feat(build): build the rpm offline, and test the package rather than the checkout #26

Open

dusan wants to merge 1 commit from t3code/f2087226 into main

pull from: t3code/f2087226

merge into: dusan:main

dusan:main

Conversation 0 Commits 1 Files changed 19 +806 -43

dusan commented 2026-08-20 05:02:44 +00:00

Owner

Copy link

Makes the rpm build trustworthy: offline, tested, linted, and verified by driving the binaries out of the package itself.

What changed

Offline build. build-aux/make-vendor-tarball.sh produces a second source tarball with every crate the workspace depends on. The spec unpacks it in %prep, writes a .cargo/config.toml pointing at it, and exports TK_OFFLINE=1, which cargo-build.sh and cargo-test.sh turn into --offline. A build that fetches from crates.io is not reproducible and is refused outright by koji and by a COPR chroot.

%check means something. cargo test --workspace is registered as a meson test in a rust suite, reusing the profile and target directory of the build so nothing compiles twice. %check went from two file validators to those plus the whole suite.

A smoke test for the package. build-aux/rpm-smoke.sh extracts an rpm into a throwaway prefix and drives the binaries out of it on a private D-Bus session, with the installed application ID rather than .Devel. It checks the three binaries resolve their libraries, the three schemas are present and compile, the desktop entry validates and points at an icon the package ships, the man pages are there, then starts the packaged window and agent and has the packaged terminalkoctl talk to them. smoke.sh cannot see any of this: it drives target/debug, where every file is present whether the package ships it or not.

Two test fixes the packaging found. foreground::tests::this_process_can_be_read and a_session_reports_what_it_is_running asserted the tests are not root. That is false in a chroot or a root container — including the Fedora container the CI job already runs in — so %check would have failed there. Both now compare the reader against the real geteuid().

One version, one bump. build-aux/release.sh <version> [--tag] rewrites meson.build, Cargo.toml and the spec, refreshes Cargo.lock, and prepends a %changelog entry. build-aux/version-check.sh, which ci.sh runs, fails the build when the three disagree — the part that actually holds the line.

Lint and man pages. Three man pages in data/man/, installed to %{_mandir} with the version substituted. build-aux/rpmlint.toml filters only the deliberate findings, each with its reason next to it: British spelling, the obsolete tags Fedora dropped, an SPDX identifier the check only knows with the licence data package installed.

Release plumbing. Source0 and Source1 are release-asset URLs. The packaging job builds both tarballs, builds the rpm, lints the spec and the packages, and smoke tests the rpm under xvfb.

Verified on Fedora 44

• ./build-aux/ci.sh — pass
• ./build-aux/smoke.sh — pass
• rpmbuild -ba under unshare -rn, so with no network at all — exit 0, %check 3/3
• rpmlint --config build-aux/rpmlint.toml over the spec and both rpms — 0 errors, 0 warnings
• ./build-aux/rpm-smoke.sh on the built rpm — pass
• meson install — man pages land in /usr/share/man/man1, render, version substituted
• release.sh 0.1.1 in a throwaway clone — bumps all three plus the lock and changelog; the guard catches drift

Still open

• A mock rebuild, which is what proves BuildRequires is complete. unshare -rn shows the build never touches the network, but not that the chroot has everything. Command is in the README.
• dnf install of the rpm, the only path that exercises %post — the schema cache and the desktop database.
• The packaging job has still not run on a runner, and there is no COPR repository yet. The README says so in both cases.

Makes the rpm build trustworthy: offline, tested, linted, and verified by driving the binaries out of the package itself. ## What changed **Offline build.** `build-aux/make-vendor-tarball.sh` produces a second source tarball with every crate the workspace depends on. The spec unpacks it in `%prep`, writes a `.cargo/config.toml` pointing at it, and exports `TK_OFFLINE=1`, which `cargo-build.sh` and `cargo-test.sh` turn into `--offline`. A build that fetches from crates.io is not reproducible and is refused outright by koji and by a COPR chroot. **`%check` means something.** `cargo test --workspace` is registered as a meson test in a `rust` suite, reusing the profile and target directory of the build so nothing compiles twice. `%check` went from two file validators to those plus the whole suite. **A smoke test for the package.** `build-aux/rpm-smoke.sh` extracts an rpm into a throwaway prefix and drives the binaries out of it on a private D-Bus session, with the installed application ID rather than `.Devel`. It checks the three binaries resolve their libraries, the three schemas are present and compile, the desktop entry validates and points at an icon the package ships, the man pages are there, then starts the packaged window and agent and has the packaged `terminalkoctl` talk to them. `smoke.sh` cannot see any of this: it drives `target/debug`, where every file is present whether the package ships it or not. **Two test fixes the packaging found.** `foreground::tests::this_process_can_be_read` and `a_session_reports_what_it_is_running` asserted the tests are not root. That is false in a chroot or a root container — including the Fedora container the CI job already runs in — so `%check` would have failed there. Both now compare the reader against the real `geteuid()`. **One version, one bump.** `build-aux/release.sh <version> [--tag]` rewrites `meson.build`, `Cargo.toml` and the spec, refreshes `Cargo.lock`, and prepends a `%changelog` entry. `build-aux/version-check.sh`, which `ci.sh` runs, fails the build when the three disagree — the part that actually holds the line. **Lint and man pages.** Three man pages in `data/man/`, installed to `%{_mandir}` with the version substituted. `build-aux/rpmlint.toml` filters only the deliberate findings, each with its reason next to it: British spelling, the obsolete tags Fedora dropped, an SPDX identifier the check only knows with the licence data package installed. **Release plumbing.** `Source0` and `Source1` are release-asset URLs. The packaging job builds both tarballs, builds the rpm, lints the spec and the packages, and smoke tests the rpm under `xvfb`. ## Verified on Fedora 44 - `./build-aux/ci.sh` — pass - `./build-aux/smoke.sh` — pass - `rpmbuild -ba` under `unshare -rn`, so with no network at all — exit 0, `%check` 3/3 - `rpmlint --config build-aux/rpmlint.toml` over the spec and both rpms — 0 errors, 0 warnings - `./build-aux/rpm-smoke.sh` on the built rpm — pass - `meson install` — man pages land in `/usr/share/man/man1`, render, version substituted - `release.sh 0.1.1` in a throwaway clone — bumps all three plus the lock and changelog; the guard catches drift ## Still open - A `mock` rebuild, which is what proves `BuildRequires` is complete. `unshare -rn` shows the build never touches the network, but not that the chroot has everything. Command is in the README. - `dnf install` of the rpm, the only path that exercises `%post` — the schema cache and the desktop database. - The packaging job has still not run on a runner, and there is no COPR repository yet. The README says so in both cases.

dusan added 1 commit 2026-08-20 05:02:44 +00:00

feat(build): add offline RPM packaging and release automation ... 3d171ea0b1

- Vendored crates tarball makes %build offline, reproducible, COPR-ready
- Smoke test drives binaries out of built package, catches packaging errors
- release.sh bumps version in meson.build, Cargo.toml, spec with changelog
- version-check.sh fails build on version drift between files
- Tests fixed: root detection now matches actual euid instead of assuming unprivileged
- Man pages for terminalko, terminalko-agent, terminalkoctl added to %files
- CI workflow lints spec, smoke tests on xvfb, uploads artifacts to run
- cargo-test.sh added for workspace tests in %check phase

Some checks failed

Hide all checks

CI / check (push) Has been cancelled

Details

CI / package (push) Has been cancelled

Details

CI / check (pull_request) Has been cancelled

Details

CI / package (pull_request) Has been cancelled

Details

This pull request has changes conflicting with the target branch.

• README.md

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title Merge pull request 'feat(build): build the rpm offline, and test the package rather than the checkout' (#26) from t3code/f2087226 into main

Merge commit body Reviewed-on: https://git.d4s4.xyz/dusan/terminalko/pulls/26

Merge pull request 'feat(build): build the rpm offline, and test the package rather than the checkout' (#26) from t3code/f2087226 into main Reviewed-on: https://git.d4s4.xyz/dusan/terminalko/pulls/26 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin t3code/f2087226:t3code/f2087226

git switch t3code/f2087226

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff t3code/f2087226

git switch t3code/f2087226

git rebase main

git switch main

git merge --ff-only t3code/f2087226

git switch t3code/f2087226

git rebase main

git switch main

git merge --no-ff t3code/f2087226

git switch main

git merge --squash t3code/f2087226

git switch main

git merge --ff-only t3code/f2087226

git switch main

git merge t3code/f2087226

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

dusan/terminalko!26

No description provided.