Unify the build with Fedora

Source and Patch listings should not be conditionalized, as that causes
SRPM contents to be inconsistent [1].

There's no need to do a build just for this.

[1] Fedora commit 006d4f5d814545d8
    https://src.fedoraproject.org/rpms/toolbox/c/006d4f5d814545d8
    https://src.fedoraproject.org/rpms/toolbox/pull-request/14

Resolves: RHEL-1834
This commit is contained in:
Debarshi Ray 2023-10-02 11:36:06 +02:00
parent f6f9b4530c
commit 2ab5b81b7a
3 changed files with 126 additions and 8 deletions

View File

@ -0,0 +1,54 @@
From 865f58881c17c233f288b8978faaeba8b4b2c2f0 Mon Sep 17 00:00:00 2001
From: Debarshi Ray <rishi@fedoraproject.org>
Date: Mon, 29 Jun 2020 17:57:47 +0200
Subject: [PATCH] build: Make the build flags match Fedora's %{gobuildflags}
for PPC64
The Go toolchain also doesn't like the LDFLAGS environment variable as
exported by Fedora's %{meson} RPM macro.
Note that these flags are only meant for the "ppc64" CPU architecture,
and should be kept updated to match Fedora's Go guidelines. Use
'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
---
src/go-build-wrapper | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/src/go-build-wrapper b/src/go-build-wrapper
index c572d6dfb02b..cae2de426a96 100755
--- a/src/go-build-wrapper
+++ b/src/go-build-wrapper
@@ -33,9 +33,9 @@ if ! cd "$1"; then
exit 1
fi
-tags=""
+tags="-tags rpm_crashtraceback,${BUILDTAGS:-}"
if $7; then
- tags="-tags migration_path_for_coreos_toolbox"
+ tags="$tags,migration_path_for_coreos_toolbox"
fi
if ! libc_dir=$("$5" --print-file-name=libc.so); then
@@ -70,11 +70,16 @@ fi
dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
+unset LDFLAGS
+
# shellcheck disable=SC2086
go build \
+ -compiler gc \
$tags \
- -trimpath \
- -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
+ -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
+ -a \
+ -v \
+ -x \
-o "$2/$3"
exit "$?"
--
2.39.2

View File

@ -0,0 +1,54 @@
From f4582e4748a15c462eac229f9bd9214415f166c9 Mon Sep 17 00:00:00 2001
From: Debarshi Ray <rishi@fedoraproject.org>
Date: Mon, 29 Jun 2020 17:57:47 +0200
Subject: [PATCH] build: Make the build flags match Fedora's %{gobuildflags}
The Go toolchain doesn't like the LDFLAGS environment variable as
exported by Fedora's %{meson} RPM macro.
Note that these flags are meant for every CPU architecture other than
PPC64, and should be kept updated to match Fedora's Go guidelines. Use
'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
---
src/go-build-wrapper | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/src/go-build-wrapper b/src/go-build-wrapper
index c572d6dfb02b..0e6a2efa6853 100755
--- a/src/go-build-wrapper
+++ b/src/go-build-wrapper
@@ -33,9 +33,9 @@ if ! cd "$1"; then
exit 1
fi
-tags=""
+tags="-tags rpm_crashtraceback,${BUILDTAGS:-}"
if $7; then
- tags="-tags migration_path_for_coreos_toolbox"
+ tags="$tags,migration_path_for_coreos_toolbox"
fi
if ! libc_dir=$("$5" --print-file-name=libc.so); then
@@ -70,11 +70,17 @@ fi
dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
+unset LDFLAGS
+
# shellcheck disable=SC2086
go build \
+ -buildmode pie \
+ -compiler gc \
$tags \
- -trimpath \
- -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
+ -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
+ -a \
+ -v \
+ -x \
-o "$2/$3"
exit "$?"
--
2.39.2

View File

@ -17,21 +17,23 @@ Summary: Tool for containerized command line environments on Linux
License: ASL 2.0
URL: https://containertoolbx.org/
Source0: https://github.com/containers/%{name}/releases/download/%{version}/%{name}-%{version}-vendored.tar.xz
%if 0%{?rhel}
# RHEL specific
Source1: %{name}.conf
%endif
# Upstream
Patch0: toolbox-Don-t-use-podman-1-when-generating-the-comp.patch
Patch1: toolbox-Don-t-validate-subordinate-IDs-when-generat.patch
Patch2: toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch
# Fedora specific
Patch100: toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch
Patch101: toolbox-Make-the-build-flags-match-Fedora-s-gobuild-for-PPC64.patch
# RHEL specific
Patch100: toolbox-Make-the-build-flags-match-RHEL-s-gobuild.patch
Patch101: toolbox-Make-the-build-flags-match-RHEL-s-gobuild-for-PPC64.patch
%if 0%{?rhel}
Patch102: toolbox-Add-migration-paths-for-coreos-toolbox-users.patch
%endif
Patch200: toolbox-Make-the-build-flags-match-RHEL-s-gobuild.patch
Patch201: toolbox-Make-the-build-flags-match-RHEL-s-gobuild-for-PPC64.patch
Patch202: toolbox-Add-migration-paths-for-coreos-toolbox-users.patch
BuildRequires: gcc
BuildRequires: go-md2man
@ -95,14 +97,22 @@ The %{name}-tests package contains system tests for %{name}.
%patch1 -p1
%patch2 -p1
%if 0%{?fedora}
%ifnarch ppc64
%patch100 -p1
%else
%patch101 -p1
%endif
%endif
%if 0%{?rhel}
%patch102 -p1
%ifnarch ppc64
%patch200 -p1
%else
%patch201 -p1
%endif
%patch202 -p1
%endif
%gomkdir -s %{_builddir}/%{extractdir}/src %{?rhel:-k}