swoutersup/scap-security-guide
1
0
Fork 0
forked from autopatch/scap-security-guide
Code Pull Requests Activity

Add branch-aware local-build.sh for local testing

Browse Source
This commit is contained in:
Sam Wouters 2026-07-17 17:47:27 +02:00
parent c2670e5d11
commit 8a09c702df
1 changed files with 88 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
local-build.sh Executable file
View File

@ -0,0 +1,88 @@
#!/usr/bin/env bash
# Mimics the AlmaLinux RPM %prep + cmake pipeline locally.
# Usage: ./local-build.sh [almalinux9|almalinux10] [git-repo-url-or-local-path] [branch]
#
# Defaults: product=almalinux10, repo=https://github.com/swoutersup/ComplianceAsCode-content, branch=main
#
# Patches and support scripts are sourced from this autopatch repo's files/ directory.
# The script is branch-aware: if the current checkout is not the branch that owns
# the requested product, it extracts files/ from git automatically — no manual
# branch switch needed.
#
# Produces: <workdir>/build/ssg-<product>-ds.xml
set -euo pipefail
PRODUCT="${1:-almalinux10}"
CONTENT_SRC="${2:-https://github.com/swoutersup/ComplianceAsCode-content}"
CONTENT_BRANCH="${3:-}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WORK_DIR="$(pwd)/work-${PRODUCT}"
# Map each product to its branch in this autopatch repo
case "${PRODUCT}" in
almalinux9) PRODUCT_BRANCH="a9" ;;
almalinux10) PRODUCT_BRANCH="a10" ;;
*) echo "ERROR: unsupported product '${PRODUCT}'. Use almalinux9 or almalinux10." >&2; exit 1 ;;
esac
CURRENT_BRANCH="$(git -C "${SCRIPT_DIR}" branch --show-current 2>/dev/null || echo '')"
if [[ "${CURRENT_BRANCH}" != "${PRODUCT_BRANCH}" ]]; then
# Extract files/ from the correct branch into a temporary directory
echo "==> Current branch is '${CURRENT_BRANCH}'; extracting ${PRODUCT} build files from '${PRODUCT_BRANCH}'"
BUILD_FILES_DIR="$(mktemp -d)"
trap 'rm -rf "${BUILD_FILES_DIR}"' EXIT
git -C "${SCRIPT_DIR}" show \
"${PRODUCT_BRANCH}:files/add-${PRODUCT}-support.sh" \
> "${BUILD_FILES_DIR}/add-${PRODUCT}-support.sh"
while IFS= read -r patch; do
git -C "${SCRIPT_DIR}" show "${PRODUCT_BRANCH}:files/${patch}" \
> "${BUILD_FILES_DIR}/${patch}"
done < <(git -C "${SCRIPT_DIR}" ls-tree --name-only "${PRODUCT_BRANCH}:files/" \
| grep '\.patch$')
else
BUILD_FILES_DIR="${SCRIPT_DIR}/files"
fi
SUPPORT_SCRIPT="${BUILD_FILES_DIR}/add-${PRODUCT}-support.sh"
if [[ ! -f "${SUPPORT_SCRIPT}" ]]; then
echo "ERROR: support script not found: ${SUPPORT_SCRIPT}" >&2
exit 1
fi
rm -rf "${WORK_DIR}"
if [[ "${CONTENT_SRC}" == http* || "${CONTENT_SRC}" == git@* ]]; then
BRANCH_ARGS=()
[[ -n "${CONTENT_BRANCH}" ]] && BRANCH_ARGS=(--branch "${CONTENT_BRANCH}")
echo "==> Cloning ${CONTENT_SRC}${CONTENT_BRANCH:+ (branch: ${CONTENT_BRANCH})} to ${WORK_DIR}"
git clone --depth=1 "${BRANCH_ARGS[@]}" "${CONTENT_SRC}" "${WORK_DIR}"
else
echo "==> Copying ${CONTENT_SRC} to ${WORK_DIR}"
cp -r "${CONTENT_SRC}" "${WORK_DIR}"
fi
cd "${WORK_DIR}"
echo "==> Applying patches (%autosetup -p1)"
for PATCH in "${BUILD_FILES_DIR}"/*.patch; do
[[ -f "${PATCH}" ]] || continue
echo " Applying $(basename "${PATCH}")"
patch -p1 --forward --silent < "${PATCH}" || {
echo "WARNING: patch $(basename "${PATCH}") already applied or failed — continuing"
}
done
echo "==> Running ${SUPPORT_SCRIPT}"
bash "${SUPPORT_SCRIPT}"
echo "==> Building ssg-${PRODUCT}-ds.xml"
ADDITIONAL_CMAKE_OPTIONS="-DSSG_SCE_ENABLED=ON" ./build_product "${PRODUCT}" --datastream
echo ""
echo "==> Done. Datastream at:"
echo " ${WORK_DIR}/build/ssg-${PRODUCT}-ds.xml"