fedora-extras/rpmbuild.sh at main · rusty-snake/fedora-extras · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
#!/bin/bash

set -e

shopt -s nullglob

cd -P -- "$(readlink -e "$(dirname "$0")")"

USER="${USER:-$(id -un)}"
HOME="${HOME:-$(getent passwd "$USER" | cut -d: -f7)}"
XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"

usage() {
	cat <<-EOM
	./rpmbuild.sh [-hlnsi] <package>

	  -h  Show this help and exit.
	  -l  Do not run rpmlint.
	  -n  Disable build dependencies check, useful if they aren't installed via dnf.
	  -s  Run rpmbuild unsandboxed.
	  -i  Allow rpmbuild to access the network (ignore if used together with -s).
	EOM
}

while getopts "hlnsi" opt; do
	case $opt in
		h)
			usage
			exit 0
		;;
		l)
			RBS_NOLINT=true
		;;
		n)
			RBS_NODEPS=true
		;;
		s)
			RBS_NOSANDBOX=true
		;;
		i)
			RBS_SANDBOX_INET=true
		;;
		*)
			exit 2
		;;
	esac
done
PACKAGE="${!OPTIND}"

if [[ -z "$PACKAGE" ]]; then
	usage
	exit 2
fi

REQUIRED_PROGRAMS=(rpmbuild rpmlint spectool)
for program in "${REQUIRED_PROGRAMS[@]}"; do
	if ! command -v "$program" >&-; then
		echo "rpmbuild.sh: Please install $program: run0 sh -c \"dnf install '\$(dnf repoquery --whatprovides \"/usr/bin/$program\" 2>/dev/null | tail -n1)'\""
		exit 5
	fi
done

TOPDIR="$(mktemp -d /var/tmp/rpmbuild.sh-XXXXXX)"
# shellcheck disable=SC2064
trap "rm -rf '$TOPDIR'" EXIT

BUILDDIR=$(rpm --define "_topdir $TOPDIR" --eval %_builddir)
RPMDIR=$(rpm --define "_topdir $TOPDIR" --eval %_rpmdir)
SOURCEDIR=$(rpm --define "_topdir $TOPDIR" --eval %_sourcedir)
SPECDIR=$(rpm --define "_topdir $TOPDIR" --eval %_specdir)
SRPMDIR=$(rpm --define "_topdir $TOPDIR" --eval %_srcrpmdir)
mkdir -p "$BUILDDIR" "$RPMDIR" "$SOURCEDIR" "$SPECDIR" "$SRPMDIR"

cp "$PACKAGE/$PACKAGE.spec" "$SPECDIR/$PACKAGE.spec"
if [[ -e "$PACKAGE/setup_sourcedir.sh" ]]; then
	(cd "$PACKAGE" && source ./setup_sourcedir.sh)
else
	spectool -C "$XDG_CACHE_HOME/rpmbuild.sh/$PACKAGE" --gf "$SPECDIR/$PACKAGE.spec"
	while read -r source; do
		cp "$XDG_CACHE_HOME/rpmbuild.sh/$PACKAGE/$source" "$SOURCEDIR/$source"
	done < <(spectool --lf "$SPECDIR/$PACKAGE.spec" | xargs -d"\n" -L1 basename)
fi

BWRAP_ARGS=(
	# TODO: --seccomp
	--die-with-parent
	--unshare-all
	--new-session
	--cap-drop all
	--proc /proc
	--dev /dev
	--ro-bind /usr /usr
	--symlink usr/bin /bin
	--symlink usr/lib /lib
	--symlink usr/lib64 /lib64
	--symlink usr/sbin /sbin
	--dir /tmp
	--ro-bind-try /etc/alternatives /etc/alternatives
	--ro-bind-try /etc/dnf /etc/dnf
	--ro-bind-try /etc/rpm /etc/rpm
	--ro-bind-try /etc/rpmrc /etc/rpmrc
	--ro-bind-try /etc/selinux /etc/selinux
	--ro-bind-try /etc/yum.repos.d /etc/yum.repos.d
	--ro-bind-try /var/cache/dnf /var/cache/dnf
	--ro-bind-try /var/lib/dnf /var/lib/dnf
	--ro-bind-try /var/lib/rpm /var/lib/rpm
	--dir /var/tmp
	--bind "$TOPDIR" "$TOPDIR"
)
if [[ -n "$RBS_SANDBOX_INET" ]]; then
	BWRAP_ARGS+=(
		--share-net
		--ro-bind-try /etc/resolv.conf /etc/resolv.conf
		--ro-bind-try /etc/pki /etc/pki
		--ro-bind-try /etc/ssl /etc/ssl
	)
fi

RPMBUILD_ARGS=(
	--nodebuginfo
	--define "_topdir $TOPDIR"
)
if [[ -n "$RBS_NODEPS" ]]; then
	RPMBUILD_ARGS+=(--nodeps)
fi

RPMBUILD_CMD=(rpmbuild "${RPMBUILD_ARGS[@]}" -bb "$SPECDIR/$PACKAGE.spec")

if [[ -n "$RBS_NOSANDBOX" ]]; then
	"${RPMBUILD_CMD[@]}"
else
	bwrap "${BWRAP_ARGS[@]}" -- "${RPMBUILD_CMD[@]}"
fi

if [[ -z "$RBS_NOLINT" ]]; then
	rpmlint --info "$SPECDIR"/*.spec "$RPMDIR"/*/*.rpm "$SRPMDIR"/*.rpm ||:
fi

cp "$RPMDIR"/*/*.rpm "$SRPMDIR"/*.rpm .