diff --git a/.gitignore b/.gitignore index f779712..67e59d9 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/v1.1.1.tar.gz +SOURCES/v1.2.0.tar.gz diff --git a/.oci-seccomp-bpf-hook.metadata b/.oci-seccomp-bpf-hook.metadata index 88e375f..0de06b3 100644 --- a/.oci-seccomp-bpf-hook.metadata +++ b/.oci-seccomp-bpf-hook.metadata @@ -1 +1 @@ -f1a6515ef0620c1c9c4c43d7626cd9bec05a5faa SOURCES/v1.1.1.tar.gz +87e5a6bd76c56b81e779438c531f31f14a6c9b7e SOURCES/v1.2.0.tar.gz diff --git a/SPECS/oci-seccomp-bpf-hook.spec b/SPECS/oci-seccomp-bpf-hook.spec index 363f712..5c9706b 100644 --- a/SPECS/oci-seccomp-bpf-hook.spec +++ b/SPECS/oci-seccomp-bpf-hook.spec @@ -1,19 +1,15 @@ -%global with_devel 0 -%global with_bundled 1 -%global with_debug 1 %global with_check 0 -%global with_unit_test 0 -%if 0%{?with_debug} %global _find_debuginfo_dwz_opts %{nil} %global _dwz_low_mem_die_limit 0 -%else -%global debug_package %{nil} -%endif %if 0%{?rhel} > 7 && ! 0%{?fedora} %define gobuild(o:) \ -go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}; +go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -linkmode=external -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v %{?**}; +%else +%if ! 0%{?gobuild:1} +%define gobuild(o:) GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -linkmode=external -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v %{?**}; +%endif %endif %global provider github @@ -25,12 +21,12 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl %global import_path %{provider_prefix} %global git0 https://%{provider}.%{provider_tld}/%{project}/%{repo} -# bcc is not built for i686 -ExcludeArch: i686 +# https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures +ExclusiveArch: %{go_arches} Name: oci-seccomp-bpf-hook -Version: 1.1.1 -Release: 1%{?dist} +Version: 1.2.0 +Release: 2%{?dist} Summary: OCI Hook to generate seccomp json files based on EBF syscalls used by container License: ASL 2.0 URL: %{git0} @@ -44,6 +40,7 @@ BuildRequires: git BuildRequires: gpgme-devel BuildRequires: libseccomp-devel BuildRequires: make +Requires: crun >= 0.17 Enhances: podman Enhances: cri-o @@ -61,6 +58,7 @@ sed -i '/$(HOOK_DIR)\/%{name}.json/d' Makefile %build export GO111MODULE=off export GOPATH=$(pwd):$(pwd)/_build +export CGO_CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64" mkdir _build pushd _build @@ -70,6 +68,7 @@ popd ln -s vendor src export GOPATH=$(pwd)/_build:$(pwd) +export LDFLAGS="-X main.version=%{version}" %gobuild -o bin/%{name} %{import_path} pushd docs @@ -77,19 +76,11 @@ go-md2man -in %{name}.md -out %{name}.1 popd %install -# install binary -%{__make} PREFIX=%{buildroot}%{_usr} ETCDIR=%{buildroot}%{_sysconfdir} OCI-SECCOMP-BPF_VERSION=%{version} install - -# install %%{name}.json to /usr/share/containers/oci/hooks.d -install -dp %{buildroot}%{_datadir}/containers/oci/hooks.d -install -m 0644 %{name}.json %{buildroot}%{_datadir}/containers/oci/hooks.d - -# install manpage -install -dp %{buildroot}%{_mandir}/man1 -install -m 0644 docs/%{name}.1 %{buildroot}/%{_mandir}/man1 +%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} install-nobuild +%{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} GOMD2MAN=go-md2man -C docs install-nobuild %check -%if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel} +%if 0%{?with_check} # Since we aren't packaging up the vendor directory we need to link # back to it somehow. Hack it up so that we can add the vendor # directory from BUILD dir as a gopath to be searched when executing @@ -117,6 +108,43 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath} %{_mandir}/man1/%{name}.1* %changelog +* Mon Feb 22 2021 Jindrich Novy - 1.2.0-2 +- revert back to 1.2.0 - build issues +- Related: #1883490 + +* Fri Feb 19 2021 Jindrich Novy - 1.2.1-1 +- update to + https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1 +- require crun >= 0.17 +- Related: #1883490 + +* Thu Jan 28 2021 Jindrich Novy - 1.2.0-1 +- revert back to 1.2.0 due to build issues +- Related: #1883490 + +* Thu Jan 28 2021 Jindrich Novy - 1.2.1-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1 +- Related: #1883490 + +* Tue Dec 08 2020 Jindrich Novy - 1.2.0-2 +- sync with RHEL8 devel branch +- Related: #1883490 + +* Wed Oct 21 2020 Jindrich Novy - 1.2.0-1 +- synchronize with stream-container-tools-rhel8 +- Related: #1883490 + +* Tue Aug 11 2020 Jindrich Novy - 1.1.2-3 +- propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization +- Related: #1821193 + +* Thu Jul 23 2020 Lokesh Mandvekar - 1.1.2-2 +- Resolves: #1857606 + +* Fri Jul 17 2020 Jindrich Novy - 1.1.2-1 +- update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.2 +- Related: #1821193 + * Thu Jun 18 2020 Jindrich Novy - 1.1.1-1 - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.1.1 - Related: #1821193