craigwblake / redline Goto Github PK

Signing an RPM package with a DSA key appears to be successful, but generates an RPM with an unverifiable signature.
CentOS 7 (RPM version 4.11.3):
error: skipping package <package> with unverifiable signature
CentOS 6 (RPM version 4.8.0):
error: skipping package <package> with unverifiable v4 signature

There doesn't seem to be any support in Redline for signing with a DSA key, but neither does the tool fail or even give a warning if the algorithm of the key is not supported.

From my cursory inspection of the code, it looks like the key is passed off to bouncycastle code to generate the signatures, but then added to the RPM in PGP and RSA headers (SignatureGenerator.prepare() method).

Are there any plans to support DSA keys? Or should a check be added to throw an exception if the key is DSA?

i've built a maven plugin around redline rpm and the rpm seems fine a rpm -qp --script .rpm prints out a nice

...
postuninstall scriptlet (using /bin/sh):
echo "postuninstall"

but when i erase or update my rpm "postuninstall" won't be printed out.
I am testing on a CentOS 6.3

Within the gradle-rpm-plugin project, I'm trying to mimic what the RedlineTask is doing, using the Builder directly. However, the RPM files it produces appear to pop out an error when I try to install them on CentOS.

The single test currently in that project drops an RPM. If I try to use that, I get the following result:

[admin@test01 ~]$ sudo rpm -ivh bleah-1.0-1.i386.rpm
Preparing...                ########################################### [100%]
   1:bleah                  ########################################### [100%]
error: unpacking of archive failed on file ./opt: cpio: Archive file not in header

Note, this seems to happen both with the current, committed 0.1 release that uses Redline 1.1.2, as well as the 0.2 I'm working on that integrates with Redline 1.1.8. This is probably related to the way I'm calling the Builder, but I can't see what the issue might be.

Your docs say:

 java -cp redline.jar org.redline_rpm.Scanner test.rpm

But the result with 1.2.1 is:

java -cp redline-1.2.1.jar org.redline_rpm.Scanner rpm.rpm

Exception in thread "main" java.lang.NoClassDefFoundError: org/slf4j/LoggerFactory
at org.redline_rpm.Scanner.(Scanner.java:33)
Caused by: java.lang.ClassNotFoundException: org.slf4j.LoggerFactory
at java.net.URLClassLoader$1.run(URLClassLoader.java:372)
at java.net.URLClassLoader$1.run(URLClassLoader.java:361)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:360)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 1 more

Please close this issue. Stupid typo error. False alarm.

It would be great if this could be supported!

This issue was originally raised against the Nebula plugin for Gradle, but I closed it there because they are merely a wrapper around Redline which I'm pretty sure is the source of the problem, though I'm not sure what it is.

According to the Fedora guide for building RPMs, scriptlets such as %post, %preun are passed an argument (retrievable by $1) that indicates

the number of packages of this name which will be left on the system when the action completes

These arguments are intended as tests for whether the scriptlet should proceed or not, to protect against bad things happening in the case of erroroneous installs. I want to wrap some my %post, %preun, %postun functionality in tests that depend on these parameters

In particular on an uninstall, the expected value of $1 for the %preun and %postun scripts is supposed to be 0. However, I find that after a successful install of an rpm built with Redline, on installing this rpm, the $1 argument value is 1, and therefore the functionality in %preun that is guarded against execution when an instance of the rpm will remain installed is wrongly not executed when it should be, because we are in fact about to uninstall the last instance.

To make this clearer, here is the scriptlet:

echo "PRE-UNINSTALL PROCESS HAS BEEN INITIATED"
echo The number of packages that will be installed after the uninstall completes is ${1}
if [ ${1} != 0 ]
then
    echo "SINCE THERE IS CURRENTLY MORE THAN ONE PACKAGE INSTALLED THE PRE-UNINSTALL SCRIPT WILL NOT BE RUN"
    exit 0
fi
echo Running any pre uninstall scripts found in the tar file!
if [ -s /usr/local/vtone/apps/%{name}/rpm/%{release}/preremove ]
then
    sh /usr/local/vtone/apps/%{name}/rpm/%{release}/preremove
fi
echo "PRE-UNINSTALL PROCESS HAS BEEN COMPLETED"

Expected output is:

The number of packages that will be installed after the uninstall completes is 0
...
PRE-UNINSTALL PROCESS HAS BEEN COMPLETED

but instead, I see

The number of packages that will be installed after the uninstall completes is 1
SINCE THERE IS CURRENTLY MORE THAN ONE PACKAGE INSTALLED THE PRE-UNINSTALL SCRIPT WILL NOT BE RUN

There is another version of this rpm that is built with rpmbuild and it does not have this problem, so I presume that there's something wrong with what Redline is doing, or at least with how I have configured it.

Here is one bit of information that might be relevant to the problem:

With the version of the rpm built with rpmbuild, the following query shows the what the rpm requires:

# rpm -qR gvp008
rpmlib(VersionedDependencies) <= 3.0.3-1
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1

whereas, when the version of the rpm that was built with rpmbuild is installed, the results are guite different:

# rpm -qR gvp008
/bin/sh  

I should also mention the environment this is running under (and the rpm is being built and installed on the same machine):

# uname -a
Linux servername 2.6.32-573.el6.x86_64 #1 SMP Wed Jul 1 18:23:37 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux
# rpm --version
RPM version 4.8.0

don't know if it is real issue but now other tool accept "-" in version (maven, gradle, ...)

Scanner throws this when run on JDK6:

Exception in thread "main" java.lang.NoSuchMethodError: java.nio.CharBuffer.subSequence(II)Ljava/nio/CharBuffer;
    at org.freecompany.redline.payload.CpioHeader.readChars(CpioHeader.java:158)
    at org.freecompany.redline.payload.CpioHeader.readSix(CpioHeader.java:148)
    at org.freecompany.redline.payload.CpioHeader.read(CpioHeader.java:188)
    at org.freecompany.redline.Scanner.main(Scanner.java:59)

This is caused by this addition in JDK7: http://bugs.sun.com/view_bug.do?bug_id=6733145

Building with JDK6 or JDK5 fixes it, but I have to verify that a version built using JDK6 will work when run using Java 7 - on a Snow Leopard Mac at the moment so I can't check.

Since ant 1.8.0 we have:

  ArchiveFileSet.setErrorOnMissingArchive(boolean errorOnMissingArchive): Sets whether an error is thrown if an archive does not exist.

(see: http://grepcode.com/file_/repo1.maven.org/maven2/org.apache.ant/ant/1.8.4/org/apache/tools/ant/types/ArchiveFileSet.java/?v=source)

It looks like RedLine-RPM does NOT support this attribute!
It would be very handy to have it!

The RPM specs supports multiple requires for a single package. For example:
requires: somepackage >= 0.5.0, somepackage < 0.6.0

Unfortunately this does not work with Redline since it stores everything in a Map (in Builder.java ), so having multiple dependencies of the same package will result in the latest value winning.

For example take the following ant script:

<project name="test" default="rpm" xmlns:redline="antlib:org.redline_rpm">
   <target name="rpm">
    <mkdir dir="rpms"/>
     <redline:rpm group="Java Development" name="test" version="1.2.3" destination="rpms">
      <zipfileset prefix="/usr/share/java" file="test-1.2.3.jar"/>
      <link path="/usr/share/java/test.jar" target="/usr/share/java/test-1.2.3.jar"/>
      <depends name="somepackage " version="1.2" comparison="greater|equal" />
      <depends name="somepackage " version="1.3" comparison="less" />
    </redline:rpm>
   </target>
 </project>

It should create an rpm that has two requires entries:
somepackage >= 1.2
somepackage < 1.3

But examining the rpm using rpm -qpR test-1.2.3.rpm shows that it only has somepackage < 1.3

Both depends and conflicts should support multiple values for the same name.

This is different from some other similar issues in that I'm trying to install onto an older version of Linux than that on which the rpm was built. Other issues such as #42 seem to be trying to install on newer versions. In any case the error message is different:

# rpm -Uvh /var/tmp/xyz-12.0.1-cs.noarch.rpm 
error: /var/tmp/xyz-12.0.1-cs.noarch.rpm: headerRead failed: Header sanity check: OK
Segmentation fault

Same or similar issue is encountered when trying to READ the rpm

rpm -qlvp /var/tmp/xyz-12.0.1-cs.noarch.rpm 
error: /var/tmp/xyz-12.0.1-cs.noarch.rpm: headerRead failed: Header sanity check: OK

Exception running against RPM.

Exception in thread "main" java.nio.BufferUnderflowException
at java.nio.Buffer.nextGetIndex(Buffer.java:472)
at java.nio.HeapByteBuffer.get(HeapByteBuffer.java:117)
at org.freecompany.redline.header.Lead.read(Lead.java:72)
at org.freecompany.redline.Scanner.run(Scanner.java:75)
at org.freecompany.redline.Scanner.main(Scanner.java:43)

The issue was on line 73 of Lead.java.

while (((b = data.get()) != 0)) builder.append(( char) b);

Needed to become:

while ((data.hasRemaining() && (b = data.get()) != 0)) builder.append(( char) b);

In some upgrade scenarios it would be needed to declare obsolete packages. Please see here:

https://fedoraproject.org/wiki/Upgrade_paths_%E2%80%94_renaming_or_splitting_packages#.28n:1.29_Many-to-one_replacement

It would be great to support this feature.

Rather than seeing an ArrayIndexOutOfBoundsException I would expect to see a friendly error message indicating the package name exceeds the current maximum supported length.

Caused by: portal-layout-article-right-rail-noaddthis\target\antrun\build-rpm.xml:5: java.lang.ArrayIndexOutOfBoundsException
        at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:116)
        at org.apache.tools.ant.Task.perform(Task.java:348)
        at org.apache.tools.ant.Target.execute(Target.java:390)
        at org.apache.tools.ant.Target.performTasks(Target.java:411)
        at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1399)
        at org.apache.tools.ant.Project.executeTarget(Project.java:1368)
        at org.apache.maven.plugin.antrun.AntRunMojo.execute(AntRunMojo.java:327)
        ... 21 more
Caused by: java.lang.ArrayIndexOutOfBoundsException
        at java.lang.System.arraycopy(Native Method)
        at org.freecompany.redline.header.Lead.write(Lead.java:96)
        at org.freecompany.redline.Builder.build(Builder.java:983)
        at org.freecompany.redline.Builder.build(Builder.java:913)
        at org.freecompany.redline.ant.RedlineTask.execute(RedlineTask.java:181)
        at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:291)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:601)
        at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106)
        ... 27 more

Hi there,

I am using redline ant tasks to create an rpm
https://drive.google.com/file/d/0B-t-EIEZQv1AaHI5OGNGLW9veFE/edit?usp=sharing

I can successfully install it using
sudo yum --nogpgcheck localinstall test-rpm-1.0.6-SNAPSHOT-1.noarch.rpm

I can see the files expanded at the right location and can verify with
rpm -Vv test-rpm and 'yum list | grep test-rpm' shows installed.

Whey I try erasing it with sudo yum erase test-rpm yum would recognise the installed package and will log as if it really uninstalled it finishing with:

  Removed:
  test-rpm.noarch 0:1.0.6-SNAPSHOT-1
  Complete!

Still nothing is removed from the FS, rpm -Vv test-rpm lists all the contents and 'yum list | grep test-rpm' reports installed.

I can only uninstall the package with:
sudo rpm -e --noscripts test-rpm

There are no any scripts in the rpm yet.

Thanks in advance,
Lucho

I have been trying to install the produced RPMs in various systems and it appears that for rpm version <=4.8 all is good but in Centos 7 we have rpm version 4.11.1 which complains as follows:

rpm -ivh test.rpm
error: test.rpm: headerRead failed: hdr load: BAD
error: test.rpm cannot be installed

rpm --version
RPM version 4.11.1

First off I love this library, awesome work.

There is a library out there for creating deb packages (jdeb) but the api interface is so wonky and it doesn't support everything. I like the redline api interface and was wondering if any though has been put into creating a .buildDeb() call on the builder that builds a debian package? The inputs are practically the same just need to spit out a different artifact.

I'm planning on creating a fork and at least trying to make it work, just curious if there was any thought put into this or not.

Currently, redline ant task does not support setting value for rpm Epoch field but it is instead hard-coded to zero (0).

This is trivial to fix and I will provide a pull request shortly.

Is it possible to set the dist tag (https://fedoraproject.org/wiki/Packaging:DistTag)? There is a "distribution" header tag but this seems to be something different.

setPackage lets you set a version that fails silently at runtime. In particular, '-', '/', '~'. and '.' are illegal characters, but Builder.setPackage does not detect that and throw an exception. This leads to very cryptic failures later on. In particular, we versioned an RPM like "1.2.3-SNAPSHOT", and the RPM build correctly, and installed correctly, but failed silently at erase time. It took awhile to figure out what was going on; it would be great if redline would have detected that problem.

RPMTAG_FILEMD5S should be renamed to RPMTAG_FILEDIGESTS and support for new RPMTAG_FILEDIGESTALGO should be added.

If FILEDIGESTALGO is not specificied, it defaults to md5 for backwards compatibilitity.

http://fedoraproject.org/wiki/RPM_file_format_changes_to_support_SHA-256

We wanted to write a test to check that the file modes of our generated RPM were correct, but the numbers seen in the RPM description from Format.toString() do not seem to make sense. They mostly do not appear to represent the correct permissions when converted to octal, and differ from the values reported by the ‘rpm’ command (see below). For example, the mode reported for /tmp/myapp/somefile in rpm-1-1.0-1.noarch.rpm in decimal is -32348, yet rpm reports it as 33188 (-rw-r--r--). The mode reported for /usr/myusr/app seems to be correctly reported as 16877 (drwxr-xr-x).

I’ve added a failing test which asserts that the values match those given by the rpm command—I will create a PR including it. I did attempt to see if I could understand where the issue was and what the fix would be but I struggled to work it out.

The filemodes from Format.toString():

22: filemodes[tag=1030,type=3,count=15,size=30,offset=920]
    -32348, -24065, 16877, -32275, -32275, -32275, -32275, -24083, -32275, 16877, -32348, -32348, 16877, -32348, -24065, 

The output from rpm:

$ rpm -qp --queryformat "[%{FILEMODES} %{FILEMODES:perms} %{FILENAMES}\n]" src/test/resources/rpm-1-1.0-1.noarch.rpm
33188 -rw-r--r-- /tmp/myapp/somefile
41471 lrwxrwxrwx /tmp/myapp/somefile2
16877 drwxr-xr-x /usr/myusr/app
33261 -rwxr-xr-x /usr/myusr/app/bin/filter-version.txt
33261 -rwxr-xr-x /usr/myusr/app/bin/filter.txt
33261 -rwxr-xr-x /usr/myusr/app/bin/name-Linux.sh
33261 -rwxr-xr-x /usr/myusr/app/bin/name.sh
41453 lrwxr-xr-x /usr/myusr/app/bin/oldname.sh
33261 -rwxr-xr-x /usr/myusr/app/bin/start.sh
16877 drwxr-xr-x /usr/myusr/app/conf
33188 -rw-r--r-- /usr/myusr/app/conf/log4j.xml
33188 -rw-r--r-- /usr/myusr/app/conf/log4j.xml.deliver
16877 drwxr-xr-x /usr/myusr/app/lib
33188 -rw-r--r-- /usr/myusr/app/lib/grizzly-comet-counter.war
41471 lrwxrwxrwx /usr/myusr/app2

Hello,

when I install with yum on centos 5 I get following back:

yum install abn-tomcat-7.0.22/dist/abn-tomcat-7.0.22-20111215.noarch.rpm

Examining abn-tomcat-7.0.22/dist/abn-tomcat-7.0.22-20111215.noarch.rpm: abn-tomcat-7.0.22-20111215.src
Cannot add package abn-tomcat-7.0.22/dist/abn-tomcat-7.0.22-20111215.noarch.rpm to transaction. Not a compatible architecture: src

Same yum install works fine on centos 6.

Any RPM built with redline will not install with yum on centos 5.

Thanks Igor

Hi,

when using the Ant task, the (PRE|POST|...)(IN|UN|...)PROG setting is always set to "/bin/sh" regardless of what is defined in the script itself (e.g. #!/bin/bash).

The "Builder" class reads the script interpreter from the script interpreter correctly, but the task resets it to the default value afterwards.

See https://github.com/craigwblake/redline/blob/master/src/main/java/org/redline_rpm/ant/RedlineTask.java#L135 for an example.

What is the reason for resetting the interpreter program in the task? Ideally (from my point of view) the task would just leave the program as it is.

Thanks,
Alex

Hello,

I am trying to use redline to create a rpm. I am still trying to do a basic rpm doing nothing.

I have the following code

File directory = new File(Constants.RPM_OUTPUT_DIRECTORY);
builder.setType(RpmType.BINARY);
builder.setPlatform(Architecture.X86_64, Os.MACOSX);
builder.setPackage(Constants.RPM_NAME, Constants.RPM_VERSION, Constants.RPM_RELEASE);
builder.build(directory);

I am able to create my rpm.

When I run

rpm -Uvh myrpm.rpm

Then I get the following error :
error: source package contains no .spec file

Any idea what I am doing wrong ?

I've been using jdeb with maven for a while now, and a pure Java implementation with maven deps is a peace of mind thing. It'd be great if on top of the ant task there was a simple maven plugin that mapped config across. I see that you use maven to build this, so if you're up for writing it, I'm up for testing. On the other hand, if you're not up for writing it, I could be, however more so if you'd include it into your tree so it didn't fall behind. Thoughts?

package org.freecompany.redline.header;

class public Lead {
    // ...
    public void write( WritableByteChannel channel) throws IOException {
        // ...
        byte[] data = new byte[ 66];
        byte[] encoded = name.getBytes( "UTF-8");
        System.arraycopy( encoded, 0, data, 0, encoded.length);
        buffer.put( data);
        // ...
    }

And from http://www.rpm.org/max-rpm/s1-rpm-file-format-rpm-file-format.html

The next sixty-six bytes (starting with 7270 6d2d) contain the name of the package. The name must end with a null byte, which leaves sixty-five bytes for RPM's usual name-version-release-style name.

There are currently two examples of usage relying on Ant here:
http://redline-rpm.org/usage.html

They are simple to understand but a more complete example for an application packaged as a single "fat" jar would be welcome especially for the developers who have only a very few notions on Linux native packaging as you can see on StackOverflow:
http://stackoverflow.com/questions/22562799/create-rpm-package-for-java-any-automatic-software

Moreover, it would help the transition from Java Webstart to native packaging with RPM.

This more elaborated example should mention the following "elements":

• a .desktop file for the desktop shortcut
• a pre-install script to install the shortcuts (by calling xdg-desktop-icon and xdg-desktop-menu)
• a script (in /usr/bin ?) to run the application, it would call "java -jar app_name.jar"
• a post-install script to uninstall the shortcuts (by calling xdg-desktop-icon and xdg-desktop-menu)
• a fat jar (in /usr/share/java/app_name?)
• something to indicate that it requires Java (using "depends" name="java")

Maybe there is nothing to do to create the shortcuts, I don't know the native rpm build tools enough to be sure of that.

I don't know the good practices. I don't even know why you create a symbolic link in the second example, it probably allows to install several versions of the same library and to point to the latest installed one. When is it recommended to do so? What are the pros and cons?

I can contribute but I'll need some help. Don't see this as a waste of time. When it works, I'll mention it in the JOGL user's guide and I'll use it for my game.

In some upgrade scenarios it would be needed to declare obsolete packages. Please see here:

https://fedoraproject.org/wiki/Upgrade_paths_%E2%80%94_renaming_or_splitting_packages#.28n:1.29_Many-to-one_replacement

It would be great to support this feature.

Using the redline ant task to create an rpm package that contains files/folders in /var/lib which have owner/group that is not root, can not be installed on RHEL/CentOS (and possibly other rpm distributions).

Rpm file installation fails with message file /var/lib from install of <name>-<version>.<arch> conflicts with file from package filesystem-<version>.<arch>

For example: file /var/lib from install of test-0:1.1-1.noarch conflicts with file from package filesystem-3.2-18.el7.x86_64

This bug can be reproduced by creating an rpm package and including rpmfileset with prefix="/var/lib" and username="" and group="" attributes set to value other than root.

Conflict happens because the rpm package installation tries to set owner/group for /var/lib folder instead of just /var/lib/<folder>.

You can use ant script below to create example rpm package that produces this bug (when installed on RHEL/CentOS). Change username="tomcat" and group="tomcat" if needed (user and group must exist on target system).

<project name="test" default="rpm" xmlns:redline="antlib:org.redline_rpm">

    <property name="redline.lib" value="target/redline-1.1.17-SNAPSHOT-jar-with-dependencies.jar" />

    <typedef resource="org/redline_rpm/antlib.xml" uri="antlib:org.redline_rpm" classpath="${redline.lib}" />

    <target name="rpm">
        <mkdir dir="rpms/var/lib/test" />
        <touch file="rpms/var/lib/test/file" />
        <redline:rpm group="Java Development" name="test" version="1.2.3" destination="rpms">
            <redline:rpmfileset dir="rpms/var/lib" prefix="/var/lib" username="tomcat" group="tomcat"/>
        </redline:rpm>
    </target>

</project>

I have question when will be offically release this version ?

Hi there,

is package contents extraction ability planned?

I am trying to have my RPM set some files as noreplace, their permissions and owner with rpmfileset.

My code is included below, but it does not work. The RPM builds fine, just on install it does nothing.

<rpmfileset
fullpath="/usr/local/tomcat/webapps/admin/resources/admin/resources/sync_ind_file.sh"
file="target/admin/resources/sync_ind_file.sh"
filemode="755" username="root" group="www" config="true" noreplace="true"/>

I am trying to build rpms using the Nebula rpm plugin for Gradle, which, of course, is based on Redline.
What I find is that when an rpm is built with rpmbuild and spec files (the traditional way), and a directory is created with %dir, any files subsequently written to that directory prevent its deletion by rpm -e. This is default behavior of rpm and desirable. Imagine an rpm creating a logs directory somewhere to which the installed application writes log files. We want to preserve those logfiles, even in an rpm uninstall (especially since rpm -U (upgrade) does an uninstall followed by an install).

However in an rpm built by the Gradle plugin, I find that on uninstallation (rpm -e) I find that any log files that have been written to this directory after installation are blown away along with the directory. Even more bizarrely, this happens in spite of the debug output of rpm -e saying that it can't delete the directory because it isn't empty:

# rpm -evv myapp
...
D: fini      040755  2 (7007, 500)      4096 /usr/local/myapp/logs 
D:    erase rmdir of /usr/local/myapp/logs failed: Directory not empty
...
# ls -al /usr/local/myapp/logs
ls: cannot access /usr/local/myapp/logs: No such file or directory

It seems clear that rpmbuild is doing something that redline, or at least the Gradle plugin isn't. However, I'm unable to discern after reading rpm documentation, etc. what that might be. Can you tell me? I notice that your Builder.addDirectory() methods allow a Directive to be specified, but after looking at these Directives, nothing jumps out at me as being relevant to this situation, and in any case, in the spec file versions of my test, we are just providing a %dir without any other fancy directives. In any event, the Gradle plugin simply passes null for the Directive when it calls Redline.

I have also posted this issue on the os-nebula project, Stack Overflow, and SuperUser. Hopefully someone can explain this frustrating situation.

It looks like the Epoch is hard-coded to 0 in Builder.java. It should be configurable.

Builder builder = new Builder();
builder.setPackage( "test", "1.0", "1" );
builder.setBuildHost( "localhost" );
builder.setLicense( "GPL" );
builder.setPlatform( Architecture.NOARCH, Os.LINUX );
builder.setType( RpmType.BINARY );
builder.build(outputPath);

yum install test-1.0-1.noarch.rpm
Loaded plugins: langpacks, refresh-packagekit
error: /home/metadeus/test-1.0-1.noarch.rpm: headerRead failed: hdr load: BAD
Cannot open: test-1.0-1.noarch.rpm. Skipping.
Error: Nothing to do

What's wrong?

I'm not sure if it's how I generated my keys (did the standard gpg keygen using 4096), or what, but I was getting this error when I tried to sign:

java.lang.RuntimeException: Error writing pending entry '268'.
    at org.redline_rpm.header.AbstractHeader.writePending(AbstractHeader.java:182)
aused by: java.nio.BufferOverflowException
    at java.nio.HeapByteBuffer.put(HeapByteBuffer.java:189)

With a bit of debugging it appears that the default SIGNATURE_SIZE size of 287 wasn't enough for the apparent 543 length ones in these keys? Bumping the size up to 543 fixes the issue.

From what I am seeing, the current RedlineTask does not do any error checking around the name given by the user for the rpm, and does not throw an exception when the name contains whitespace. According to the Fedora RPM Guide Documentation:

The name should not contain any spaces or other whitespace characters such as tabs or newlines.

Additional checking should be also done around other invalid characters in the name, such as "/".

I'm not sure if recursively adding a directory is supported by redline.

When calling addFile() if you pass it a directory you get:

java.io.FileNotFoundException: script/rpm/layout/etc (Is a directory)
 at java.io.FileInputStream.open (FileInputStream.java:-2)
    java.io.FileInputStream.<init> (FileInputStream.java:138)
    org.redline_rpm.payload.Contents.getMD5s (Contents.java:582)
    org.redline_rpm.Builder.build (Builder.java:1142)

Putting a directory in the %files section appears to be straight forward from the .spec file standpoint. See: http://www.rpm.org/max-rpm/s1-rpm-inside-files-list.html

Is there another way redline supports that I'm not noticing or do I have to do the recursion in my code?

what's the idea of scanSomeArchTest()? test method ends in an ArrayIndexOutOfBoundsException because of the unknown OS-Type (FF) in the leap header of the source rpm. either assert the exception or change the source rpm to get an expected result.

Is it possible to create an RPM using the Redline Ant Task that can install the RPM into the installer's current working directory? It does not seem possible with the current implementation

There are several projects which depend on the Redline library for its functionality in a dynamic way (eg. version 1.1.+, any version that has 1.1 as the two most significant version numbers). When making a major API breaking change such as moving the classes to a different package it is common to change the major portion of the version (move to 2.0.0). As a result of the move, many projects which have dynamic dependencies on redline are now broken. While this is certainly not the fault of the Redline library, it would be good in the future to denote major API changes with a similarly major version number increment.

Hi,

First of all, thanks for this plugin which is quiet usefull for rpms deployment.

I have an issue while trying to set up permission within a tarfile.
When installing the rpm with the root user, I have the folowing warning :

[root@install_medintegr]# rpm -ihv application-test-0.0.1-1.noarch.rpm
Preparing... ########################################### [100%]
1:application-test warning: user "jboss" does not exist - using root
warning: group "jboss" does not exist - using root
warning: user "jboss" does not exist - using root
warning: group "jboss" does not exist - using root
warning: user "jboss" does not exist - using root
warning: group "jboss" does not exist - using root
warning: user "jboss" does not exist - using root
warning: group "jboss" does not exist - using root

##################################### [100%]

Still, my jboss user exists :
[root@install_medintegr]# id jboss
uid=4500(jboss) gid=4500(jboss) groups=4500(jboss)

I assume i can still find a workaround with a post script, but it would be cleaner to do it though the configuration of reline lib.

BR/

I am trying to implement a method for putting a changelog into an RPM. From studying the
C source code of rpm, it is clear that this involves creating headers. At least one of these headers must be of Integer type. Given the current codebase, this is not possible. The only method for adding a header through the Builder is

`public void addHeaderEntry( final Tag tag, final String value)`

which means that all value, regardless of the type implied in the Tag parameter must be passed in as a String. The code invoked by this method in AbstractHeader.java

`public Entry< String[]> createEntry( Tag tag, CharSequence value) {`

creates an Entry of the proper type implied by the tag parameter, but makes no attempt to convert the value parameter to an object of that type, resulting in ClassCastException being thrown, making the above-mentioned effort to add changelogs impossible as the code is currently implemented.

I can't build my RPM with Redline 1.2.2 and install it on CentOs 5.8. RPM complains that the header is bad.

The same project worked fine with Redline 1.2.1, but breaks with Redline 1.2.2

Note: I am consuming Redline via the nebula.ospackage gradle plugin.

Here is a test repo that showcases the issue:
https://github.com/gbranchaudrubenovitch/redline-centos5-rpm-fail

Steps to repro:

1. git clone https://github.com/gbranchaudrubenovitch/redline-centos5-rpm-fail.git
2. cd redline-centos5-rpm-fail
3. ./gradlew buildRpm
4. rpm -vvqip ./build/distributions/main-1.0.1-1.noarch.rpm

Results on CentOS 5.8, with RPM v4.4.2.3 (it fails!)

[]$ rpm -vvqip  ./build/distributions/main-1.0.1-1.noarch.rpm
D: Expected size:         5230 = lead(96)+sigs(180)+pad(4)+data(4950)
D:   Actual size:         5230
error: ./build/distributions/main-1.0.1-1.noarch.rpm: headerRead failed: Header sanity check: OK
D: May free Score board((nil))

Results on CentOS 7, with RPM v4.11.1 (it works!)

D: loading keyring from pubkeys in /var/lib/rpm/pubkeys/*.key
D: couldn't find any keys in /var/lib/rpm/pubkeys/*.key
D: loading keyring from rpmdb
D: serialize failed, using private dbenv
D: opening  db environment /var/lib/rpm cdb:private:0x401
D: opening  db index       /var/lib/rpm/Packages 0x400 mode=0x0
D: locked   db index       /var/lib/rpm/Packages
D: opening  db index       /var/lib/rpm/Name 0x400 mode=0x0
D:  read h#     356 Header SHA1 digest: OK (e6870d8b02e1f67dee30779203c6104284ea269a)
D: added key gpg-pubkey-f4a80eb5-53a7ff4b to keyring
D:  read h#     498 Header SHA1 digest: OK (972185b98bfd453af12d4b667b22871cc2fdb803)
D: added key gpg-pubkey-352c64e5-52ae6884 to keyring
D: Using legacy gpg-pubkey(s) from rpmdb
D: Expected size:         5222 = lead(96)+sigs(180)+pad(4)+data(4942)
D:   Actual size:         5222
D: ./build/distributions/main-1.0.1-1.noarch.rpm: Header SHA1 digest: OK (f2de67d60184b8e359c7e0b31575c6fea034c21c)
Name        : main
Epoch       : 0
Version     : 1.0.1
Release     : 1
Architecture: noarch
Install Date: (not installed)
Group       : Some/Modules
Size        : 2670
License     : Commercial
Signature   : (none)
Source RPM  : main-1.0.1-1-src.rpm
Build Date  : Wed 20 Jan 2016 02:23:19 PM GMT
Build Host  : some.centos7.host
Relocations : /some /some
Packager    : gbranchaud
Vendor      : TheCompany <[email protected]>
URL         : some-url
Summary     : main
Description :

D: closed   db index       /var/lib/rpm/Name
D: closed   db index       /var/lib/rpm/Packages
D: closed   db environment /var/lib/rpm

Expected results on both OS:

• I expect to have no errors and have a valid & installable rpm on both OS.

Version 1.2.3 is not passing the gradle-ospackage-plugin test suite. Details are at https://travis-ci.org/nebula-plugins/gradle-ospackage-plugin/builds/159733276 .

This seems to have been caused by this pull request Feature/multiple dependency support #101 . By returning to a LinkedList implementation of storage, this PR seems to have lost the duplicate-prevention feature that was in version 1.2.2.

original rpm supports adding empty directories eg:
/var/log/application/
/var/run/application/
/var/lib/application/

already added pull request

I tried to use Scanner to extract a RPM package, such as make. It failed to read CPIO header due to the payload compressor is 'xz'.

When using the method org.redline_rpm.Builder.addFile from the Gradle OsPackage plugin, it seems that the parameters uname and gname are not properly used when building the RPM. What we are experiencing is that they are ignored.

Do you have a test case for this method? Please let me know if you need additional information.