From 62a70a6a5e1d2fe7a2f48b7a1857b80304dc794f Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Wed, 26 Aug 2026 13:36:16 +0200 Subject: [PATCH 1/2] feat: add OpenSpec artifacts for RPM spec modernization Add proposal, design, and tasks for modernizing the RPM spec to conform to Fedora Go Packaging Guidelines. Key changes planned: - Adopt go-vendor-tools for vendored license verification - Switch to %gobuild macro for hardened builds and debuginfo - Add main package for shared license files - Aggregate vendored dependency licenses in License field - Add Fedora 43 Go 1.25 compatibility workaround - Bump complyctl dependency to >= 1.0.0 Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .../rpm-spec-modernization/.openspec.yaml | 3 + .../changes/rpm-spec-modernization/design.md | 126 ++++++++++++++++++ .../rpm-spec-modernization/proposal.md | 66 +++++++++ .../changes/rpm-spec-modernization/tasks.md | 88 ++++++++++++ 4 files changed, 283 insertions(+) create mode 100644 openspec/changes/rpm-spec-modernization/.openspec.yaml create mode 100644 openspec/changes/rpm-spec-modernization/design.md create mode 100644 openspec/changes/rpm-spec-modernization/proposal.md create mode 100644 openspec/changes/rpm-spec-modernization/tasks.md diff --git a/openspec/changes/rpm-spec-modernization/.openspec.yaml b/openspec/changes/rpm-spec-modernization/.openspec.yaml new file mode 100644 index 0000000..9bb4379 --- /dev/null +++ b/openspec/changes/rpm-spec-modernization/.openspec.yaml @@ -0,0 +1,3 @@ +schema: spec-driven +created: 2026-08-26 +skip_specs: true diff --git a/openspec/changes/rpm-spec-modernization/design.md b/openspec/changes/rpm-spec-modernization/design.md new file mode 100644 index 0000000..93ecaa9 --- /dev/null +++ b/openspec/changes/rpm-spec-modernization/design.md @@ -0,0 +1,126 @@ +## Context + +See proposal.md for motivation. The current `complytime-providers.spec` +was written for internal/COPR builds. Fedora Go packages must use the +`go-vendor-tools` ecosystem for vendored license handling, `%gobuild` +for hardened builds, and forge macros for source management. The +`complyctl` spec on `opsx/rpm-spec-modernization` was already modernized +and serves as the reference implementation. + +Key constraints: +- complytime-providers builds **three** binaries (not one like complyctl) +- The spec produces only sub-packages (no main binary), but Fedora + needs a main package to hold shared license files +- Fedora 43 ships Go 1.25; `go.mod` requires Go 1.26.5 +- Provider binaries must install to + `/usr/libexec/complytime/providers/` (owned by `complyctl` RPM) +- The `gopkg.in/yaml.v3` vendored license is a dual MIT+Apache-2.0 + file that `askalono` cannot auto-detect + +## Goals / Non-Goals + +**Goals:** +- Pass Fedora package review for Go packaging compliance +- Align with the modernized `complyctl` spec patterns +- Ensure `complyctl` + `complytime-providers` install cleanly + together on Fedora and provider discovery works end-to-end +- Generate proper debuginfo packages (removing `%{nil}` override) + +**Non-Goals:** +- Packaging `snappy`, `ampel`, or `conftest` for Fedora (external + runtime deps for ampel/opa providers remain user-managed) +- Changing provider binary behavior or code +- Creating man pages for providers (can be added later) + +## Decisions + +### D1: Main package as license holder (not meta-package) + +The main `complytime-providers` package holds shared license files +(via `%go_vendor_license_filelist`) and `README.md`. It does NOT +pull in all sub-packages. + +**Why**: Sub-packages have different runtime dependency profiles +(`openscap-scanner + scap-security-guide` vs `git` vs nothing). +A meta-package would force unnecessary dependencies on users who +only want one provider. + +**Alternative considered**: Attach `%go_vendor_license_filelist` to +one arbitrary sub-package. Rejected because it creates asymmetry +between sub-packages and the chosen sub-package would need to be +installed even when the user wants a different provider. + +### D2: Three `%gobuild` calls for three binaries + +Each provider binary gets its own `%gobuild` invocation in `%build`. +The `%gobuild` macro supports `-o ` syntax, +identical to `go build`, so three calls are straightforward. + +**Why**: `%gobuild` is the Fedora-standard macro that applies PIE, +RELRO, FORTIFY, and generates proper DWARF debuginfo. No batching +mechanism exists for multiple binaries. + +### D3: Single `GO_LDFLAGS` for version injection + +Only `internal/version.version` is injected (unlike complyctl which +also injects `gitTreeState`, `commit`, and `buildDate`). The +providers' `internal/version` package only exposes `version`. + +``` +export GO_LDFLAGS="-X %{goipath}/internal/version.version=%{version}" +``` + +### D4: Fedora 43 Go compatibility via conditional sed + +Matches the `complyctl` spec approach: conditionally lower the +`go` directive in `go.mod` and `vendor/modules.txt` from 1.26 to +1.25 when building on Fedora 43. + +**Why**: Fedora 43 is supported until 2026-12-09. Using a +conditional `%if 0%{?fedora} == 43` block keeps it self-documenting +and easy to remove after EOL. + +**Alternative considered**: Carrying a patch file. Rejected because +the `sed` approach is identical to the complyctl reference and +avoids maintaining a separate patch file that would need updating +on every Go version bump. + +### D5: No `%gocheck2` exclusions + +All 29 test files were analyzed. Every test that touches external +tools (oscap, conftest, snappy, ampel, git) uses mock/fake +implementations. The only integration test +(`cmd/openscap-provider/config/integration_test.go`) is gated by +`//go:build integration` and is automatically excluded from +`go test ./...`. Toolcheck tests use universally available commands +(`go`, `ls`). + +### D6: `go-vendor-tools.toml` with yaml.v3 license override + +The `askalono` detector correctly identifies all vendored licenses +except `gopkg.in/yaml.v3/LICENSE` (dual MIT + Apache-2.0 in a +single file). A manual `[[licensing.licenses]]` override is +required, matching the same override in `complyctl`'s config. + +## Risks / Trade-offs + +**[Risk] `%gobuild` external linker requirement** The `%gobuild` +macro uses `-linkmode=external` which requires a C compiler and +linker. This is standard in Fedora build environments but differs +from the current `CGO_ENABLED=0` approach in `.goreleaser.yaml`. +RPM builds and release builds are intentionally different +environments. +Mitigation: Fedora build roots always have `gcc` available. + +**[Risk] Fedora 43 Go compat workaround fragility** The `sed` +command pattern-matches `go [0-9].*` in `go.mod`. If the format +changes in future Go versions, it could silently fail. +Mitigation: The block is conditional on `%{?fedora} == 43` only +and has a documented EOL date for removal. + +**[Risk] License expression drift** If vendored dependencies +change, the `License:` field and `go-vendor-tools.toml` overrides +must be updated. +Mitigation: `%go_vendor_license_check` in `%check` will fail the +build if the license config is stale. The `go_vendor_license report +--verify-spec` workflow catches drift. diff --git a/openspec/changes/rpm-spec-modernization/proposal.md b/openspec/changes/rpm-spec-modernization/proposal.md new file mode 100644 index 0000000..2b00896 --- /dev/null +++ b/openspec/changes/rpm-spec-modernization/proposal.md @@ -0,0 +1,66 @@ +## Why + +The complytime-providers package is being proposed for inclusion in Fedora. +The current RPM spec was written for internal/COPR builds and does not +conform to the Fedora Go Packaging Guidelines. Key gaps include: missing +vendored dependency license aggregation (Fedora requires the `License:` +field to enumerate all vendored licenses), raw `go build` commands +instead of `%gobuild` macros (bypasses hardening flags and debuginfo +generation), and manual source/vendor handling instead of the +`go-vendor-tools` workflow that Fedora Go packages use. A parallel +modernization was completed for the `complyctl` spec on the +`opsx/rpm-spec-modernization` branch and serves as the reference +for this work. + +## What Changes + +- Adopt `go-vendor-tools` for vendored license verification, replacing + manual `%license` directives with `%go_vendor_license_filelist` +- Create `go-vendor-tools.toml` configuration with license detection + overrides for ambiguous vendored licenses (e.g., `gopkg.in/yaml.v3`) +- Replace raw `go build` commands with `%gobuild` macro (enables RPM + hardening flags, proper debuginfo generation, build ID injection) +- Remove `%global debug_package %{nil}` (no longer needed with + `%gobuild`) +- Switch source handling from raw GitHub URL to forge macros + (`%{gosource}`) with separate vendor archive (`Source1`) +- Aggregate vendored dependency licenses into the `License:` field + (`Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0`) +- Replace `go test` with `%gocheck2` macro and add `%bcond check` + toggle +- Switch to `%autorelease` for automatic release numbering +- Introduce a main `complytime-providers` package to hold shared + license files and documentation; sub-packages require it via + `Requires: %{name} = %{version}-%{release}` +- Bump `Requires: complyctl` from `>= 0.0.8` to `>= 1.0.0` +- Add Fedora 43 Go 1.25 compatibility workaround (conditional + `go.mod`/`vendor/modules.txt` patching) +- Add `%generate_buildrequires` section with + `%go_vendor_license_buildrequires` + +## Capabilities + +### New Capabilities + +None. This change modernizes packaging artifacts only. + +### Modified Capabilities + +None. No spec-level behavior changes. The `skip_specs: true` marker +is set in `.openspec.yaml` because this is a pure packaging/tooling +change with no behavioral impact. + +## Impact + +- **Files modified**: `complytime-providers.spec` +- **Files created**: `go-vendor-tools.toml` +- **Dependencies**: Adds build-time dependency on `go-vendor-tools` + (Fedora-packaged); removes explicit `golang >= 1.26` and + `go-rpm-macros` build requirements (pulled transitively) +- **Runtime**: No change to binary behavior. Provider discovery, + install paths, and binary names remain identical. +- **Cross-package**: Requires `complyctl >= 1.0.0` RPM to be + available (the `complyctl` spec on `opsx/rpm-spec-modernization` + targets v1.0.0). The `complyctl` RPM owns + `/usr/libexec/complytime/` and `/usr/libexec/complytime/providers/`; + provider sub-packages install binaries into that directory. diff --git a/openspec/changes/rpm-spec-modernization/tasks.md b/openspec/changes/rpm-spec-modernization/tasks.md new file mode 100644 index 0000000..b0e4933 --- /dev/null +++ b/openspec/changes/rpm-spec-modernization/tasks.md @@ -0,0 +1,88 @@ +## 1. Vendored License Tooling + +- [ ] 1.1 Create `go-vendor-tools.toml` with `[archive]` section, + `[licensing]` section (`detector = "askalono"`), and manual + `[[licensing.licenses]]` override for `vendor/gopkg.in/yaml.v3/LICENSE` + (expression: `MIT AND (MIT AND Apache-2.0)`). Verify by running + `go_vendor_license --config go-vendor-tools.toml report expression` + and confirming the output is + `Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0`. + +## 2. Spec Header Modernization + +- [ ] 2.1 Add `%bcond check 1` at the top of the spec. Reorder globals: + move `%global app_dir complytime` before the goipath block, remove + `%global base_url`, remove `%global debug_package %{nil}`. Move + `Version:` before `%gometa -f`. Verify the header follows the pattern + in the complyctl reference spec. + +- [ ] 2.2 Update `Release:` from `1%{?dist}` to `%autorelease`. Update + `License:` to `Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0` + (must match the `go_vendor_license report expression` output). Update + `URL:` from `%{base_url}` to `%{gourl}`. Replace `Source0:` with + `%{gosource}` and add `Source1: %{archivename}-vendor.tar.bz2` and + `Source2: go-vendor-tools.toml`. Replace `BuildRequires: golang >= 1.26` + and `BuildRequires: go-rpm-macros` with `BuildRequires: go-vendor-tools`. + Verify by inspecting the spec header matches the Fedora Go packaging + pattern. + +## 3. Main Package and Sub-package Updates + +- [ ] 3.1 Add a main `%files` section for `complytime-providers` with + `-f %{go_vendor_license_filelist}` and `%doc README.md`. This package + holds shared license files. Verify the main `%description` already + exists (it does) and is appropriate. + +- [ ] 3.2 Update all three sub-packages (`openscap`, `ampel`, `opa`): + bump `Requires: complyctl` from `>= 0.0.8` to `>= 1.0.0`, add + `Requires: %{name} = %{version}-%{release}` to each. Remove + `%license LICENSE` and `%doc README.md vendor/modules.txt` from each + sub-package `%files` section (now in main package). Verify each + sub-package `%files` section contains only the `%attr` line for its + binary. + +## 4. Build and Prep Sections + +- [ ] 4.1 Replace `%prep` section: change `%goprep -k` to `%goprep -A`, + add `%setup -q -T -D -a1 %{forgesetupargs}` and `%autopatch -p1`. + Add the Fedora 43 Go 1.25 compatibility block (conditional `sed` on + `go.mod` and `vendor/modules.txt`). Add `%generate_buildrequires` + section with `%go_vendor_license_buildrequires -c %{S:2}`. Verify by + comparing with the complyctl reference spec `%prep` section. + +- [ ] 4.2 Replace `%build` section: remove `%set_build_flags`, + `export GO111MODULE=on`, `GO_LD_EXTRAFLAGS`, `GO_BUILD_BINDIR`, + and raw `go build` commands. Add `%global gomodulesmode GO111MODULE=on`, + `export GO_LDFLAGS` with version injection, and three `%gobuild` calls + targeting `%{gobuilddir}/bin/` output paths. Verify the three + `%gobuild` lines reference the correct import paths + (`%{goipath}/cmd/openscap-provider`, `%{goipath}/cmd/ampel-provider`, + `%{goipath}/cmd/opa-provider`). + +## 5. Install, Check, and Files + +- [ ] 5.1 Update `%install` section: add `%go_vendor_license_install -c %{S:2}` + at the top. Update binary install source paths from `bin/` to + `%{gobuilddir}/bin/`. Verify install paths for all three binaries + target `%{buildroot}%{_libexecdir}/%{app_dir}/providers/`. + +- [ ] 5.2 Replace `%check` section: add + `%go_vendor_license_check -c %{S:2}`, wrap test execution in + `%if %{with check}` / `%endif`, replace `go test -mod=vendor -v ./...` + with `%gocheck2`. Verify the check section structure matches the + complyctl reference. + +## 6. Changelog and Verification + +- [ ] 6.1 Update `%changelog`: add a new entry at the top documenting + all modernization changes. Verify the date format and entry style + match existing changelog entries. + +- [ ] 6.2 Run `go_vendor_license --config go-vendor-tools.toml report + --verify-spec` against the updated spec to confirm the license + expression is consistent. Verify no errors. + +- [ ] 6.3 Run `rpmbuild -bs complytime-providers.spec` (or equivalent + source RPM build) to verify the spec parses correctly. If the build + environment supports it, run `rpmbuild -bb` or a mock build to verify + end-to-end. Document any issues found. From 96d33df521dfb814bf8d96054d1e8f26dbc1021e Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Wed, 26 Aug 2026 17:35:53 +0200 Subject: [PATCH 2/2] feat: modernize RPM spec for Fedora Go packaging guidelines - Adopt go-vendor-tools for vendored license verification - Replace raw go build with %gobuild macro for hardened builds - Switch to forge macros and %autorelease - Add aggregated vendored license expression - Introduce main package for shared license files - Bump complyctl dependency to >= 1.0.0 - Add Fedora 43 Go 1.25 compatibility workaround - Create go-vendor-tools.toml with yaml.v3 license override - Update CHANGELOG.md and AGENTS.md project structure - Incorporate spec review feedback into OpenSpec artifacts Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- AGENTS.md | 1 + CHANGELOG.md | 1 + complytime-providers.spec | 116 +++++++++++------- go-vendor-tools.toml | 18 +++ .../changes/rpm-spec-modernization/design.md | 35 +++++- .../rpm-spec-modernization/proposal.md | 16 +++ .../changes/rpm-spec-modernization/tasks.md | 116 +++++++++++++----- 7 files changed, 222 insertions(+), 81 deletions(-) create mode 100644 go-vendor-tools.toml diff --git a/AGENTS.md b/AGENTS.md index 690c1f8..c2e98aa 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -96,6 +96,7 @@ complytime-providers/ │ └── changes/ # Active change specs ├── .opencode/ # Agent definitions & convention packs ├── .goreleaser.yaml # GoReleaser v2 release config +├── go-vendor-tools.toml # Vendored license detection config (Fedora RPM) └── complytime-providers.spec # RPM packaging spec ``` diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b58e7c..4248c17 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ ### Infrastructure +- Modernized RPM spec for Fedora Go Packaging Guidelines: adopted `go-vendor-tools` for vendored license handling, replaced raw `go build` with `%gobuild` macro, switched to forge macros and `%autorelease`, added aggregated vendored license expression, and introduced main `complytime-providers` package for shared license files. - Consolidated duplicate tar.gz extraction code from ampel and OPA providers into shared `internal/archive/` package, eliminating code duplication and ensuring consistent security behavior across providers. ### Breaking Changes diff --git a/complytime-providers.spec b/complytime-providers.spec index 348accb..d5534c7 100644 --- a/complytime-providers.spec +++ b/complytime-providers.spec @@ -1,26 +1,32 @@ # SPDX-License-Identifier: Apache-2.0 -%global goipath github.com/complytime/complytime-providers -%global base_url https://%{goipath} +%bcond check 1 + %global app_dir complytime -# Go binaries include their own debug info; standard RPM debuginfo extraction -# does not produce useful output for Go executables. -%global debug_package %{nil} + +# https://github.com/complytime/complytime-providers +%global goipath github.com/complytime/complytime-providers +Version: 0.1.0 + +%gometa -f Name: complytime-providers -Version: 0.1.0 -Release: 1%{?dist} +Release: %autorelease Summary: Compliance scanning providers for complyctl -License: Apache-2.0 -URL: %{base_url} -Source0: %{base_url}/archive/refs/tags/v%{version}.tar.gz -BuildRequires: golang >= 1.26 -BuildRequires: go-rpm-macros +# License includes vendored dependency licenses. +# Generated by go-vendor-tools; verify with: +# go_vendor_license --config go-vendor-tools.toml report expression +License: Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 +URL: %{gourl} +Source0: %{gosource} +# Generated by go-vendor-tools +Source1: %{archivename}-vendor.tar.bz2 +Source2: go-vendor-tools.toml + +BuildRequires: go-vendor-tools ExclusiveArch: %{go_arches} -%gometa -f - %description Compliance scanning providers that extend complyctl with support for different policy validation platforms (PVPs). Each provider communicates @@ -32,7 +38,8 @@ can install only the providers they need. %package openscap Summary: OpenSCAP scanning provider for complyctl -Requires: complyctl >= 0.0.8 +Requires: %{name} = %{version}-%{release} +Requires: complyctl >= 1.0.0 Requires: openscap-scanner Requires: scap-security-guide @@ -47,7 +54,8 @@ and follows the complyctl-provider-* discovery convention. %package ampel Summary: Ampel scanning provider for complyctl -Requires: complyctl >= 0.0.8 +Requires: %{name} = %{version}-%{release} +Requires: complyctl >= 1.0.0 %description ampel Ampel scanning provider that extends complyctl with Ampel evaluation @@ -61,7 +69,8 @@ not currently packaged in Fedora and must be installed separately. %package opa Summary: OPA/Conftest scanning provider for complyctl -Requires: complyctl >= 0.0.8 +Requires: %{name} = %{version}-%{release} +Requires: complyctl >= 1.0.0 Requires: git %description opa @@ -73,55 +82,72 @@ NOTE: Requires the 'conftest' CLI tool at runtime. This tool is not currently packaged in Fedora and must be installed separately. %prep -%goprep -k +%goprep -A +%setup -q -T -D -a1 %{forgesetupargs} +%autopatch -p1 + +# TODO(2027-01): remove F43 workaround +# Fedora 43 ships Go 1.25 but go.mod may require Go 1.26+ due to +# transitive dependency requirements. Lower the directive to the +# system Go major.minor so rpmbuild succeeds with GOTOOLCHAIN=local. +# Fedora 43 EOL: 2026-12-09 — remove this block after EOL. +# Reference: https://packages.fedoraproject.org/pkgs/golang/golang/ +%if 0%{?fedora} == 43 +sed -i 's/^go [0-9].*/go 1.25/' go.mod +sed -i '/^## explicit; go /s/go [0-9]\..*/go 1.25/' vendor/modules.txt +%endif + +%generate_buildrequires +%go_vendor_license_buildrequires -c %{S:2} %build -# Set up environment variables and flags to build properly and securely -%set_build_flags -export GO111MODULE=on - -# Inject version via ldflags (mirrors complyctl's pattern) -GO_LD_EXTRAFLAGS="-X %{goipath}/internal/version.version=%{version}" - -# Define and create the output directory for binaries -GO_BUILD_BINDIR=./bin -mkdir -p ${GO_BUILD_BINDIR} +%global gomodulesmode GO111MODULE=on +export GO_LDFLAGS="-X %{goipath}/internal/version.version=%{version}" -# Build all provider binaries -go build -mod=vendor -buildmode=pie -ldflags "${LDFLAGS} ${GO_LD_EXTRAFLAGS}" -o ${GO_BUILD_BINDIR}/complyctl-provider-openscap ./cmd/openscap-provider -go build -mod=vendor -buildmode=pie -ldflags "${LDFLAGS} ${GO_LD_EXTRAFLAGS}" -o ${GO_BUILD_BINDIR}/complyctl-provider-ampel ./cmd/ampel-provider -go build -mod=vendor -buildmode=pie -ldflags "${LDFLAGS} ${GO_LD_EXTRAFLAGS}" -o ${GO_BUILD_BINDIR}/complyctl-provider-opa ./cmd/opa-provider +%gobuild -o %{gobuilddir}/bin/complyctl-provider-openscap %{goipath}/cmd/openscap-provider +%gobuild -o %{gobuilddir}/bin/complyctl-provider-ampel %{goipath}/cmd/ampel-provider +%gobuild -o %{gobuilddir}/bin/complyctl-provider-opa %{goipath}/cmd/opa-provider %install +%go_vendor_license_install -c %{S:2} install -d -m 0755 %{buildroot}%{_libexecdir}/%{app_dir}/providers -install -p -m 0755 bin/complyctl-provider-openscap %{buildroot}%{_libexecdir}/%{app_dir}/providers/complyctl-provider-openscap -install -p -m 0755 bin/complyctl-provider-ampel %{buildroot}%{_libexecdir}/%{app_dir}/providers/complyctl-provider-ampel -install -p -m 0755 bin/complyctl-provider-opa %{buildroot}%{_libexecdir}/%{app_dir}/providers/complyctl-provider-opa +install -p -m 0755 %{gobuilddir}/bin/complyctl-provider-openscap %{buildroot}%{_libexecdir}/%{app_dir}/providers/complyctl-provider-openscap +install -p -m 0755 %{gobuilddir}/bin/complyctl-provider-ampel %{buildroot}%{_libexecdir}/%{app_dir}/providers/complyctl-provider-ampel +install -p -m 0755 %{gobuilddir}/bin/complyctl-provider-opa %{buildroot}%{_libexecdir}/%{app_dir}/providers/complyctl-provider-opa %check -# Run unit tests -go test -mod=vendor -v ./... +%go_vendor_license_check -c %{S:2} +%if %{with check} +%gocheck2 +%endif -# No main files section -- source RPM produces only sub-packages +# Main package: shared license files and documentation +%files -f %{go_vendor_license_filelist} +%doc README.md %files openscap %attr(0755, root, root) %{_libexecdir}/%{app_dir}/providers/complyctl-provider-openscap -%license LICENSE -%doc README.md vendor/modules.txt %files ampel %attr(0755, root, root) %{_libexecdir}/%{app_dir}/providers/complyctl-provider-ampel -%license LICENSE -%doc README.md vendor/modules.txt %files opa %attr(0755, root, root) %{_libexecdir}/%{app_dir}/providers/complyctl-provider-opa -%license LICENSE -%doc README.md vendor/modules.txt %changelog -* Thu Jun 12 2026 Marcus Burghardt - 0.1.0-1 +* Wed Aug 26 2026 Marcus Burghardt - 0.1.0-1 +- Modernize spec for Fedora Go packaging guidelines +- Adopt go-vendor-tools for vendored license verification +- Fix debuginfo generation by switching to %%gobuild macro +- Use %%gocheck2 for unit tests +- Use %%autorelease for automatic release numbering +- Bump complyctl dependency to >= 1.0.0 +- Add Fedora 43 Go 1.25 compatibility workaround +- Add main package for shared license files +- Add aggregated vendored license expression + +* Fri Jun 12 2026 Marcus Burghardt - 0.1.0-1 - Bump to version 0.1.0 - Add OPA provider sub-package - Add build-time version injection via ldflags diff --git a/go-vendor-tools.toml b/go-vendor-tools.toml new file mode 100644 index 0000000..80b810d --- /dev/null +++ b/go-vendor-tools.toml @@ -0,0 +1,18 @@ +# go-vendor-tools configuration for complytime-providers +# See: https://fedora.gitlab.io/sigs/go/go-vendor-tools/config/ +# +# License overrides below are populated by: +# go_vendor_license --config go-vendor-tools.toml \ +# --path complytime-providers.spec report --prompt --autofill=auto +# +# Vendor archive is generated by: +# go_vendor_archive create --config go-vendor-tools.toml complytime-providers.spec + +[archive] + +[licensing] +detector = "askalono" +[[licensing.licenses]] +path = "vendor/gopkg.in/yaml.v3/LICENSE" +sha256sum = "d18f6323b71b0b768bb5e9616e36da390fbd39369a81807cca352de4e4e6aa0b" +expression = "MIT AND (MIT AND Apache-2.0)" diff --git a/openspec/changes/rpm-spec-modernization/design.md b/openspec/changes/rpm-spec-modernization/design.md index 93ecaa9..a7c06f0 100644 --- a/openspec/changes/rpm-spec-modernization/design.md +++ b/openspec/changes/rpm-spec-modernization/design.md @@ -17,20 +17,24 @@ Key constraints: - The `gopkg.in/yaml.v3` vendored license is a dual MIT+Apache-2.0 file that `askalono` cannot auto-detect -## Goals / Non-Goals +### Goals -**Goals:** - Pass Fedora package review for Go packaging compliance - Align with the modernized `complyctl` spec patterns - Ensure `complyctl` + `complytime-providers` install cleanly together on Fedora and provider discovery works end-to-end - Generate proper debuginfo packages (removing `%{nil}` override) -**Non-Goals:** +### Non-Goals + - Packaging `snappy`, `ampel`, or `conftest` for Fedora (external runtime deps for ampel/opa providers remain user-managed) - Changing provider binary behavior or code - Creating man pages for providers (can be added later) +- Adding `go_vendor_license` checks to GitHub Actions CI + (`go-vendor-tools` is Fedora-specific tooling not available in + standard GitHub Actions runners; license drift is caught at RPM + build time via `%go_vendor_license_check`) ## Decisions @@ -116,11 +120,32 @@ Mitigation: Fedora build roots always have `gcc` available. command pattern-matches `go [0-9].*` in `go.mod`. If the format changes in future Go versions, it could silently fail. Mitigation: The block is conditional on `%{?fedora} == 43` only -and has a documented EOL date for removal. +and has a documented EOL date for removal. A `# TODO(2027-01): +remove F43 workaround` comment should be added in the spec itself +as a sunset trigger. **[Risk] License expression drift** If vendored dependencies change, the `License:` field and `go-vendor-tools.toml` overrides must be updated. Mitigation: `%go_vendor_license_check` in `%check` will fail the build if the license config is stale. The `go_vendor_license report ---verify-spec` workflow catches drift. +--verify-spec` workflow catches drift. When vendored dependencies +change, maintainers run `go_vendor_license --config +go-vendor-tools.toml report expression` and update the spec's +`License:` field accordingly. + +**[Risk] `go-vendor-tools` availability** This change makes RPM +builds dependent on the Fedora-packaged `go-vendor-tools`. This +tool is available in Fedora 43+ but is not available in CentOS +Stream or RHEL build environments. +Mitigation: The RPM spec targets Fedora submission specifically. +Non-Fedora builds (e.g., GoReleaser releases) use a separate +build pipeline that does not depend on `go-vendor-tools`. + +**[Note] Provider binary permissions** The `%attr(0755, root, root)` +permission on provider binaries in `%{_libexecdir}` follows the +standard Fedora convention for executable helper programs. While +providers are invoked by `complyctl` via gRPC subprocess (not +directly by users), 0755 is the expected permission for +`%{_libexecdir}` binaries per Fedora packaging guidelines and +enables direct invocation for debugging purposes. diff --git a/openspec/changes/rpm-spec-modernization/proposal.md b/openspec/changes/rpm-spec-modernization/proposal.md index 2b00896..5850b7d 100644 --- a/openspec/changes/rpm-spec-modernization/proposal.md +++ b/openspec/changes/rpm-spec-modernization/proposal.md @@ -50,6 +50,10 @@ None. No spec-level behavior changes. The `skip_specs: true` marker is set in `.openspec.yaml` because this is a pure packaging/tooling change with no behavioral impact. +### Removed Capabilities + +None. + ## Impact - **Files modified**: `complytime-providers.spec` @@ -64,3 +68,15 @@ change with no behavioral impact. targets v1.0.0). The `complyctl` RPM owns `/usr/libexec/complytime/` and `/usr/libexec/complytime/providers/`; provider sub-packages install binaries into that directory. + +## Constitution Alignment + +| Principle | Alignment | +|-----------|-----------| +| I. Single Source of Truth | License expression computed from `go-vendor-tools.toml` config, not hardcoded. Version injected via single `GO_LDFLAGS` variable. | +| II. Simplicity & Isolation | Replaces manual build/install logic with standard Fedora macros (`%gobuild`, `%gocheck2`). | +| III. Incremental Improvement | Focused on a single concern: RPM packaging modernization for Fedora. No code changes. | +| IV. Readability First | Fedora Go packaging macros are well-documented community conventions that reduce spec complexity. | +| V. Don't Reinvent | Adopts the established Fedora Go packaging ecosystem (`go-vendor-tools`, `go-rpm-macros`) rather than custom tooling. | +| VI. Composability | N/A — packaging artifact, not application code. | +| VII. Convention Over Configuration | Directly embraces Fedora Go packaging conventions (`%gobuild`, `%autorelease`, forge macros). | diff --git a/openspec/changes/rpm-spec-modernization/tasks.md b/openspec/changes/rpm-spec-modernization/tasks.md index b0e4933..b33cb67 100644 --- a/openspec/changes/rpm-spec-modernization/tasks.md +++ b/openspec/changes/rpm-spec-modernization/tasks.md @@ -1,22 +1,38 @@ +**Prerequisites**: These tasks require a Fedora build environment +with `go-vendor-tools` and `rpm-build` installed (available in +the project devcontainer). The `complyctl` RPM spec modernization +(`opsx/rpm-spec-modernization` in the complyctl repo) MUST be +merged and `complyctl >= 1.0.0` MUST be available in the target +build repository before submitting `complytime-providers` for +Fedora review. + ## 1. Vendored License Tooling -- [ ] 1.1 Create `go-vendor-tools.toml` with `[archive]` section, - `[licensing]` section (`detector = "askalono"`), and manual - `[[licensing.licenses]]` override for `vendor/gopkg.in/yaml.v3/LICENSE` - (expression: `MIT AND (MIT AND Apache-2.0)`). Verify by running - `go_vendor_license --config go-vendor-tools.toml report expression` - and confirming the output is +- [x] 1.1 First, run `go_vendor_license report all` without any + config to identify which licenses `askalono` auto-detects and + which it cannot. Confirm that `vendor/gopkg.in/yaml.v3/LICENSE` + is the only undetectable license. Then create + `go-vendor-tools.toml` with `[archive]` section, `[licensing]` + section (`detector = "askalono"`), and manual + `[[licensing.licenses]]` override for + `vendor/gopkg.in/yaml.v3/LICENSE` (expression: + `MIT AND (MIT AND Apache-2.0)` — copied verbatim from + the complyctl reference `go-vendor-tools.toml`; the redundant + `MIT` is intentional to match the upstream override format). + Verify by running `go_vendor_license --config + go-vendor-tools.toml report expression` and confirming the + output is `Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0`. ## 2. Spec Header Modernization -- [ ] 2.1 Add `%bcond check 1` at the top of the spec. Reorder globals: +- [x] 2.1 Add `%bcond check 1` at the top of the spec. Reorder globals: move `%global app_dir complytime` before the goipath block, remove `%global base_url`, remove `%global debug_package %{nil}`. Move `Version:` before `%gometa -f`. Verify the header follows the pattern in the complyctl reference spec. -- [ ] 2.2 Update `Release:` from `1%{?dist}` to `%autorelease`. Update +- [x] 2.2 Update `Release:` from `1%{?dist}` to `%autorelease`. Update `License:` to `Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0` (must match the `go_vendor_license report expression` output). Update `URL:` from `%{base_url}` to `%{gourl}`. Replace `Source0:` with @@ -28,45 +44,62 @@ ## 3. Main Package and Sub-package Updates -- [ ] 3.1 Add a main `%files` section for `complytime-providers` with +- [x] 3.1 Add a main `%files` section for `complytime-providers` with `-f %{go_vendor_license_filelist}` and `%doc README.md`. This package holds shared license files. Verify the main `%description` already exists (it does) and is appropriate. -- [ ] 3.2 Update all three sub-packages (`openscap`, `ampel`, `opa`): - bump `Requires: complyctl` from `>= 0.0.8` to `>= 1.0.0`, add +- [x] 3.2 Update all three sub-packages (`openscap`, `ampel`, `opa`): + bump `Requires: complyctl` from `>= 0.0.8` to `>= 1.0.0` + (confirm `go.mod` requires `github.com/complytime/complyctl v1.0.0` + to align the Go module dependency with the RPM Requires), add `Requires: %{name} = %{version}-%{release}` to each. Remove `%license LICENSE` and `%doc README.md vendor/modules.txt` from each sub-package `%files` section (now in main package). Verify each sub-package `%files` section contains only the `%attr` line for its - binary. + binary. Verify that NO `%files` section includes `%dir` for + `/usr/libexec/complytime/` or `/usr/libexec/complytime/providers/` + (these directories are owned by the `complyctl` RPM). ## 4. Build and Prep Sections -- [ ] 4.1 Replace `%prep` section: change `%goprep -k` to `%goprep -A`, +- [x] 4.1 Replace `%prep` section: change `%goprep -k` to `%goprep -A`, add `%setup -q -T -D -a1 %{forgesetupargs}` and `%autopatch -p1`. Add the Fedora 43 Go 1.25 compatibility block (conditional `sed` on - `go.mod` and `vendor/modules.txt`). Add `%generate_buildrequires` - section with `%go_vendor_license_buildrequires -c %{S:2}`. Verify by - comparing with the complyctl reference spec `%prep` section. - -- [ ] 4.2 Replace `%build` section: remove `%set_build_flags`, + `go.mod` and `vendor/modules.txt`) with a + `# TODO(2027-01): remove F43 workaround` comment. Add + `%generate_buildrequires` section with + `%go_vendor_license_buildrequires -c %{S:2}`. Verify the sed + pattern works by running + `sed -n 's/^go [0-9].*/go 1.25/p' go.mod` and confirming it + outputs `go 1.25` (proving the pattern matches `go 1.26.5`). + +- [x] 4.2 Replace `%build` section: remove `%set_build_flags`, `export GO111MODULE=on`, `GO_LD_EXTRAFLAGS`, `GO_BUILD_BINDIR`, and raw `go build` commands. Add `%global gomodulesmode GO111MODULE=on`, - `export GO_LDFLAGS` with version injection, and three `%gobuild` calls - targeting `%{gobuilddir}/bin/` output paths. Verify the three - `%gobuild` lines reference the correct import paths - (`%{goipath}/cmd/openscap-provider`, `%{goipath}/cmd/ampel-provider`, - `%{goipath}/cmd/opa-provider`). + `export GO_LDFLAGS` with version injection, and three `%gobuild` + calls (the `%gobuild` macro wraps `go build` with Fedora hardening + flags, PIE, and debuginfo; it passes `-o` and import path arguments + through to `go build`): + ``` + %gobuild -o %{gobuilddir}/bin/complyctl-provider-openscap %{goipath}/cmd/openscap-provider + %gobuild -o %{gobuilddir}/bin/complyctl-provider-ampel %{goipath}/cmd/ampel-provider + %gobuild -o %{gobuilddir}/bin/complyctl-provider-opa %{goipath}/cmd/opa-provider + ``` + Note: `%gocheck2` uses `go test` with vendor mode under the hood; + key differences from the current raw `go test -mod=vendor -v ./...` + include automatic build tag handling and integration with the + `%bcond check` toggle. Verify the three `%gobuild` lines reference + the correct import paths. ## 5. Install, Check, and Files -- [ ] 5.1 Update `%install` section: add `%go_vendor_license_install -c %{S:2}` +- [x] 5.1 Update `%install` section: add `%go_vendor_license_install -c %{S:2}` at the top. Update binary install source paths from `bin/` to `%{gobuilddir}/bin/`. Verify install paths for all three binaries target `%{buildroot}%{_libexecdir}/%{app_dir}/providers/`. -- [ ] 5.2 Replace `%check` section: add +- [x] 5.2 Replace `%check` section: add `%go_vendor_license_check -c %{S:2}`, wrap test execution in `%if %{with check}` / `%endif`, replace `go test -mod=vendor -v ./...` with `%gocheck2`. Verify the check section structure matches the @@ -74,15 +107,36 @@ ## 6. Changelog and Verification -- [ ] 6.1 Update `%changelog`: add a new entry at the top documenting +- [x] 6.1 Update `%changelog`: add a new entry at the top documenting all modernization changes. Verify the date format and entry style match existing changelog entries. -- [ ] 6.2 Run `go_vendor_license --config go-vendor-tools.toml report +- [x] 6.2 Run `go_vendor_license --config go-vendor-tools.toml report --verify-spec` against the updated spec to confirm the license expression is consistent. Verify no errors. -- [ ] 6.3 Run `rpmbuild -bs complytime-providers.spec` (or equivalent - source RPM build) to verify the spec parses correctly. If the build - environment supports it, run `rpmbuild -bb` or a mock build to verify - end-to-end. Document any issues found. +- [x] 6.3 Run `rpmbuild -bs complytime-providers.spec` to verify the + spec parses correctly into a source RPM. This MUST pass. + +- [x] 6.4 If the build environment supports it, run `rpmbuild -bb` + or a mock build to verify end-to-end binary RPM generation. If + attempted and it fails due to spec errors (not missing external + deps), the task is blocked until resolved. Run `rpmlint` on the + built SRPM and binary RPMs to catch common Fedora packaging + errors (unowned directories, permission issues, license tag + mismatches). Document any deliberately suppressed warnings. + +- [x] 6.5 Update `CHANGELOG.md` under `## Unreleased` / + `### Infrastructure` with an entry documenting the RPM spec + modernization for Fedora Go packaging compliance. Verify the + entry is consistent with existing changelog style. + +- [x] 6.6 Add `go-vendor-tools.toml` to the project structure in + `AGENTS.md` alongside `.goreleaser.yaml` (e.g., + `├── go-vendor-tools.toml # Vendored license detection config + (Fedora RPM)`). Verify the TMT test plan at + `plans/test-RPM-providers.fmf` remains compatible with the + updated spec (same binary names and install paths). + + +