cfengine-nova-hub.spec.in

%define prefix %{buildprefix}

%global __os_install_post %{nil}

Summary: The CFEngine Configuration System
Name: cfengine-nova-hub
Version: @@VERSION@@
# {?dist} adds a dot-separated OS codename (like .el6 or .fc30)
Release: @@RELEASE@@%{?dist}
Vendor: Northern.tech AS
License: COSL
Group: Applications/System
Url: https://cfengine.com
BuildRoot: %{_topdir}/%{name}-%{version}-%{release}-buildroot
Obsoletes: cfengine3 < @@VERSION@@, cf-community < @@VERSION@@
Requires: coreutils
# "Recommends" is only supported on RHEL 8+
%if %{?rhel}%{!?rhel:0} >= 8
Recommends: gzip
%endif
Requires(pre): /usr/sbin/useradd, /usr/sbin/userdel, /usr/bin/getent
Requires(post): /usr/sbin/usermod, /bin/sed

# we require selinux-policy package version that matches or exceeds our build system version
# this guarantees that our compiled selinux policy will work.
%if %{?rhel}%{!?rhel:0} >= 8
Requires: selinux-policy >= @@SELINUX_POLICY_VERSION@@
%endif

# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
%if %{?rhel}%{!?rhel:0} == 8
Requires: libssl.so.1.1()(64bit) libssl.so.1.1(OPENSSL_1_1_0)(64bit) libssl.so.1.1(OPENSSL_1_1_1)(64bit)
Requires: libcrypto.so.1.1()(64bit) libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)
%endif

# We build against systems with the latest available dependencies such as OpenSSL.
# We use rpm -q --provides to determine the highest API present in OpenSSL and then use that as a Requires.
# OPENSSL_VERSION is determined in build-scripts/package script.
# This should ensure that when packages are installed with yum/dnf any required OpenSSL package upgrades will be performed or the installation will fail.
%if %{?rhel}%{!?rhel:0} > 8
Requires: libcrypto.so.3()(64bit) libcrypto.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
Requires: libssl.so.3()(64bit) libssl.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
%endif

# cfbs/Build requires Python 3.5+ (not available on RHEL 6)
%if %{?rhel}%{!?rhel:0} == 7
Requires: python3 >= 3.5
%endif
# on RHEL 8 and newer, we can use weak dependencies
# and we require python3-rpm-macros so that the shebang in cfbs can be fixed with platform-python path
%if %{?rhel}%{!?rhel:0} > 7
Recommends: python3 >= 3.5
%endif

# on rhel-8 only, we need python3-rpm-macros to fix the shebang in /var/cfengine/bin/cfbs
%if %{?rhel}%{!?rhel:0} == 8
BuildRequires: python3-rpm-macros
BuildRequires: platform-python-devel
%endif

AutoReqProv: no

%if %{?with_debugsym}%{!?with_debugsym:0}
%define debug_package {nil}
%endif

%description
CFEngine is the standalone, open-source datacenter management platform run by
leading enterprises since 1993. Customize your IT systems, align to network,
business and regulatory needs, monitor problems, automatically repair and
maintain systems.

%install
#rm -rf $RPM_BUILD_ROOT

mkdir -p $RPM_BUILD_ROOT%{prefix}
cp -a %{prefix}/* $RPM_BUILD_ROOT%{prefix}
cp -a %{_basedir}/cfengine/dist/* $RPM_BUILD_ROOT

# ENT-11901
# For el9+ we started seeing issues from other packages not expecting init scripts
%if %{?rhel}%{!?rhel:0} >= 9
rm -f $RPM_BUILD_ROOT/etc/sysconfig/cfengine3
rm -f $RPM_BUILD_ROOT/etc/init.d/cfengine3
rm -f $RPM_BUILD_ROOT/etc/profile.d/cfengine.sh
%endif
# Remove useless stuff

rm -f $RPM_BUILD_ROOT%{prefix}/lib/libpromises.la
rm -f $RPM_BUILD_ROOT%{prefix}/lib/libpromises.so
rm -f $RPM_BUILD_ROOT%{prefix}/lib/cfengine-enterprise.la
rm -f $RPM_BUILD_ROOT%{prefix}/lib/cfengine-report-collect.la
rm -f $RPM_BUILD_ROOT%{prefix}/bin/getfacl

# Remove ssl things we don't need
rm -f %{prefix}/ssl/misc/CA.pl
rm -f %{prefix}/ssl/misc/tsget
rm -f %{prefix}/ssl/openssl.cnf.dist
rm -f %{prefix}/ssl/misc/tsget.pl

# Add an openssl symlink if openssl binary doesn't exist
if ! [ -f $RPM_BUILD_ROOT%{prefix}/bin/openssl ]; then
  ln -s `which openssl` $RPM_BUILD_ROOT%{prefix}/bin/openssl
fi

# Hub does not need cf-upgrade, it is only present in host packages
rm -f $RPM_BUILD_ROOT%{prefix}/bin/cf-upgrade

rm -f $RPM_BUILD_ROOT%{prefix}/lib/php/cfmod.la
rm -f $RPM_BUILD_ROOT%{prefix}/lib/php/cfengine-enterprise-api.la

# GUI, REST, KB

cp -R %{_basedir}/mission-portal $RPM_BUILD_ROOT%prefix/share/GUI

cp -vR %{_basedir}/mission-portal/Apache-htaccess $RPM_BUILD_ROOT%prefix/share/GUI/htaccess
mkdir -p $RPM_BUILD_ROOT%prefix/share/GUI/api
cp -R %{_basedir}/nova/api/http/* $RPM_BUILD_ROOT%prefix/share/GUI/api
chmod 700 $RPM_BUILD_ROOT%prefix/share/GUI/api/dc-scripts/*.sh
cp -R %{_basedir}/nova/api/http/.htaccess $RPM_BUILD_ROOT%prefix/share/GUI/api
cp -R %{_basedir}/enterprise/misc/solaris_admin_files $RPM_BUILD_ROOT%prefix/share
rm -rf $RPM_BUILD_ROOT%prefix/share/GUI/tests
rm -rf $RPM_BUILD_ROOT%prefix/share/GUI/api/tests
rm -rf $RPM_BUILD_ROOT%prefix/share/GUI/ldap/tests
rm -rf $RPM_BUILD_ROOT%prefix/share/GUI/application/controllers/testing.php
rm -rf $RPM_BUILD_ROOT%prefix/share/GUI/unittest_index.php
rm -rf $RPM_BUILD_ROOT%prefix/share/GUI/unit_test.php

rm -rf $RPM_BUILD_ROOT%prefix/share/GUI/secrets.txt

rm -rf $RPM_BUILD_ROOT%prefix/httpd/build
rm -rf $RPM_BUILD_ROOT%prefix/httpd/build
rm -rf $RPM_BUILD_ROOT%prefix/httpd/build
rm -rf $RPM_BUILD_ROOT%prefix/httpd/include
rm -f $RPM_BUILD_ROOT%prefix/httpd/htdocs/index.html
#remove binaries needed to compile apache ldap module
rm -rf $RPM_BUILD_ROOT%prefix/bin/apr-1-config
rm -rf $RPM_BUILD_ROOT%prefix/bin/apu-1-config

# Change development mode in MP to production mode and generate a session key
# Also change the client secret for Oauth2 api
sed "s/define('ENVIRONMENT', 'development')/define('ENVIRONMENT','production')/g" $RPM_BUILD_ROOT%prefix/share/GUI/public/index.php > $RPM_BUILD_ROOT%prefix/share/GUI/public/index.php.tmp

mv $RPM_BUILD_ROOT%prefix/share/GUI/public/index.php.tmp $RPM_BUILD_ROOT%prefix/share/GUI/public/index.php
rm -f $RPM_BUILD_ROOT%prefix/share/GUI/public/index.php.tmp

# NovaBase
mkdir -p $RPM_BUILD_ROOT%prefix/share/NovaBase
cp -R $RPM_BUILD_ROOT%prefix/masterfiles $RPM_BUILD_ROOT%prefix/share/NovaBase/masterfiles
rm -rf $RPM_BUILD_ROOT%prefix/masterfiles


if [ -f %{prefix}/include/sqlite3.h ]; then
  sudo rm -rf %{prefix}/include
  sudo rm -f %{prefix}/lib/libsqlite3.so
fi

mkdir -p $RPM_BUILD_ROOT%prefix/share/db
cp %{_basedir}/nova/db/schema.sql $RPM_BUILD_ROOT%prefix/share/db/
cp %{_basedir}/nova/db/schema_settings.sql $RPM_BUILD_ROOT%prefix/share/db/
cp %{_basedir}/nova/db/ootb_settings.sql $RPM_BUILD_ROOT%prefix/share/db/
cp %{_basedir}/nova/db/ootb_import.sql $RPM_BUILD_ROOT%prefix/share/db/
mkdir -p $RPM_BUILD_ROOT/var/log/
touch $RPM_BUILD_ROOT/var/log/postgresql.log

# RHEL 6 doesn't have Python 3 so no cfbs there.
%if %{?rhel}%{!?rhel:0} >= 7
# Make sure cfbs is available and in place
mkdir -p $RPM_BUILD_ROOT/tmp/cfbs_root
pip3 install --root $RPM_BUILD_ROOT/tmp/cfbs_root -r %{_basedir}/buildscripts/packaging/cfengine-nova-hub/requirements.txt
mkdir -p $RPM_BUILD_ROOT%{prefix}/lib/python
mv $RPM_BUILD_ROOT/tmp/cfbs_root/usr/lib/python*/site-packages/cfbs $RPM_BUILD_ROOT%prefix/lib/python
mv $RPM_BUILD_ROOT/tmp/cfbs_root/usr/bin/cfbs $RPM_BUILD_ROOT%prefix/bin/
sed -i "/^from cfbs.*/i sys.path.append(\"%prefix/lib/python\")" $RPM_BUILD_ROOT%prefix/bin/cfbs
rm -rf $RPM_BUILD_ROOT/tmp/cfbs_root
# only on rhel-8, which provides platform-python, do we need to fix the shebang in cfbs, this requires python3-rpm-macros and platform-python-devel packages to be installed on the build machine.
%if %{?rhel}%{!?rhel:0} == 8
%py3_shebang_fix $RPM_BUILD_ROOT%prefix/bin/cfbs
%endif
%endif

# Add cf-enterprise-support to share
cp %{_basedir}/nova/misc/cf-support-nova-hub.sh $RPM_BUILD_ROOT%prefix/share/
chmod 755 $RPM_BUILD_ROOT%prefix/share/cf-support-nova-hub.sh
%clean
#rm -rf $RPM_BUILD_ROOT

# These four will be filled in by the package script.
%pre
%post
%preun
%postun

%posttrans
#
# Work around bug in CFEngine <= 3.6.1. Search for
# BROKEN_UPGRADE_NEED_TO_RESTART_DAEMONS.txt in the buildscripts repository.
#
# This section can be removed completely when we no longer support upgrading
# from the 3.6 series.
#
if [ -f %{prefix}/BROKEN_UPGRADE_NEED_TO_RESTART_DAEMONS.txt ]; then
  service cfengine3 start
  rm -f %{prefix}/BROKEN_UPGRADE_NEED_TO_RESTART_DAEMONS.txt
fi

exit 0

%files

# Executables
%defattr(755,root,root,755)
# Main program
%dir %prefix
%dir %prefix/bin
%prefix/bin/cf-agent
%prefix/bin/cf-check
%prefix/bin/cf-execd
%prefix/bin/cf-key
%prefix/bin/cf-monitord
%prefix/bin/cf-net
%prefix/bin/cf-promises
%prefix/bin/cf-runagent
%prefix/bin/cf-secret
%prefix/bin/cf-serverd
%prefix/bin/cf-support
# Nova-only binaries
%prefix/bin/cf-hub
%prefix/bin/cf-reactor

# Only verify owner group mode maj min symlink
# Don't verify md5, size, mtime
#rsync
%prefix/bin/rsync
# init.d script enterprise part
%{prefix}/bin/cfengine3-nova-hub-init-d.sh

# OpenSSL tools (we don't bundle OpenSSL on RHEL 8)
# Note that prefix/bin/openssl is outside of `if`, since
# on RHEL8 it's a symlink to a system-wide openssl binary
%{prefix}/bin/openssl
%if %{?rhel}%{!?rhel:0} <= 7
%dir %{prefix}/ssl
%{prefix}/ssl/openssl.cnf
%{prefix}/ssl/ct_log_list.cnf
%{prefix}/ssl/ct_log_list.cnf.dist
%endif

%prefix/bin/git
%prefix/bin/gitk
%prefix/bin/git-cvsserver
%prefix/bin/git-receive-pack
%prefix/bin/git-shell
%prefix/bin/git-upload-archive
%prefix/bin/git-upload-pack
%prefix/bin/curl
%prefix/bin/wcurl
#postgresql binaries
%{prefix}/bin/clusterdb
%{prefix}/bin/createdb
%{prefix}/bin/createuser
%{prefix}/bin/dropdb
%{prefix}/bin/dropuser
%{prefix}/bin/initdb
%{prefix}/bin/oid2name
%{prefix}/bin/pg_amcheck
%{prefix}/bin/pg_archivecleanup
%{prefix}/bin/pg_basebackup
%{prefix}/bin/pgbench
%{prefix}/bin/pg_checksums
%{prefix}/bin/pg_config
%{prefix}/bin/pg_controldata
%{prefix}/bin/pg_ctl
%{prefix}/bin/pg_dump
%{prefix}/bin/pg_dumpall
%{prefix}/bin/pg_isready
%{prefix}/bin/pg_receivewal
%{prefix}/bin/pg_recvlogical
%{prefix}/bin/pg_resetwal
%{prefix}/bin/pg_restore
%{prefix}/bin/pg_rewind
%{prefix}/bin/pg_test_fsync
%{prefix}/bin/pg_test_timing
%{prefix}/bin/pg_upgrade
%{prefix}/bin/pg_verifybackup
%{prefix}/bin/pg_waldump
%{prefix}/bin/postgres
%{prefix}/bin/psql
%{prefix}/bin/reindexdb
%{prefix}/bin/vacuumdb
%{prefix}/bin/vacuumlo
# LMDB
%prefix/bin/lmdump
%prefix/bin/lmmgr
%prefix/bin/mdb_copy
%prefix/bin/mdb_stat
%prefix/bin/mdb_dump
%prefix/bin/mdb_load
# diffutils
%prefix/bin/diff
%prefix/bin/cmp
%prefix/bin/sdiff
%prefix/bin/diff3
# Auxiliary programs
%prefix/bin/rpmvercmp
#libexec of git
%prefix/lib/git-core/*

# Libraries
%defattr(644,root,root,755)
%dir %prefix/lib
%prefix/lib/lib*.so*
%prefix/lib/cfengine-enterprise.so
%prefix/lib/cfengine-report-collect.so

# PHP modules
%prefix/lib/php
#libs needed by apache ldapmodules
%prefix/lib/apr-util-1
#libs of postgres
%{prefix}/lib/postgresql/*

# Python stuff (bindings + cfbs)
%dir %prefix/lib/python
%prefix/lib/python/*
%if %{?rhel}%{!?rhel:0} >= 7
%attr(755,root,root) %prefix/bin/cfbs
%endif

# Initscript, other configuration
%defattr(755,root,root,755)
# ENT-11901
# For el9+ we started seeing issues from other packages not expecting init scripts
%if %{?rhel}%{!?rhel:0} < 9
/etc/init.d/cfengine3
/etc/profile.d/cfengine.sh
%attr(644,root,root) /etc/sysconfig/cfengine3
%endif

# Systemd units
%defattr(644,root,root,755)
/usr/lib/systemd/system/cfengine3.service
/usr/lib/systemd/system/cf-apache.service
/usr/lib/systemd/system/cf-execd.service
/usr/lib/systemd/system/cf-hub.service
/usr/lib/systemd/system/cf-reactor.service
/usr/lib/systemd/system/cf-monitord.service
/usr/lib/systemd/system/cf-postgres.service
/usr/lib/systemd/system/cf-serverd.service

%if %{?rhel}%{!?rhel:0} > 7
# SELinux policy
%dir %prefix/selinux
%prefix/selinux/cfengine-enterprise.pp
%prefix/selinux/cfengine-enterprise.te
%prefix/selinux/cfengine-enterprise.fc
%prefix/selinux/cfengine-enterprise-unconfined.pp
%prefix/selinux/cfengine-enterprise-unconfined.te
%prefix/selinux/cfengine-enterprise-unconfined.fc
%prefix/selinux/label-binaries-unconfined.sh
%endif

# Documentation
%defattr(644,root,root,755)
%dir %prefix/share
%prefix/share/cf-support-nova-hub.sh
%prefix/share/doc
# Web interface
%prefix/share/GUI
#postgresql share
%prefix/share/postgresql/*
# PostgreSQL log file
%attr(600,cfpostgres,cfpostgres) /var/log/postgresql.log
# Only verify owner group mode maj min symlink
# Don't verify md5, size, mtime
%verify(not md5 size mtime) /var/log/postgresql.log

# ENT-2708, ENT-2846
%defattr(600,root,root,700)
%prefix/share/db/*.sql

# No-one should need access to anything under share/GUI
%defattr(400,root,root,400)
# We can change these configuration files as part of masterfiles policy so need to mark as configs
%config(noreplace) %prefix/share/GUI/application/config/config.php
%config(noreplace) %prefix/share/GUI/api/modules/inventory/config/config.php
%prefix/share/GUI

# Base policy
%defattr(644,root,root,755)
%prefix/share/NovaBase
%defattr(755,root,root,755)
%prefix/modules

#DC deps
%defattr(755,root,root,755)
%prefix/share/locale
%prefix/share/git-core
%prefix/share/git-gui
%prefix/share/gitk
%prefix/share/gitweb

#Solaris upgrade files
%prefix/share/solaris_admin_files

%defattr(755,root,root,755)
%dir %prefix/httpd
%prefix/httpd/bin
%prefix/httpd/cgi-bin

%defattr(460,root,cfapache,570)
%prefix/httpd/conf
%config %prefix/httpd/conf/httpd.conf
# Note: MPF policy must be aligned search for ENT-11096 or cfengine_mp_apache_config_ownership_perms
%attr(400,root,root) %prefix/httpd/conf/httpd.conf
%prefix/httpd/error
%prefix/httpd/htdocs
%prefix/httpd/icons
%prefix/httpd/logs
%prefix/httpd/modules
%prefix/httpd/php/lib
%prefix/httpd/php/php
%config(noreplace) %prefix/httpd/php/lib/php.ini

%defattr(755,root,root,755)
%prefix/httpd/php/bin

# Software upgrade delivery area
%dir %prefix/master_software_updates

# Private directories
%defattr(700,root,root,700)
%dir %prefix/ppkeys
%dir %prefix/outputs
%dir %prefix/inputs
%dir %prefix/state

%changelog