[PATCH 1/4] Switch rpm gen to use command-line macro defs.

Spencer Shimko sshimko at tresys.com
Fri Apr 20 14:13:46 UTC 2012


Instead of relying on a user's ~/.rpmmacros file define
macros via the command line thus avoiding any deps on
user environment (aside from rpmbuild).

Additionally, gen the RPM from a src RPM ensuring the
src RPM is suitable for distribution to vendors.

Signed-off-by: Spencer Shimko <sshimko at tresys.com>
---
 rhel6/src/Makefile                                 |   97 ++++++++++++++-----
 .../input/rpmbuild/scap-security-guide-alpha.spec  |   11 ++-
 2 files changed, 78 insertions(+), 30 deletions(-)

diff --git a/rhel6/src/Makefile b/rhel6/src/Makefile
index cc6f237..763a18a 100644
--- a/rhel6/src/Makefile
+++ b/rhel6/src/Makefile
@@ -1,8 +1,48 @@
+VERSION := 0.1
+RELEASE := 1
 IN=input
 OUT=output
 TRANS=transforms
 REFS=references
-DIST=scap-security-guide-alpha
+PKGNAME := scap-security-guide
+DIST := $(PKGNAME)-$(VERSION)
+
+ARCH := noarch
+VENDOR := scap-security-guide
+PACKAGER := scap-security-guide
+
+###################################################
+# Used for rolling an RPM
+
+RPM_SPEC := ${IN}/rpmbuild/scap-security-guide-alpha.spec
+
+ROOT_DIR ?= ${CURDIR}
+OUTPUT_DIR ?= ${ROOT_DIR}
+SRPM_OUTPUT_DIR ?= ${OUTPUT_DIR}
+
+# This file will be created by tar'ing up ${OUT}/
+TARBALL = ${SRPM_OUTPUT_DIR}/${DIST}.tar.gz
+
+# exhaustive list of deps for the RPM, used to determine if RPM needs to be rebuilt
+TAR_DEPS = $(wildcard $(DIST)/*)
+RPM_DEPS := $(TARBALL) $(RPM_SPEC) Makefile
+
+RPM_TMPDIR ?= ${ROOT_DIR}/tmp
+RPM_TOPDIR ?= ${RPM_TMPDIR}/src/redhat
+RPM_BUILDROOT ?= ${RPM_TMPDIR}/rpm-buildroot
+
+MKDIR = test -d $(1) || mkdir -p $(1)
+
+RPMBUILD_ARGS := --define '_topdir ${RPM_TOPDIR}'  --define '_tmppath ${RPM_TMPDIR}'
+
+define rpm-prep
+	 $(call MKDIR,$(RPM_TOPDIR)/SOURCES)
+	 $(call MKDIR,$(RPM_TOPDIR)/SPECS)
+	 $(call MKDIR,$(RPM_TOPDIR)/BUILD)
+	 $(call MKDIR,$(RPM_TOPDIR)/RPMS/$(ARCH))
+	 $(call MKDIR,$(RPM_TOPDIR)/SRPMS)
+endef
+
 
 all: shorthand-guide shorthand2xccdf tables guide checks content dist rpm
 
@@ -21,12 +61,12 @@ checks:
 	xmlwf ${IN}/checks/*.xml
 	${TRANS}/combinechecks.py ${IN}/checks > ${OUT}/rhel6-oval.xml
 	xmllint --format --output ${OUT}/rhel6-oval.xml ${OUT}/rhel6-oval.xml 
-#       SCC might return someday
+#	SCC might return someday
 
 
 guide: shorthand-guide shorthand2xccdf 
 	oscap xccdf generate guide --profile allrules ${OUT}/rhel6-xccdf.xml > ${OUT}/rhel6-guide.html
-#       specifying a nonexistent profile, "allrules," to make oscap print all Rules
+#	specifying a nonexistent profile, "allrules," to make oscap print all Rules
 
 # example, if needed: for converting XCCDF into shorthand
 #xccdf2shorthand:
@@ -75,6 +115,9 @@ eval-common:
 	oscap xccdf eval --profile common --results /tmp/results-test.xml ${OUT}/rhel6-xccdf-scap-security-guide.xml
 
 dist: content guide tables
+	$(call MKDIR,${DIST}/guide)
+	$(call MKDIR,${DIST}/content)
+	$(call MKDIR,${DIST}/policytables)
 	cp -r ${IN}/dist_template/ ${DIST}/
 	cp ${OUT}/rhel6-guide.html ${DIST}/guide
 	cp ${OUT}/rhel6-xccdf-scap-security-guide.xml ${DIST}/content
@@ -84,35 +127,37 @@ dist: content guide tables
 	cp ${OUT}/rhel6-table-cnssrefs.html ${DIST}/policytables
 	cp ${OUT}/rhel6-table-dcidrefs.html ${DIST}/policytables
 
-rpm: dist
+tarball: ${TARBALL}
 
-	# A few quick notes on preparing your system to build the SSG RPMs:
-	# (1) May the flies of a thousand horses annoy you for eternity
-	#     if you build an RPM as root. Don't do it!
-	# (2) This build process assumes you have your rpmbuild structure setup
-	# 	$ sudo yum -y install rpm-build
-	# 	$ mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
-	# (3) The value if ${DIST} in this Makefile needs to match
-	#     the %{name}-%{version} string from the .spec file, i.e.
-	#     scap-security-guide-alpha
-	# (4) If you're making an RPM, chances are the code has changed. Make
-	#     sure you update the %changelog in the .spec to reflect what's new
+${TARBALL}: dist $(TAR_DEPS)
+	tar -czf $@ $(TAR_DEPS)
 
-	# copy template .spec over to rpmbuild
-	cp ${IN}/rpmbuild/scap-security-guide-alpha.spec ${OUT}/
+srpm: ${SRPM_OUTPUT_DIR}/${DIST}-${RELEASE}.src.rpm
 
-	# tar up the sources
-	tar -zcvf ${OUT}/scap-security-guide-alpha.tar.gz ${DIST}
-	mv ${OUT}/scap-security-guide-alpha.tar.gz ~/rpmbuild/SOURCES/
-	
-	# let's see if a build works
-	rpmbuild -ba ${OUT}/scap-security-guide-alpha.spec
+${SRPM_OUTPUT_DIR}/${DIST}-${RELEASE}.src.rpm: $(RPM_DEPS)
+	echo "Building ${PKGNAME} SRPM..."
+	$(call rpm-prep)
+	cp ${TARBALL} ${RPM_TOPDIR}/SOURCES/
+	echo -e "%define arch $(ARCH)\n%define pkgname ${PKGNAME}\n%define _sysconfdir /etc\n%define version ${VERSION}\n%define release ${RELEASE}\n%define vendor ${VENDOR}\n%define packager ${PACKAGER}" > ${RPM_TOPDIR}/SPECS/$(notdir ${RPM_SPEC})
+	cat ${RPM_SPEC} >> ${RPM_TOPDIR}/SPECS/$(notdir ${RPM_SPEC})
+	cd ${RPM_TOPDIR} && rpmbuild ${RPMBUILD_ARGS} --target=$(ARCH) -bs SPECS/$(notdir ${RPM_SPEC}) --nodeps
+	mv  ${RPM_TOPDIR}/SRPMS/${DIST}-${RELEASE}.src.rpm ${SRPM_OUTPUT_DIR}
 
-	# Our RPM(s) will be waiting for us in ${HOMEDIR}, so copy them back
-	mv ~/rpmbuild/RPMS/ ${OUT}/
+rpm: ${OUTPUT_DIR}/${DIST}-${RELEASE}.$(ARCH).rpm
 
+${OUTPUT_DIR}/${DIST}-${RELEASE}.$(ARCH).rpm: ${SRPM_OUTPUT_DIR}/${DIST}-${RELEASE}.src.rpm
+	 @echo "Building ${DIST} RPM..."
+	 $(call rpm-prep)
+	 cd ${RPM_TOPDIR}/SRPMS && rpmbuild --rebuild --target=$(ARCH) ${RPMBUILD_ARGS} --buildroot ${RPM_BUILDROOT} -bb $<
+	 mv  ${RPM_TOPDIR}/RPMS/$(ARCH)/${DIST}-${RELEASE}*.rpm ${OUTPUT_DIR}
 
 clean:
 	rm -f ${OUT}/*.xml ${OUT}/*.html ${OUT}/*.pdf  ${OUT}/*.spec ${OUT}/*.tar ${OUT}/*.gz ${OUT}/*.ini
 	rm -rf ${DIST}/
-	rm -rf ${OUT}/RPMS/
+	rm -rf ${RPM_TMPDIR}
+
+bare: clean
+	rm -rf $(TARBALL) $(OUTPUT_DIR)/$(notdir ${OUTPUT_DIR}/${DIST}-${RELEASE}.$(ARCH).rpm)
+	rm -rf $(OUTPUT_DIR)/$(notdir ${SRPM_OUTPUT_DIR}/${DIST}-${RELEASE}.src.rpm)
+
+.PHONY: rpm srpm tarball clean all shorthand-guide shorthand2xccdf checks guide table-profilenistrefs table-refs table-srgmap tables content validate eval-test eval-ftp eval-common
diff --git a/rhel6/src/input/rpmbuild/scap-security-guide-alpha.spec b/rhel6/src/input/rpmbuild/scap-security-guide-alpha.spec
index 01ad83f..b97debf 100644
--- a/rhel6/src/input/rpmbuild/scap-security-guide-alpha.spec
+++ b/rhel6/src/input/rpmbuild/scap-security-guide-alpha.spec
@@ -1,6 +1,6 @@
 Name:           scap-security-guide
-Version:        alpha
-Release:        1%{?dist}
+Version:        %{version}
+Release:        %{release}
 Summary:        The scap-security-guide project, or SSG for short, aims to deliver security guidance, baselines, and associated validation mechanisms for Red Hat Enterprise Linux.
 
 Group:          Testing
@@ -10,7 +10,7 @@ URL:            https://fedorahosted.org/scap-security-guide/
 Source0:        %{name}-%{version}.tar.gz
 BuildRoot:      %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
-BuildArch:	noarch
+BuildArch:	%{arch}
 
 BuildRequires:  /bin/rm, /bin/mkdir, /bin/cp
 Requires:       /bin/bash, /bin/date, /usr/bin/oscap
@@ -29,7 +29,7 @@ you will be able to find documentation, support, and information on getting
 involved in the SCAP Security Guide community.
 
 %prep
-%setup -q
+%setup -q 
 
 
 %build
@@ -60,5 +60,8 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0750,root,root)/usr/local/scap-security-guide/
 
 %changelog
+* Thu Apr 19 2012 Spencer Shimko <sshimko at tresys.com> 1.0-2
+- Minor updates to pass some variables in from build system.
+
 * Mon Apr 02 2012 Shawn Wells <shawn at redhat.com> 1.0-1
 - First attempt at SSG RPM. May ${diety} help us...
-- 
1.7.1



More information about the scap-security-guide mailing list