Agent only build10 - test - #1
Closed
Fantu wants to merge 10 commits into
Closed
Conversation
Native packaging that builds a stripped-down, agent-only NSClient++ for Linux: no web frontend/HTTP server and no bundled documentation. It runs checks locally and exposes them over NRPE/NSCA/check_mk (and can actively submit results to a central server). This squashes the iterative packaging history into a single commit (the per-file/per-step commits were getting too many); later packaging changes go on top as separate commits. The mixed CMakeLists.txt + debian/rules change for the private libdir is kept as its own commit and cherry-picked after this one, so this commit touches debian/ only. debian/control: source-only "nscp" package (Multi-Arch: foreign, Rules-Requires-Root: no, Standards-Version 4.7.3) with the agent-only Build-Depends: cmake, pkgconf, libssl-dev, libboost-all-dev, libprotobuf-dev, protobuf-compiler, liblua5.4-dev, libtinyxml2-dev, libffi-dev, python3-dev, python3-protobuf, python3-jinja2, libdbus-1-dev, libzip-dev, libcrypto++-dev, libgtest-dev, libgmock-dev, dh-sequence-installsysusers. debian/rules (dh, debhelper-compat 13): agent-only configure (-DBUILD_MODULE_WEBServer=OFF to drop the whole web layer, -DNSCP_BUILD_TESTS=ON, -DNSCP_BOOST_PYTHON_VERSION derived from the default python3, -DCHECK_NSCLIENT_MISSING=ON), full hardening (hardening=+all), and the upstream test suite run with --output-on-failure. BUILD_MODULE_WEBServer matches the new "cmake: allow disabling the web layer via BUILD_MODULE_WEBServer" patch in this branch (build6 used the older downstream -DBUILD_WEBSERVER=OFF). debian/ runtime bits: ship our own systemd unit (PID in /run, since the bundled one writes its PID under read-only /usr), provision the system user via dh-sequence-installsysusers + debian/nscp.sysusers, plus log rotation (debian/nscp.logrotate) and postrm cleanup. debian/copyright: Files:* default with explicit exceptions, reflecting the upstream license harmonization; debian/TODO tracks the repack candidates still to resolve. Refs mickem#1278 Assisted-by: Claude Code (Opus 4.8) Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it>
Keep the source package as nscp but ship the binary package as nsclient,
matching the service (nsclient.service), the system user (nsclient) and
the upstream project name (NSClient++); nscp stays the program/binary
name (/usr/sbin/nscp).
Rename the per-package maintainer files accordingly
(debian/nscp.{postrm,sysusers,logrotate} -> debian/nsclient.*) so
debhelper keeps auto-installing them by package name, and point the
staging paths in debian/rules at debian/nsclient/.
As a side effect debian/nsclient.service now matches dh_installsystemd's
debian/<package>.service convention, so debhelper installs it (over the
upstream unit, same path) and wires up enable/start; drop the
now-redundant manual install in execute_after_dh_auto_install, keeping
only the /var placeholder cleanup.
Verified by a binary build in a sid chroot: the package builds as
nsclient_*.deb, ships a single nsclient.service (the Debian one, with
the PID in /run), and the maintainer scripts carry the sysusers,
logrotate and systemd enable/start snippets.
Assisted-by: Claude Code (Opus 4.8)
Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it>
Build the upstream MkDocs manual into a separate Architecture: all
package, nsclient-doc, and have nsclient Suggest it. The manual covers
every module - including the Windows-only ones absent from the
agent-only nsclient build - because it is built from the committed
documentation sources rather than by introspecting the running binary.
Use the mkdocs debhelper sequence via dh-sequence-mkdocs, kept in
Build-Depends-Indep so the addon is inactive in architecture-only builds
(where it would otherwise abort on the missing manual). dh_mkdocs
--theme-package mkdocs-material replaces the bundled mkdocs-material and
lunr assets with symlinks into the mkdocs-material package and fills in
${mkdocs:Depends}, so the package embeds no JavaScript/CSS copies (and
needs no copyright stanzas for them). The material theme's Google Fonts
are disabled (font: false, injected into a build-time copy of mkdocs.yml
so docs/mkdocs.yml stays untouched for upstreaming) to avoid a privacy
breach.
With two binary packages dh_auto_install now stages the CMake install
into debian/tmp, so add debian/nsclient.install to move it into nsclient
and drop the /var placeholder there. The empty override_dh_mkdocs-arch
keeps a full build's binary-arch pass from aborting.
Verified by a full binary build in a sid chroot: nsclient is unchanged;
nsclient-doc ships 88 HTML pages with 43 theme assets symlinked to
mkdocs-material, Depends: mkdocs-material (>= 9.6.4-1), no Google Fonts,
and is lintian-clean apart from the pre-existing changelog/README
skeleton tags shared with nsclient.
Assisted-by: Claude Code (Opus 4.8)
Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it>
…stream The upstream "custom install prefix on Linux builds" change moves the systemd unit it installs to an absolute /lib/systemd/system (NSCP_SYSTEMD_UNITDIR) and keeps staging a /var/log/nsclient/nsclient.log placeholder. Neither is captured by the etc/usr globs in debian/nsclient.install, so dh_missing aborts the build on them. We ship neither: dh_installsystemd installs our own debian/nsclient.service (PID in /run, systemd-managed RuntimeDirectory/LogsDirectory) to /usr/lib/systemd/system, and the log directory is created at runtime by the unit's LogsDirectory with the correct ownership. List both staged files in debian/not-installed so dh_missing treats the omission as intentional - the idiomatic replacement for the previous "rm -rf debian/tmp/var" in d/rules, which no longer covered the relocated unit. Verified in a sid chroot: the nsclient package ships our /run unit at /usr/lib/systemd/system/nsclient.service, and its contents and full lintian tag set are identical to the previous packaging (agent-only-build8) save for the intended upstream changes - private libs now unversioned (no SOVERSION) and the new CheckDisk module. Assisted-by: Claude Code (Opus 4.8) Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it>
nsclient.ini may hold credentials (NRPE/NSCA/check_mk passwords, allowed-hosts secrets), so it should not stay world-readable. Add a postinst that sets it to root:nsclient 0640 - root owns it, the nsclient service group (under which the daemon runs) gets read access. Follow the cups-daemon/ssl-cert idiom: (re)apply the permissions on every configure unless the administrator has registered their own dpkg-statoverride for the file, in which case it is left untouched. The .deb itself ships the file as 0644 root:root and the perms are applied at install time, so no lintian non-standard-file-perm override is needed (unlike freeipmi, which bakes 0640 into the package using the static adm group). The snippet runs after #DEBHELPER#, where dh_installsysusers inserts the systemd-sysusers call: the sysusers "u" type creates both the nsclient user and the nsclient group, so the group exists by the time the chown runs. Document the scheme in README.Debian: a plain chmod is reset on upgrade, and the supported way to customise the permissions permanently is to register a dpkg-statoverride (with a note that any override must keep the file readable by the nsclient user/group or the service will fail to start). Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it> Assisted-by: Claude Code (Opus 4.8)
Set the changelog version to the current upstream release (0.13.0, the latest tag) instead of the previous git-snapshot placeholder. Add a changelog note that this is an experimental, work-in-progress build of a future Debian package: the packaging is still incomplete and not intended for production use. This makes the status visible in the .deb shipped during testing. Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it> Assisted-by: Claude Code (Opus 4.8)
Drop the DEP-12 template boilerplate from debian/upstream/metadata, keeping the populated fields, and add Documentation and Donation links (the upstream documentation site and the maintainer's GitHub Sponsors page). Add debian/nsclient.lintian-overrides for the no-manual-page tag on /usr/sbin/nscp: upstream ships no manual page and the package does not generate one yet (tracked as a packaging follow-up; a help2man-generated page can be added later). Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it> Assisted-by: Claude Code (Opus 4.8)
… stubs Fix the hardening build options variable name: rules exported DEB_BUILD_MAINTAINER_OPTIONS, which dpkg-buildflags does not read, so "hardening=+all" was silently ignored and only the default hardening set was applied (relro, but not bindnow). Use the correct DEB_BUILD_MAINT_OPTIONS so the requested extra features take effect - the linker now gets -Wl,-z,now (full RELRO) and lintian no longer emits hardening-no-bindnow. Replace the broad "etc"/"usr" globs in debian/nsclient.install with explicit paths (globbing only the numerous groups: private libs, modules, scripts, security PEMs), so dh_missing flags anything upstream adds or removes and we make a deliberate decision about it. Stop shipping two files via debian/not-installed: - usr/lib/nsclient/web/index.html: a stub Vite/React index template that upstream accidentally ships in web/dist/ (it references assets that do not exist). The agent-only package has no web frontend; the real bundle is fetched at runtime with `nscp web install-ui`. - usr/lib/nsclient/license.txt: a redundant copy of the upstream license, not read at runtime (only the Windows MSI references it) and already covered by debian/copyright. Extend debian/nsclient.lintian-overrides for no-manual-page to also cover the bundled NRPE check helpers (check_nscp, check_nscp_nrpe), which are always built and shipped alongside nscp. Verified with a sid build: Status successful, 44/44 tests, and the targeted lintian tags (no-manual-page, hardening-no-bindnow, extra-license-file) are all gone. Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it> Assisted-by: Claude Code (Opus 4.8)
…agraph) Strip the leading ./ from all Files patterns: licensecheck generates them with a ./ prefix, which lintian flags as superfluous-file-pattern (DEP-5 patterns are relative to the source root). Stop listing the upstream license-text files - COPYING, files/license.txt, libs/mongoose-cpp/LICENSE and installers/installer-NSCP/License.rtf (the GPL-2 text wrapped in RTF). These are license texts, not works needing their own attribution paragraph; not listing them is common practice and clears the license-file-listed-in-debian-copyright tags. Remove the orphaned standalone "License: UNKNOWN" paragraph, which no Files paragraph referenced (unused-license-paragraph-in-dep5-copyright). GPL-2, Expat and Binary-no-source remain referenced by other paragraphs, so no new orphans are introduced. The remaining UNKNOWN (the bundled binary assets) still needs per-file licensing and is tracked for the upstream license harmonization / +dfsg repack pass in debian/TODO. Signed-off-by: Fabio Fantoni <fantonifabio@tiscali.it> Assisted-by: Claude Code (Opus 4.8)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.