[SSSD] [RFC] Add basic support for CI test execution

Lukas Slebodnik lslebodn at redhat.com
Wed Jun 11 15:19:17 UTC 2014


On (11/06/14 17:28), Nikolai Kondrashov wrote:
>On 06/11/2014 03:46 PM, Lukas Slebodnik wrote:
>>On (11/06/14 14:52), Nikolai Kondrashov wrote:
>>>On 06/11/2014 10:52 AM, Lukas Slebodnik wrote:
>>>>I would like to avoind maintain two different lists with build dependency for
>>>>fedora/rhel based OSes. We already have listed all build dependencies in
>>>>sssd spec file. It acn be used with rhel6, rhel7 and recent versions of fedora.
>>>>You can install build dependencies with command:
>>>>     a) yum-builddep path/to/package.src.rpm
>>>>     b) yum-builddep path/to/package.spec
>>>>
>>>>sssd.spec file can be created from contrib/sssd.spec.in with few replacements.
>>>>     @see contrib/fedora/make_srpm.sh
>>>
>>>The RPM dependencies and CI dependencies are not exactly the same thing. CI
>>>needs some packages the RPM doesn't, andi
>>>it is possible that CI might not need some packages the RPM needs.
>>I don't think so or they are negligible.
>>
>>>Thus, we would still need to maintain an extra
>>>package list for CI purposes.
>>RPM dependencies are subset of CI dependencies.
>
>Even so, we need to have a list of CI-specific dependencies in CI scripts
>anyway.
>
>
>>>The process of extracting the dependencies from the .spec file is
>>>non-straightforward, considering we need to do substitutions to make it valid.
>>>Such code would need to track changes to both the Makefile.am and the .spec
>>>file. This would require having separate code for different distributions,
>>>which is also a maintenance burden.
>>You do no need to extract dependencies from spec.file. We already have tool for
>>this purpose. yum-builddep.
>>If you have problem with yum-builddep you can use rpmbuild as well
>>     e.g. rpm -q -p --requires rpmbuild/SRPMS/sssd-1.11.92-0.fc20.src.rpm
>
>Apart from complicating the process further by requiring to build the source
>package first, this doesn't make much difference, as it would still expand RPM
>macros.
>
>
>>>Then, a rule to run yum-builddep cannot be added to sudoers safely as it
>>>basically allows execution of any code in RPM macros, compared to just adding
>>>a rule to run package installation from repos defined by local admin. This
>>>would force users to either enter sudo password often or significantly lower
>>>security.
>>I cannot see difference between executing yum install and yum-builddep.
>>yum-builddep  is  a program which installs the RPMs needed to build the
>>specified package. It won't execute any any pre(post) scripts from spec file.
>
>It will expand macros, which can include Lua scripts, and those can do
>basically anything. See http://www.rpm.org/wiki/PackagerDocs/RpmLua
>
>Try putting %{lua: os.execute('echo "Hello, world!"')} into a spec file and
>running "sudo yum-builddep" on it.
>
It isn't valid argument. You can execute a shell command from C source code.
    system("echo "Hello, world!");

Solution:
We should not push any patch to CI without reading code.

>
>>>A package missing from CI dependencies would be immediately obvious as CI
>>>builds would fail and it would be easy to then update the lists.
>>RPM dependencies are subset of CI dependencies.
>>
>>you can install CI dependencies with yum install and sssd dependencies with
>>yum-builddep
>
>Sure, but this will be more complicated than just installing them with
>yum-builddep.
>
Sorry,
You did not persuade me.
I still prefer to to reuse build dependencies from spec file.

In spec file, you can use different packages for different OS.
e.g.
  %if 0%{?rhel5_minor} >= 7
  BuildRequires: openldap24-libs-devel
  %else
  BuildRequires: openldap-devel
  %endif

Everything is possible to solve it in bash script, but it will be another
complication. This is a reason why I want to avoid any duplicity.


LS



More information about the sssd-devel mailing list