40

I am adding some sources to an existing rpm .spec file by URL and don't have them downloaded yet. Is there a way to get rpmbuild to download the sources rather than doing it manually?

joeforker
  • 40,459
  • 37
  • 151
  • 246

4 Answers4

57

The spectool utility from the rpmdevtools package can do this. Just install rpmdevtools and point spectools at the .spec like so:

spectool -g -R SPECS/nginx.spec

It will download any missing sources into rpm's %{_sourcedir} (usually SOURCES) directory.

funkyhat
  • 13
  • 5
joeforker
  • 40,459
  • 37
  • 151
  • 246
  • I can't find which rpm contains spectool in SUSE. – aleung Mar 23 '16 at 10:37
  • Is it not simply 'spectool' https://build.opensuse.org/package/show/devel:tools/spectool – joeforker Mar 23 '16 at 13:56
  • 3
    As I wanted to know what the flags mean: "-g, --gf, --get-files gets the sources/patches that are listed with a URL; -R, --sourcedir download into rpm's %{_sourcedir}" – Richlv Jun 30 '17 at 20:33
  • @aleung Try yum whatprovides "*bin/spectool" – RedShift Aug 09 '17 at 14:00
  • For SUSE: https://software.opensuse.org/download.html?project=devel%3Atools&package=spectool – fuzzyTew Feb 16 '19 at 21:30
  • 4
    As @Richlv pointed out, `spectool` downloads files into the `%{_sourcedir}` directory. If you want to know where that is on your own system, you can evaluate it using `rpm --eval "%{_sourcedir}"`. I happen to use this for all sorts of things recently and found it pretty useful to share. – Konrad Kleine Feb 03 '21 at 14:02
47

For posterity, there is another way to do it, which does not need any additional tools or downloads:

rpmbuild --undefine=_disable_source_fetch -ba /path/to/your.spec

Downloading sources automatically is forbidden by default because RPM lacks built-in integrity checks for the source archives. The network has to be trusted, and any checksums and signatures checked. This restriction makes sense for package maintainers, as they are responsible for shipping trusted code.

However, when you know what you are doing and understand the risks, you may just forcibly lift the restriction.

Yaroslav Fedevych
  • 663
  • 6
  • 10
19

In the spec file, you can place %undefine _disable_source_fetch anywhere before the source URL.

For security purposes, you should also specify the sha256sum, and check it in the %prep section prior to setup.

Here is a working example:

Name:       monit
Version:    5.25.1
Release:    1%{?dist}
Summary:    Monitoring utility for unix systems

Group:      Applications/System
License:    GNU AFFERO GENERAL PUBLIC LICENSE version 3
URL:        https://mmonit.com/monit/
%undefine _disable_source_fetch
Source0:    https://mmonit.com/monit/dist/%name-%version.tar.gz
%define     SHA256SUM0 4b5c25ceb10825f1e5404f1d8a7b21507716b82bc20c3586f86603691c3b81bc

%define debug_package %nil

BuildRequires:  coreutils

%description
Monit is a small Open Source utility for managing and monitoring Unix systems. Monit conducts automatic maintenance
and repair and can execute meaningful causal actions in error situations.

%prep
echo "%SHA256SUM0  %SOURCE0" | sha256sum -c -
%setup -q

...

Credits

@YaroslavFedevych for undefine _disable_source_fetch.

Matt
  • 20,108
  • 1
  • 57
  • 70
  • I tried doing all of this, but I am still not getting RPM to download the tarball from the url. Instead, it tries to use the /usr/src/packages/SOURCES/%name-%version.tar.gz file. FYI I am using the 4.4.2.3 rpmbuild version – amine Aug 19 '19 at 10:00
  • 1
    I have just tested on another environment that has rpmbuild 4.12.0.1 and everything worked perfectly (even without the %undefine and %define lines). If it can help others, I found out that download of sources from url instead of using SOURCES/ has been introduced since 4.4.6 https://www.redhat.com/archives/rpm-list/2007-December/msg00003.html – amine Aug 19 '19 at 12:10
  • 1
    I found 4.11.3 does not honor the `%undefine _disable_source_fetch` directive. However, you can still use it on the command line as @Yaroslav mentioned. But @Matt kudos for the SHA checksum code... great idea even if the tarball is already in the `SOURCES` directory. – fbicknel Feb 11 '20 at 20:12
  • Note that there's a typo in the validation code: There must be two spaces between `%SHA256SUM0` and `%SOURCE0`, not just one space. – vog Apr 24 '20 at 23:56
  • @vog Works for me, but I'll take your word for it that that's the case for you. Updated, thanks. – Matt Apr 25 '20 at 00:57
1

If you are getting sources from a (git) hosting service (github, etc..) there is support for automatically checking it out already built-in, when combined with _disable_source_fetch...

https://fedoraproject.org/wiki/Packaging:SourceURL

For example, for a specific githash from github:

%global commit 40-CHARACTER-HASH-VALUE
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Source0:  https://github.com/OWNER/PROJECT/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
...
%prep
%autosetup -n PROJECT-%{commit}
tesch1
  • 2,756
  • 1
  • 14
  • 11