Build / test under Fedora

CMakeLists.txt

@@ -347,6 +347,7 @@ option(ENABLE_MITRE "enables MITRE tests -- requires specific environment suppor
 # ---------- LANGUAGE BINDINGS
 cmake_dependent_option(ENABLE_PYTHON3 "if enabled, the python3 swig bindings will be built" ON "PYTHONINTERP_FOUND;SWIG_FOUND;PYTHONLIBS_FOUND" OFF)
 cmake_dependent_option(ENABLE_PERL "if enabled, the perl swig bindings will be built" ON "PERLLIBS_FOUND;SWIG_FOUND" OFF)
+option(ENABLE_ASAN "if enabled, the build using asan" FALSE)
 
 # ---------- NO IDEA WHAT THIS IS FOR
 set(WANT_BASE64 TRUE CACHE BOOL "wants builtin Base64")
@@ -535,6 +536,12 @@ if(APPLE)
 	add_definitions(-D_DARWIN_C_SOURCE)
 endif()
 
+if(ENABLE_ASAN)
+	add_compile_options(-fno-common -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=pointer-compare -fsanitize=pointer-subtract -fsanitize=undefined)
+	add_link_options(-fno-common -fno-omit-frame-pointer -fsanitize=address -static-libasan -fsanitize-address-use-after-scope -fsanitize=pointer-compare -fsanitize=pointer-subtract -fsanitize=undefined)
+endif()
+
+
 include_directories(
 	"compat/"
 	"src/"

openscap.spec

@@ -1,50 +1,96 @@
+# build with asan
+# - bindings/sce fail to work because of some asan linkage issues presumed
+%bcond_with asan
+
+# gconf is a legacy system not used any more, and it blocks testing of oscap-anaconda-addon
+# as gconf is no longer part of the installation medium
+%bcond_with gconf
+
+# By default do not build perl swig bindings
+%bcond_with perl
+
 # This spec file is not synchronized to the Fedora downstream.
 # It serves as Fedora CI configuration and as support for downstream updates.
 Name:           openscap
+Version:        1.3.6
 Release:        0%{?dist}
-Version:        1.3.0
 Epoch:          1
 Summary:        Set of open source libraries enabling integration of the SCAP line of standards
 License:        LGPLv2+
 URL:            http://www.open-scap.org/
 Source0:        https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
+Source1:        https://github.com/OpenSCAP/yaml-filter/archive/refs/tags/v0.2.0.tar.gz
 BuildRequires:  make
-BuildRequires:  cmake >= 2.6
+BuildRequires:  cmake >= 2.8
+BuildRequires:  ninja-build
+BuildRequires:  pkg-config
+BuildRequires:  systemd-rpm-macros
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
-BuildRequires:  swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
-BuildRequires:  rpm-devel
-BuildRequires:  libgcrypt-devel
-BuildRequires:  pcre-devel
-BuildRequires:  libacl-devel
-BuildRequires:  libselinux-devel
-BuildRequires:  libcap-devel
-BuildRequires:  libblkid-devel
-BuildRequires:  bzip2-devel
+%if %{with asan}
+BuildRequires:  libasan
+BuildRequires:  libasan-static
+BuildRequires:  libubsan
+%endif
+
+# Try to follow CMakeLists.txt order
+BuildRequires:  pkgconfig(libacl)
+BuildRequires:  pkgconfig(blkid)
+BuildRequires:  pkgconfig(libcap)
+BuildRequires:  pkgconfig(libcurl)
+BuildRequires:  pkgconfig(dbus-1)
+BuildRequires:  doxygen
+%if %{with gconf}
+BuildRequires:  pkgconfig(glib-2.0)
+BuildRequires:  pkgconfig(gobject-2.0)
+BuildRequires:  pkgconfig(gconf-2.0)
+%endif
+BuildRequires:  pkgconfig(ldap)
+BuildRequires:  pkgconfig(opendbx)
+BuildRequires:  pkgconfig(libpcre)
+%if %{with perl}
+BuildRequires:  perl-devel
+# BuildRequires:  perl-generators
+%endif
+BuildRequires:  pkgconfig(popt)
+BuildRequires:  pkgconfig(libsystemd)
+BuildRequires:  pkgconfig(libprocps)
+BuildRequires:  pkgconfig(python3)
+BuildRequires:  pkgconfig(rpm)
+BuildRequires:  pkgconfig(libselinux)
+BuildRequires:  swig
+BuildRequires:  pkgconfig(libxml-2.0)
+BuildRequires:  pkgconfig(libxslt)
+BuildRequires:  pkgconfig(xmlsec1)
+BuildRequires:  pkgconfig(xmlsec1-openssl)
+BuildRequires:  pkgconfig(openssl)
+BuildRequires:  pkgconfig(bzip2)
+BuildRequires:  pkgconfig(libgcrypt)
+BuildRequires:  pkgconfig(yaml-0.1)
 BuildRequires:  asciidoc
-BuildRequires:  openldap-devel
-BuildRequires:  glib2-devel
-BuildRequires:  dbus-devel
-BuildRequires:  libyaml-devel
-BuildRequires:  xmlsec1-devel xmlsec1-openssl-devel
+BuildRequires:  git
+BuildRequires:  sed
 BuildRequires:  systemd
-%if %{?_with_check:1}%{!?_with_check:0}
-BuildRequires:  perl-XML-XPath
+
+%if %{with check}
 BuildRequires:  bzip2
+BuildRequires:  chkconfig
+BuildRequires:  diffutils
+BuildRequires:  findutils
+BuildRequires:  gawk
+BuildRequires:  hostname
+BuildRequires:  ipcalc
+BuildRequires:  iproute
+BuildRequires:  libselinux-utils
+BuildRequires:  lua
+BuildRequires:  openssl
+BuildRequires:  perl(XML::Parser)
+BuildRequires:  perl(XML::XPath)
+BuildRequires:  procps
+BuildRequires:  rpm-build
+BuildRequires:  tar
+BuildRequires:  tcpdump
 %endif
-Requires:       bash
-Requires:       bzip2-libs
-Requires:       dbus
-Requires:       glib2
-Requires:       libacl
-Requires:       libblkid
-Requires:       libcap
-Requires:       libselinux
-Requires:       openldap
-Requires:       popt
-# Fedora has procps-ng, which provides procps
-Requires:       procps
-Requires:       xmlsec1 xmlsec1-openssl
 
 %description
 OpenSCAP is a set of open source libraries providing an easier path
@@ -55,9 +101,6 @@ for the expression of Computer Network Defense related information.
 %package        devel
 Summary:        Development files for %{name}
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Requires:       libxml2-devel
-Requires:       pkgconfig
-BuildRequires:  doxygen
 
 %description    devel
 The %{name}-devel package contains libraries and header files for
@@ -66,7 +109,6 @@ developing applications that use %{name}.
 %package        python3
 Summary:        Python 3 bindings for %{name}
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-BuildRequires:  python3-devel
 
 %description    python3
 The %{name}-python3 package contains the bindings so that %{name}
@@ -75,8 +117,6 @@ libraries can be used by python3.
 %package        scanner
 Summary:        OpenSCAP Scanner Tool (oscap)
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Requires:       libcurl >= 7.12.0
-BuildRequires:  libcurl-devel >= 7.12.0
 
 %description    scanner
 The %{name}-scanner package contains oscap command-line tool. The oscap
@@ -86,6 +126,7 @@ compliance checking using SCAP content.
 %package        utils
 Summary:        OpenSCAP Utilities
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+# These not probed from: scap-as-rpm
 Requires:       rpmdevtools rpm-build
 Requires:       %{name}-scanner%{?_isa} = %{epoch}:%{version}-%{release}
 
@@ -94,6 +135,7 @@ The %{name}-utils package contains command-line tools build on top
 of OpenSCAP library. Historically, openscap-utils included oscap
 tool which is now separated to %{name}-scanner sub-package.
 
+%if ! %{with asan}
 %package        engine-sce
 Summary:        Script Check Engine plug-in for OpenSCAP
 Requires:       %{name}%{?_isa} = %{epoch}:%{version}-%{release}
@@ -107,44 +149,62 @@ commands using a scripting language (Bash, Perl, Python, Ruby, ...).
 Summary:        Development files for %{name}-engine-sce
 Requires:       %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
 Requires:       %{name}-engine-sce%{?_isa} = %{epoch}:%{version}-%{release}
-Requires:       pkgconfig
 
 %description    engine-sce-devel
 The %{name}-engine-sce-devel package contains libraries and header files
 for developing applications that use %{name}-engine-sce.
+%endif
 
 %package        containers
 Summary:        Utils for scanning containers
 Requires:       %{name} = %{epoch}:%{version}-%{release}
-Requires:       %{name}-scanner
+Requires:       %{name}-scanner%{?_isa} = %{epoch}:%{version}-%{release}
 BuildArch:      noarch
 
 %description    containers
 Tool for scanning Atomic containers.
 
 %prep
 %autosetup -p1
+tar xvzf %{SOURCE1} --directory=yaml-filter --strip-components=1
 
 %build
 %undefine __cmake_in_source_build
-# gconf is a legacy system not used any more, and it blocks testing of oscap-anaconda-addon
-# as gconf is no longer part of the installation medium
-%cmake \
-    -DENABLE_PERL=OFF \
+%cmake -G Ninja \
     -DENABLE_DOCS=ON \
+%if %{with asan}
+    -DENABLE_ASAN=TRUE \
+    -DENABLE_PERL=OFF \
+    -DENABLE_PYTHON=OFF \
+    -DENABLE_SCE=OFF \
+%endif
+%if ! %{with gconf}
     -DOPENSCAP_PROBE_UNIX_GCONF=OFF \
-    -DGCONF_LIBRARY=
+    -DGCONF_LIBRARY= \
+%endif
+%if ! %{with perl}
+    -DENABLE_PERL=OFF \
+%endif
+
 %cmake_build
 make docs
 
 %check
-%if %{?_with_check:1}%{!?_with_check:0}
-ctest -V %{?_smp_mflags}
+%if %{with check}
+# Tests use common files. Running tests parallel causes failed tests because of that.
+%undefine _smp_mflags
+%if %{with asan}
+# https://github.com/google/sanitizers/wiki/AddressSanitizer
+# - but do not detect leaks, program is not long running, also numerous leaks so fix these completely would require some effort
+export ASAN_OPTIONS=detect_leaks=0:strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:detect_invalid_pointer_pairs=2
+%endif
+%ctest
 %endif
 
 %install
 %cmake_install
 
+%if "0%{?!fedora:1}"
 find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
 # fix python shebangs
@@ -157,6 +217,7 @@ pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
 # https://bugzilla.redhat.com/show_bug.cgi?id=1833176
 mkdir -p %{buildroot}%{_unitdir}/system-update.target.wants/
 ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.wants/oscap-remediate.service
+%endif
 
 %files
 %doc AUTHORS NEWS README.md
@@ -179,40 +240,51 @@ ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.w
 %{_libdir}/libopenscap.so
 %{_libdir}/pkgconfig/*.pc
 %{_includedir}/openscap
+%if ! %{with asan}
 %exclude %{_includedir}/openscap/sce_engine_api.h
-
-%files engine-sce-devel
-%{_libdir}/libopenscap_sce.so
-%{_includedir}/openscap/sce_engine_api.h
+%endif
 
 %files scanner
-%{_mandir}/man8/oscap.8*
 %{_bindir}/oscap
 %{_bindir}/oscap-chroot
+%{_mandir}/man8/oscap.8*
+%{_mandir}/man8/oscap-chroot.8*
 %{_sysconfdir}/bash_completion.d
 %{_libexecdir}/oscap-remediate
 %{_unitdir}/oscap-remediate.service
+%if "0%{?!fedora:1}"
 %{_unitdir}/system-update.target.wants/
+%endif
 
 %files utils
 %doc docs/oscap-scan.cron
-%{_mandir}/man8/*
-%exclude %{_mandir}/man8/oscap.8*
-%exclude %{_mandir}/man8/oscap-docker.8*
-%{_bindir}/*
-%exclude %{_bindir}/oscap
-%exclude %{_bindir}/oscap-docker
-%exclude %{_bindir}/oscap-chroot
-
+%{_bindir}/autotailor
+%{_bindir}/oscap-remediate-offline
+%{_bindir}/oscap-ssh
+%{_bindir}/oscap-vm
+%{_bindir}/scap-as-rpm
+%{_mandir}/man8/autotailor.8*
+%{_mandir}/man8/oscap-remediate-offline.8*
+%{_mandir}/man8/oscap-ssh.8*
+%{_mandir}/man8/oscap-vm.8*
+%{_mandir}/man8/scap-as-rpm.8*
+
+%if ! %{with asan}
 %files engine-sce
+%{_bindir}/oscap-run-sce-script
 %{_libdir}/libopenscap_sce.so.*
 
+%files engine-sce-devel
+%{_libdir}/libopenscap_sce.so
+%{_includedir}/openscap/sce_engine_api.h
+%endif
+
 %files containers
 %{_bindir}/oscap-docker
 %{_mandir}/man8/oscap-docker.8*
-%{python3_sitelib}/oscap_docker_python/*
 %{_bindir}/oscap-podman
 %{_mandir}/man8/oscap-podman.8*
+%{python3_sitelib}/oscap_docker_python/*
 
 %changelog
 %autochangelog

utils/CMakeLists.txt

@@ -1,6 +1,8 @@
-install(PROGRAMS "oscap-run-sce-script"
-	DESTINATION ${CMAKE_INSTALL_BINDIR}
-)
+if(ENABLE_SCE)
+	install(PROGRAMS "oscap-run-sce-script"
+		DESTINATION ${CMAKE_INSTALL_BINDIR}
+	)
+endif()
 
 if(ENABLE_OSCAP_UTIL)
 	file(GLOB UTILS_SOURCES "*.c")