Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Include the patched version of aws-nitro-enclaves-cose in the repo and packit enhancements #704

Closed
wants to merge 10 commits into from
+2,709 −197
Closed

Include the patched version of aws-nitro-enclaves-cose in the repo and packit enhancements #704

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
05104a3
chore: add aws-nitro-enclaves-cose 0.4.0 crate to the repo
mmartinv Nov 28, 2024
2e7579d
chore: fix aws-nitro-enclaves-cose errors
mmartinv Nov 28, 2024
0d936ec
chore: spec changes
mmartinv Nov 28, 2024
8e9c5d5
chore: use the new local copy of aws-nitro-enclaves-cose
mmartinv Nov 28, 2024
c6bf7d5
chore: add new Makefile targets
mmartinv Nov 28, 2024
a8ef044
chore: use the new Makefile target in packit
mmartinv Nov 28, 2024
f98bf3f
chore: remove unused patches and scripts
mmartinv Nov 28, 2024
a9c8087
chore: skip external crates from analisys
mmartinv Nov 29, 2024
23d26e7
chore: ignore source code and vendor tarballs
mmartinv Nov 29, 2024
b1a55bd
chore: avoid clippy errors
mmartinv Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
- name: Run DevSkim scanner
uses: microsoft/DevSkim-Action@v1
with:
ignore-globs: '**/examples/**'
ignore-globs: '**/examples/** **/external/**'

- name: Upload DevSkim scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
check_filenames: true
check_hidden: true
ignore_words_file: .github/spellcheck-ignore
skip: "./docs/Gemfile.lock,./docs/_config.yml,./.github,./.git"
skip: "./docs/Gemfile.lock,./docs/_config.yml,./.github,./.git,./external"

fmt:
name: Rustfmt
Expand Down
9 changes: 9 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,13 @@
/docs/_site/
/docs/.jekyll-cache/
/docs/Gemfile.lock

# RPM build directory
/rpmbuild

# Vendor directory
/vendor

# Source and vendor tar files
fido-device-onboard-rs-*.tar.gz
fido-device-onboard-rs-*-vendor.tar.xz
95 changes: 50 additions & 45 deletions .packit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,20 +3,22 @@

specfile_path: fido-device-onboard.spec

files_to_sync:
- src:
- patches/0001-Revert-chore-use-git-fork-for-aws-nitro-enclaves-cos.patch
- .packit.yaml
- fido-device-onboard.spec
- "fido-device-onboard-rs-*-vendor-patched.tar.xz"
dest: .

upstream_package_name: fido-device-onboard
downstream_package_name: fido-device-onboard

upstream_tag_template: v{version}
copy_upstream_release_description: true

actions:
create-archive:
- bash -c "make VERSION=${PACKIT_PROJECT_VERSION} packit-create-archive"
- bash -c "ls -1 fido-device-onboard-rs-${PACKIT_PROJECT_VERSION}.tar.gz"

files_to_sync:
- ".packit.yaml"
- "fido-device-onboard.spec"
- "fido-device-onboard-rs-*-vendor.tar.xz"

srpm_build_deps:
- cargo
- openssl-devel
Expand All @@ -30,37 +32,46 @@ packages:
upstream_package_name: fido-device-onboard
pkg_tool: centpkg

actions:
pre-sync:
- bash -c "./make-vendored-tarfile.sh ${PACKIT_PROJECT_VERSION}"
- bash -c "git restore Cargo.lock"
create-archive:
- bash -c "cp ./patches/0001-Revert-chore-use-git-fork-for-aws-nitro-enclaves-cos.patch ."
- bash -c "git archive --prefix=fido-device-onboard-rs-${PACKIT_PROJECT_VERSION}/ --format=tar HEAD > fido-device-onboard-rs-${PACKIT_PROJECT_VERSION}.tar"
- bash -c "./make-vendored-tarfile.sh ${PACKIT_PROJECT_VERSION}"
- bash -c "tar -xvf fido-device-onboard-rs-${PACKIT_PROJECT_VERSION}.tar"
- bash -c "ls -1 ./fido-device-onboard-rs-${PACKIT_PROJECT_VERSION}.tar"

jobs:
- &fdo_copr_build
- &fdo_copr_build_fedora
job: copr_build
packages: [fido-device-onboard-fedora]
trigger: pull_request
targets:
centos-stream-9: {}
fedora-latest-stable: {}
fedora-latest: {}
fedora-rawhide: {}
targets: ["fedora-latest-stable", "fedora-latest", "fedora-rawhide"]

- <<: *fdo_copr_build_fedora
trigger: commit
branch: main
owner: "@fedora-iot"
project: fedora-iot

- &fdo_copr_build_centos
job: copr_build
packages: [fido-device-onboard-centos]
trigger: pull_request
targets: ["centos-stream-9", "centos-stream-10"]

- <<: *fdo_copr_build_centos
trigger: commit
branch: main
owner: "@fedora-iot"
project: fedora-iot

- job: tests
trigger: pull_request
identifier: onboarding
identifier: onboarding-centos
fmf_path: test/fmf
tmt_plan: plans/onboarding
targets:
centos-stream-9: {}
fedora-latest-stable: {}
fedora-latest: {}
fedora-rawhide: {}
packages: [fido-device-onboard-centos]
targets: ["centos-stream-9", "centos-stream-10"]

- job: tests
trigger: pull_request
identifier: onboarding-fedora
fmf_path: test/fmf
tmt_plan: plans/onboarding
packages: [fido-device-onboard-fedora]
targets: ["fedora-latest-stable", "fedora-latest", "fedora-rawhide"]

- job: sync_from_downstream
trigger: commit
Expand All @@ -69,33 +80,27 @@ jobs:
trigger: release
packages: [fido-device-onboard-fedora]
dist_git_branches:
- fedora-development
- fedora-latest-stable
- fedora-development
- fedora-latest-stable

- job: propose_downstream
trigger: release
packages: [fido-device-onboard-centos]
dist_git_branches:
- c10s
- c9s
- c10s
- c9s

- job: koji_build
trigger: commit
allowed_pr_authors: [all_committers]
dist_git_branches:
- fedora-development
- fedora-latest-stable
- fedora-development
- fedora-latest-stable

- job: bodhi_update
trigger: commit
allowed_builders: [all_committers]
dist_git_branches:
- fedora-development
- fedora-latest-stable

- <<: *fdo_copr_build
trigger: commit
branch: main
owner: "@fedora-iot" # copr repo namespace
project: fedora-iot # copr repo name so you can consume the builds
- fedora-development
- fedora-latest-stable
...
17 changes: 3 additions & 14 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

89 changes: 65 additions & 24 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
include /etc/os-release

SRCDIR ?= .
COMMIT = $(shell (cd "$(SRCDIR)" && git rev-parse HEAD))
VENDOR ?= false
VERSION = $(shell (cd "$(SRCDIR)" && git describe --tags | sed -e 's/^v//' -e 's/-/./'))
PLATFORMS = $(shell (echo {x86_64,aarch64,powerpc64le,s390x}-unknown-linux-gnu))

#
# Generic Targets
Expand All @@ -23,9 +25,44 @@ help:
@echo "The following targets are available:"
@echo
@echo " help: Print this usage information."
@echo " source: Generate source tar file in the current directory."
@echo " vendor: Generate vendor tar file in the current directory."
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess we can update the SOP document to use these commands too - like git checkout v0.5.2 and then make source && make vendor and then git checkout c10s && centpkg updload file.tar.gz etc etc (maybe for another PR of course)

Copy link
Contributor Author

@mmartinv mmartinv Dec 2, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't the propose-downstream also work for centos? (except for the corresponding Jira ticket creation)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, but you still have to upload the sources (this is how I read the page on the packit guide as it's not yet implemented to upload sources to the lookaside cache) - also, building isn't taken care of as far as I can tell

maybe I'm wrong :)

Copy link
Contributor Author

@mmartinv mmartinv Dec 4, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I think you are right, It looks like the automation will not do it for us but there's the option of using the cli according to the warning note.

Mabye something like (after filing the corresponding Jira ticket: RHEL-XXXXX):

git checkout v0.5.2
packit propose-downstream --pr \
                          --dist-git-branch c10s \
                          --resolve-bug RHEL-XXXXX
                          --package fido-device-onboard-centos

@echo " rpm: Generate RPM."
@echo " srpm: Generate SRPM."
@echo " man: Generate man pages."

#
# Generating sources and vendor tar files
#

SOURCE_TARBALL=fido-device-onboard-rs-$(VERSION).tar.gz

$(SOURCE_TARBALL):
git archive --prefix=fido-device-onboard-rs-$(VERSION)/ --format=tar.gz HEAD > $(SOURCE_TARBALL)

.PHONY: source
source: $(SOURCE_TARBALL)

VENDOR_TARBALL=fido-device-onboard-rs-$(VERSION)-vendor.tar.xz

$(VENDOR_TARBALL):
vendor_filterer_cmd=$$(command -v cargo-vendor-filterer||:)
[ -z "$$vendor_filterer_cmd" ] || rm -f $${vendor_filterer_cmd}
# We need v0.5.7 because of RHEL rust version
cargo install --quiet [email protected];
for platform in $(PLATFORMS); do \
args+="--platform $${platform} "; \
done
# https://issues.redhat.com/browse/RHEL-65521
args+="--exclude-crate-path idna#tests "
rm -rf vendor
cargo vendor-filterer $${args}
tar cJf $(VENDOR_TARBALL) vendor
rm -rf vendor

.PHONY: vendor
vendor: $(VENDOR_TARBALL)

#
# Building packages
#
Expand All @@ -38,41 +75,45 @@ help:
# ./rpmbuild, using rpmbuild's usual directory structure.
#

RPM_SPECFILE=rpmbuild/SPECS/fido-device-onboard-rs-$(COMMIT).spec
RPM_TARBALL=rpmbuild/SOURCES/fido-device-onboard-rs-$(COMMIT).tar.gz
VENDOR_TARBALL=rpmbuild/SOURCES/fido-device-onboard-rs-$(COMMIT)-vendor-patched.tar.xz
SPEC_FILE=./fido-device-onboard.spec
RPM_TOP_DIR=$(CURDIR)/rpmbuild
RPMS_SPECS_DIR=$(RPM_TOP_DIR)/SPECS
RPMS_SOURCES_DIR=$(RPM_TOP_DIR)/SOURCES
RPM_SPECFILE=$(RPMS_SPECS_DIR)/fido-device-onboard-rs-$(VERSION).spec
RPM_TARBALL=$(RPMS_SOURCES_DIR)/fido-device-onboard-rs-$(VERSION).tar.gz
RPM_VENDOR_TARBALL=${RPMS_SOURCES_DIR}/$(VENDOR_TARBALL)

$(RPM_SPECFILE):
mkdir -p $(CURDIR)/rpmbuild/SPECS
sed -e "s/^Version:.*/Version: $(COMMIT)/;" fido-device-onboard.spec > $(RPM_SPECFILE)
if [ "$(ID)" = "fedora" ] && [ $(VARIANT_ID) != "eln" ]; then \
sed -i "/Source1/d ; /^# See make-vendored-tarfile.sh in upstream repo/d ;" $(RPM_SPECFILE); \
fi
mkdir -p $(RPMS_SPECS_DIR)
sed -e "s/^Version:.*/Version: $(VERSION)/;" \
-e "s|%{url}/archive/v%{version}/||;" \
$(SPEC_FILE) > $(RPM_SPECFILE)

$(RPM_TARBALL):
mkdir -p $(CURDIR)/rpmbuild/SOURCES
cp ./patches/0001-Revert-chore-use-git-fork-for-aws-nitro-enclaves-cos.patch rpmbuild/SOURCES/;
git archive --prefix=fido-device-onboard-rs-$(COMMIT)/ --format=tar.gz HEAD > $(RPM_TARBALL)

$(VENDOR_TARBALL):
[ "$(ID)" = "fedora" ] && [ $(VARIANT_ID) != "eln" ] || ( \
mkdir -p $(CURDIR)/rpmbuild/SOURCES ; \
./make-vendored-tarfile.sh $(COMMIT) ; \
mv fido-device-onboard-rs-$(COMMIT)-vendor-patched.tar.xz rpmbuild/SOURCES ;)
$(RPM_TARBALL): $(SOURCE_TARBALL) $(VENDOR_TARBALL)
mkdir -p $(RPMS_SOURCES_DIR)
mv $(SOURCE_TARBALL) $(RPM_TARBALL)
mv $(VENDOR_TARBALL) $(RPM_VENDOR_TARBALL);

.PHONY: srpm
srpm: $(RPM_SPECFILE) $(RPM_TARBALL) $(VENDOR_TARBALL)
srpm: $(RPM_SPECFILE) $(RPM_TARBALL)
rpmbuild -bs \
--define "_topdir $(CURDIR)/rpmbuild" \
--define "_topdir $(RPM_TOP_DIR)" \
$(RPM_SPECFILE)

.PHONY: rpm
rpm: $(RPM_SPECFILE) $(RPM_TARBALL) $(VENDOR_TARBALL)
sudo dnf builddep -y fido-device-onboard
rpm: $(RPM_SPECFILE) $(RPM_TARBALL)
sudo dnf builddep -y $(RPM_SPECFILE)
rpmbuild -bb \
--define "_topdir $(CURDIR)/rpmbuild" \
--define "_topdir $(RPM_TOP_DIR)" \
$(RPM_SPECFILE)

#
# Packit target
#

.PHONY: packit-create-archive
packit-create-archive: $(SOURCE_TARBALL) $(VENDOR_TARBALL)

#
# Generating man pages
#
Expand Down
3 changes: 2 additions & 1 deletion client-linuxapp/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1231,7 +1231,8 @@ async fn main() -> Result<()> {
Command::new("systemctl")
.arg("reboot")
.spawn()
.expect("Reboot failed");
.expect("Reboot failed")
.wait()?;
}
Ok(())
}
2 changes: 2 additions & 0 deletions client-linuxapp/src/serviceinfo.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,8 @@ fn create_user_with_password(user: &str, password: &str) -> Result<()> {
log::info!("Checking for password encryption");
if !is_password_encrypted(password) {
log::info!("Encrypting password");
#[allow(unknown_lints)]
#[allow(clippy::zombie_processes)]
let echo = Command::new("echo")
.arg(password)
.stdout(Stdio::piped())
Expand Down
4 changes: 2 additions & 2 deletions data-formats/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,10 @@ serde_cbor = "0.11"
serde_repr = "0.1.19"
serde_tuple = "0.5"
thiserror = "1"
aws-nitro-enclaves-cose = { git = "https://github.com/nullr0ute/aws-nitro-enclaves-cose/", rev = "e3938e60d9051690569d1e4fcbe1c0c99d2fafa8" }
aws-nitro-enclaves-cose = { path = "../external/aws-nitro-enclaves-cose"}
uuid = "1.3"
num-traits = "0.2"
num-derive = "0.3"
num-derive = "0.4"
paste = "1.0"
pem = "3.0"
tss-esapi = { version = "7.4", features = ["generate-bindings"] }
Expand Down
2 changes: 1 addition & 1 deletion data-formats/src/constants/serviceinfo_names.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ impl<'de> serde::Deserialize<'de> for ServiceInfoModule {
D: serde::de::Deserializer<'de>,
{
struct SIMVisitor;
impl<'de> serde::de::Visitor<'de> for SIMVisitor {
impl serde::de::Visitor<'_> for SIMVisitor {
type Value = ServiceInfoModule;

fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
Expand Down
Loading
Loading