mirror of
https://github.com/XRPLF/rippled.git
synced 2026-06-02 16:26:48 +00:00
4bccbbb9e2
- **RPM version scheme**: pre-releases now use `~` in the `Version` field instead of the `0.<release>.<suffix>` `Release`-field hack. Matches Debian's `~` convention, so RPM and DEB version strings are symmetric. Requires rpm ≥ 4.10 (RHEL 9 ships 4.17). Before/after for a pre-release build: ``` # before xrpld-3.2.0-0.1.rc3+202606011647.d4cb68d5.el9.x86_64.rpm # after (symmetric with DEB) xrpld-3.2.0~rc2+202606010139.7679a310-1.el9.x86_64.rpm xrpld_3.2.0~rc2+202606010139.7679a310-1_amd64.deb ``` - **Auto-update removed**: `update-xrpld`, `update-xrpld.service`, and `update-xrpld.timer` deleted. The `50-xrpld.preset` `disable` line for the timer is dropped too. - **Service hardening** (two new `[Service]` directives in `xrpld.service`): - `CapabilityBoundingSet=CAP_NET_BIND_SERVICE` — drops every Linux capability except `CAP_NET_BIND_SERVICE`, capping the privilege ceiling to least-privilege while still letting operators bind ports <1024 (e.g. WS/HTTPS on 443). - `SystemCallArchitectures=native` — restricts the service to the native syscall ABI, blocking alternate-ABI (32-bit/x32) syscalls used to evade seccomp filtering. - [ ] Build RPM from a pre-release version (e.g. `3.2.0-b1`) and confirm `rpm -qi` shows `Version: 3.2.0~b1`, `Release: 1` - [ ] Confirm `3.2.0~b1` sorts before `3.2.0` via `rpmvercmp` - [ ] Install package and confirm no `update-xrpld*` units appear in `systemctl list-unit-files` - [ ] Confirm `systemctl show xrpld` reflects the new `CapabilityBoundingSet` and `SystemCallArchitectures`
26 lines
553 B
Makefile
26 lines
553 B
Makefile
#!/usr/bin/make -f
|
|
|
|
export DH_VERBOSE = 1
|
|
|
|
%:
|
|
dh $@
|
|
|
|
override_dh_auto_configure override_dh_auto_build override_dh_auto_test:
|
|
@:
|
|
|
|
override_dh_installsystemd:
|
|
dh_installsystemd --no-stop-on-upgrade xrpld.service
|
|
|
|
execute_before_dh_installtmpfiles:
|
|
dh_installsysusers
|
|
|
|
override_dh_installsysusers:
|
|
|
|
override_dh_install:
|
|
install -D -m 0755 xrpld debian/xrpld/usr/bin/xrpld
|
|
install -D -m 0644 xrpld.cfg debian/xrpld/etc/xrpld/xrpld.cfg
|
|
install -D -m 0644 validators.txt debian/xrpld/etc/xrpld/validators.txt
|
|
|
|
override_dh_dwz:
|
|
@:
|