75 lines
3.8 KiB
Markdown
75 lines
3.8 KiB
Markdown
# Development RPM builds
|
|
|
|
The Gitea workflow selects the `ubuntu-latest` runner and runs the build inside
|
|
Fedora 43, matching the saved lab package context. The workstation currently
|
|
reports Fedora 44; this first workflow does not claim a Fedora 44 build test.
|
|
It runs on main pushes, pull requests and manual dispatch.
|
|
|
|
The build installs only the OCF executable and nine modules, plus documentation.
|
|
It includes no Quadlet, secrets, databases or cluster configuration. There are
|
|
no RPM lifecycle scriptlets. Installation does not start, stop or restart a
|
|
service or change maintenance mode. Host PostgreSQL packages are not required.
|
|
|
|
The draft LicenseRef-Provenance-Pending field is a status marker, not a license
|
|
grant. See PROVENANCE.md. Packages are unsigned development artifacts. The
|
|
workflow does not publish a release or upload to the Gitea RPM registry.
|
|
|
|
## Local build
|
|
|
|
In a disposable Fedora 43 build environment, install the packages listed in
|
|
Containerfile, then run from a Git checkout:
|
|
|
|
```bash
|
|
bash scripts/build-rpm.sh
|
|
```
|
|
|
|
Artifacts are written to dist/: a noarch binary RPM, a source RPM and SHA256SUMS.
|
|
Build trees remain under .build/ for inspection. The script packages the current
|
|
working tree; use a clean checkout for a build identified by its Git revision.
|
|
Only explicitly listed project directories enter the source archive. Lab
|
|
snapshots, local agent configuration, .git and secrets are excluded.
|
|
|
|
Version comes from packaging/VERSION. Development Release values are
|
|
`0.<UTC commit timestamp>.git<12-character commit>`, plus the Fedora dist suffix.
|
|
A future release with Release 1 will sort after these development builds of the
|
|
same version. SOURCE_REVISION and SOURCE_DATE_EPOCH can supply build identity
|
|
when testing an exported source tree; RPM_OUTPUT_DIR selects the output path.
|
|
|
|
%check runs the offline differential suite and checks the staged executable's
|
|
metadata from both the build directory and /tmp. No live HA actions run.
|
|
Actual target-node validate-all and HA transitions remain separate lab tests.
|
|
|
|
## Gitea requirements
|
|
|
|
Enable repository Actions. The runner must support container jobs and reach
|
|
Gitea, GitHub (for actions), the Fedora image registry, and Fedora repositories.
|
|
Checkout uses the job token over HTTPS; no SSH private key is required.
|
|
|
|
The workflow uses upload-artifact v3 for compatibility with older act_runner
|
|
installations. Newer Gitea runners may support v4; check the installed server
|
|
and runner versions before changing the artifact action. Artifact upload and
|
|
runner integration must be verified by the first actual Gitea run.
|
|
|
|
Before release publishing, resolve licensing, add its text to the package,
|
|
choose signing and version-tag policy, and configure registry authentication.
|
|
|
|
## Validation performed
|
|
|
|
On 2026-09-12, the working-tree candidate was built with Fedora 43 / RPM 6.0.2
|
|
in a disposable rootless Podman container. Binary and source RPM builds passed,
|
|
including all 22 offline differential scenarios and staged metadata checks.
|
|
DNF successfully resolved dependencies and installed the binary RPM inside that
|
|
container. tests/verify_installed_rpm.py verified the installed architecture,
|
|
RPM integrity, exact agent bytes, root ownership, 0755/0644 modes, allowed file
|
|
paths, absence of lifecycle scriptlets, and metadata from an unrelated cwd.
|
|
The source RPM rebuilt with the same version/release without Git metadata.
|
|
|
|
Fedora's automatic shebang rewriting is disabled for this shell-only package
|
|
so the entrypoint remains byte-identical to the tested source. The Corosync
|
|
runtime dependency is the corosync package (its cmapctl binary is in /usr/bin
|
|
on Fedora 43). No package was installed on either lab host.
|
|
|
|
The Gitea server reports 1.27.3. Its Actions API returned HTTP 401 without
|
|
authentication, so a successful local build does not establish runner checkout
|
|
or artifact upload success. Check the first run in the repository's Actions tab.
|