Re: [PATCH] fedora: Replace pasta hard links by copies, mangle Build-IDs

On Wed, 23 Aug 2023 15:31:46 +0100
"Richard W.M. Jones" <rjones(a)redhat.com> wrote:

...
  On Wed, Aug 23, 2023 at 03:59:39PM +0200, Stefano
Brivio wrote:
  On Wed, 23 Aug 2023 14:53:27 +0100
 "Richard W.M. Jones" <rjones(a)redhat.com> wrote:
   
  On Wed, Aug 23, 2023 at 03:48:44PM +0200, Stefano
Brivio wrote:  
  The hard link trick didn't actually fix the
issue with SELinux file
 contexts properly: as opposed to symbolic links, SELinux now
 correctly associates types to the labels that are set -- except that
 those labels are now shared, so we can end up (depending on how
 rpm(8) extracts the archives) with /usr/bin/passt having a
 pasta_exec_t context.
 
 This got rather confusing as running restorecon(8) seemed to fix up
 labels -- but that's simply toggling between passt_exec_t and
 pasta_exec_t for both links, because each invocation will just "fix"
 the file with the mismatching context.
 
 Replace the hard links with copies. AppArmor's attachment, instead,
 works with hard links, and if there's no LSM, we can keep symbolic
 links, so keep symbolic links in the Makefile.
 
 With copies, rpmbuild(8) will warn about duplicate Build-IDs in the
 same package. Mangle them in pasta binaries by summing one to the
 last byte, modulo one byte, using xxd (provided by vim-common) and
 disable the automatic rehashing by find-debuginfo(1) -- we already
 have per-release Build-IDs thanks to $VERSION passed on 'make'.     
 
 Right, this ^ was going to be my comment.  RPM doesn't like having two
 identical copies of a file.   
 
 In which other way, though? cpio(1) is fine with it, and I tried to
 install the package on both ext4 and xfs -- the only warning I got was
 the (semi-reasonable) one from rpmbuild about duplicate Build-IDs.   
 
 I'm fairly sure I've seen an error when you have two identical files; 
...but those are not identical, exactly because I change the Build-ID.

...
  it might only happen in Koji.  Anyway, hacking the
binary is surely
 wrong, but let's hear the opinions of the Fedora / SELinux developers. 
I don't see why it would be "surely wrong".

It's surely ugly, though, and David suggested that two separate builds
might be slightly less ugly, albeit (more) wasteful, but passt takes
seconds to build, after all. New patch posted.

-- 
Stefano