Re: [PATCH] fedora: Separately restore context for /run/user in %posttrans selinux

[Max Chernoff <git@maxchernoff.ca>]

Hi Stefano,

On Fri, 2025-05-23 at 14:19 +0200, Stefano Brivio wrote:
> For one-off builds:
>
> > but I was eventually able to get the following to work:
> >
> >     $ git archive --prefix=passt-$(git rev-parse @)/ @ > ./passt-$(git rev-parse @).tar
> >     $ xz passt-*.tar
> >     $ mv *.tar.xz contrib/fedora/
> >     $ cd contrib/fedora/
> >     $ rpkg local --outdir $(realpath .)
>
> I actually do something like this, but uglier. I didn't think of using
> git-archive:
>
> $ mkdir passt-679cb68455a9ae40cc72233abf218c20527500a6/
> $ cp -Rpd *.c *.h Makefile seccomp.sh passt.1 passt-repair.1 qrap.1 README.md doc/ contrib/ LICENSES/ passt-679cb68455a9ae40cc72233abf218c20527500a6/
> $ tar Jcvf /home/sbrivio/rpmbuild/SOURCES/passt-679cb68455a9ae40cc72233abf218c20527500a6.tar.xz passt-679cb68455a9ae40cc72233abf218c20527500a6/
> $ cd contrib/fedora
> $ rpkg spec
> /tmp/rpkg/passt-1-djdq6cud/passt.spec
> $ rpmbuild -ba /tmp/rpkg/passt-1-djdq6cud/passt.spec

Ah, I've never built an rpm package before, so I figured that I was just
missing something obvious.

> We would need to replace %prep with a simple copy from the current
> directory. I didn't really think this through, but perhaps we could
> make it conditional, like this:
>
> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
> index 745cf01..f1973ee 100644
> --- a/contrib/fedora/passt.spec
> +++ b/contrib/fedora/passt.spec
> @@ -47,7 +47,13 @@ Requires(preun): policycoreutils
>  This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).
>
>  %prep
> +%if "%(ls passt.c)" == "passt.c"
> +# Hack for local build from source tree
> +cp -a %(pwd)/* .
> +%else
> +# The usual process with an upstream tarball
>  %setup -q -n passt-%{git_hash}
> +%endif
>
>  %build
>  %set_build_flags

I also needed to add "touch ../passt-%{git_hash}.tar.xz" (which is an
awful hack) for it to work properly:

diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
index 5aaf7ac..02dab93 100644
--- a/contrib/fedora/passt.spec
+++ b/contrib/fedora/passt.spec
@@ -47,7 +47,14 @@ Requires(preun): policycoreutils
 This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).

 %prep
+%if "%(ls passt.c)" == "passt.c"
+# Hack for local build from source tree
+cp -a %(pwd)/* .
+touch ../passt-%{git_hash}.tar.xz
+%else
+# The usual process with an upstream tarball
 %setup -q -n passt-%{git_hash}
+%endif

 %build
 %set_build_flags

Thanks,
-- Max