Config packaging with nfpm

[kgaughan]

This is the final configuration and scripts from this blogpost:

https://keith.gaughan.ie/creating-a-signed-rpm-with-nfpm-and-gnupg.html

Summary by Sourcery

Add packaging configuration and script to build a signed RPM using nfpm.

Build:

• Introduce nfpm.yaml to define RPM package metadata, contents, and signing key configuration.
• Add package.sh helper script to generate versioned, reproducible RPMs via nfpm with optional passphrase prompting.

[sourcery-ai]

Reviewer's Guide

Adds an nfpm-based RPM packaging workflow, including a packaging script and nfpm configuration for the socketmap-sql Python script, with GPG signing support and versioning derived from git metadata.

Sequence diagram for nfpm-based RPM packaging workflow

sequenceDiagram
  actor Maintainer
  participant package_sh
  participant Git
  participant nfpm
  participant GPG

  Maintainer->>package_sh: ./package.sh [-P]
  alt passphrase_prompt_requested
    package_sh->>package_sh: [NFPM_PASSPHRASE is empty]
    package_sh->>Maintainer: read passphrase
    Maintainer-->>package_sh: NFPM_PASSPHRASE
    package_sh->>package_sh: export NFPM_PASSPHRASE
  end

  package_sh->>Git: git describe --tags --abbrev=0
  Git-->>package_sh: VERSION
  package_sh->>Git: git log -1 --pretty=%ct
  Git-->>package_sh: SOURCE_DATE_EPOCH
  package_sh->>package_sh: export VERSION, SOURCE_DATE_EPOCH

  package_sh->>nfpm: nfpm package --packager rpm
  nfpm->>nfpm: read nfpm.yaml
  nfpm->>GPG: use signing.gpg to sign RPM
  GPG-->>nfpm: signature
  nfpm-->>Maintainer: signed RPM package

Loading

File-Level Changes

Change	Details	Files
Introduce a shell script to build signed RPM packages using nfpm.	Add CLI handling with -h help and -P optional passphrase prompt Implement interactive passphrase capture into NFPM_PASSPHRASE when requested Export VERSION from latest git tag with a fallback default Export SOURCE_DATE_EPOCH from the timestamp of the latest git commit Invoke nfpm to build an RPM package using the configured packager	package.sh
Add nfpm configuration for building the socketmap-sql RPM package.	Define package metadata including name, architecture, dependencies, maintainer, description, homepage, and license Configure version reference to the VERSION environment variable Specify contents mapping socketmapsql.py into /usr/libexec/socketmap-sql with executable permissions Configure RPM signature to use signing.gpg as the key file	nfpm.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 2 issues, and left some high level feedback:

• In package.sh, read -p is a bashism and test ... -a ... is non‑portable; consider using POSIX‑compliant constructs (e.g. printf before read and [ with && in the conditional) to ensure the script works with /bin/sh on more systems.
• The usage function currently always writes to stdout; for error cases (e.g. the * branch in getopts), it would be clearer to direct the usage text to stderr instead of using usage 2>&1.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `package.sh`, `read -p` is a bashism and `test ... -a ...` is non‑portable; consider using POSIX‑compliant constructs (e.g. `printf` before `read` and `[` with `&&` in the conditional) to ensure the script works with `/bin/sh` on more systems.
- The `usage` function currently always writes to stdout; for error cases (e.g. the `*` branch in `getopts`), it would be clearer to direct the usage text to stderr instead of using `usage 2>&1`.

## Individual Comments

### Comment 1
<location path="package.sh" line_range="35-37" />
<code_context>
+done
+
+if test "${prompt:-}" = "1" -a -z "${NFPM_PASSPHRASE:-}"; then
+	stty -echo
+	read -p "passphrase> " NFPM_PASSPHRASE
+	stty echo
+	echo
+	export NFPM_PASSPHRASE
</code_context>
<issue_to_address>
**issue (bug_risk):** Echo may remain disabled if the script is interrupted while prompting.

If the script is interrupted (e.g., Ctrl-C) between `stty -echo` and `stty echo`, the terminal can be left with echo disabled. Consider saving and restoring the original tty state with a trap, e.g.:

```sh
orig_stty=$(stty -g)
trap 'stty "$orig_stty"' INT TERM EXIT
stty -echo
read -p "passphrase> " NFPM_PASSPHRASE
stty "$orig_stty"
trap - INT TERM EXIT
```

This ensures the terminal is restored even on errors or interrupts.
</issue_to_address>

### Comment 2
<location path="nfpm.yaml" line_range="3" />
<code_context>
+name: socketmap-sql
+arch: all
+version: $VERSION
+depends:
+  - python3
</code_context>
<issue_to_address>
**issue (bug_risk):** Environment variable interpolation syntax may not match nfpm’s templating expectations.

Using `version: $VERSION` only works if nfpm is run through a shell that expands env vars first; nfpm itself usually expects Go-style templates (e.g. `{{ .Env.VERSION }}`). Please confirm nfpm’s config syntax and switch to the supported mechanism so the version is actually read from the environment rather than ending up as the literal `$VERSION`.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}