From bcef8cd8455816e3f4414a5883ebc0915ed51592 Mon Sep 17 00:00:00 2001 From: Gleb Chesnokov Date: Mon, 24 Aug 2026 11:47:15 +0300 Subject: [PATCH] build: Add Rocky Linux RPM builder Add Docker targets that build the existing RPM packages in an isolated Rocky Linux 10.2 environment. Keep the source worktree read-only, derive the target kernel from the installed kernel-devel package and export only verified RPM and source RPM artifacts. --- .gitignore | 1 + Makefile | 26 +++++++++- docker/rocky-10.2/Dockerfile | 33 +++++++++++++ docker/rocky-10.2/build-rpm | 94 ++++++++++++++++++++++++++++++++++++ 4 files changed, 153 insertions(+), 1 deletion(-) create mode 100644 docker/rocky-10.2/Dockerfile create mode 100644 docker/rocky-10.2/build-rpm diff --git a/.gitignore b/.gitignore index 9565728d7..7b7dd2131 100644 --- a/.gitignore +++ b/.gitignore @@ -38,6 +38,7 @@ debian/scst.dkms debian/scst/ debian/scstadmin/ debian/tmp/ +docker-rpmbuilddir/ dpkg/ fcst/build_mode iscsi-scst/conftest/*/result-*.txt diff --git a/Makefile b/Makefile index 707ca1e02..fdaf14b80 100644 --- a/Makefile +++ b/Makefile @@ -93,6 +93,11 @@ VERSION := $(RELEASE_VERSION).$(REVISION) DEBIAN_REVISION := 1.1 RPMTOPDIR ?= $(shell if [ $$(id -u) = 0 ]; then echo /usr/src/packages;\ else echo $$PWD/rpmbuilddir; fi) +DOCKER ?= docker +DOCKER_RPM_CONTEXT ?= docker/rocky-10.2 +DOCKER_RPM_DOCKERFILE ?= $(DOCKER_RPM_CONTEXT)/Dockerfile +DOCKER_RPM_IMAGE ?= scst-rpm-builder:rocky-10.2 +DOCKER_RPM_OUTPUT ?= $(CURDIR)/docker-rpmbuilddir SCST_SOURCE_FILES = $(shell if [ -e scripts/list-source-files ]; then \ scripts/list-source-files; \ else \ @@ -173,6 +178,8 @@ help: @echo " scstadm-rpm : make scstadmin RPM packages" @echo " rpm : make both SCST and scstadmin RPM packages" @echo " rpm-dkms : make both SCST DKMS and scstadmin RPM packages" + @echo " docker-rpm-image : build the RPM builder Docker image" + @echo " docker-rpm : build RPM packages in Docker" @echo "" @echo " dpkg : make SCST dpkg packages" @echo "" @@ -432,6 +439,22 @@ rpm-dkms: find -name '*.rpm'; \ fi +docker-rpm-image: + $(DOCKER) build --file "$(DOCKER_RPM_DOCKERFILE)" \ + --tag "$(DOCKER_RPM_IMAGE)" "$(DOCKER_RPM_CONTEXT)" + +docker-rpm: docker-rpm-image + mkdir -p "$(DOCKER_RPM_OUTPUT)" + git_common_dir="$$(git rev-parse --path-format=absolute \ + --git-common-dir)" && \ + $(DOCKER) run --rm \ + --user "$$(id -u):$$(id -g)" \ + --env HOME=/tmp \ + --mount "type=bind,source=$(CURDIR),target=/source,readonly" \ + --mount "type=bind,source=$${git_common_dir},target=$${git_common_dir},readonly" \ + --mount "type=bind,source=$(DOCKER_RPM_OUTPUT),target=/output" \ + "$(DOCKER_RPM_IMAGE)" + debian/changelog: debian/changelog.in sed 's/%{scst_version}/$(VERSION)-$(DEBIAN_REVISION)/' \ debian/changelog @@ -528,5 +551,6 @@ multiple-release-archives: fcst fcst_clean fcst_extraclean fcst_install fcst_uninstall \ scst_local scst_local_clean scst_local_extraclean scst_local_install scst_local_uninstall \ usr usr_clean usr_extraclean usr_install usr_uninstall \ - scst-rpm scst-dkms-rpm scstadm-rpm rpm rpm-dkms dpkg \ + scst-rpm scst-dkms-rpm scstadm-rpm rpm rpm-dkms \ + docker-rpm-image docker-rpm dpkg \ 2perf 2release 2debug diff --git a/docker/rocky-10.2/Dockerfile b/docker/rocky-10.2/Dockerfile new file mode 100644 index 000000000..00c1fe81d --- /dev/null +++ b/docker/rocky-10.2/Dockerfile @@ -0,0 +1,33 @@ +FROM rockylinux/rockylinux:10.2 + +ENV LANG=C \ + LC_ALL=C + +RUN dnf -y install \ + bzip2 \ + elfutils-libelf-devel \ + findutils \ + gcc \ + git \ + kernel \ + kernel-devel \ + kernel-headers \ + kmod \ + make \ + openssl \ + perl \ + perl-Data-Dumper \ + perl-devel \ + perl-ExtUtils-MakeMaker \ + redhat-rpm-config \ + rpm-build \ + systemd-rpm-macros \ + tar \ + which \ + && dnf clean all \ + && rm -rf /var/cache/dnf + +COPY build-rpm /usr/local/bin/build-scst-rpm +RUN chmod 0755 /usr/local/bin/build-scst-rpm + +ENTRYPOINT ["/usr/local/bin/build-scst-rpm"] diff --git a/docker/rocky-10.2/build-rpm b/docker/rocky-10.2/build-rpm new file mode 100644 index 000000000..15efe5cac --- /dev/null +++ b/docker/rocky-10.2/build-rpm @@ -0,0 +1,94 @@ +#!/bin/bash + +set -euo pipefail + +readonly source_dir="${SCST_SOURCE_DIR:-/source}" +readonly output_dir="${SCST_OUTPUT_DIR:-/output}" + +if ! git -C "${source_dir}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then + echo "Error: ${source_dir} is not an SCST Git worktree." >&2 + exit 1 +fi + +if [[ ! -d "${output_dir}" || ! -w "${output_dir}" ]]; then + echo "Error: ${output_dir} is not a writable output directory." >&2 + exit 1 +fi + +mapfile -t kernel_releases < <( + rpm -q --qf '%{VERSION}-%{RELEASE}.%{ARCH}\n' kernel-devel | sort -V +) +if [[ ${#kernel_releases[@]} -ne 1 ]]; then + echo "Error: expected exactly one kernel-devel package." >&2 + printf 'Found kernel releases: %s\n' "${kernel_releases[*]:-none}" >&2 + exit 1 +fi + +readonly kernel_release="${kernel_releases[0]}" +readonly kernel_dir="/usr/src/kernels/${kernel_release}" +if [[ ! -d "${kernel_dir}" ]]; then + echo "Error: kernel build directory ${kernel_dir} does not exist." >&2 + exit 1 +fi + +tmp_dir="$(mktemp -d)" +readonly tmp_dir +artifact_stage="" +cleanup() { + rm -rf -- "${tmp_dir}" + if [[ -n "${artifact_stage}" ]]; then + rm -rf -- "${artifact_stage}" + fi +} +trap cleanup EXIT + +readonly build_dir="${tmp_dir}/scst" +readonly rpm_topdir="${tmp_dir}/rpmbuild" +mkdir -p "${build_dir}" "${rpm_topdir}" + +git -C "${source_dir}" ls-files -z -- | + tar --directory="${source_dir}" --null --files-from=- --create --file=- | + tar --directory="${build_dir}" --extract --file=- + +git_commit="${GIT_COMMIT:-$(git -C "${source_dir}" rev-parse --short=12 HEAD)}" +build_number="${BUILD_NUMBER:-$(git -C "${source_dir}" rev-list --count HEAD)}" +revision="${REVISION:-${build_number}.${git_commit}}" +readonly git_commit build_number revision + +make -C "${build_dir}" \ + BUILD_NUMBER="${build_number}" \ + GIT_COMMIT="${git_commit}" \ + REVISION="${revision}" \ + KDIR="${kernel_dir}" \ + KVER="${kernel_release}" \ + RPMTOPDIR="${rpm_topdir}" \ + rpm + +mapfile -d '' -t rpm_files < <( + find "${rpm_topdir}/RPMS" "${rpm_topdir}/SRPMS" \ + -type f -name '*.rpm' -print0 | sort -z +) +if [[ ${#rpm_files[@]} -eq 0 ]]; then + echo "Error: the RPM build produced no packages." >&2 + exit 1 +fi +rpm --checksig --nosignature "${rpm_files[@]}" + +artifact_stage="$(mktemp -d "${output_dir}/.scst-rpm.XXXXXX")" +cp -a "${rpm_topdir}/RPMS" "${rpm_topdir}/SRPMS" "${artifact_stage}/" +( + cd "${artifact_stage}" + find RPMS SRPMS -type f -name '*.rpm' -print0 | + sort -z | xargs -0 sha256sum >SHA256SUMS +) + +rm -rf -- "${output_dir}/RPMS" "${output_dir}/SRPMS" +rm -f -- "${output_dir}/SHA256SUMS" +mv "${artifact_stage}/RPMS" "${artifact_stage}/SRPMS" \ + "${artifact_stage}/SHA256SUMS" "${output_dir}/" +rmdir "${artifact_stage}" +artifact_stage="" + +echo "Built SCST RPM packages for kernel ${kernel_release}:" +find "${output_dir}/RPMS" "${output_dir}/SRPMS" \ + -type f -name '*.rpm' -print | sort