How do I get rpmbuild to download all of the sources for a particular .spec?

Question

I am adding some sources to an existing rpm .spec file by URL and don't have them downloaded yet. Is there a way to get rpmbuild to download the sources rather than doing it manually?

Ursulina

Answer 1

The spectool utility from the rpmdevtools package can do this. Just install rpmdevtools and point spectools at the .spec like so:

spectool -g -R SPECS/nginx.spec

It will download any missing sources into rpm's %{_sourcedir} (usually SOURCES) directory.

Ursulina

I can't find which rpm contains spectool in SUSE. – Hausmann

Is it not simply 'spectool' build.opensuse.org/package/show/devel:tools/spectool – Ursulina

As I wanted to know what the flags mean: "-g, --gf, --get-files gets the sources/patches that are listed with a URL; -R, --sourcedir download into rpm's %{_sourcedir}" – Scotism

@Hausmann Try yum whatprovides "*bin/spectool" – Cheesy

For SUSE: software.opensuse.org/… – Hawsehole

As @Scotism pointed out, spectool downloads files into the %{_sourcedir} directory. If you want to know where that is on your own system, you can evaluate it using rpm --eval "%{_sourcedir}". I happen to use this for all sorts of things recently and found it pretty useful to share. – Countersubject

Answer 2

For posterity, there is another way to do it, which does not need any additional tools or downloads:

rpmbuild --undefine=_disable_source_fetch -ba /path/to/your.spec

Downloading sources automatically is forbidden by default because RPM lacks built-in integrity checks for the source archives. The network has to be trusted, and any checksums and signatures checked. This restriction makes sense for package maintainers, as they are responsible for shipping trusted code.

However, when you know what you are doing and understand the risks, you may just forcibly lift the restriction.

Reach

rpmbuild --undefine=_disable_source_fetch --define '_sourcedir .' -ba *.spec finally. – Luckett

Answer 3

In the spec file, you can place %undefine _disable_source_fetch anywhere before the source URL.

For security purposes, you should also specify the sha256sum, and check it in the %prep section prior to setup.

Here is a working example:

Name:       monit
Version:    5.25.1
Release:    1%{?dist}
Summary:    Monitoring utility for unix systems

Group:      Applications/System
License:    GNU AFFERO GENERAL PUBLIC LICENSE version 3
URL:        https://mmonit.com/monit/
%undefine _disable_source_fetch
Source0:    https://mmonit.com/monit/dist/%name-%version.tar.gz
%define     SHA256SUM0 4b5c25ceb10825f1e5404f1d8a7b21507716b82bc20c3586f86603691c3b81bc

%define debug_package %nil

BuildRequires:  coreutils

%description
Monit is a small Open Source utility for managing and monitoring Unix systems. Monit conducts automatic maintenance
and repair and can execute meaningful causal actions in error situations.

%prep
echo "%SHA256SUM0  %SOURCE0" | sha256sum -c -
%setup -q

...

Credits

@YaroslavFedevych for undefine _disable_source_fetch.

Tint

I tried doing all of this, but I am still not getting RPM to download the tarball from the url. Instead, it tries to use the /usr/src/packages/SOURCES/%name-%version.tar.gz file. FYI I am using the 4.4.2.3 rpmbuild version – Magnet

I have just tested on another environment that has rpmbuild 4.12.0.1 and everything worked perfectly (even without the %undefine and %define lines). If it can help others, I found out that download of sources from url instead of using SOURCES/ has been introduced since 4.4.6 redhat.com/archives/rpm-list/2007-December/msg00003.html – Magnet

I found 4.11.3 does not honor the %undefine _disable_source_fetch directive. However, you can still use it on the command line as @Yaroslav mentioned. But @Tint kudos for the SHA checksum code... great idea even if the tarball is already in the SOURCES directory. – Mori

Note that there's a typo in the validation code: There must be two spaces between %SHA256SUM0 and %SOURCE0, not just one space. – Unification

@Unification Works for me, but I'll take your word for it that that's the case for you. Updated, thanks. – Tint

Answer 4

If you are getting sources from a (git) hosting service (github, etc..) there is support for automatically checking it out already built-in, when combined with _disable_source_fetch...

https://fedoraproject.org/wiki/Packaging:SourceURL

For example, for a specific githash from github:

%global commit 40-CHARACTER-HASH-VALUE
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Source0:  https://github.com/OWNER/PROJECT/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
...
%prep
%autosetup -n PROJECT-%{commit}

Emulsoid