Fix lintian and rpmlint findings in built packages

.github/workflows/package.yml

@@ -36,6 +36,14 @@ jobs:
           docker pull ghcr.io/${{ github.repository_owner }}/fpm:latest
           docker tag ghcr.io/${{ github.repository_owner }}/fpm:latest fpm
 
+      - name: Render changelogs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api --paginate 'repos/${{ github.repository_owner }}/relay/releases?per_page=100' \
+            | jq -s 'add' > /tmp/releases.json
+          ./build/changelog.sh /tmp/releases.json '${{ github.event.inputs.tag }}' build/changelog
+
       - name: Bundle packages
         run: |
           cd build

.gitignore

@@ -1,4 +1,4 @@
 /build/dist
-/build/src/deb/*-php*
-/build/src/rpm/*-php*
+/build/src/*/*-php*
+/build/changelog/
 key-private.asc

build/changelog.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+
+# Renders changelogs from the relay GitHub releases feed.
+#
+#   changelog.sh <releases.json> <version> <out_dir>
+#
+# Writes deb.tpl (@PKG@ is substituted per package by fpm_build), rpm and
+# epoch into <out_dir>.
+
+set -euo pipefail
+
+releases=$1
+version=${2#v}
+out=$3
+
+mkdir -p "$out"
+
+maintainer="Relay Team <hello@cachewerk.com>"
+
+# release notes routinely exceed lintian's 80 column limit
+wrap_bullets()
+{
+  awk -v prefix="$1" -v cont="$2" -v max=76 '
+    index($0, prefix) != 1 { print; next }
+    {
+      text = substr($0, length(prefix) + 1)
+      n = split(text, w, " ")
+      line = prefix w[1]
+      for (i = 2; i <= n; i++) {
+        if (length(line) + 1 + length(w[i]) > max) { print line; line = cont w[i] }
+        else line = line " " w[i]
+      }
+      print line
+    }'
+}
+
+# the topmost entry has to match the version being packaged
+if ! jq -e --arg v "$version" 'any(.[]; (.draft | not) and (.tag_name | ltrimstr("v")) == $v)' \
+     "$releases" > /dev/null; then
+  echo "No published release found for $version" >&2
+  exit 1
+fi
+
+# newest first, without drafts or anything above the version being built
+filtered=$(jq --arg v "$version" '
+  map(select(.draft | not))
+  | sort_by(.published_at)
+  | reverse
+  | map(. + {ver: (.tag_name | ltrimstr("v"))})
+  | (map(.ver) | index($v)) as $i
+  | .[$i:]
+' "$releases")
+
+# bullet lines only, headings dropped
+bullets='
+  (.body // "")
+  | gsub("\r"; "")
+  | split("\n")
+  | map(select(test("^\\s*[-*]\\s+\\S")))
+  | map(sub("^\\s*[-*]\\s+"; ""))
+  | map(gsub("\\s+$"; ""))
+'
+
+echo "$filtered" | jq -r --arg m "$maintainer" "
+  .[]
+  | ($bullets) as \$b
+  | (if (\$b | length) == 0 then [\"Relay \" + .ver] else \$b end) as \$b
+  | \"@PKG@ (\" + .ver + \") unstable; urgency=medium\n\n\"
+    + (\$b | map(\"  * \" + .) | join(\"\n\"))
+    + \"\n\n -- \" + \$m + \"  \"
+    + (.published_at | fromdateiso8601 | strftime(\"%a, %d %b %Y %H:%M:%S +0000\"))
+    + \"\n\"
+" | wrap_bullets "  * " "    " > "$out/deb.tpl"
+
+echo "$filtered" | jq -r --arg m "$maintainer" "
+  .[]
+  | ($bullets) as \$b
+  | (if (\$b | length) == 0 then [\"Relay \" + .ver] else \$b end) as \$b
+  | \"* \" + (.published_at | fromdateiso8601 | strftime(\"%a %b %d %Y\"))
+    + \" \" + \$m + \" - \" + .ver + \"-1\n\"
+    + (\$b | map(\"- \" + .) | join(\"\n\"))
+    + \"\n\"
+" | wrap_bullets "- " "  " > "$out/rpm"
+
+# the source date epoch must not be newer than the newest changelog entry
+echo "$filtered" | jq -r '.[0].published_at | fromdateiso8601' > "$out/epoch"
+
+echo "Wrote $(grep -c '^@PKG@' "$out/deb.tpl") deb entries, $(grep -c '^\* ' "$out/rpm") rpm entries"

build/helpers.sh

@@ -1,4 +1,12 @@
 
+# must not be named pkg_*, main() unsets those before every build
+read -r -d '' relay_description <<'DESCRIPTION' || true
+Fastest Redis client for PHP
+100x faster cache reads, near-zero bandwidth, no code changes required.
+Relay keeps a partial replica of the Redis or Valkey data set inside the
+PHP process, avoiding network round trips.
+DESCRIPTION
+
 main()
 {
   rm -rf /tmp/relay*
@@ -57,16 +65,50 @@ fpm_build()
     cp $src_path/relay.ini $dest_path/$config_file
   done
 
+  mkdir -p $dest_path/usr/share/doc/$pkg_name
+  {
+    echo "Copyright (C) 2021-$(date -u -d @$(cat /root/build/changelog/epoch) +%Y) CacheWerk, Inc."
+    echo "All rights reserved."
+    echo
+    echo "Relay is proprietary software, licensed under the End-User License"
+    echo "Agreement reproduced below."
+    echo
+    cat $src_path/LICENSE
+
+    # only the -pkg builds statically link these
+    if [[ "$pkg_binary" == *-pkg* ]]; then
+      for bundled in hiredis ck; do
+        echo
+        echo "------------------------------------------------------------------------------"
+        echo
+        echo "This build statically links $bundled, distributed under the following terms:"
+        echo
+        cat /root/build/licenses/$bundled.txt
+      done
+
+      # ck's notice for src/ck_hp.c is Apache-2.0, which must reference the shipped copy
+      echo
+      echo "On Debian systems the complete text of the Apache License, Version 2.0"
+      echo "can be found in /usr/share/common-licenses/Apache-2.0."
+    fi
+  } > $dest_path/usr/share/doc/$pkg_name/copyright
+
+  if [[ "$type" == "deb" && ${#pkg_lintian_overrides[@]} -gt 0 ]]; then
+    mkdir -p $dest_path/usr/share/lintian/overrides
+    for tag in "${pkg_lintian_overrides[@]}"; do
+      echo "$pkg_name binary: $tag"
+    done > $dest_path/usr/share/lintian/overrides/$pkg_name
+  fi
+
   pkg_version=${version#v}
   pkg_filename="${pkg_name}-${pkg_version}-php${php_version}-${pkg_identifier}-${pkg_arch}.${type}"
 
   args=(
     "--input-type dir"
     "--output-type $type"
 
-    "--vendor 'CacheWerk, Inc.'"
     "--maintainer 'Relay Team <hello@cachewerk.com>'"
-    "--description 'The next-generation caching layer for PHP.'"
+    "--description '$relay_description'"
     "--url 'https://relay.so'"
     "--license 'Proprietary'"
     "--category 'php'"
@@ -75,7 +117,7 @@ fpm_build()
     "--architecture $pkg_arch"
 
     "--package dist/$pkg_filename"
-    "--source-date-epoch-default $(stat -c %Y $src_path/relay.so)"
+    "--source-date-epoch-default $(cat /root/build/changelog/epoch)"
 
     "--template-value binary_paths='$pkg_binary_dest'"
     "--template-value php_version='$php_version'"
@@ -84,6 +126,22 @@ fpm_build()
     "--deb-no-default-config-files"
   )
 
+  # deb has no Vendor field; an empty value omits it. Don't do the same for
+  # --license, fpm emits that line unconditionally and it'd end up empty.
+  if [[ "$type" == "rpm" ]]; then
+    args+=("--vendor 'CacheWerk, Inc.'")
+  else
+    args+=("--vendor ''")
+  fi
+
+  # deb changelog entries embed the package name, rpm ones don't
+  if [[ "$type" == "deb" ]]; then
+    sed "s/@PKG@/$pkg_name/g" /root/build/changelog/deb.tpl > /tmp/changelog-$pkg_name.deb
+    args+=("--deb-changelog /tmp/changelog-$pkg_name.deb")
+  else
+    args+=("--rpm-changelog /root/build/changelog/rpm")
+  fi
+
   if [ ! -z "$pkg_provides" ]; then
     args+=("--provides '$pkg_provides'")
   fi

build/licenses/ck.txt

@@ -0,0 +1,54 @@
+Copyright 2010-2014 Samy Al Bahra.
+Copyright 2011-2013 AppNexus, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+Hazard Pointers (src/ck_hp.c) also includes this license:
+
+(c) Copyright 2008, IBM Corporation.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+ck_pr_rtm leverages work from Andi Kleen:
+Copyright (c) 2012,2013 Intel Corporation
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that: (1) source code distributions
+retain the above copyright notice and this paragraph in its entirety, (2)
+distributions including binary code include the above copyright notice and
+this paragraph in its entirety in the documentation or other materials
+provided with the distribution
+
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+

build/licenses/hiredis.txt

@@ -0,0 +1,29 @@
+Copyright (c) 2009-2011, Salvatore Sanfilippo <antirez at gmail dot com>
+Copyright (c) 2010-2011, Pieter Noordhuis <pcnoordhuis at gmail dot com>
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice,
+  this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of Redis nor the names of its contributors may be used
+  to endorse or promote products derived from this software without specific
+  prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

build/src/deb/after-remove-multi.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -e
+
+# Undoes after-install-multi.sh. Failures are tolerated throughout: the PHP
+# tooling may already be gone, and nothing here may block the removal.
+
+if [ "$1" = "remove" ]; then
+  if [ -e /usr/lib/php/php-maintscript-helper ]; then
+    . /usr/lib/php/php-maintscript-helper
+    php_invoke dismod "<%= php_version %>" ALL relay || true
+  elif command -v phpdismod > /dev/null; then
+    phpdismod -v "<%= php_version %>" relay || true
+  fi
+fi
+
+# dpkg owns the conffile, but not the symlinks phpenmod created
+if [ "$1" = "purge" ]; then
+  find "/etc/php/<%= php_version %>" -type l 2>/dev/null | while read -r symlink; do
+    if [ "$(basename "$(readlink -m "${symlink}")")" = "relay.ini" ]; then
+      rm -f "${symlink}"
+    fi
+  done
+fi
+
+exit 0

build/src/deb/config.base.sh

@@ -24,4 +24,5 @@ pkg_depends=(
 fpm_args=(
   "--deb-pre-depends 'php-common'"
   "--after-install /root/build/src/deb/after-install.sh"
+  "--description $'Relay metapackage for PHP $php_version\nThis dependency metapackage pulls in the Relay extension for PHP\n$php_version.'"
 )

build/src/deb/config.ls.sh

@@ -20,8 +20,6 @@ pkg_config_dest=(
 
 pkg_depends=(
     "libc6 >= 2.17"
-    "liblz4-1 >= 0.0~r130"
-    "libzstd1 >= 1.3.2"
     "lsphp$php_version_short-common"
     "lsphp$php_version_short-igbinary"
     "lsphp$php_version_short-msgpack"
@@ -32,6 +30,19 @@ pkg_depends=(
   "libck0 >= 0.7.0"
 )
 
+# LiteSpeed keeps its bundled PHP under /usr/local, and the ini must stay a
+# conffile there or user settings are lost on upgrade
+pkg_lintian_overrides=(
+  "dir-in-usr-local"
+  "file-in-usr-local"
+  "file-in-unusual-dir"
+  "file-in-usr-marked-as-conffile"
+  "non-etc-file-marked-as-conffile"
+)
+
 fpm_args=(
+  # dlopen'd at startup since Relay v0.40.0, not linked
+  "--deb-recommends 'liblz4-1 (>= 0.0~r130)'"
+  "--deb-recommends 'libzstd1 (>= 1.3.2)'"
   "--after-install /root/build/src/deb/after-install.sh"
 )

build/src/deb/config.multi.sh

@@ -21,8 +21,6 @@ pkg_config_dest=(
 
 pkg_depends=(
     "libc6 >= 2.17"
-    "liblz4-1 >= 0.0~r130"
-    "libzstd1 >= 1.3.2"
     "php$php_version-common"
     "php$php_version-igbinary"
     "php$php_version-msgpack"
@@ -34,8 +32,12 @@ pkg_depends=(
 )
 
 fpm_args=(
+  # dlopen'd at startup since Relay v0.40.0, not linked
+  "--deb-recommends 'liblz4-1 (>= 0.0~r130)'"
+  "--deb-recommends 'libzstd1 (>= 1.3.2)'"
   "--replaces 'php-relay << ${version#v}'"
   "--deb-pre-depends 'php-common'"
   "--deb-field 'Source: php-relay'"
   "--after-install /root/build/src/deb/after-install-multi.sh"
+  "--after-remove /root/build/src/deb/after-remove-multi.sh"
 )

build/src/rpm/config.ls.el7.sh

@@ -1,7 +1,6 @@
 #!/bin/bash
 
 pkg_name="lsphp$php_version_short-relay"
-pkg_provides="lsphp$php_version_short-relay"
 pkg_binary="relay-pkg.so"
 pkg_identifier="el7"