diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/gating.yaml b/gating.yaml index c60f9b5..c8a218f 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,9 +1,14 @@ --- !Policy product_versions: - fedora-* -decision_contexts: - - bodhi_update_push_testing - - bodhi_update_push_stable +decision_context: bodhi_update_push_stable +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_testing subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/oci-seccomp-bpf-hook.spec b/oci-seccomp-bpf-hook.spec index 061a7e2..c695c58 100644 --- a/oci-seccomp-bpf-hook.spec +++ b/oci-seccomp-bpf-hook.spec @@ -1,4 +1,8 @@ +%global with_devel 0 +%global with_bundled 1 %global with_debug 1 +%global with_check 0 +%global with_unit_test 0 %if 0%{?with_debug} %global _find_debuginfo_dwz_opts %{nil} @@ -7,21 +11,35 @@ %global debug_package %{nil} %endif -%global gomodulesmode GO111MODULE=on +%if 0%{?rhel} > 7 && ! 0%{?fedora} +%define gobuild(o:) \ +go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%else +%if ! 0%{?gobuild:1} +%define gobuild(o:) GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v -x %{?**}; +%endif +%endif -Name: oci-seccomp-bpf-hook -Version: 1.2.10 -License: Apache-2.0 and BSD-2-Clause and BSD-3-Clause and ISC and MIT -Release: %autorelease -# use the same arch definitions as present in the bcc package -ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl +%global provider github +%global provider_tld com +%global project containers +%global repo oci-seccomp-bpf-hook +# https://github.com/containers/oci-seccomp-bpf-hook +%global import_path %{provider}.%{provider_tld}/%{project}/%{repo} +%global git0 https://%{provider}.%{provider_tld}/%{project}/%{repo} +%global commit0 9fac5591f37a857d13850e555639843c06ee910c +%global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) + +Name: %{repo} +Epoch: 100 +Version: 1.2.4 +Release: 2.git%{shortcommit0}%{?dist} Summary: OCI Hook to generate seccomp json files based on EBF syscalls used by container -URL: https://github.com/containers/%{name} -# Tarball fetched from upstream -Source0: %{url}/archive/v%{version}.tar.gz +License: ASL 2.0 +URL: %{git0} +Source0: %{git0}/archive/%{commit0}.tar.gz BuildRequires: golang BuildRequires: go-md2man -BuildRequires: go-rpm-macros BuildRequires: glib2-devel BuildRequires: glibc-devel BuildRequires: bcc-devel @@ -35,7 +53,7 @@ Enhances: cri-o %description %{summary} -%{name} provides a library for applications looking to use +%{repo} provides a library for applications looking to use the Container Pod concept popularized by Kubernetes. %package tests @@ -51,29 +69,45 @@ Requires: podman This package contains system tests for %{name} %prep -%autosetup -Sgit -n %{name}-%{version} -sed -i 's;HOOK_BIN_DIR;%{_libexecdir}/oci/hooks.d;' %{name}.json +%autosetup -Sgit -n %{name}-%{commit0} +sed -i '/$(MAKE) -C docs install/d' Makefile +sed -i 's/HOOK_BIN_DIR/\%{_usr}\/libexec\/oci\/hooks.d/' %{name}.json sed -i '/$(HOOK_DIR)\/%{name}.json/d' Makefile - -%build -%set_build_flags -export CGO_CFLAGS=$CFLAGS -# These extra flags present in $CFLAGS have been skipped for now as they break the build -CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-flto=auto//g') -CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-Wp,D_GLIBCXX_ASSERTIONS//g') -CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1//g') - -%ifarch x86_64 -export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full" +%ifarch armv7hl +sed -i 's/func lostCallback(cbCookie unsafe.Pointer, lost C.ulong)/func lostCallback(cbCookie unsafe.Pointer, lost C.uint64_t)/' vendor/github.com/iovisor/gobpf/bcc/perf.go %endif -export LDFLAGS="-X main.version=%{version}" -%gobuild -o bin/%{name} . +%build +export GO111MODULE=off +export GOPATH=$(pwd):$(pwd)/_build +export CGO_CFLAGS="-O2 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -ffat-lto-objects -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64" +%ifarch x86_64 +export CGO_CFLAGS="$CGO_CFLAGS -m64 -mtune=generic" +%if 0%{?fedora} || 0%{?centos} >= 8 +export CGO_CFLAGS="$CGO_CFLAGS -fcf-protection" +%endif +%endif +# These extra flags present in %%{optflags} have been skipped for now as they break the build +#export CGO_CFLAGS="$CGO_CFLAGS -flto=auto -Wp,D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1" -%{__make} docs +mkdir _build +pushd _build +mkdir -p src/%{provider}.%{provider_tld}/%{project} +ln -s ../../../../ src/%{import_path} +popd +ln -s vendor src + +export GOPATH=$(pwd)/_build:$(pwd) +export LDFLAGS="-X main.version=%{version}" +%gobuild -o bin/%{name} %{import_path} + +pushd docs +go-md2man -in %{name}.md -out %{name}.1 +popd %install -%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} install.docs-nobuild install-nobuild +%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} install-nobuild +%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} GOMD2MAN=go-md2man -C docs install-nobuild install -d -p %{buildroot}/%{_datadir}/%{name}/test/system cp -pav test/. %{buildroot}/%{_datadir}/%{name}/test/system @@ -111,4 +145,91 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath} %{_datadir}/%{name}/test %changelog -%autochangelog +* Wed Jul 14 2021 Lokesh Mandvekar - 100:1.2.4-2.git9fac559 +- bump epoch to override default package + +* Wed Jul 14 2021 Lokesh Mandvekar - 1.2.4-1.git9fac559 +- update release tag +- built commit 9fac559 + +* Sat Jun 19 2021 RH Container Bot - 1.0.1-0.8.gitb58c502 +- bump to 1.0.1 +- autobuilt b58c502 + +* Fri Jun 11 2021 RH Container Bot - 1.2.4-0.7.git4f66654 +- autobuilt 4f66654 + +* Thu May 06 2021 RH Container Bot - 1.2.4-0.6.git4a30d95 +- autobuilt 4a30d95 + +* Wed Apr 28 2021 RH Container Bot - 1.2.4-0.5.git1910bb0 +- bump to 1.2.4 +- autobuilt 1910bb0 + +* Thu Feb 04 2021 Lokesh Mandvekar - 1.2.2-0.4.git50e7112 +- requires bcc + +* Thu Jan 28 2021 Lokesh Mandvekar - 1.2.2-0.3.git50e7112 +- use latest master commit to check gating tests + +* Thu Jan 28 2021 Eduardo Santiago - 1.2.1-2 +- add -tests subpackage, and gating-test invocations + +* Wed Jan 27 2021 Lokesh Mandvekar - 1.2.2-0.1.git4e42394 +- built latest master commit + +* Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Oct 02 2020 Jindrich Novy - 1.2.0-4 +- use the same arch definitions as present in the bcc package + +* Fri Oct 02 2020 Jindrich Novy - 1.2.0-3 +- exclude also armv7hl arch as bcc is not built there + +* Wed Sep 30 2020 Jindrich Novy - 1.2.0-2 +- fix spec file to accommodate the new upstream release + +* Wed Sep 30 2020 Jindrich Novy - 1.2.0-1 +- update to + https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.0 + +* Sat Aug 01 2020 Fedora Release Engineering - 1.1.1-3 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 1.1.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Fri Jul 17 2020 Jindrich Novy - 1.1.1-1 +- update to + https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.1 + +* Fri Jul 17 2020 Jindrich Novy - 1.1.0-2 +- switch to mainline releases + +* Tue May 19 2020 Lokesh Mandvekar - 1.1.0-1.1.git05a82a1 +- bump version +- reuse Makefile targets + +* Mon Feb 17 2020 Lokesh Mandvekar - 0.0.1-0.6.gitba7bbb16 +- Resolves: #1799105 - solve ftbfs and build latest upstream commit + +* Wed Jan 29 2020 Fedora Release Engineering - 0.0.1-0.5.git3baa603a +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Nov 05 2019 Jindrich Novy - 0.0.1-0.4.git3baa603a +- limit arches to only those supported by bcc so that this can be built + +* Mon Nov 04 2019 Jindrich Novy - 0.0.1-0.3.git3baa603a +- fix the license - should be ASL 2.0 +- use %%gobuild + +* Mon Nov 04 2019 Jindrich Novy - 0.0.1-0.2.git3baa603a +- pull in golang deps as BR + +* Mon Sep 23 2019 Jindrich Novy - 0.0.1-0.1.git3baa603a +- fix spec file and build + +* Sun Sep 22 2019 Dan Walsh - 0.0.1 +- Initial Version diff --git a/plans/main.fmf b/plans/main.fmf deleted file mode 100644 index e6c2ff6..0000000 --- a/plans/main.fmf +++ /dev/null @@ -1,5 +0,0 @@ -summary: Run all smoke tests -discover: - how: fmf -execute: - how: tmt diff --git a/sources b/sources index f35f7c5..6774980 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v1.2.10.tar.gz) = 184045dbbc2d6a08c49939f9fb1dc1ed1c24d5e33005f2f8f3d4d09d2f2edac0f97cf30c27b5fb0afa478a2eb377657952de505076bbddf4be013c11e1c8bac3 +SHA512 (oci-seccomp-bpf-hook-b58c502.tar.gz) = 1fd12763bd3047d0a46018152e7188eb1153c4460beabf68932199a075b9477e55f02a6217880705d27940348353929b298523bf8fa73068556ec22a83c4961c diff --git a/tests/main.fmf b/tests/main.fmf deleted file mode 100644 index 9d3fe93..0000000 --- a/tests/main.fmf +++ /dev/null @@ -1,2 +0,0 @@ -summary: bats tests -test: ./test_osbh.sh diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..c3099ad --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,14 @@ +--- +- hosts: localhost + roles: + - role: standard-test-basic + tags: + - classic + - container + required_packages: + - oci-seccomp-bpf-hook-tests + tests: + - root-test: + dir: ./ + run: ./test_osbh.sh + timeout: 15m