scap-security-guide/local-build.sh

99 lines
3.6 KiB
Bash
Executable File

#!/usr/bin/env bash
# Mimics the AlmaLinux RPM %prep + cmake pipeline locally.
# Usage: ./local-build.sh [almalinux9|almalinux10] [git-repo-url-or-local-path] [branch]
#
# Defaults: product=almalinux10, repo=https://github.com/swoutersup/ComplianceAsCode-content, branch=main
#
# Patches and support scripts are sourced from this autopatch repo's files/ directory.
# The script is branch-aware: if the current checkout is not the branch that owns
# the requested product, it extracts files/ from git automatically — no manual
# branch switch needed.
#
# Produces: <workdir>/build/ssg-<product>-ds.xml
set -euo pipefail
PRODUCT="${1:-almalinux10}"
CONTENT_SRC="${2:-https://github.com/swoutersup/ComplianceAsCode-content}"
CONTENT_BRANCH="${3:-}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WORK_DIR="$(pwd)/work-${PRODUCT}"
# Map each product to its branch in this autopatch repo
case "${PRODUCT}" in
almalinux9) PRODUCT_BRANCH="a9" ;;
almalinux10) PRODUCT_BRANCH="a10" ;;
*) echo "ERROR: unsupported product '${PRODUCT}'. Use almalinux9 or almalinux10." >&2; exit 1 ;;
esac
CURRENT_BRANCH="$(git -C "${SCRIPT_DIR}" branch --show-current 2>/dev/null || echo '')"
if [[ "${CURRENT_BRANCH}" != "${PRODUCT_BRANCH}" ]]; then
# Resolve the git ref: prefer local branch, fall back to remote tracking branch
if git -C "${SCRIPT_DIR}" rev-parse --verify "${PRODUCT_BRANCH}" &>/dev/null; then
GIT_REF="${PRODUCT_BRANCH}"
elif git -C "${SCRIPT_DIR}" rev-parse --verify "origin/${PRODUCT_BRANCH}" &>/dev/null; then
GIT_REF="origin/${PRODUCT_BRANCH}"
else
echo "ERROR: branch '${PRODUCT_BRANCH}' not found locally or as origin/${PRODUCT_BRANCH}" >&2
exit 1
fi
# Extract files/ from the correct branch into a temporary directory
echo "==> Current branch is '${CURRENT_BRANCH}'; extracting ${PRODUCT} build files from '${GIT_REF}'"
BUILD_FILES_DIR="$(mktemp -d)"
trap 'rm -rf "${BUILD_FILES_DIR}"' EXIT
git -C "${SCRIPT_DIR}" show \
"${GIT_REF}:files/add-${PRODUCT}-support.sh" \
> "${BUILD_FILES_DIR}/add-${PRODUCT}-support.sh"
while IFS= read -r patch; do
git -C "${SCRIPT_DIR}" show "${GIT_REF}:files/${patch}" \
> "${BUILD_FILES_DIR}/${patch}"
done < <(git -C "${SCRIPT_DIR}" ls-tree --name-only "${GIT_REF}:files/" \
| grep '\.patch$')
else
BUILD_FILES_DIR="${SCRIPT_DIR}/files"
fi
SUPPORT_SCRIPT="${BUILD_FILES_DIR}/add-${PRODUCT}-support.sh"
if [[ ! -f "${SUPPORT_SCRIPT}" ]]; then
echo "ERROR: support script not found: ${SUPPORT_SCRIPT}" >&2
exit 1
fi
rm -rf "${WORK_DIR}"
if [[ "${CONTENT_SRC}" == http* || "${CONTENT_SRC}" == git@* ]]; then
BRANCH_ARGS=()
[[ -n "${CONTENT_BRANCH}" ]] && BRANCH_ARGS=(--branch "${CONTENT_BRANCH}")
echo "==> Cloning ${CONTENT_SRC}${CONTENT_BRANCH:+ (branch: ${CONTENT_BRANCH})} to ${WORK_DIR}"
git clone --depth=1 "${BRANCH_ARGS[@]}" "${CONTENT_SRC}" "${WORK_DIR}"
else
echo "==> Copying ${CONTENT_SRC} to ${WORK_DIR}"
cp -r "${CONTENT_SRC}" "${WORK_DIR}"
fi
cd "${WORK_DIR}"
echo "==> Applying patches (%autosetup -p1)"
for PATCH in "${BUILD_FILES_DIR}"/*.patch; do
[[ -f "${PATCH}" ]] || continue
echo " Applying $(basename "${PATCH}")"
patch -p1 --forward --silent < "${PATCH}" || {
echo "WARNING: patch $(basename "${PATCH}") already applied or failed — continuing"
}
done
echo "==> Running ${SUPPORT_SCRIPT}"
bash "${SUPPORT_SCRIPT}"
echo "==> Building ssg-${PRODUCT}-ds.xml"
ADDITIONAL_CMAKE_OPTIONS="-DSSG_SCE_ENABLED=ON" ./build_product "${PRODUCT}" --datastream
echo ""
echo "==> Done. Datastream at:"
echo " ${WORK_DIR}/build/ssg-${PRODUCT}-ds.xml"