Replace monolithic patch with script + targeted patch
Switch from a 23K-line monolithic patch to add-almalinux9-support.sh script and a single independent patch, matching the AL10 approach.
This commit is contained in:
parent
24d647395b
commit
57520a8841
55
config.yaml
55
config.yaml
@ -1,33 +1,47 @@
|
||||
actions:
|
||||
- add_files:
|
||||
- type: "source"
|
||||
name: "add-almalinux9-support.sh"
|
||||
number: 9001
|
||||
- type: "patch"
|
||||
name: "1001-add-almalinux-to-ansible-product-whitelist.patch"
|
||||
number: 1001
|
||||
|
||||
- replace:
|
||||
- target: "spec"
|
||||
find: |
|
||||
%if ( %{defined rhel} && (! %{defined centos}) )
|
||||
%package rule-playbooks
|
||||
find: "%autosetup -p1"
|
||||
replace: |
|
||||
%if %{defined rhel}
|
||||
%package rule-playbooks
|
||||
%autosetup -p1
|
||||
bash %{SOURCE9001}
|
||||
count: 1
|
||||
- target: "spec"
|
||||
find: |
|
||||
%if 0%{?centos}
|
||||
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=OFF -DSSG_PRODUCT_RHEL%{centos}:BOOLEAN=ON -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON -DSSG_SCE_ENABLED:BOOL=ON
|
||||
%endif
|
||||
%if ( %{defined rhel} && (! %{defined centos}) )
|
||||
%package rule-playbooks
|
||||
replace: |
|
||||
%if 0%{?centos}
|
||||
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=OFF -DSSG_PRODUCT_RHEL%{centos}:BOOLEAN=ON -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON -DSSG_SCE_ENABLED:BOOL=ON
|
||||
%endif
|
||||
%if 0%{?almalinux}
|
||||
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=OFF -DSSG_PRODUCT_ALMALINUX%{almalinux}:BOOLEAN=ON -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCE_ENABLED:BOOL=ON -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON
|
||||
%endif
|
||||
%if %{defined rhel}
|
||||
%package rule-playbooks
|
||||
count: 1
|
||||
- target: "spec"
|
||||
find: |
|
||||
%if ( %{defined rhel} && (! %{defined centos}) )
|
||||
%files rule-playbooks
|
||||
%if 0%{?centos}
|
||||
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=OFF -DSSG_PRODUCT_RHEL%{centos}:BOOLEAN=ON -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON -DSSG_SCE_ENABLED:BOOL=ON
|
||||
%endif
|
||||
replace: |
|
||||
%if %{defined rhel}
|
||||
%files rule-playbooks
|
||||
%if 0%{?centos}
|
||||
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=OFF -DSSG_PRODUCT_RHEL%{centos}:BOOLEAN=ON -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=ON -DSSG_SCE_ENABLED:BOOL=ON
|
||||
%endif
|
||||
%if 0%{?almalinux}
|
||||
%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=OFF -DSSG_PRODUCT_ALMALINUX%{almalinux}:BOOLEAN=ON -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_SCE_ENABLED:BOOL=ON -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON
|
||||
%endif
|
||||
count: 1
|
||||
- target: "spec"
|
||||
find: |
|
||||
%if ( %{defined rhel} && (! %{defined centos}) )
|
||||
%files rule-playbooks
|
||||
replace: |
|
||||
%if %{defined rhel}
|
||||
%files rule-playbooks
|
||||
count: 1
|
||||
|
||||
- modify_release:
|
||||
@ -39,8 +53,3 @@ actions:
|
||||
email: "alukoshko@almalinux.org"
|
||||
line:
|
||||
- "Add AlmaLinux 9 support"
|
||||
|
||||
- add_files:
|
||||
- type: "patch"
|
||||
name: "scap-security-guide-add-almalinux9-product.patch"
|
||||
number: 1000
|
||||
|
||||
26
files/1001-add-almalinux-to-ansible-product-whitelist.patch
Normal file
26
files/1001-add-almalinux-to-ansible-product-whitelist.patch
Normal file
@ -0,0 +1,26 @@
|
||||
From 2011f053dac69527a78ad8dff692cea8a53dce9c Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Lukoshko <alukoshko@cloudlinux.com>
|
||||
Date: Mon, 14 Jul 2025 13:26:40 +0000
|
||||
Subject: [PATCH] Add almalinux8,9,10 to ansible's PRODUCT_WHITELIST
|
||||
|
||||
---
|
||||
utils/ansible_playbook_to_role.py | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/utils/ansible_playbook_to_role.py b/utils/ansible_playbook_to_role.py
|
||||
index 3eede4fcb..a7c03e1e7 100755
|
||||
--- a/utils/ansible_playbook_to_role.py
|
||||
+++ b/utils/ansible_playbook_to_role.py
|
||||
@@ -65,6 +65,9 @@ PRODUCT_ALLOWLIST = set([
|
||||
"rhel8",
|
||||
"rhel9",
|
||||
"rhel10",
|
||||
+ "almalinux8",
|
||||
+ "almalinux9",
|
||||
+ "almalinux10",
|
||||
])
|
||||
|
||||
PROFILE_DENYLIST = set([
|
||||
--
|
||||
2.43.7
|
||||
|
||||
121
files/add-almalinux9-support.sh
Normal file
121
files/add-almalinux9-support.sh
Normal file
@ -0,0 +1,121 @@
|
||||
#!/bin/bash
|
||||
# Add AlmaLinux 9 support to scap-security-guide
|
||||
# This script is intended to run from the unpacked source root during %prep
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# 1. Change GRUB EFI dir to /boot/efi/EFI/almalinux everywhere
|
||||
find ./shared ./linux_os ./tests -type f -exec sed -i 's|EFI/redhat|EFI/almalinux|g' {} \;
|
||||
|
||||
# 2. Use ensure_almalinux_gpgkey_installed where applicable in controls
|
||||
find ./controls -maxdepth 1 -type f -exec sed -i 's|ensure_redhat_gpgkey_installed|ensure_almalinux_gpgkey_installed|g' {} \;
|
||||
|
||||
# 3. Add AlmaLinux support to linux_os, tests, and shared
|
||||
find ./linux_os -type d -name ensure_redhat_gpgkey_installed -prune -o -type f -exec sed -i \
|
||||
-e '/prodtype:/s/rhel9/rhel9,almalinux9/g' \
|
||||
-e '/# platform =/{ /multi_platform_almalinux/! s/multi_platform_rhel/multi_platform_rhel,multi_platform_almalinux/g }' \
|
||||
-e '/# platform =/s/Red Hat Enterprise Linux 9/Red Hat Enterprise Linux 9,AlmaLinux OS 9/g' {} \;
|
||||
|
||||
find ./tests -type f -exec sed -i \
|
||||
-e '/prodtype:/s/rhel9/rhel9,almalinux9/g' \
|
||||
-e '/# platform =/{ /multi_platform_almalinux/! s/multi_platform_rhel/multi_platform_rhel,multi_platform_almalinux/g }' \
|
||||
-e '/# platform =/s/Red Hat Enterprise Linux 9/Red Hat Enterprise Linux 9,AlmaLinux OS 9/g' {} \;
|
||||
|
||||
find ./shared -type f -exec sed -i \
|
||||
-e '/prodtype:/s/rhel9/rhel9,almalinux9/g' \
|
||||
-e '/# platform =/{ /multi_platform_almalinux/! s/multi_platform_rhel/multi_platform_rhel,multi_platform_almalinux/g }' \
|
||||
-e '/# platform =/s/Red Hat Enterprise Linux 9/Red Hat Enterprise Linux 9,AlmaLinux OS 9/g' \
|
||||
-e 's|<platform>Red Hat Enterprise Linux 9</platform>|<platform>Red Hat Enterprise Linux 9</platform>\n<platform>AlmaLinux OS 9</platform>|g' \
|
||||
-e 's|<platform>multi_platform_rhel</platform>|<platform>multi_platform_rhel</platform>\n<platform>multi_platform_almalinux</platform>|g' {} \;
|
||||
|
||||
# 4. Improve Ansible support in conditionals
|
||||
find ./linux_os -type d -name ensure_redhat_gpgkey_installed -prune -o -type f -exec sed -i \
|
||||
-e '/if product in/ s/"rhel9"/"rhel9", "almalinux9"/g' {} \;
|
||||
|
||||
# 5. Add disa references symlinks for AlmaLinux
|
||||
for xml in $(find shared/references/ -type f -name 'disa-stig-rhel*.xml'); do
|
||||
target="$(echo "$xml" | sed 's/rhel/almalinux/g')"
|
||||
if [ ! -e "$target" ]; then
|
||||
ln -s "$(basename "$xml")" "$target"
|
||||
fi
|
||||
done
|
||||
|
||||
# 6. Add AlmaLinux 9 product (copy from rhel9 and rebrand)
|
||||
rm -fr products/almalinux9
|
||||
cp -r products/rhel9 products/almalinux9
|
||||
|
||||
if [ -d products/almalinux9/kickstart ]; then
|
||||
for cfg in $(find products/almalinux9/kickstart/ -type f); do
|
||||
mv "$cfg" "$(echo "$cfg" | sed 's/rhel9/almalinux9/g')"
|
||||
done
|
||||
sed -i 's/Red Hat Enterprise Linux 9.*/AlmaLinux OS 9/g' products/almalinux9/kickstart/*
|
||||
fi
|
||||
|
||||
if [ -d products/almalinux9/transforms ]; then
|
||||
sed -i \
|
||||
-e 's/Red Hat Enterprise Linux/AlmaLinux OS/g' \
|
||||
-e 's/RHEL */AL/g' \
|
||||
-e 's/rhel/almalinux/g' \
|
||||
-e 's/red_hat_linux/almalinuxos_linux/g' \
|
||||
products/almalinux9/transforms/*
|
||||
fi
|
||||
|
||||
if [ -d products/almalinux9/overlays ]; then
|
||||
sed -i \
|
||||
-e 's/Red Hat Enterprise Linux/AlmaLinux OS/g' \
|
||||
-e 's/Red Hat Network or a Satellite Server/Foreman/g' \
|
||||
-e 's/Red Hat/AlmaLinux/g' \
|
||||
-e 's/RHEL9/AlmaLinux OS 9/g' \
|
||||
-e 's/RHEL/AlmaLinux OS/g' \
|
||||
products/almalinux9/overlays/*
|
||||
fi
|
||||
|
||||
if [ -d products/almalinux9/controls ]; then
|
||||
for ctl in $(find products/almalinux9/controls/ -type f -name '*rhel9*'); do
|
||||
mv "$ctl" "$(echo "$ctl" | sed 's/rhel9/almalinux9/g')"
|
||||
done
|
||||
find products/almalinux9/controls -type f -exec sed -i \
|
||||
-e 's/Red Hat Enterprise Linux/AlmaLinux OS/g' \
|
||||
-e 's/RHEL9/ALMALINUX9/g' \
|
||||
-e 's/RHEL-9/ALMALINUX-9/g' \
|
||||
-e '/^id:/s/rhel9/almalinux9/g' \
|
||||
-e '/^product:/s/rhel9/almalinux9/g' \
|
||||
-e 's/ensure_redhat_gpgkey_installed/ensure_almalinux_gpgkey_installed/g' {} \;
|
||||
fi
|
||||
|
||||
sed -i \
|
||||
-e 's/rhel9/almalinux9/' \
|
||||
-e 's/Red Hat Enterprise Linux/AlmaLinux OS/g' \
|
||||
-e 's/RHEL-9/ALMALINUX-9/g' \
|
||||
-e 's#https://access.redhat.com/security/team/key#https://almalinux.org/security/#' \
|
||||
-e 's/^pkg_release:.*/pkg_release: "61e69f29"/g' \
|
||||
-e 's/^pkg_version:.*/pkg_version: "b86b3716"/g' \
|
||||
-e '/^aux_pkg_release:/d' \
|
||||
-e '/^aux_pkg_version:/d' \
|
||||
-e 's/release_key_fingerprint:.*/release_key_fingerprint: "BF18AC2876178908D6E71267D36CB86CB86B3716"/g' \
|
||||
-e '/^release_key_fingerprint:/a oval_feed_url: "https://security.almalinux.org/oval/org.almalinux.alsa-9.xml.bz2"' \
|
||||
-e '/^auxiliary_key_fingerprint:/d' \
|
||||
-e '/^pqc_key_fingerprint:/d' \
|
||||
-e '/^pqc_pkg_release:/d' \
|
||||
-e '/^pqc_pkg_version:/d' \
|
||||
-e 's/redhat:enterprise_linux/almalinux:almalinux/g' \
|
||||
-e 's/red_hat_linux/almalinuxos_linux/g' \
|
||||
-e '/^centos_/d' \
|
||||
products/almalinux9/product.yml
|
||||
|
||||
sed -i 's/rhel/almalinux/g' products/almalinux9/CMakeLists.txt
|
||||
|
||||
sed -i -z \
|
||||
-e 's/Red Hat Enterprise Linux/AlmaLinux OS/g' \
|
||||
-e 's/red_hat_linux/almalinuxos_linux/g' \
|
||||
-e 's/Red Hat Enterprise\n Linux/\n AlmaLinux OS/g' \
|
||||
-e 's/released ....-..-../released 2024-06-24/g' \
|
||||
-e 's/RHEL/AlmaLinux OS/g' \
|
||||
products/almalinux9/profiles/*
|
||||
|
||||
sed -i \
|
||||
-e 's/ensure_redhat_gpgkey_installed/ensure_almalinux_gpgkey_installed/g' \
|
||||
-e 's/rhel9:/almalinux9:/g' \
|
||||
-e "s/'\!ensure_almalinux_gpgkey_installed'/ensure_almalinux_gpgkey_installed/g" \
|
||||
-e '/"!ensure_almalinux_gpgkey_installed"/d' \
|
||||
products/almalinux9/profiles/*
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user