From da54912cf7dc952aef414576920a16869669fe82 Mon Sep 17 00:00:00 2001 From: Zbigniew Jędrzejewski-Szmek Date: Apr 25 2024 16:20:57 +0000 Subject: [PATCH 1/4] Lisp: drop cruft Those things are not needed in spec files. --- diff --git a/guidelines/modules/ROOT/pages/Lisp.adoc b/guidelines/modules/ROOT/pages/Lisp.adoc index fde8f0f..42e4733 100644 --- a/guidelines/modules/ROOT/pages/Lisp.adoc +++ b/guidelines/modules/ROOT/pages/Lisp.adoc @@ -66,8 +66,6 @@ Requires(preun): common-lisp-controller %build %install -%{__rm} -rf %{buildroot} - # Replace @NAME@ below with the Common Lisp library name, which may be different from the # package name if it is not already prefixed with "cl-". @@ -90,9 +88,6 @@ done %preun /usr/sbin/unregister-common-lisp-source @NAME@ -%clean -%{__rm} -rf %{buildroot} - %files %doc %{_datadir}/common-lisp/source/@NAME@ From f593707735281384a354db9cc3214ef62b7c24ed Mon Sep 17 00:00:00 2001 From: Zbigniew Jędrzejewski-Szmek Date: Apr 25 2024 16:20:57 +0000 Subject: [PATCH 2/4] Drop absolute paths where they are not useful Absolute paths generally make things more complicated and less portable. Historically, rpm packaging was big on specifying absolute paths everywhere, for example with macros like %__mkdir and %__rm. This made the spec files harder to read, but was not particularly useful. We run with $PATH set and all those binaries are in $PATH. Maybe this rule made some sense if people were installing rpms in some strange half-broken environments, but this is not something that we support or actually do in the last twenty years of Linux. (On the security angle, if somebody managed to insert a rogue 'mkdir' or 'rm' into one of the directories in $PATH, using an absolute path in some rpm scriptlet is not going to help much. More complicated programs may call other programs, and they do this using $PATH, so even if it seems like we're providing aditional protection here, it's not worth much. And those rogue binaries would be soon called by the administrator anyway in some other context.) Similarly, systemd required absolute paths in ExecStart= and similar lines. This was "because selinux", but that seems bogus in hindsight, because selinux still works fine after we switched to non-absolute paths. This is particularly true for systemd units, which would often be completely portable between distributions, except for the absolute paths. Thus, drop absolute paths in various examples. This also makes things nicer for the upcoming merge of /usr/sbin and /usr/bin. With an absolute path, we could either say "/usr/bin/foo" which doesn't work on old systems, or we say "/usr/sbin/foo" which works also on merged systems but is the compat path. So say "foo" which is correct everywhere and easier to write. --- diff --git a/guidelines/modules/ROOT/pages/Alternatives.adoc b/guidelines/modules/ROOT/pages/Alternatives.adoc index a56bb9a..4fbbfb2 100644 --- a/guidelines/modules/ROOT/pages/Alternatives.adoc +++ b/guidelines/modules/ROOT/pages/Alternatives.adoc @@ -93,12 +93,12 @@ Requires(postun): %{_sbindir}/update-alternatives touch %{buildroot}%{_bindir}/antlr %post -%{_sbindir}/update-alternatives --install %{_bindir}/antlr \ +update-alternatives --install %{_bindir}/antlr \ %{name} %{_bindir}/antlr-java 10 %postun if [ $1 -eq 0 ] ; then - %{_sbindir}/update-alternatives --remove %{name} %{_bindir}/antlr-java + update-alternatives --remove %{name} %{_bindir}/antlr-java fi ... %files @@ -137,13 +137,13 @@ touch %{buildroot}%{_mandir}/man8/sendmail.8 %postun if [ "$1" -ge "1" ]; then if [ "`+readlink %{_sysconfdir}/alternatives/mta+`" == "%{_sbindir}/sendmail.sendmail" ]; then - %{_sbindir}/alternatives --set mta %{_sbindir}/sendmail.sendmail + alternatives --set mta %{_sbindir}/sendmail.sendmail fi fi %post # Set up the alternatives files for MTAs. -%{_sbindir}/update-alternatives --install %{_sbindir}/sendmail mta %{_sbindir}/sendmail.sendmail 90 \ +update-alternatives --install %{_sbindir}/sendmail mta %{_sbindir}/sendmail.sendmail 90 \ --slave %{_bindir}/mailq mta-mailq %{_bindir}/mailq.sendmail \ --slave %{_bindir}/newaliases mta-newaliases %{_bindir}/newaliases.sendmail \ --slave %{_bindir}/rmail mta-rmail %{_bindir}/rmail.sendmail \ @@ -158,7 +158,7 @@ fi %preun if [ $1 = 0 ]; then - %{_sbindir}/update-alternatives --remove mta %{_sbindir}/sendmail.sendmail + update-alternatives --remove mta %{_sbindir}/sendmail.sendmail fi ... diff --git a/guidelines/modules/ROOT/pages/Lisp.adoc b/guidelines/modules/ROOT/pages/Lisp.adoc index 42e4733..8016db4 100644 --- a/guidelines/modules/ROOT/pages/Lisp.adoc +++ b/guidelines/modules/ROOT/pages/Lisp.adoc @@ -35,9 +35,9 @@ Libraries should depend on the common-lisp-controller package. Lisp source should be installed in %\{_datadir}/common-lisp/source/. The package should own that directory. The parent directories are owned by the common-lisp-controller package. A symlink to the asdf system definition file should be created from %\{_datadir}/common-lisp/systems/.asd to %\{_datadir}/common-lisp/source//.asd (this target directory is also owned by common-lisp-controller). -The %post section should call "%\{_sbindir}/register-common-lisp-source ". -The %preun section should call "%\{_sbindir}/unregister-common-lisp-source " -These scripts are provided by common-lisp-controller. +The %post section should call `+register-common-lisp-source+`. +The %preun section should call `+unregister-common-lisp-source+`. +These scripts are provided by `+common-lisp-controller+`. === Spec file template @@ -83,10 +83,10 @@ for asd in *.asd; do done %post -/usr/sbin/register-common-lisp-source @NAME@ +register-common-lisp-source @NAME@ %preun -/usr/sbin/unregister-common-lisp-source @NAME@ +unregister-common-lisp-source @NAME@ %files %doc @@ -116,12 +116,12 @@ Common Lisp implementations should depend on the common-lisp-controller package. Common Lisp implementations should install a script in %\{_libdir}/common-lisp/bin/.sh that supports a single command on the command line: "install-clc". This should load %\{_datadir}/common-lisp/source/common-lisp-controller/common-lisp-controller.lisp, call (common-lisp-controller:init-common-lisp-controller-v4 ) and then save the resulting image as default for the system. -The %post section should call "%\{_sbindir}/register-common-lisp-implementation ". -The %preun section should call "%\{_sbindir}/unregister-common-lisp-implementation " +The %post section should call `+register-common-lisp-implementation+`. +The %preun section should call `+unregister-common-lisp-implementation+`. -These scripts, and the %\{_libdir}/common-lisp/bin directory are provided and owned by the common-lisp-controller package. +These scripts, and the `+%{_libdir}/common-lisp/bin+` directory are provided and owned by the common-lisp-controller package. -All implementations should be modified to load common-lisp-controller's %\{_sysconfdir}/lisp-config.lisp on startup. +All implementations should be modified to load common-lisp-controller's `+%{_sysconfdir}/lisp-config.lisp+` on startup. == Further reading diff --git a/guidelines/modules/ROOT/pages/Scriptlets.adoc b/guidelines/modules/ROOT/pages/Scriptlets.adoc index 9f9cfde..6c2a2ec 100644 --- a/guidelines/modules/ROOT/pages/Scriptlets.adoc +++ b/guidelines/modules/ROOT/pages/Scriptlets.adoc @@ -211,7 +211,7 @@ They MUST NOT use the `+%ldconfig+`, `+%ldconfig_post+`, `+%ldconfig_postun+` or `+%ldconfig_scriptlets+` macros to do this, since these macros do not have any effect on Fedora. -Instead simply call `+/sbin/ldconfig+` directly in both +Instead simply call `+ldconfig+` directly in both `+%post+` and `+%postun+` as well as adding the necessary dependencies when necessary: @@ -228,11 +228,11 @@ Requires(postun): /sbin/ldconfig [...] %post [...] -/sbin/ldconfig +ldconfig [...] %postun [...] -/sbin/ldconfig +ldconfig [...] .... @@ -246,10 +246,10 @@ which cause ldconfig to be run automatically when necessary: .... %transfiletriggerin -P 2000000 -- DIRECTORIES -/sbin/ldconfig +ldconfig %transfiletriggerpostun -P 2000000 -- DIRECTORIES -/sbin/ldconfig +ldconfig .... Replace `+DIRECTORIES+` with the space-separated list of directories diff --git a/guidelines/modules/ROOT/pages/Systemd.adoc b/guidelines/modules/ROOT/pages/Systemd.adoc index ae7bfd9..fb2cf08 100644 --- a/guidelines/modules/ROOT/pages/Systemd.adoc +++ b/guidelines/modules/ROOT/pages/Systemd.adoc @@ -198,8 +198,8 @@ Example: [Service] Type=forking EnvironmentFile=-/etc/sysconfig/httpd -ExecStart=/usr/sbin/httpd $OPTIONS -ExecReload=/usr/sbin/httpd $OPTIONS -k restart +ExecStart=httpd $OPTIONS +ExecReload=httpd $OPTIONS -k restart .... You may then refer to variables set in the `+/etc/sysconfig/httpd+` file @@ -283,7 +283,7 @@ Description=ABRT Automated Bug Reporting Tool [Service] Type=dbus BusName=com.redhat.abrt -ExecStart=/usr/sbin/abrtd -d -s +ExecStart=abrtd -d -s [Install] WantedBy=multi-user.target @@ -383,7 +383,7 @@ The ConsoleKit bus activation file .... [D-BUS Service] Name=org.freedesktop.ConsoleKit -Exec=/usr/sbin/console-kit-daemon --no-daemon +Exec=console-kit-daemon --no-daemon User=root SystemdService=console-kit-daemon.service .... @@ -398,7 +398,7 @@ Description=Console Manager [Service] Type=dbus BusName=org.freedesktop.ConsoleKit -ExecStart=/usr/sbin/console-kit-daemon --no-daemon +ExecStart=console-kit-daemon --no-daemon .... As you can see `+SystemdService=+` is used in the D-Bus activation file @@ -442,7 +442,7 @@ SystemdService=dbus-org.freedesktop.Avahi.service # This service should not be bus activated if systemd isn't running, # so that activation won't conflict with the init script startup. -Exec=/bin/false +Exec=false .... Here is the Avahi systemd unit `+.service+` file @@ -456,8 +456,8 @@ Requires=avahi-daemon.socket [Service] Type=dbus BusName=org.freedesktop.Avahi -ExecStart=/usr/sbin/avahi-daemon -s -ExecReload=/usr/sbin/avahi-daemon -r +ExecStart=avahi-daemon -s +ExecReload=avahi-daemon -r NotifyAccess=main [Install] From f80e2dc64197d88821fdaae53f297f4f4315cd97 Mon Sep 17 00:00:00 2001 From: Zbigniew Jędrzejewski-Szmek Date: Apr 25 2024 16:20:57 +0000 Subject: [PATCH 3/4] Describe the file system after sbin-bin merge https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin Since now %_sbindir is the same %_bindir, relegate it to the compat section. Use "/usr/bin" or "%{_bindir}" everywhere. --- diff --git a/guidelines/modules/ROOT/pages/RPMMacros.adoc b/guidelines/modules/ROOT/pages/RPMMacros.adoc index 5c2549c..124cd28 100644 --- a/guidelines/modules/ROOT/pages/RPMMacros.adoc +++ b/guidelines/modules/ROOT/pages/RPMMacros.adoc @@ -55,7 +55,6 @@ The following table lists macros which are widely used in fedora `.spec` files. | +%{_bindir}+ | +%{_exec_prefix}+/bin | default: `/usr/bin` | +%{_libdir}+ | +%{_exec_prefix}/%{_lib}+ | default: `+/usr/%{_lib}+` | +%{_libexecdir}+ | +%{_exec_prefix}+/libexec | default: `/usr/libexec` -| +%{_sbindir}+ | +%{_exec_prefix}+/sbin | default: `/usr/sbin` | +%{_datadir}+ | +%{_datarootdir}+ | default: `/usr/share` | +%{_infodir}+ | +%{_datarootdir}+/info | default: `/usr/share/info` | +%{_mandir}+ | +%{_datarootdir}+/man | default: `/usr/share/man` @@ -75,6 +74,7 @@ and there might be cases where they are still needed. | macro | definition | comment | +%{_datarootdir}+ | +%{_prefix}/share+ | default: `/usr/share` | +%{_var}+ | /var | +| +%{_sbindir}+ | same as +%{_bindir}+ | historically `/usr/sbin`, now `/usr/bin`, provided for compatibility | +%{_tmppath}+ | +%{_var}/tmp+ | default: `/var/tmp` | +%{_usr}+ | /usr | | +%{_usrsrc}+ | +%{_usr}/src+ | default: `/usr/src` diff --git a/guidelines/modules/ROOT/pages/index.adoc b/guidelines/modules/ROOT/pages/index.adoc index 08e9dd3..ef5650b 100644 --- a/guidelines/modules/ROOT/pages/index.adoc +++ b/guidelines/modules/ROOT/pages/index.adoc @@ -641,10 +641,10 @@ as long as package as a whole also supports Chromium. If Chrome in the future allows a more standard directory to be used for this purpose, this exception will be removed. -=== Effect of the UsrMove Fedora Feature +=== Merged file system layout -Fedora has merged several directories in `+/+` -with their counterparts in `+/usr/+`: +Fedora has merged several directories that historically used to be +separate. [cols=",,"] |=== @@ -655,8 +655,12 @@ with their counterparts in `+/usr/+`: |`+{_bindir}+` |`+/sbin+` +|`+/usr/bin+` +|`+%{_bindir}+` + |`+/usr/sbin+` -|`+%{_sbindir}+` +|`+/usr/bin+` +|`+%{_bindir}+` |`+/lib64+` or `+/lib+` |`+/usr/lib64+` or `+/usr/lib+` @@ -667,8 +671,9 @@ with their counterparts in `+/usr/+`: |`+%{_prefix}/lib+` |=== -For example, end users will find that `+/bin/sh+` -is the same file as `+/usr/bin/sh+`. +For example, end users will find that +`+/bin/sh+` is the same file as `+/usr/bin/sh+`, +and `+/usr/sbin/sendmail+` is the the same as `+/usr/bin/sendmail+`. However, rpm file dependencies don't work according to what's on the filesystem, @@ -696,7 +701,7 @@ For instance: Provides: /sbin/ifconfig [...] %files -%{_sbindir}/ifconfig +%{_bindir}/ifconfig ---- == Use `+rpmlint+` @@ -825,7 +830,6 @@ instead of packages. Packages MAY include such dependencies for paths inside one of the following directories: * `+/usr/bin+` -* `+/usr/sbin+` * `+/etc+` They also MAY depend on paths listed in an explicit `Provides:`. From 507e5ff6a6058587e7c13427b46cb9560815c6f4 Mon Sep 17 00:00:00 2001 From: Zbigniew Jędrzejewski-Szmek Date: Apr 25 2024 16:20:57 +0000 Subject: [PATCH 4/4] Use /usr/bin/ in all paths for binaries Those old paths would still work, but would be confusing to new packagers, since we require that the real paths be used in %files [1]. In particular, ldconfig was "moved" in [2] and sendmail in [3]. [1] https://pagure.io/packaging-committee/pull-request/1355 [2] https://src.fedoraproject.org/rpms/glibc/pull-request/91 [3] https://src.fedoraproject.org/rpms/sendmail/pull-request/7 --- diff --git a/guidelines/modules/ROOT/pages/Alternatives.adoc b/guidelines/modules/ROOT/pages/Alternatives.adoc index 4fbbfb2..f1ec3d5 100644 --- a/guidelines/modules/ROOT/pages/Alternatives.adoc +++ b/guidelines/modules/ROOT/pages/Alternatives.adoc @@ -37,7 +37,7 @@ If a non-root user would gain value by switching between the variants then alternatives *MUST NOT* be used. A good example of using alternatives are the various MTAs -which all provide `+/usr/sbin/sendmail+` with similar command line arguments. +which all provide `+/usr/bin/sendmail+` with similar command line arguments. Bad examples of using alternatives include: @@ -61,10 +61,10 @@ are example packages using environment-modules for this purpose. If a package is using alternatives, the files which would otherwise conflict MUST be installed with an appropriate suffix -(for example: `+%{_sbindir}/sendmail.postfix+` -instead of `+%{_sbindir}/sendmail+`), +(for example: `+%{_bindir}/sendmail.postfix+` +instead of `+%{_bindir}/sendmail+`), the original locations MUST be touched -(for example: `+touch %{_sbindir}/sendmail+`), +(for example: `+touch %{_bindir}/sendmail+`), the links set up by alternatives MUST be listed as %ghost in the file list and proper Requires: MUST be added, like in the examples below. @@ -85,8 +85,8 @@ Example from antlr.spec: [source, rpm-spec] ---- -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): %{_bindir}/update-alternatives +Requires(postun): %{_bindir}/update-alternatives ... %install ... @@ -112,15 +112,15 @@ slightly edited: [source, rpm-spec] ---- -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives -Requires(preun): %{_sbindir}/update-alternatives +Requires(post): %{_bindir}/update-alternatives +Requires(postun): %{_bindir}/update-alternatives +Requires(preun): %{_bindir}/update-alternatives ... %install ... # rename files for alternative usage -mv %{buildroot}%{_sbindir}/sendmail %{buildroot}%{_sbindir}/sendmail.sendmail -touch %{buildroot}%{_sbindir}/sendmail +mv %{buildroot}%{_bindir}/sendmail %{buildroot}%{_bindir}/sendmail.sendmail +touch %{buildroot}%{_bindir}/sendmail for i in mailq newaliases rmail; do mv %{buildroot}%{_bindir}/$i %{buildroot}%{_bindir}/$i.sendmail touch %{buildroot}%{_bindir}/$i @@ -136,14 +136,14 @@ touch %{buildroot}%{_mandir}/man8/sendmail.8 %postun if [ "$1" -ge "1" ]; then - if [ "`+readlink %{_sysconfdir}/alternatives/mta+`" == "%{_sbindir}/sendmail.sendmail" ]; then - alternatives --set mta %{_sbindir}/sendmail.sendmail + if [ "`+readlink %{_sysconfdir}/alternatives/mta+`" == "%{_bindir}/sendmail.sendmail" ]; then + %{_bindir}/alternatives --set mta %{_bindir}/sendmail.sendmail fi fi %post # Set up the alternatives files for MTAs. -update-alternatives --install %{_sbindir}/sendmail mta %{_sbindir}/sendmail.sendmail 90 \ +update-alternatives --install %{_bindir}/sendmail mta %{_bindir}/sendmail.sendmail 90 \ --slave %{_bindir}/mailq mta-mailq %{_bindir}/mailq.sendmail \ --slave %{_bindir}/newaliases mta-newaliases %{_bindir}/newaliases.sendmail \ --slave %{_bindir}/rmail mta-rmail %{_bindir}/rmail.sendmail \ @@ -158,13 +158,13 @@ update-alternatives --install %{_sbindir}/sendmail mta %{_sbindir}/sendmail.send %preun if [ $1 = 0 ]; then - update-alternatives --remove mta %{_sbindir}/sendmail.sendmail + update-alternatives --remove mta %{_bindir}/sendmail.sendmail fi ... %files ... -%ghost %{_sbindir}/sendmail +%ghost %{_bindir}/sendmail %ghost %{_bindir}/mailq %ghost %{_bindir}/newaliases %ghost %{_bindir}/rmail @@ -175,7 +175,7 @@ fi %ghost %{_mandir}/man1/newaliases.1.gz %ghost %{_mandir}/man5/aliases.5.gz -%{_sbindir}/sendmail.sendmail +%{_bindir}/sendmail.sendmail %{_bindir}/mailq.sendmail %{_bindir}/newaliases.sendmail %{_bindir}/rmail.sendmail diff --git a/guidelines/modules/ROOT/pages/CronFiles.adoc b/guidelines/modules/ROOT/pages/CronFiles.adoc index 9f62791..f50beac 100644 --- a/guidelines/modules/ROOT/pages/CronFiles.adoc +++ b/guidelines/modules/ROOT/pages/CronFiles.adoc @@ -20,7 +20,7 @@ then a custom crontab file should be added to /etc/cron.d (with 0640 permissions). In this case, the cron job file (the script) must be placed in an appropriate system location -(e.g. %\{_sbindir}, %\{_libexecdir}), and NOT in /etc/cron.d. +(e.g. %\{_bindir}, %\{_libexecdir}), and NOT in /etc/cron.d. Both cron job files and crontab definition files installed in any of these directories @@ -53,7 +53,7 @@ specified in /etc/cron.d/example # | | | | | # * * * * * user-name command to be executed -0 */2 * * * root /usr/sbin/example +0 */2 * * * root /usr/bin/example .... == Cron job file names diff --git a/guidelines/modules/ROOT/pages/Scriptlets.adoc b/guidelines/modules/ROOT/pages/Scriptlets.adoc index 6c2a2ec..961aec7 100644 --- a/guidelines/modules/ROOT/pages/Scriptlets.adoc +++ b/guidelines/modules/ROOT/pages/Scriptlets.adoc @@ -28,7 +28,7 @@ of the rpm spec file. The scripts support a special flag, `+-p+` which allows the scriptlet to invoke a single program directly rather than having to spawn a shell to invoke the programs. -(i.e., `+%post -p /sbin/ldconfig+`) +(i.e., `+%post -p /usr/bin/ldconfig+`) When scriptlets are called, they will be supplied with an argument. @@ -216,15 +216,15 @@ Instead simply call `+ldconfig+` directly in both as well as adding the necessary dependencies when necessary: .... -%post -p /sbin/ldconfig -%postun -p /sbin/ldconfig +%post -p /usr/bin/ldconfig +%postun -p /usr/bin/ldconfig .... or, as part of existing `+%post+` or `+%postun+` scriptlets: .... -Requires(post): /sbin/ldconfig -Requires(postun): /sbin/ldconfig +Requires(post): /usr/bin/ldconfig +Requires(postun): /usr/bin/ldconfig [...] %post [...]