Contributing RPM packaging and SELinux module

[veitw]

Hi @uunicorn,

I'd like to contribute the necessary bits to allow RPM packaging and usage on SELinux enabled systems for both python-validity and open-fprintd. Please see my pull requests #53 and uunicorn/open-fprintd#7.

The specfiles have been created close to the RedHat guidelines and tested on Fedora 33. I expect them to work on EL8 (RHEL 8, CentOS 8), too. Other RPM based distros such as openSUSE might need tweaking.

However the python-validity specfile uses a post install scriptlet derived from your Debian scripts, to make them as close as possible. But I expect this to prevent the package to be accepted into the distros, as I think automatically downloading and flashing firmware on package installation conflicts with RedHat's/Fedora's packaging rules.

For fprintd-clients, I decided to NOT use your fork of fprintd, but to use Fedora's fprintd package as template and only rename the package and to simply not package the daemon files. The result, fprintd-clients.spec, along with a patch file to the original fprintd package's fprintd.spec, has been attached: fprintd-clients.zip

Best regards,
// Veit

[veitw]

For those who want to try this using the current releases, here are RPMs for Fedora 33 x86_64 and of course the corresponding SRPMs to build yourself for other distros/releases:

• rpms-python-validity.zip
• rpms-open-fprintd.zip
• rpms-fprintd-clients.zip

Installation instructions for Fedora 33:

1. Extract the RPMs from the archives above.
2. Install the packages: sudo dnf install python3-validity-0.12-1.fc33.noarch.rpm open-fprintd-0.6-1.fc33.noarch.rpm fprintd-clients-1.90.1-2.fc33.x86_64.rpm fprintd-clients-pam-1.90.1-2.fc33.x86_64.rpm
3. Enable and start the service: systemctl enable python3-validity.service; systemctl start python3-validity.service
4. Profit!

Starting the service should suffice, but maybe better reboot.

[RaghavRao]

Amazing work, thank you @veitw

[uunicorn]

But I expect this to prevent the package to be accepted into the distros, as I think automatically downloading and flashing firmware on package installation conflicts with RedHat's/Fedora's packaging rules

Yes, I'm not sure that was a very good idea myself. There may not be any real hardware when you install the package, so it is not clear which firmware to download. It is also downloading a piece of software with it's own license without a user's explicit permission.

[rodgersan]

For those who want to try this using the current releases, here are RPMs for Fedora 33 x86_64 and of course the corresponding SRPMs to build yourself for other distros/releases:

* [rpms-python-validity.zip](https://github.com/uunicorn/python-validity/files/5539808/rpms-python-validity.zip)

* [rpms-open-fprintd.zip](https://github.com/uunicorn/python-validity/files/5539809/rpms-open-fprintd.zip)

* [rpms-fprintd-clients.zip](https://github.com/uunicorn/python-validity/files/5539811/rpms-fprintd-clients.zip)

Installation instructions for Fedora 33:

1. Extract the RPMs from the archives above.

2. Install the packages: `sudo dnf install python3-validity-0.12-1.fc33.noarch.rpm open-fprintd-0.6-1.fc33.noarch.rpm fprintd-clients-1.90.1-2.fc33.x86_64.rpm fprintd-clients-pam-1.90.1-2.fc33.x86_64.rpm`

3. Enable and start the service: `systemctl enable python3-validity.service; systemctl start python3-validity.service`

4. Profit!

Starting the service should suffice, but maybe better reboot.

You might want to have a look at the RPM packages provided in issue #54.

Thanks for packaging it for Fedora 33! However I am getting almost the same error as @alexjfinch in issue #42 using your RPMs and instructions:

● python3-validity.service - python-validity driver dbus service
Loaded: loaded (/usr/lib/systemd/system/python3-validity.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Sun 2020-11-15 00:08:44 CET; 1s ago
Process: 5293 ExecStart=/usr/lib/python-validity/dbus-service --debug (code=exited, status=1/FAILURE)
Main PID: 5293 (code=exited, status=1/FAILURE)
CPU: 158ms

nov 15 00:08:44 fedora-t470 dbus-service[5293]: Traceback (most recent call last):
nov 15 00:08:44 fedora-t470 dbus-service[5293]: File "/usr/lib/python-validity/dbus-service", line 307, in
nov 15 00:08:44 fedora-t470 dbus-service[5293]: main()
nov 15 00:08:44 fedora-t470 dbus-service[5293]: File "/usr/lib/python-validity/dbus-service", line 260, in main
nov 15 00:08:44 fedora-t470 dbus-service[5293]: backoff()
nov 15 00:08:44 fedora-t470 dbus-service[5293]: File "/usr/lib/python-validity/dbus-service", line 214, in backoff
nov 15 00:08:44 fedora-t470 dbus-service[5293]: with open(backoff_file, 'w') as f:
nov 15 00:08:44 fedora-t470 dbus-service[5293]: PermissionError: [Errno 13] Permission denied: '/usr/share/python-validity/backoff'
nov 15 00:08:44 fedora-t470 systemd[1]: python3-validity.service: Main process exited, code=exited, status=1/FAILURE
nov 15 00:08:44 fedora-t470 systemd[1]: python3-validity.service: Failed with result 'exit-code'.

Any ideas?

[bwiercinski]

@rodgersan you can try to sudo mkdir /usr/share/python-validity and start again, but in my case other errors appeared.

@veitw why these packages requires python3.9? any ideas to fix that? sudo dnf install python3.9 didn't worked

Error: 
 Problem 1: conflicting requests
  - nothing provides python(abi) = 3.9 needed by python3-validity-0.12-1.fc33.noarch
  - nothing provides python3.9dist(cryptography) >= 2.1.4 needed by python3-validity-0.12-1.fc33.noarch
  - nothing provides python3.9dist(pyusb) >= 1 needed by python3-validity-0.12-1.fc33.noarch
  - nothing provides python3.9dist(pyyaml) >= 3.12 needed by python3-validity-0.12-1.fc33.noarch
 Problem 2: conflicting requests
  - nothing provides python(abi) = 3.9 needed by open-fprintd-0.6-1.fc33.noarch
(try to add '--skip-broken' to skip uninstallable packages)

[rodgersan]

@rodgersan you can try to sudo mkdir /usr/share/python-validity and start again, but in my case other errors appeared.

@veitw why these packages requires python3.9? any ideas to fix that? sudo dnf install python3.9 didn't worked

Error: 
 Problem 1: conflicting requests
  - nothing provides python(abi) = 3.9 needed by python3-validity-0.12-1.fc33.noarch
  - nothing provides python3.9dist(cryptography) >= 2.1.4 needed by python3-validity-0.12-1.fc33.noarch
  - nothing provides python3.9dist(pyusb) >= 1 needed by python3-validity-0.12-1.fc33.noarch
  - nothing provides python3.9dist(pyyaml) >= 3.12 needed by python3-validity-0.12-1.fc33.noarch
 Problem 2: conflicting requests
  - nothing provides python(abi) = 3.9 needed by open-fprintd-0.6-1.fc33.noarch
(try to add '--skip-broken' to skip uninstallable packages)

Thanks @bwiercinski but somehow that folder was already there... concerning python 3.9, it's shipped by default on Fedora 33 if I am not mistaken.

Are you on Fedora 33 by the way?

[bwiercinski]

@rodgersan nope... i think it's a good occasion to upgrade

after fixing permission problems with /usr/share/python-validity is the package working?

[rodgersan]

@rodgersan nope... i think it's a good occasion to upgrade

after fixing permission problems with /usr/share/python-validity is the package working?

@bwiercinski, sorry but what should be those working permissions? I have drwxr-xr-x, owner is root.

I am not sure this is the problem as it tries to access /usr/share/python-validity/backoff which does not exist and does not seem to be provided by any of the rpm. Did you have the same error before getting python3.9 issues?

[bwiercinski]

python-validity is creating backoff file by itself but the /usr/share/python-validity directory must be created and accessible

in my case after creating this directory backoff file was created by itself

i had this issue when i was installing the library manually not via rpm

are u starting python-validary service as --user or root?

[rodgersan]

@bwiercinski

Understood! Yet I am running everything as root to rule out any permission errors (and because of python-validity wiki).
If I run validity-sensors-firmware as root, I get this;

`Traceback (most recent call last):
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 582, in _build_master
ws.require(requires)
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 899, in require
needed = self.resolve(parse_requirements(requirements))
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 790, in resolve
raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.VersionConflict: (python-validity 0.12 (/usr/lib/python3.9/site-packages), Requirement.parse('python-validity==0.9'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/bin/validity-sensors-firmware", line 4, in
import('pkg_resources').run_script('python-validity==0.9', 'validity-sensors-firmware')
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 3257, in
def _initialize_master_working_set():
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 3240, in _call_aside
f(*args, **kwargs)
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 3269, in _initialize_master_working_set
working_set = WorkingSet._build_master()
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 584, in _build_master
return cls._build_from_requirements(requires)
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 597, in _build_from_requirements
dists = ws.resolve(reqs, Environment())
File "/usr/lib/python3.9/site-packages/pkg_resources/init.py", line 785, in resolve
raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'python-validity==0.9' distribution was not found and is required by the application`

And if I run (root); python3.9 /usr/share/python-validity/playground/factory-reset.py

Traceback (most recent call last): File "/usr/share/python-validity/playground/factory-reset.py", line 6, in <module> factory_reset() File "/usr/lib/python3.9/site-packages/validitysensor/sensor.py", line 86, in factory_reset assert_status(usb.cmd(b'\x10' + b'\0' * 0x61)) File "/usr/lib/python3.9/site-packages/validitysensor/util.py", line 12, in assert_status raise Exception('Failed: %04x' % s) Exception: Failed: 0404

So I am lost... thanks anyway for your help!

[rodgersan]

I am just realising I may have issues because of python-validity 0.9 leftovers!?!?

Although when I run python3.9 -m pip list, I get python-validity 0.12!

[bwiercinski]

ok i've upgraded fedora to 33 and install python-validity via provided rpm packages
i had the same error with backoff file, then i've initialized it via sudo touch /usr/share/python-validity/backoff
now i have an error
PermissionError: [Errno 13] Permission denied: '/usr/share/python-validity/calib-data.bin'

[rodgersan]

Sorry for the noob question but neither calib-data.bin nor backoff exist on this repo. I am not having better results looking for them on the internet... are they really supposed to be there? or are they just scraps from previous versions?