mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Gustavo Lima ChavesandJohnathan Corgan
17ca52e694
Add an RPM package for Fedora and RHEL. `make -C packaging rpm` builds it from packaging/rpm/fips.spec, and the release workflow attaches it beside the .deb and the systemd tarball. - The package is named `fips-mesh`, because Fedora already ships an unrelated `fips` (a FITS image viewer) that owns /usr/bin/fips. The spec declares `Conflicts: fips`. - It installs the same files, units and fips group as the .deb. fips.service and fips-dns.service are enabled but not started on install; fips-firewall and fips-gateway stay opt-in. - An upgrade queues `systemctl --no-block try-restart` of fips, fips-dns and fips-gateway, and reloads fips-firewall rather than restarting it. - The binaries come from the pinned build image via build-deb-container.sh, so the RPM passes the same glibc floor and dependency checks as the .deb. rpmbuild runs in FIPS_RPM_BUILD_IMAGE, AlmaLinux 9 pinned by digest. - The glibc floor is now 2.34 project-wide, the lowest supported RPM distribution (RHEL 9). testing/check-rpm-floor.sh fails a package that requires a newer glibc. RHEL 8 and openSUSE are not supported. - Erase removes the DNS drop-ins fips-dns-setup wrote and restarts or reloads the resolver whose file it removed, as the Debian postrm does. /etc/fips is kept, since rpm has no purge. - Dev builds are versioned 0.6.0-0.dev.git<date>.<sha>. Tested on Fedora 44 and in AlmaLinux 9 containers with systemd: the package requires GLIBC_2.34 and passes the floor check; install leaves both units enabled and inactive; upgrade returns immediately and the daemon restarts on the new binary; erase removes the units and DNS files and keeps /etc/fips; host-built binaries (GLIBC_2.39) fail the floor check; dnf refuses to install alongside the FITS viewer. The erase branch's resolver restart and reload were exercised in AlmaLinux 9 with systemctl stubbed. No install-test suite covers the RPM yet; it is only built.
87 lines
4.7 KiB
Bash
87 lines
4.7 KiB
Bash
# The glibc floor for the Linux release artifacts, and the image that produces it.
|
|
#
|
|
# Sourced by packaging/debian/build-deb-container.sh,
|
|
# packaging/rpm/build-rpm-container.sh, testing/check-glibc-floor.sh and
|
|
# testing/check-rpm-floor.sh. It exists so the floor is a decision written
|
|
# down in one place rather than a side effect of whichever build host ran
|
|
# last.
|
|
#
|
|
# The rule it encodes: FIPS installs on every version of a supported operating
|
|
# system that its distributor still supports for free. As of 2026-09-05 that is
|
|
#
|
|
# Ubuntu 22.04 glibc 2.35 free support ends April 2027
|
|
# Debian 12 glibc 2.36 LTS ends 2028-06-30
|
|
# Ubuntu 24.04 glibc 2.39
|
|
# Debian 13 glibc 2.41 LTS ends 2030-06-30
|
|
# Ubuntu 26.04 glibc 2.43
|
|
#
|
|
# and on the RPM side, where the same binaries ship as fips-mesh:
|
|
#
|
|
# RHEL 9 and rebuilds glibc 2.34 AlmaLinux/Rocky 9 supported to 2032-05
|
|
# Fedora (current two) glibc 2.42+ each release supported ~13 months
|
|
#
|
|
# so the lowest of both families is RHEL 9 and the floor is its 2.34. Debian 11
|
|
# left the set on 2026-08-31 and is deliberately not counted. openSUSE is not
|
|
# in the set yet: nobody has run the package on Leap, and it joins when an
|
|
# install leg does.
|
|
#
|
|
# RHEL 8 and its rebuilds are deliberately NOT in the set. Their glibc is 2.28
|
|
# and AlmaLinux 8 and Rocky 8 are in free support until 2029-05, so this is a
|
|
# real exclusion rather than an oversight: reaching 2.28 means building on an
|
|
# EL8-era toolchain, which is a second build image and a second floor, and no
|
|
# one has asked for it. If someone does, that is the decision to reopen -- not
|
|
# this number.
|
|
#
|
|
# The RPM family is why the floor is 2.34 rather than Ubuntu 22.04's 2.35: both
|
|
# families ship the same binaries, so the project-wide floor is the lowest
|
|
# member of either, and that is RHEL 9. The binaries built in FIPS_BUILD_IMAGE
|
|
# happen to reference nothing above 2.34 today, which is what lets a package
|
|
# built there install on RHEL 9 at all; without this line that is luck, and the
|
|
# first commit to pull in a 2.35 symbol would pass the check and silently drop
|
|
# every EL9 host. One step tighter costs the Debian side nothing and makes the
|
|
# EL9 claim enforced.
|
|
#
|
|
# Deliberately NOT a GitHub runner label. Runner availability follows GitHub's
|
|
# rule of supporting the newest two images; the floor follows distributors'
|
|
# support windows. Those are different clocks, and ubuntu-26.04 being in preview
|
|
# means the ubuntu-22.04 runner will very likely retire before Canonical's date.
|
|
# A container base outlives the runner label and builds the same way on a
|
|
# developer's machine, which is what lets local and GitHub CI do identical work.
|
|
#
|
|
# Changing FIPS_GLIBC_FLOOR drops support for every distribution below it. Check
|
|
# the table above first, and expect check-glibc-floor.sh to hold you to it.
|
|
|
|
# Base image for the build. The oldest supported *Debian-family* distribution,
|
|
# which is no longer the oldest supported distribution outright: RHEL 9 sits a
|
|
# step below it at 2.34, and FIPS_GLIBC_FLOOR rather than this image is what
|
|
# the binaries are held to.
|
|
FIPS_BUILD_IMAGE="ubuntu:22.04"
|
|
|
|
# Image that runs rpmbuild. It compiles nothing -- the binaries it packages are
|
|
# built in FIPS_BUILD_IMAGE -- and supplies two things the build host may not
|
|
# have: rpmbuild itself, and systemd-rpm-macros, without which the spec's
|
|
# %systemd_post would not expand and the package would ship scriptlets that
|
|
# quietly do nothing. The oldest rpm in free support (RHEL 9, rpm 4.16), so a
|
|
# package it writes is readable by every newer rpm, which is this file's glibc
|
|
# rule applied to the packaging format.
|
|
#
|
|
# Pinned by digest, not by tag. `almalinux:9` floats: it moves with every
|
|
# rebuild, and the systemd-rpm-macros it carries is what expands %systemd_post
|
|
# into the scriptlets a release artifact ships. A floating input to a release
|
|
# artifact is the thing this file exists to prevent, and the workflow that
|
|
# consumes it runs on three branches, every pull request and every tag. The
|
|
# digest is a multi-arch index, so both matrix legs resolve their own
|
|
# architecture from it.
|
|
#
|
|
# To move it: `docker buildx imagetools inspect almalinux:9 --format
|
|
# '{{.Manifest.Digest}}'`, and check that the rpm inside is still old enough
|
|
# for the distributions in the table above.
|
|
FIPS_RPM_BUILD_IMAGE="almalinux@sha256:3a3fa7f043b142bc8008c8b308d39b47d2c84008addcd52f9f9a7a82d2a90474"
|
|
|
|
# Highest glibc symbol version any shipped binary may require. Building on
|
|
# FIPS_BUILD_IMAGE currently yields exactly this, so there is no headroom left:
|
|
# the check is an upper bound, and the build sits on it. A change that raises
|
|
# what the binaries need will fail check-glibc-floor.sh rather than ship a
|
|
# package RHEL 9 refuses.
|
|
FIPS_GLIBC_FLOOR="2.34"
|