-
Notifications
You must be signed in to change notification settings - Fork 277
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Meta] OpenSearch / OpenSearch Dashboards - Support for RPM distribution #27
Comments
Continuing a discussion over from the forums, I wanted to see if the RPMs will be signed with SHA256? (Suggestion: they should). See this open issue back at the elastic area: But there are others, I think including Logstash (I understand opensearch isn't distributing logstash or a logstash fork, atm) that suffer from this same problem. This prevents the use of the rpms / yum repo for install on Redhat / Centos 8 when the machine is in FIPS mode, which is quite important for a segment of the user population and not something that can be resolved by 'turning it off'. Without SHA256, the rpm's won't install and there is no way of overriding on the dnf/yum command. Can you comment as to whether you think that the RPM distros will include a SHA256 digest/signature on them? Thanks! |
NB the ways that Elasticsearch could be administered with init or systemd - let's be sure the OpenSearch RPM offers the same options. https://www.elastic.co/guide/en/elasticsearch/reference/current/starting-elasticsearch.html#start-rpm |
Fast forward work after this one complete is #849. |
How we previously create DEB/RPM for ODFE:
https://github.com/opendistro-for-elasticsearch/opendistro-build/tree/main/elasticsearch/linux_distributions New ways: We should invoke the process creating pkg in assemble workflows. As for APT/YUM repo, we use aptly and create repo, while using expect scripts to sign the whole repo, generate locally, then sync to the S3 bucket for access. @dblock please take a look I think we can start with single pkg 1st by invoking into assemble, then start from them per our discussion today. |
We have an assemble workflow (invoked by |
Understand majority of the code for assemble now and have an idea on how to implement it. A little bit more complicated to insert an rpm than I initially thought. |
It is probably better if we use setuptools to work on rpm creation, not fpm, as our code base for assemble are in python. |
Also need to add these for PA: https://github.com/opensearch-project/performance-analyzer/tree/main/packaging |
Able to automate the creation of rpm of OpenSearch now:
|
We switch back to fpm as it is still the most complete tool for package creation. |
Invoke fpm generation of rpm through assemble workflows
|
Any updates regarding OpenSearch DEB/RPM packages? |
Design document for RPM and the FAQ has been added to #1452. Feel free to comment on that issue as well. |
We will be tracking the distributions in a different road map (not tied to OpenSearch releases) - https://github.com/orgs/opensearch-project/projects/13 |
Does that mean we won't actually be seeing RPMs at the opensearch 1.3 release? |
@bbarani ^ |
New blocker: |
as i said in #28: Hello, please consider to generate not only debian/rpm binary packages, but also source packages (dsc,gz,sprm). This will for one ensure that your packaging quality will be better, it also would enhance the possibilities that your software would be included in standard repositories of systems like redhat, debian, ubuntu, suse as they will only include packages where the have the source version of. Please consider this. This would dramatically enhance your position as a project in the opensource community. |
Hi @deknos the code in this repo already allows you to build a opensearch bundle rpm directly. With above things available is a srpm still necessary? As far as I know our srpm is basically spec + binaries to be regenerate on another build env. Thanks. |
As you can see the spec file, our case is a bit different because we did not compile source in build section of spec file, we are running the code base of this repo to generate binaries, and use spec file to assemble into rpm. |
Well, actually the idea is that with the source package and the spec you can create a package for that platform. |
i just looked into the opensuse packaging, that will not work for some reasons right now. also if your srpm (or dsc for debian/ubuntu) only includes the binary it will not be picked up by the system repositories. they want to build the file from the source package (with the instructions in there to build the software) to generate the binary package from it. the advantage is: if you have at least done that, even with "design errors", maintainers from the distro will pick it up and include it potentially in their base distribution which would increase the chances massively that everyone will use opensearch. trust in opensource is built when you enable people with your software to be independent of you :) |
@deknos Happy to see other/alt distribution mechanisms build from source. I believe the ask for RPM here has been to distribute signed binaries that can be verified and trusted. Any reason why we can't have both? |
Closing this issue as we have shipped RPM artifacts with 2.0 RC1 and 1.3.2 version. Feel free to re-open if needed. |
It would be great to have RPM for opensearch-min (OpenSearch Minimum). I understand that it contains no security features and is designed to be used only when embedded with another solution or service. Exactly what I need. |
Is your feature request related to a problem? Please describe.
No
Describe the solution you'd like
Provide signed RPM artifact for OpenSearch / OpenSearch Dashboards
--distribution
to specify which distribution to build./assemble builds/manifests.yml --distribution rpm
to build rpm and get a rpm file in return for installation.Tasks based on the updated requirements in #1452
[Milestone 1] OpenSearch build process design for RPM generation
[Milestone 2] RPM Package Signing
[Milestone 3] RPM Package Design
[Milestone 4] RPM Package Publishing
[Milestone 5] RPM Package installation
[Milestone 6] RPM Validation
Describe alternatives you've considered
Generating the artifact using the source code
Additional context
Currently there are no RPM artifacts for OpenSearch / OpenSearch Dashboards
The text was updated successfully, but these errors were encountered: