From 6c9c4d51aacfdb5fa4eaa22df07eb2178ddb028a Mon Sep 17 00:00:00 2001 From: Vladimir Dubrovin <3proxy@3proxy.ru> Date: Sat, 22 Aug 2026 10:39:05 +0300 Subject: [PATCH] Build rpm packages against Enterprise Linux, not Ubuntu rpmbuild ran directly on the Ubuntu runner, so the packages carried Ubuntu's ABI: glibc 2.38, libssl.so.3 and libpcre2-8. No RPM distribution can satisfy that - RHEL 9 has glibc 2.34, RHEL 8 has 2.28 and OpenSSL 1.1 - so the rpms were installable nowhere. Build them in AlmaLinux 8, 9 and 10 containers instead, covering supported AlmaLinux and CentOS Stream releases. Release: 1%{?dist} already in the spec now expands, so the packages are named el8, el9 and el10 and can coexist. Two spec changes are needed for a build outside Ubuntu: debug_package is disabled. Enterprise Linux enables debuginfo extraction by default while Ubuntu's rpm does not; the build produces no debug sources, so rpmbuild aborted on an empty debugsourcefiles.list. /bin/3proxy is excluded from automatic requires. The installed configuration file is executable and begins with #!/bin/3proxy, so rpm generates a dependency on it. rpm 4.16 and later canonicalise that to /usr/bin/3proxy while %files declares /bin/3proxy, leaving a dependency that can never be satisfied and making the package uninstallable on el9 and el10. Enterprise Linux has no 32-bit ARM, so the armhf workflow now builds only the deb package. --- .github/workflows/build-rpm-arm64.yml | 30 ++++++++++--- .github/workflows/build-rpm-armhf.yml | 60 ++------------------------ .github/workflows/build-rpm-x86-64.yml | 30 ++++++++++--- scripts/rh/3proxy.spec | 3 ++ 4 files changed, 57 insertions(+), 66 deletions(-) diff --git a/.github/workflows/build-rpm-arm64.yml b/.github/workflows/build-rpm-arm64.yml index 1c2ea45..ec41266 100644 --- a/.github/workflows/build-rpm-arm64.yml +++ b/.github/workflows/build-rpm-arm64.yml @@ -43,11 +43,31 @@ jobs: cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz - name: rpmbuild run: | - ret=`pwd` - cd ~/rpmbuild/SPECS - rpmbuild -ba 3proxy-$RELEASE.spec - cd $ret - mv ~/rpmbuild/RPMS/aarch64/3proxy-$RELEASE-1.aarch64.rpm 3proxy-$RELEASE.arm64.rpm + mkdir -p rpmout + for EL in 8 9 10; do + docker run --rm \ + -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \ + -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \ + -v "$PWD/rpmout:/out" \ + -e RELEASE="$RELEASE" \ + "almalinux:$EL" bash -c ' + set -e + dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip + mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} + cp /src.tar.gz ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz + ln -sf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz + cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec + cd ~/rpmbuild/SPECS + rpmbuild -ba 3proxy-$RELEASE.spec + cp ~/rpmbuild/RPMS/*/*.rpm /out/' + done + for f in rpmout/*.rpm; do + dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//') + arch=$(rpm -qp --qf '%{ARCH}' "$f") + mv "$f" "3proxy-$RELEASE.$dist.$arch.rpm" + done + rmdir rpmout + ls -l *.rpm - name: Get artifact rpm uses: actions/upload-artifact@v7 with: diff --git a/.github/workflows/build-rpm-armhf.yml b/.github/workflows/build-rpm-armhf.yml index dc179bd..e7413cd 100644 --- a/.github/workflows/build-rpm-armhf.yml +++ b/.github/workflows/build-rpm-armhf.yml @@ -1,4 +1,4 @@ -name: RPM/DEB build armhf +name: DEB build armhf on: release: @@ -54,7 +54,7 @@ jobs: sudo cp ~/ubuntu.sources /etc/apt/sources.list.d/ubuntu.sources sudo apt update sudo apt install libssl3t64:armhf openssl:armhf libssl-dev:armhf libpam0g:armhf libpam0g-dev:armhf libpcre2-dev:armhf rpm crossbuild-essential-armhf build-essential debhelper - - name: configure rpm env + - name: configure deb env run: | mkdir ~/debian mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} @@ -62,24 +62,6 @@ jobs: ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz - - name: rpmbuild - run: | - ret=`pwd` - cd ~/rpmbuild/SPECS - PATH=/usr/arm-linux-gnueabihf/bin:$PATH - export PATH=$PATH - CC=arm-linux-gnueabihf-gcc - export CC=$CC - export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH - export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH - rpmbuild -ba --define "PAMLIB pam0g" --define "_arch arm" --define "cross yes" --target=arm-linux-gnueabihf 3proxy-$RELEASE.spec - cd $ret - mv ~/rpmbuild/RPMS/arm/3proxy-$RELEASE-1.arm.rpm 3proxy-$RELEASE.arm.rpm - - name: Get artifact rpm - uses: actions/upload-artifact@v7 - with: - name: "3proxy-${{ env.RELEASE }}-arm.rpm" - path: "*.rpm" - name: debbuild run: | ret=`pwd` @@ -123,45 +105,12 @@ jobs: gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \ -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt rm -f /tmp/prime.txt - - name: Sign rpm - if: github.event_name == 'release' - env: - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - run: | - GPGBIN=$(command -v gpg) - if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi - umask 077 - printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass - echo test > /tmp/signtest - gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \ - -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest - echo "key can sign" - { echo "%_gpg_name $GPG_KEYID" - echo "%__gpg $GPGBIN" - echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}' - } > ~/.rpmmacros - rpm --addsign *.rpm - rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig - for f in *.rpm; do - sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null) - case "$sig" in ""|"(none)") - sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;; - esac - case "$sig" in ""|"(none)") - echo "$f is not signed" - echo "--- rpm version ---"; rpm --version - echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}' - echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true - exit 1 ;; - esac - echo "$f: $sig" - done - name: Checksums and detached signatures if: github.event_name == 'release' env: GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} run: | - sha256sum *.rpm *.deb > SHA256SUMS-arm + sha256sum *.deb > SHA256SUMS-arm for f in *.deb SHA256SUMS-arm; do gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \ -u "$GPG_KEYID" --armor --detach-sign "$f" @@ -173,11 +122,10 @@ jobs: uses: actions/attest-build-provenance@v2 with: subject-path: | - *.rpm *.deb - name: Upload to release if: github.event_name == 'release' env: GH_TOKEN: ${{ github.token }} TAG: ${{ github.event.release.tag_name }} - run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc + run: gh release upload "$TAG" *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc diff --git a/.github/workflows/build-rpm-x86-64.yml b/.github/workflows/build-rpm-x86-64.yml index eec8028..70df49e 100644 --- a/.github/workflows/build-rpm-x86-64.yml +++ b/.github/workflows/build-rpm-x86-64.yml @@ -43,11 +43,31 @@ jobs: cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz - name: rpmbuild run: | - ret=`pwd` - cd ~/rpmbuild/SPECS - rpmbuild -ba 3proxy-$RELEASE.spec - cd $ret - mv ~/rpmbuild/RPMS/x86_64/3proxy-$RELEASE-1.x86_64.rpm 3proxy-$RELEASE.x86_64.rpm + mkdir -p rpmout + for EL in 8 9 10; do + docker run --rm \ + -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \ + -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \ + -v "$PWD/rpmout:/out" \ + -e RELEASE="$RELEASE" \ + "almalinux:$EL" bash -c ' + set -e + dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip + mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} + cp /src.tar.gz ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz + ln -sf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz + cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec + cd ~/rpmbuild/SPECS + rpmbuild -ba 3proxy-$RELEASE.spec + cp ~/rpmbuild/RPMS/*/*.rpm /out/' + done + for f in rpmout/*.rpm; do + dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//') + arch=$(rpm -qp --qf '%{ARCH}' "$f") + mv "$f" "3proxy-$RELEASE.$dist.$arch.rpm" + done + rmdir rpmout + ls -l *.rpm - name: Get artifact rpm uses: actions/upload-artifact@v7 with: diff --git a/scripts/rh/3proxy.spec b/scripts/rh/3proxy.spec index 088cee2..5f06e35 100644 --- a/scripts/rh/3proxy.spec +++ b/scripts/rh/3proxy.spec @@ -9,6 +9,9 @@ Prefix: %{_prefix} Packager: z3APA3A Source: https://github.com/%{packager}/%{name}/archive/%{version}.tar.gz +%global debug_package %{nil} +%global __requires_exclude ^/(usr/)?bin/3proxy$ + %description 3proxy is lightweight yet powerful proxy server