Skip to content

Vanagon packaging - #643

Draft
nmburgan wants to merge 15 commits into
mainfrom
vanagon_packaging
Draft

Vanagon packaging#643
nmburgan wants to merge 15 commits into
mainfrom
vanagon_packaging

Conversation

@nmburgan

@nmburgan nmburgan commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

This adds all the machinery to build openvox-server packages with vanagon instead of ezbake. It does not yet remove the extraneous ezbake machinery.

There are two stages. First, a tarball containing the uberjar, vendored gems, and FIPS BC jars for FIPS builds is created. Then, this is used by the openvox-server project to then package these up with the service files and CLI files. This is two stages because the uberjar and related files are not platform-specific, so it would be a waste to compile this every time for every platform.

Requires OpenVoxProject/shared-actions#149 for building in GHA

@nmburgan

nmburgan commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

I think this is currently broken for building FIPS. I'll debug that tomorrow. Edit: Fixed via OpenVoxProject/vanagon#98

@nmburgan

nmburgan commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

This also does not yet create the openvox-server tarball that @smortex needs for FreeBSD builds. Will push up a commit with that next. Edit: Now it does.

@nmburgan nmburgan mentioned this pull request Sep 17, 2026
Merged
@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

The rpm/deb packages and the JAR file for openvox-server are available in a zip archive:
https://github.com/OpenVoxProject/openvox-server/actions/runs/35668225910/artifacts/10670351312

nmburgan and others added 15 commits October 6, 2026 22:42
@nmburgan
Add the build tooling the vanagon packaging needs
a26b24f 
The vanagon packaging under packaging/ will build the uberjar without
ezbake, so add pkg and pkg-fips profiles for that build. The
pkg-fips profile leaves every BouncyCastle class out of the jar because the
FIPS packages install the BC FIPS jars next to it instead.

Add packaging group to the Gemfile. The packaging gem pin is commented
out because it conflicts with the packaging version vanagon's gemspec
requires, and the Rakefile's use of it has been commented out for a while.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Import the packaging content from the shipped packages
988650a 
These are the CLI machinery and subcommands, the configuration files,
bootstrap.cfg, java.security.fips and the 8.x wrapper scripts exactly as
ezbake renders them into the shipped openvox-server packages, taken from the
9.x and 8.x packages. Keeping them in the repo makes the package
contents reviewable here instead of being generated at build time.

Two things differ from the shipped copies. The  version line in bin/puppetserver
has a @@Version@@ placeholder that the vanagon build fills in, and the
wrapper helper is renamed from ezbake-functions.sh to helper-functions.sh
because ezbake is no longer involved. The wrapper scripts that source it are
updated to match.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Add vanagon packaging for openvox-server
08f85e7 
Two vanagon projects replace the ezbake build. openvox-server-uberjar builds
the uberjar and the vendored gems once per variant, on el-9 for the regular
jar and on redhatfips-9 for the FIPS jar, and publishes the installed tree as
a rooted archive rather than a package. openvox-server builds the noarch
rpm or deb for one platform. Its uberjar-tarball component unpacks that
archive and its openvox-server component installs the authored content from
resources/files and the rendered unit, defaults file and cli-defaults.sh.

The JDK and leiningen are installed inside the build container, with the
lein script and standalone jar pinned by checksum. The platform to variant
mapping, the archive naming and the Clojure dependency rebuild knobs live in
lib/server_packaging.rb so the rake tasks and the vanagon configs share one
definition.

Both service styles from the ezbake packages are kept and chosen by major
version. The direct style matches the ezbake 4.x units shipped for 9.x, with
Type=notify-reload where the platform's systemd is new enough and the FIPS
jars directory on the classpath. The wrapper style matches the ezbake 2.x
packages shipped for 8.x.

Deviations from the ezbake packages: install.sh and ezbake.manifest are no
longer shipped, the deb enables the service on a fresh install, purging the
deb no longer removes the log directory, the log directory is 0700 on rpm
platforms, the Fedora dist tag is fcNN, and the 8.x wrapper helper is
installed as helper-functions.sh.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Build and upload rake tasks
e2e5d06 
When run locally, building openvox-server first builds the uberjar archive
it needs when that is missing from packaging/output and then points vanagon
at that directory. In CI, the uberjar job has already uploaded the archive,
so the project falls back to the artifacts bucket URL. The version helper
mirrors vanagon's version_from_git so the archive name computed here matches
the one vanagon computes for the same ref.

vox:upload uploads the vanagon output for one platform. Packages have the
short platform tag in their names while the uberjar archives carry the full
vanagon platform name, so the filter accepts either.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Add a workflow for the vanagon build
ba52ffe 
The workflow calls the shared build_vanagon.yml twice. The first call builds
the openvox-server-uberjar project on its two fixed platforms and always
uploads the archives, because the second call, which builds openvox-server
for every platform in the server-vanagon list, fetches them from the
artifacts bucket. This depends on the platforms_key input and
the server-vanagon lists in shared-actions.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Change section for puppet.conf entries to server
8e9e425 
Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
@nmburgan
Add building the source tarball
ed50a5b 
The ezbake build created openvox-server-<version>.tar.gz next to the
packages, and the FreeBSD port fetches that tarball from the artifacts
bucket to build its own package. It takes the jar, the configuration files,
bootstrap.cfg, the CLI dispatcher and subcommands and cli-defaults.sh from
under a puppetserver-<version> top level directory.

The openvox-server package build already has all of those in place, so on
one platform its openvox-server component also assembles that layout and
writes the tarball into output/, where vanagon copies it back next to the
packages and vox:upload publishes it under the same name as before. A
build_requires on the uberjar-tarball component only orders the two
components so the jar is unpacked first. The tarball is built with
reproducible tar flags from SOURCE_DATE_EPOCH.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@marcusdots @nmburgan
port of auth.conf
742eed3 
context
On a default installation the primary should be able to clean its own code cache
https://github.com/OpenVoxProject/openvox-server/pull/640/changes

Signed-off-by: Marcus Poller <marcus.poller@betadots.de>
@nmburgan
Update readme
a282a8f 
Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
@nmburgan
Update workflows
84eaa99 
Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
@nmburgan
Run Java through the launcher of the ezbake 4.2 packages
6e63fce 
The OpenVox 9 packages built with ezbake 4.2 ship
apps/puppetserver/bin/java, a launcher that runs the first of a list of
Java major versions it finds, and they depend on any one of those
versions. The packaging here now does the same for 9.x versions.

java.erb is the ezbake template. The project turns the java_versions
setting into an rpm requirement of the form (a or b) with a Suggests tag
for the preferred package, or into the deb alternative a | b, and points
java_bin at the launcher so the unit runs it. The defaults file leaves
JAVA_BIN commented out, the dispatcher exports JAVA_BIN from the launcher
when it is installed, and the source tarball carries the launcher under
ext/bin as the ezbake tarball does. proj.suggests needs the suggests DSL
method added to the OpenVox vanagon fork.

OpenVox 8 packages keep one Java package per platform and
JAVA_BIN="/usr/bin/java", as the ezbake 2.x packages have.

The direct unit passes $LOG_APPENDER only on deb platforms because the
ezbake debian template does and the redhat one does not. Nothing sets the
variable for the service, so this only keeps the units identical.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Carry the ezbake 4.2 CLI fixes
e968251 
The dispatcher reports an unknown subcommand on stderr and exits 1, and
foreground exits with the status of the Java process instead of the
status of popd. Both match the scripts the ezbake 4.2 packages ship.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Ship bcutil-fips with the FIPS jars
d6ccb07 
The move to BouncyCastle FIPS 2.1 added bcutil-fips as a fourth jar of
the provider. The FIPS uberjar archive now carries it next to bc-fips,
bcpkix-fips and bctls-fips so the service classpath has the whole
provider.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Add the redhatfips-10 platform
663e834 
The ezbake FIPS build list already includes redhatfips-10. The platform
inherits the vanagon defaults, and its systemd is new enough for
Type=notify-reload, which the project derives from the version.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>
@nmburgan
Name Fedora packages like the ezbake builds
47e2110 
Vanagon's Fedora defaults use fcNN as the dist tag, so the rpm would be
named openvox-server-<version>-1.fc44.noarch.rpm where the ezbake build
produced .fedora44. The smoke test task finds packages by the
<os><version> string of the platform, so the platform files set the dist
to match and the upload filter no longer rewrites fedora to fc.

Signed-off-by: nmburgan <13688219+nmburgan@users.noreply.github.com>
Assisted-by: Claude Fable 5.1 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bastelfreak bastelfreak bastelfreak left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nmburgan @bastelfreak @marcusdots