists. skipping" - fi - done < sources - "${hashtype}sum" -c sources - fi -else - echo "Exploded SRPM layout style" - # This section is for the "non-flat" dist-git layout, where the spec file - # is stored in a SPECS folder, the patches in a SOURCES folder and the sha - # of the tarball of the project is present in a '..metadata' file. - - mkdir -p SOURCES - # should go into a function section at some point - weakHashDetection () { - strHash=${1}; - case $((`echo ${strHash}|wc -m` - 1 )) in - 128) - hashBin='sha512sum' - ;; - 64) - hashBin='sha256sum' - ;; - 40) - hashBin='sha1sum' - ;; - 32) - hashBin='md5sum' - ;; - *) - hashBin='unknown' - ;; - esac - echo ${hashBin}; - } - - # check metadata file and extract package name - shopt -s nullglob - set -- .*.metadata - if (( $# == 0 )) - then - echo 'Missing metadata. Please run from inside a sources git repo' >&2 - exit 1 - elif (( $# > 1 )) - then - echo "Warning: multiple metadata files found. Using $1" - fi - meta=$1 - pn=${meta%.metadata} - pn=${pn#.} - - while read -r fsha fname ; do - if [ ".${fsha}" = ".da39a3ee5e6b4b0d3255bfef95601890afd80709" ]; then - # zero byte file - touch ${fname} - else - hashType=$(weakHashDetection ${fsha}) - if [ "${hashType}" == "unknown" ]; then - echo 'Failure: Hash type unknown.' >&2 - exit 1; - fi - hashName=$(echo ${hashType}| sed -e s'|sum||') - - if [ ${CHECK} -eq 1 ]; then - which ${hashType} >/dev/null 2>&1 - if [[ $? -ne 0 ]]; then - echo "Failure: You need ${hashType} in PATH." >&2 - exit 1; - fi - fi - if [ -e ${fname} -a ${CHECK} -eq 1 ]; then - # check hash sum and force download if wrong - downsum=$(${hashType} ${fname} | awk '{print $1}') - if [ "${fsha}" != "${downsum}" ]; then - rm -f ${fname} - fi - fi - if [ ! -e "${fname}" ]; then - for br in "${branches[@]}" - do - br=$(echo ${br}| sed -e s'|remotes/origin/||') - # Try the branch-specific lookaside structure - url="${SURL}/${pn}/${br}/${fsha}" - echo "Retrieving ${url}" - HTTP_CODE=$(curl -L ${QUIET} -H Pragma: -o "${fname}" -R -S --fail --retry 5 "${url}" --write-out "%{http_code}" || true) - echo "Returned ${HTTP_CODE}" - if [[ ${HTTP_CODE} -gt 199 && ${HTTP_CODE} -lt 300 ]] ; then - echo "bailing" - break - fi - # Try the hash-specific lookaside structure - url="${SURL}/$pn/$fname/${hashName}/$fsha/$fname" - echo "Retrieving ${url}" - curl -L ${QUIET} -H Pragma: -o "${fname}" -R -S --fail --retry 5 "${url}" && break - done - else - echo "${fname} exists. skipping" - fi - if [ ${CHECK} -eq 1 ]; then - downsum=$(${hashType} ${fname} | awk '{print $1}') - if [ "${fsha}" != "${downsum}" ]; then - rm -f ${fname} - echo "Failure: ${fname} hash does not match hash from the .metadata file" >&2 - exit 1; - fi - fi - fi - done < "${meta}" - -fi diff --git a/lookaside_upload b/lookaside_upload deleted file mode 100644 index 05dfae4..0000000 --- a/lookaside_upload +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/bash - -# This script will let you upload sources/blobs to new CentOS lookaside cache -# requirements: -# - curl -# - valid TLS certs from https://accounts.centos.org (or dev instance for testing) -# - valid group membership to let you upload to specific "branch" - -# Some variables, switch for new url -lookaside_baseurl="https://git.centos.org" - -function usage { - -cat << EOF - -You need to call the script like this : $0 -arguments - - -f : filename/source to upload (required, default:none) - -n : package name for that source (requred, default:none, example "httpd") - -b : "branch" where to upload to (required, default:none, example "c7-sig-core") - -h : display this help - -EOF - -} - -function varcheck { -if [ -z "$1" ] ; then - usage - exit 1 -fi - -} - -function f_log { - echo "[+] CentOS Lookaside upload tool -> $*" -} - - - -while getopts “hf:n:b:” OPTION -do - case $OPTION in - h) - usage - exit 1 - ;; - f) - file=$OPTARG - ;; - n) - pkgname=$OPTARG - ;; - b) - branch=$OPTARG - ;; - ?) - usage - exit - ;; - esac -done - -varcheck $file -varcheck $pkgname -varcheck $branch - -if [ ! -f ~/.centos.cert ] ;then - f_log "No mandatory TLS cert found (~/.centos.cert) .." - f_log "please use centos-cert to retrieve your ACO TLS cert" - exit 1 -fi - -if [ ! -f "${file}" ] ;then - f_log "Source to upload ${file} not found" - exit 2 -fi - -checksum=$(sha1sum ${file}|awk '{print $1}') - -f_log "Checking if file already uploaded" -local_size=$(stat -c %s ${file}) -http_code=$(curl -s -o /dev/null -w "%{http_code}" ${lookaside_baseurl}/sources/${pkgname}/${branch}/${checksum}) -remote_size=$(curl --silent -i --head ${lookaside_baseurl}/sources/${pkgname}/${branch}/${checksum}|grep "Content-Length"|cut -f 2 -d ':'|tr -d [:blank:]|tr -d '\r') -if [ "$http_code" -eq 200 ] && [ "$local_size" -eq "$remote_size" ] ; then - f_log "File already uploaded" - exit 3 -fi - -f_log "Initialing new upload to lookaside" -f_log "URL : $lookaside_baseurl" -f_log "Source to upload : ${file} " -f_log "Package name: $pkgname" -f_log "sha1sum: ${checksum}" -f_log "Remote branch: ${branch}" -f_log " ====== Trying to upload =======" -echo "" -curl ${lookaside_baseurl}/sources/upload.cgi \ - --fail \ - --cert ~/.centos.cert \ - --form "name=${pkgname}" \ - --form "branch=${branch}" \ - --form "sha1sum=${checksum}" \ - --form "file=@${file}" \ - --progress-bar | tee /dev/null - -upload_result="${PIPESTATUS[0]}" - -if [ "$upload_result" -ne "0" ] ;then - f_log "[ERROR] Something didn't work to push to ${lookaside_baseurl}/sources/${pkgname}/${branch}/${checksum}" - f_log "[ERROR] Verify at the server side" - exit 1 -fi - -f_log "Validating that source was correctly uploaded ...." -remote_size=$(curl --silent -i --head ${lookaside_baseurl}/sources/${pkgname}/${branch}/${checksum}|grep "Content-Length"|cut -f 2 -d ':'|tr -d [:blank:]|tr -d '\r') -if [ "$local_size" -eq "$remote_size" ] ; then - f_log "[SUCCESS] Source should be available at ${lookaside_baseurl}/sources/${pkgname}/${branch}/${checksum}" -else - f_log "[ERROR] it seems there is a mismatch with source size and remote file size" -fi - - diff --git a/lookaside_upload_sig b/lookaside_upload_sig deleted file mode 100644 index ab12641..0000000 --- a/lookaside_upload_sig +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/bash - -# This script will let you upload sources/blobs to new CentOS lookaside cache -# requirements: -# - curl -# - valid TLS certs from https://accounts.centos.org (or dev instance for testing) - -# Some variables, switch for new url -lookaside_baseurl=$LOOKASIDE_BASEURL -hash_parameter="sha512" - -if [ -z $LOOKASIDE_BASEURL ]; then - lookaside_baseurl="https://git.centos.org" - echo "Base URL set to default: $lookaside_baseurl" -fi - -function usage { - - cat < ./lookaside_upload_sig ... -EOF -} - -function varcheck { - if [ -z "$1" ]; then - usage - exit 1 - fi - -} - -function f_log { - echo "[+] CentOS Lookaside upload tool -> $*" -} - -while getopts “hf:n:” OPTION; do - case $OPTION in - h) - usage - exit 1 - ;; - f) - file=$OPTARG - ;; - n) - pkgname=$OPTARG - ;; - ?) - usage - exit - ;; - esac -done - -varcheck $file -varcheck $pkgname - -if [ ! -f ~/.centos.cert ]; then - f_log "No mandatory TLS cert found (~/.centos.cert) .." - f_log "please use centos-cert to retrieve your ACO TLS cert" - exit 1 -fi - -if [ ! -f "${file}" ]; then - f_log "Source to upload ${file} not found" - exit 2 -fi - -checksum="$(${hash_parameter}sum ${file} | awk '{print $1}')" - -f_log "Checking if file already uploaded" -local_size=$(stat -c %s ${file}) -http_code=$(curl -s -o /dev/null -w "%{http_code}" ${lookaside_baseurl}/sources/${pkgname}/${file}/${hash_parameter}/${checksum}/${file}) -remote_size=$(curl --silent -i --head ${lookaside_baseurl}/sources/${pkgname}/${file}/${hash_parameter}/${checksum}/${file} | grep "Content-Length" | cut -f 2 -d ':' | tr -d [:blank:] | tr -d '\r') - -if [ "$http_code" -eq 200 ] && [ "$local_size" -eq "$remote_size" ]; then - f_log "File already uploaded" - exit 3 -fi - -f_log "Initialing new upload to lookaside" -f_log "URL : $lookaside_baseurl" -f_log "Source to upload : ${file} " -f_log "Hash parameter : ${hash_parameter}" -f_log "Package name: $pkgname" -f_log "${hash_parameter}sum: ${checksum}" -f_log " ====== Trying to upload =======" -echo "" - -# Concatenating sha512 -hash_cmd="$(${hash_parameter}sum ${file} | awk '{print $1}')" -curl ${lookaside_baseurl}/sources/upload_sig.cgi \ - --fail \ - --cert ~/.centos.cert \ - --form "name=${pkgname}" \ - --form "hash=${hash_parameter}" \ - --form "${hash_parameter}sum=${hash_cmd}" \ - --form "file=@${file}" \ - --progress-bar | tee /dev/null - -upload_result="${PIPESTATUS[0]}" - -if [ "$upload_result" -ne "0" ]; then - f_log "[ERROR] Something didn't work to push to ${lookaside_baseurl}/sources/${pkgname}/${checksum}" - f_log "[ERROR] Verify at the server side" - exit 1 -fi - -f_log "Validating that source was correctly uploaded ...." -remote_size=$(curl --silent -i --head ${lookaside_baseurl}/sources/${pkgname}/${file}/${hash_parameter}/${checksum}/${file} | grep "Content-Length" | cut -f 2 -d ':' | tr -d [:blank:] | tr -d '\r') -if [ "$local_size" -eq "$remote_size" ]; then - f_log "[SUCCESS] Source should be available at ${lookaside_baseurl}/sources/${pkgname}/${file}/${hash_parameter}/${checksum}/${file}" -else - f_log "[ERROR] it seems there is a mismatch with source size and remote file size" -fi