Hash: SHA256

On RedHat based systems

To build a RPM, you need to prepare your system with packages, libraries a specific configuration file and optionally a way to sign created packets. We’re going through all these as quickly as possible.

Installing prerequisites

Building packets doesn’t require you any specific rights - just a plain user account. In fact, it’s really really a good idea to build packets under an unprivileged user as you won’t be able to do any damage on the system itself if you’re doing something wrong.

TL;DR; : don’t use root to build packages ! NEVER !

Installing prerequisites

In order to be ready to build a package, your system needs to have some packages and libraries installed. We are going to install the most common ones; if your package requires one, just install it. (This should be done as root)

Note: We are going to install a lot of packages containing scripts and pieces coming providing help for setuping and maintaining build environments from the sister distribution, Fedora.

yum install glibc rpmbuild rpmdevtools yum-utils make
yum groupinstall "Fedora Packager" #Contains a bunch of scripts and tools

Creating a GPG key

Note: This step is optional, if you don’t want having your packets signed, then just skip this part.

What we are going to do here, is create a GPG private/public key pair in order to sign your packets. The interrest of this is that there is a guarantee for the people that are usually installing your packets that the packet hasn’t been modified, otherwise a GPG error would just pop up. Doing this is pretty straight as it’s just firing one command.

gpg --gen-key
=>	gpg (GnuPG) 2.0.14; Copyright (C) 2009 Free Software Foundation, Inc.
	This is free software: you are free to change and redistribute it.
	There is NO WARRANTY, to the extent permitted by law.

	gpg: répertoire `/home/bkraft/.gnupg' créé
	gpg:  nouveau fichier de configuration `/home/bkraft/.gnupg/gpg.conf' créé
	gpg: AVERTISSEMENT: les options de `/home/bkraft/.gnupg/gpg.conf' ne sont pas encore actives cette fois
	gpg: le porte-clés `/home/bkraft/.gnupg/secring.gpg` a été créé
	gpg: le porte-clés `/home/bkraft/.gnupg/pubring.gpg` a été créé
	Sélectionnez le type de clé désiré:
	   (1) RSA and RSA (default) # This is what we are going to pick
	   (2) DSA and Elgamal
	   (3) DSA (signature seule)
	   (4) RSA (signature seule)
	Votre choix ? 1
	les clés RSA peuvent faire entre 1024 et 4096 bits de longueur.
	Quelle taille de clé désirez-vous ? (2048) 4096 # Make it big
	La taille demandée est 4096 bits
	Spécifiez combien de temps cette clé devrait être valide.
	         0 = la clé n'expire pas
	      <n>  = la clé expire dans n jours
	      <n>w = la clé expire dans n semaines
	      <n>m = la clé expire dans n mois
	      <n>y = la clé expire dans n années
	La clé est valide pour ? (0) # Make it never expires ... don't do this.
	La clé n'expire pas du tout
	Est-ce correct ? (o/N) o

	You need a user ID to identify your key; the software constructs the user ID
	from the Real Name, Comment and Email Address in this form:
	    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

	Nom réel: Benjamin KRAFT
	Adresse e-mail: benj@bkraft.fr
	Commentaire: RPM build purposes
	Vous avez sélectionné ce nom d'utilisateur:
	    "Benjamin KRAFT (RPM build purposes) <benj@bkraft.fr>"

	Changer le (N)om, le (C)ommentaire, l'(E)-mail ou (O)K/(Q)uitter ? O
	Vous avez besoin d'une phrase de passe pour protéger votre clé

	can't connect to `/home/bkraft/.gnupg/S.gpg-agent': Aucun fichier ou dossier de ce type
	gpg-agent[21736]: répertoire `/home/bkraft/.gnupg/private-keys-v1.d' créé
	Un grand nombre d'octets aléatoires doit être généré. Vous devriez faire
	autre-chose (taper au clavier, déplacer la souris, utiliser les disques)
	pendant la génération de nombres premiers; cela donne au générateur de
	nombres aléatoires une meilleure chance d'avoir assez d'entropie.
	gpg: /home/bkraft/.gnupg/trustdb.gpg: base de confiance créée
	gpg: clé 7AC6E47B marquée comme ayant une confiance ultime.
	les clés publique et secrète ont été créées et signées.

	gpg: vérifier la base de confiance
	gpg: 3 marginale(s) nécessaires, 1 complète(s) nécessaires, modèle
	de confiance PGP
	gpg: profondeur: 0  valide:   1  signé:   0
	confiance: 0-. 0g. 0n. 0m. 0f. 1u
	pub   4096R/7AC6E47B 2012-02-04
	    Empreinte de la clé = 38E9 4639 75BD 4715 55DD  28E5 178A 4B6C 7AC6 E47B
	uid                  Benjamin KRAFT (RPM build purposes) <benj@bkraft.fr>
	sub   4096R/379A3BD3 2012-02-04
Note regarding entropy

Entropy on a virtual machine like on the one I did this HOWTO was really low and I was stuck with GnuPG waiting for more of it. Here is what I used as a solution to get it finished :

Well, it seems that it really wasn’t the best solution available, as said @digdns responded :


We’ll use what we did in a further module, but you should already do the two following things :

# Export your public key to let systems recognize your signature
gpg --export --armor >RPM-GPG-KEY-benjaminkraft
# Import it in your own system
rpm --import /home/bkraft/RPM-GPG-KEY-benjaminkraft

Setting up the environment

Fire up the appropriate command that will create eveything that is necessary for your build environment

rpmdev-setuptree # Yeah. that's it.
ls -l 
=>	drwxrwxr-x 7 bkraft bkraft 4096  4 févr. 09:07 rpmbuild
ls -l rpmbuild/
total 20
=>	drwxrwxr-x 2 bkraft bkraft 4096  4 févr. 09:07 BUILD
	drwxrwxr-x 2 bkraft bkraft 4096  4 févr. 09:07 RPMS
	drwxrwxr-x 2 bkraft bkraft 4096  4 févr. 09:07 SOURCES
	drwxrwxr-x 2 bkraft bkraft 4096  4 févr. 09:07 SPECS
	drwxrwxr-x 2 bkraft bkraft 4096  4 févr. 09:07 SRPMS
cat .rpmmacros 
=>	%_topdir      %(echo $HOME)/rpmbuild
	%_smp_mflags  -j3
	%__arch_install_post   /usr/lib/rpm/check-rpaths   /usr/lib/rpm/check-buildroot

Now, add the GnuPG related stuff in order to sign your packages :

	%_topdir      %(echo $HOME)/rpmbuild
	%_smp_mflags  -j3
	%__arch_install_post   /usr/lib/rpm/check-rpaths   /usr/lib/rpm/check-buildroot
	%_signature             gpg
	%_gpg_name              Benjamin KRAFT
	%_gpg_path              %(echo $HOME)/.gnupg


Now that you’re ready, here is some common things that you’ll like to do:

# Fedora has more recent packets than CentOS, that's a fact.
# Sometimes, I do backport a package from there to here, by downloading
# a package in src.rpm format and just rebuild it.

# This can be done on one single command line to simply build it
rpmbuild --rebuild package.src.rpm

# Or, install the src.rpm (as the building user), modify the spec, and build
rpm -ivh package.src.rpm
vim rpmbuild/SPEC/package.spec
rpmbuild -bb /rpmbuild/SPEC/package.spec

# Add a GnuPG signature on the created packet
rpmsign --addsign package.el6.noarch.rpm

# Check a GnuPG signature
rpmsign --checksig rpmbuild/RPMS/noarch/package.el6.noarch.rpm 
=>	rpmbuild/RPMS/noarch/package.el6.noarch.rpm: rsa sha1 (md5) pgp md5 OK
Comment: GPGTools - http://gpgtools.org


Hint: To validate signature, please view page source and copy html code between BEGIN PGP Signed message and END PGP Signature anchors.

Created the 2012-02-13

Share this

Article content


10 last blog posts

Related to this article

blog comments powered by Disqus