[PATCH] Added 'make rpm'

Shawn Wells shawn at redhat.com
Mon Apr 2 18:27:55 UTC 2012


On 4/2/12 1:52 PM, Spencer R. Shimko wrote:
> On 4/2/12 1:31 PM, "Shawn Wells"<shawn at redhat.com>  wrote:
>> >  
>> >+rpm: dist
>> >+
>> >+    # A few quick notes on preparing your system to build the SSG RPMs:
>> >+    # (1) May the flies of a thousand horses annoy you for eternity
>> >+    #     if you build an RPM as root. Don't do it!
>> >+    # (2) This build process assumes you have your rpmbuild structure
>> >setup
>> >+    #     $ sudo yum -y install rpm-build
>> >+    #     $ mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
>> >+    # (3) The value if ${DIST} in this Makefile needs to match
>> >+    #     the %{name}-%{version} string from the .spec file, i.e.
>> >+    #     scap-security-guide-alpha
>> >+    # (4) If you're making an RPM, chances are the code has changed. Make
>> >+    #     sure you update the %changelog in the .spec to reflect what's
>> >new
>> >+
>> >+    # copy template .spec over to rpmbuild
>> >+    cp ${IN}/rpmbuild/scap-security-guide-alpha.spec ${OUT}/
>> >+
>> >+    # tar up the sources
>> >+    tar -zcvf ${OUT}/scap-security-guide-alpha.tar.gz ${DIST}
>> >+    mv ${OUT}/scap-security-guide-alpha.tar.gz ~/rpmbuild/SOURCES/
>> >+
>> >+    # let's see if a build works
>> >+    rpmbuild -ba ${OUT}/scap-security-guide-alpha.spec
>> >+
>> >+    # Our RPM(s) will be waiting for us in ${HOMEDIR}, so copy them back
>> >+    mv ~/rpmbuild/RPMS/  ${OUT}/
>> >+
>> >+
> I'm not happy with assumptions regarding user environment.  We don't
> control rpmbuild or the RPM macros file.  Barring those issues this also
> makes some assumptions about directory structure that might not be
> correct.

All valid. I wanted to get *something* in there that would work on a 
stock RHEL6 build system.

What I'd *really* like to see is input/rpmbuild be setup as a localized 
buildroot which would allow us to be completely self contained (and much 
more elegant). But I have no idea how to do that and in mucking around 
it didn't become apparent to me. Hopefully someone with more RPM 
knowledge than me could patch to make that happen.



>> >  clean:
>> >-    rm -f ${OUT}/*.xml ${OUT}/*.html ${OUT}/*.pdf
>> >+    rm -f ${OUT}/*.xml ${OUT}/*.html ${OUT}/*.pdf  ${OUT}/*.spec
>> >${OUT}/*.tar ${OUT}/*.gz ${OUT}/*.ini
>> >       rm -f ${DIST}/policytables/*.html ${DIST}/guide/*.html
>> >${DIST}/content/*.xml
>> >+    rm -rf ${OUT}/RPMS/
> Should these be moved into a bare target?

Yes, I caught that too. Done.

>> >diff --git a/rhel6/src/input/rpmbuild/scap-security-guide-alpha.spec
>> >b/rhel6/src/input/rpmbuild/scap-security-guide-alpha.spec
>> >new file mode 100644
>> >index 0000000..01ad83f
>> >--- /dev/null
>> >+++ b/rhel6/src/input/rpmbuild/scap-security-guide-alpha.spec
>> >@@ -0,0 +1,64 @@
>> >+Name:           scap-security-guide
>> >+Version:        alpha
>> >+Release:        1%{?dist}
>> >+Summary:        The scap-security-guide project, or SSG for short, aims
>> >to deliver security guidance, baselines, and associated validation
>> >mechanisms for Red Hat Enterprise Linux.
>> >+
>> >+Group:          Testing
>> >+License:        GPL
>> >+URL:https://fedorahosted.org/scap-security-guide/
>> >+
>> >+Source0:        %{name}-%{version}.tar.gz
>> >+BuildRoot:      %(mktemp -ud
>> >%{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
>> >+
>> >+BuildArch:    noarch
>> >+
>> >+BuildRequires:  /bin/rm, /bin/mkdir, /bin/cp
>> >+Requires:       /bin/bash, /bin/date, /usr/bin/oscap
>> >+
>> >+%description
>> >+Today the SSG project provides guidance against U.S. Government
>> >requirements,
>> >+including those of the U.S. Department of Defense and U.S. Intelligence
>> >Community.
>> >+Many U.S. Government policies, such as NIST 800-53 provide prose stating
>> >that
>> >+System Administrators must audit "privileged user actions," but do not
>> >define
>> >+what such actions are. The SSG bridges the gap between generalized U.S.
>> >+Government Policy and specific implementation guidance.
>> >+
>> >+To lean more about the SCAP Security Guide project, please
>> >+visithttps://fedorahosted.org/mailman/listinfo/scap-security-guide. Here
>> >+you will be able to find documentation, support, and information on
>> >getting
>> >+involved in the SCAP Security Guide community.
>> >+
>> >+%prep
>> >+%setup -q
>> >+
>> >+
>> >+%build
>> >+#configure
>> >+#`make %{?_smp_mflags}
>> >+
>> >+
>> >+%install
>> >+rm -rf $RPM_BUILD_ROOT
>> >+#make install DESTDIR=$RPM_BUILD_ROOT
>> >+mkdir -p $RPM_BUILD_ROOT/usr/local/%{name}/content
>> >+mkdir -p $RPM_BUILD_ROOT/usr/local/%{name}/guide
>> >+mkdir -p $RPM_BUILD_ROOT/usr/local/%{name}/policytables
>> >+mkdir -p $RPM_BUILD_ROOT/usr/local/%{name}/STIG-draft
>> >+mkdir -p $RPM_BUILD_ROOT/usr/local/%{name}/USGCB-submission
> How does this work if $RPM_BUILD_ROOT has spaces?

Assumed stock environment. Patches welcome.


>> >+
>> >+cp -r * $RPM_BUILD_ROOT/usr/local/%{name}/
>> >+
>> >+
>> >+%clean
>> >+rm -rf $RPM_BUILD_ROOT
>> >+
>> >+
>> >+%files
>> >+%defattr(-,root,root,-)
>> >+%doc
>> >+
>> >+%attr(0750,root,root)/usr/local/scap-security-guide/
>> >+
>> >+%changelog
>> >+* Mon Apr 02 2012 Shawn Wells<shawn at redhat.com>
>> ><mailto:shawn at redhat.com>  1.0-1
>> >+- First attempt at SSG RPM. May ${diety} help us...
>> >diff --git a/rhel6/src/output/.gitignore b/rhel6/src/output/.gitignore
>> >index 7206c02..4bbeae5 100644
>> >--- a/rhel6/src/output/.gitignore
>> >+++ b/rhel6/src/output/.gitignore
>> >@@ -3,3 +3,8 @@
>> >  *.html
>> >  *.pdf
>> >  *.ini
>> >+*.spec
>> >+*.tar
>> >+*.gz
>> >+scap-security-guide-*/
>> >+RPMS/
>> >-- 
>> >1.7.1
>> >
>> >
>> >  
>> >  
>> >
>> >  
>> >  
>> >      Pushed
> I'd prefer to wait for at least one ACK before pushing.  IMO an ACK from
> anyone with commit access should be sufficient for a merge/push.  Thoughts?

Personally I'd like to see *every* patch hit the mailing list and get 
1-2 ack's, but it's been the wild west as we get core content created. 
While I want it now, I'm thinking that once alpha drops all patches need 
to be sent out before commits.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120402/488efb46/attachment-0001.html>


More information about the scap-security-guide mailing list