Tooling improvements

[simo5]

Improve non code aspects of the project

• Better release script
• PRs template

[Jakuje]

I think the vendor tarball should be named as %{name}-%{version}-vendor.tar.gz (that is at least what we have in RHEL's rust-sequoia-sq package now). I am thinking about adding also a rebuild in centos to test this code path and make sure the vendor tarball also works.

[Jakuje]

at least that is what the instructions in the spec file say:

cargo download %%{crate}==%%{version} > %%{crate}-%%{version}.crate
tar xf %%{crate}-%%{version}.crate
cargo update ... # optional, if you want to update specific dependencies
pushd %%{crate}-%%{version}
cargo vendor-filterer --platform x86_64-unknown-linux-gnu \
                      --platform powerpc64le-unknown-linux-gnu \
                      --platform aarch64-unknown-linux-gnu \
                      --platform i686-unknown-linux-gnu \
                      --platform s390x-unknown-linux-gnu \
                      --all-features=true

Should we do the vendoring manually then or try to stick the the cargo tooling?

[Jakuje]

Why do you need the transform here? When I tried to use this tarball, it creates the /src/rpmbuild/BUILD/kryoptic-1.0.0/kryoptic-1.0.0/vendor/ and the cargo does not find the vendored dependencies during the build (at least the way I wrote it now using rust-rpm macros).

[simo5]

1. tarball names:
   do we have any guideline anywhere? Otheriwise it looks like an arbitrary choice and I am ok with vendor before version, it is more natiral to have the version at the end.

2. tooling:
   I would use cargo tooling as much as possible to generate the right stuff, but I do not want to depend on crates.io which is why I generate the vendor directory, someone with the two tarballs (and the system dependencies necessary) should be able to make a hermetic build (no access to the netwrok).

3. transform:
   If you look into the tarball, if you do not do the transform you get "vendor" as the tarball root directory ... it sounds wrong to me, I think someone that just want to manually inspect the two tarballs and simply -xf them, should get everything under /kryoptic- and not one under that and the other under an unversioned /vendor. However if the tools can't deal with that packaging I can begrudgingly change that.

[Jakuje]

Naming: I did not find the naming explained anywhere, but what rust2rpm generates is as follows "{project_name}-{project_version}-vendor.tar.xz":

https://pagure.io/fedora-rust/rust2rpm/blob/main/f/rust2rpm/vendor.py#_44

Tooling: We could use rust2rpm to generate the vendor tarball.

I think its not that the tools would not be able to handle that, but it will be more complicated. If we take the tarball as it is, the tooling will make it quite straightforward, see #178.

[simo5]

It seems you have a better handle than I have with this aspects.
Do you want to take over this task in #178 and we close this PR ?

[Jakuje]

All what I learned this afternoon while experimenting with CI rpmbuild ;)

Sure, we can take over this into the #178 if you are ok with that approach (I pulled your commits into that branch). I can see if we can get the vendoring simplified with rust2rpm tool.

[simo5]

it seem those changes are required to get the RHEL rpm builds right, and while the lack of prefix in the vendor tarball irks me, it is not a big deal.

[Jakuje]

this does not work either

Suggested change

	if [ -z "$1"]; then
	if [ -z "$1" ]; then

[simo5]

This is just a style issue right ?
Because my testing shows that the script works correctly.

[Jakuje]

it works, but throws error (which is ignored as the exit code of the condition does not make the failure of the whole script):

./misc/release.sh: line 19: [: missing `]'

[Jakuje]

Why do you need the transform here? When I tried to use this tarball, it creates the /src/rpmbuild/BUILD/kryoptic-1.0.0/kryoptic-1.0.0/vendor/ and the cargo does not find the vendored dependencies during the build (at least the way I wrote it now using rust-rpm macros).

[simo5]

Obsoleted by #178