refactor(packaging): migrate from fpm to rpmbuild for RPM packaging
- Replace fpm with native rpmbuild in Dockerfile.package
- Setup proper rpmbuild directory structure (BUILD, RPMS, SOURCES, SPECS)
- Make spec file version dynamic via %{?build_version} macro
- Improve %post script with better systemd detection and error handling
- RPM now correctly uses VERSION build argument
Builds RPM packages for el8, el9, and el10 distributions.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
This commit is contained in:
Jacquin Antoine
@ -46,7 +46,7 @@ RUN mkdir -p dist && \
|
||||
./cmd/ja4sentinel
|
||||
|
||||
# =============================================================================
|
||||
# Stage 2: RPM Builder - Build RPM pour CentOS 7, Rocky 8/9/10, AlmaLinux
|
||||
# Stage 2: RPM Builder - Build RPM pour Rocky 8/9/10, AlmaLinux using rpmbuild
|
||||
# =============================================================================
|
||||
FROM rockylinux:9 AS rpm-builder
|
||||
|
||||
@ -55,122 +55,59 @@ WORKDIR /package
|
||||
# VERSION must be redeclared for each stage that needs it
|
||||
ARG VERSION=1.0.0
|
||||
|
||||
# Install fpm and rpm tools (Rocky Linux 9)
|
||||
# fpm does not require libpcap - only needed for building the Go binary
|
||||
# Install rpm-build tools (Rocky Linux 9)
|
||||
RUN dnf install -y \
|
||||
rpm \
|
||||
rpm-build \
|
||||
ruby \
|
||||
rubygems \
|
||||
gcc \
|
||||
make \
|
||||
&& dnf clean all \
|
||||
&& gem install fpm -v 1.16.0 --no-document
|
||||
&& dnf clean all
|
||||
|
||||
# Copy binary from Go builder
|
||||
COPY --from=builder /build/dist/ja4sentinel /tmp/pkgroot/usr/bin/ja4sentinel
|
||||
# Copy systemd service and config directly (not from builder)
|
||||
COPY packaging/systemd/ja4sentinel.service /tmp/pkgroot/usr/lib/systemd/system/ja4sentinel.service
|
||||
COPY packaging/systemd/config.yml /tmp/pkgroot/etc/ja4sentinel/config.yml.default
|
||||
COPY packaging/systemd/config.yml /tmp/pkgroot/usr/share/ja4sentinel/config.yml
|
||||
COPY packaging/rpm/postinst /tmp/scripts/postinst
|
||||
COPY packaging/rpm/prerm /tmp/scripts/prerm
|
||||
COPY packaging/rpm/postrm /tmp/scripts/postrm
|
||||
# Setup rpmbuild directory structure
|
||||
RUN mkdir -p /root/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
|
||||
|
||||
# Create directories and set permissions
|
||||
RUN mkdir -p /tmp/pkgroot/var/lib/ja4sentinel && \
|
||||
mkdir -p /tmp/pkgroot/var/log/ja4sentinel && \
|
||||
mkdir -p /tmp/pkgroot/var/run/ja4sentinel && \
|
||||
chmod 755 /tmp/pkgroot/usr/bin/ja4sentinel && \
|
||||
chmod 644 /tmp/pkgroot/usr/lib/systemd/system/ja4sentinel.service && \
|
||||
chmod 640 /tmp/pkgroot/etc/ja4sentinel/config.yml.default && \
|
||||
chmod 640 /tmp/pkgroot/usr/share/ja4sentinel/config.yml && \
|
||||
chmod 750 /tmp/pkgroot/var/lib/ja4sentinel && \
|
||||
chmod 750 /tmp/pkgroot/var/log/ja4sentinel && \
|
||||
chmod 750 /tmp/pkgroot/var/run/ja4sentinel && \
|
||||
chmod 750 /tmp/pkgroot/etc/ja4sentinel && \
|
||||
chmod 755 /tmp/scripts/*
|
||||
# Copy spec file
|
||||
COPY packaging/rpm/ja4sentinel.spec /root/rpmbuild/SPECS/ja4sentinel.spec
|
||||
|
||||
# Copy binary from Go builder and other files to SOURCES
|
||||
COPY --from=builder /build/dist/ja4sentinel /root/rpmbuild/SOURCES/ja4sentinel
|
||||
COPY packaging/systemd/ja4sentinel.service /root/rpmbuild/SOURCES/ja4sentinel.service
|
||||
COPY packaging/systemd/config.yml /root/rpmbuild/SOURCES/config.yml
|
||||
|
||||
# Set permissions
|
||||
RUN chmod 755 /root/rpmbuild/SOURCES/ja4sentinel && \
|
||||
chmod 644 /root/rpmbuild/SOURCES/ja4sentinel.service && \
|
||||
chmod 640 /root/rpmbuild/SOURCES/config.yml
|
||||
|
||||
# Build RPM for Rocky Linux 8 (el8)
|
||||
# Note: Requires libpcap at runtime
|
||||
RUN mkdir -p /packages/rpm/el8 && \
|
||||
fpm -s dir -t rpm \
|
||||
-n ja4sentinel \
|
||||
-v "${VERSION}" \
|
||||
-C /tmp/pkgroot \
|
||||
--architecture "x86_64" \
|
||||
--rpm-dist el8 \
|
||||
--description "JA4 TLS fingerprinting daemon for network monitoring" \
|
||||
--url "https://github.com/your-repo/ja4sentinel" \
|
||||
--license "MIT" \
|
||||
--vendor "JA4Sentinel Team <team@example.com>" \
|
||||
--depends "systemd" \
|
||||
--depends "libpcap" \
|
||||
--after-install /tmp/scripts/postinst \
|
||||
--before-remove /tmp/scripts/prerm \
|
||||
--after-remove /tmp/scripts/postrm \
|
||||
-p /packages/rpm/el8/ja4sentinel-${VERSION}-1.el8.x86_64.rpm \
|
||||
usr/bin/ja4sentinel \
|
||||
usr/lib/systemd/system/ja4sentinel.service \
|
||||
etc/ja4sentinel/config.yml.default \
|
||||
usr/share/ja4sentinel/config.yml \
|
||||
var/lib/ja4sentinel \
|
||||
var/log/ja4sentinel \
|
||||
var/run/ja4sentinel
|
||||
RUN rpmbuild --define "_topdir /root/rpmbuild" \
|
||||
--define "dist .el8" \
|
||||
--define "build_version ${VERSION}" \
|
||||
--target x86_64 \
|
||||
-bb /root/rpmbuild/SPECS/ja4sentinel.spec && \
|
||||
mkdir -p /packages/rpm/el8 && \
|
||||
cp /root/rpmbuild/RPMS/x86_64/*.el8.x86_64.rpm /packages/rpm/el8/
|
||||
|
||||
# Build RPM for Rocky Linux 9 (el9)
|
||||
# Note: Requires libpcap at runtime
|
||||
RUN mkdir -p /packages/rpm/el9 && \
|
||||
fpm -s dir -t rpm \
|
||||
-n ja4sentinel \
|
||||
-v "${VERSION}" \
|
||||
-C /tmp/pkgroot \
|
||||
--architecture "x86_64" \
|
||||
--rpm-dist el9 \
|
||||
--description "JA4 TLS fingerprinting daemon for network monitoring" \
|
||||
--url "https://github.com/your-repo/ja4sentinel" \
|
||||
--license "MIT" \
|
||||
--vendor "JA4Sentinel Team <team@example.com>" \
|
||||
--depends "systemd" \
|
||||
--depends "libpcap" \
|
||||
--after-install /tmp/scripts/postinst \
|
||||
--before-remove /tmp/scripts/prerm \
|
||||
--after-remove /tmp/scripts/postrm \
|
||||
-p /packages/rpm/el9/ja4sentinel-${VERSION}-1.el9.x86_64.rpm \
|
||||
usr/bin/ja4sentinel \
|
||||
usr/lib/systemd/system/ja4sentinel.service \
|
||||
etc/ja4sentinel/config.yml.default \
|
||||
usr/share/ja4sentinel/config.yml \
|
||||
var/lib/ja4sentinel \
|
||||
var/log/ja4sentinel \
|
||||
var/run/ja4sentinel
|
||||
RUN rpmbuild --define "_topdir /root/rpmbuild" \
|
||||
--define "dist .el9" \
|
||||
--define "build_version ${VERSION}" \
|
||||
--target x86_64 \
|
||||
-bb /root/rpmbuild/SPECS/ja4sentinel.spec && \
|
||||
mkdir -p /packages/rpm/el9 && \
|
||||
cp /root/rpmbuild/RPMS/x86_64/*.el9.x86_64.rpm /packages/rpm/el9/
|
||||
|
||||
# Build RPM for AlmaLinux 10 (el10) - compatible with Rocky Linux 10
|
||||
# Note: Requires libpcap at runtime
|
||||
RUN mkdir -p /packages/rpm/el10 && \
|
||||
fpm -s dir -t rpm \
|
||||
-n ja4sentinel \
|
||||
-v "${VERSION}" \
|
||||
-C /tmp/pkgroot \
|
||||
--architecture "x86_64" \
|
||||
--rpm-dist el10 \
|
||||
--description "JA4 TLS fingerprinting daemon for network monitoring" \
|
||||
--url "https://github.com/your-repo/ja4sentinel" \
|
||||
--license "MIT" \
|
||||
--vendor "JA4Sentinel Team <team@example.com>" \
|
||||
--depends "systemd" \
|
||||
--depends "libpcap" \
|
||||
--after-install /tmp/scripts/postinst \
|
||||
--before-remove /tmp/scripts/prerm \
|
||||
--after-remove /tmp/scripts/postrm \
|
||||
-p /packages/rpm/el10/ja4sentinel-${VERSION}-1.el10.x86_64.rpm \
|
||||
usr/bin/ja4sentinel \
|
||||
usr/lib/systemd/system/ja4sentinel.service \
|
||||
etc/ja4sentinel/config.yml.default \
|
||||
usr/share/ja4sentinel/config.yml \
|
||||
var/lib/ja4sentinel \
|
||||
var/log/ja4sentinel \
|
||||
var/run/ja4sentinel
|
||||
RUN rpmbuild --define "_topdir /root/rpmbuild" \
|
||||
--define "dist .el10" \
|
||||
--define "build_version ${VERSION}" \
|
||||
--target x86_64 \
|
||||
-bb /root/rpmbuild/SPECS/ja4sentinel.spec && \
|
||||
mkdir -p /packages/rpm/el10 && \
|
||||
cp /root/rpmbuild/RPMS/x86_64/*.el10.x86_64.rpm /packages/rpm/el10/
|
||||
|
||||
# =============================================================================
|
||||
# Stage 3: Output - Image finale avec les packages RPM
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
Name: ja4sentinel
|
||||
Version: 1.0.2
|
||||
Version: %{?build_version}%{!?build_version:1.0.0}
|
||||
Release: 1%{?dist}
|
||||
Summary: JA4 TLS fingerprinting daemon for network monitoring
|
||||
License: MIT
|
||||
@ -62,25 +62,25 @@ exit 0
|
||||
|
||||
%post
|
||||
# Set proper ownership
|
||||
chown -R ja4sentinel:ja4sentinel /var/lib/ja4sentinel
|
||||
chown -R ja4sentinel:ja4sentinel /var/run/ja4sentinel
|
||||
chown -R ja4sentinel:ja4sentinel /var/log/ja4sentinel
|
||||
chown -R ja4sentinel:ja4sentinel /etc/ja4sentinel
|
||||
chown -R ja4sentinel:ja4sentinel /var/lib/ja4sentinel 2>/dev/null || true
|
||||
chown -R ja4sentinel:ja4sentinel /var/run/ja4sentinel 2>/dev/null || true
|
||||
chown -R ja4sentinel:ja4sentinel /var/log/ja4sentinel 2>/dev/null || true
|
||||
chown -R ja4sentinel:ja4sentinel /etc/ja4sentinel 2>/dev/null || true
|
||||
|
||||
# Set proper permissions
|
||||
chmod 750 /var/lib/ja4sentinel
|
||||
chmod 750 /var/log/ja4sentinel
|
||||
chmod 750 /etc/ja4sentinel
|
||||
chmod 750 /var/lib/ja4sentinel 2>/dev/null || true
|
||||
chmod 750 /var/log/ja4sentinel 2>/dev/null || true
|
||||
chmod 750 /etc/ja4sentinel 2>/dev/null || true
|
||||
|
||||
# Install config if not exists
|
||||
if [ ! -f /etc/ja4sentinel/config.yml ]; then
|
||||
cp /usr/share/ja4sentinel/config.yml /etc/ja4sentinel/config.yml
|
||||
chown ja4sentinel:ja4sentinel /etc/ja4sentinel/config.yml
|
||||
chown ja4sentinel:ja4sentinel /etc/ja4sentinel/config.yml 2>/dev/null || true
|
||||
chmod 640 /etc/ja4sentinel/config.yml
|
||||
fi
|
||||
|
||||
# Enable and start service (systemd macro for compatibility)
|
||||
if [ $1 -eq 1 ] && [ -x /bin/systemctl ]; then
|
||||
# Reload systemd and enable service (only if systemd is running)
|
||||
if [ -x /bin/systemctl ] && [ -d /run/systemd/system ]; then
|
||||
/bin/systemctl daemon-reload
|
||||
/bin/systemctl enable ja4sentinel.service 2>/dev/null || :
|
||||
/bin/systemctl start ja4sentinel.service 2>/dev/null || :
|
||||
|
||||
Reference in New Issue
Block a user