ci: use dnf builddep to install make-rpm build dependencies - #203
Merged
Conversation
greenboot-rs.spec has an unconditional BuildRequires: systemd-rpm-macros,
but the make-rpm job's dnf install step never installs it, only
git/make/rpm-build/rust-toolset. rpmbuild then fails dependency
resolution before it ever gets to building anything:
error: Failed build dependencies:
systemd-rpm-macros is needed by greenboot-rs-0.16.3-0.el9.x86_64
Rather than hardcode systemd-rpm-macros alongside rust-toolset (which
would just be one more package to keep in sync with the spec by hand),
use 'dnf builddep' against greenboot-rs.spec directly so the job always
installs whatever the spec's BuildRequires actually resolve to on this
container, including the rust-toolset/cargo-rpm-macros conditional
branch, with no separate list to maintain.
Verified against the exact quay.io/centos/centos:stream9 image the job
uses: 'dnf install -y git make rpm-build dnf-plugins-core' followed by
'dnf builddep -y greenboot-rs.spec' correctly resolves rust-toolset and
systemd-rpm-macros, and 'make rpm' completes and produces all four
expected RPMs.
Also checked this doesn't regress the Fedora build path: 'dnf builddep'
alone only sees the spec's static BuildRequires, not the per-crate
rust-*-devel packages that %generate_buildrequires/
%cargo_generate_buildrequires enumerate dynamically during %prep on
Fedora. That's fine here because this CI job only ever runs in the
CentOS Stream 9 container above; the Fedora path is handled entirely
separately by the Makefile's own Fedora-conditional dnf install of
GREENBOOT_RUST_DEPENDENCIES, which this change doesn't touch.
Assisted-by: OpenCode (Claude Sonnet 5)
miabbott
force-pushed
the
fix/make-rpm-systemd-macros
branch
from
August 7, 2026 20:58
7f563fa to
05dadc3
Compare
miabbott
changed the title
say-paul
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
make-rpmjob (in both.github/workflows/greenboot-ci.yamland.github/workflows/comment-ci.yaml) has been failing consistently on recent PRs:Confirmed failing identically on the last several merged/open PRs: #190, #191, #192, #178, #196.
Root cause
greenboot-rs.spechas an unconditionalBuildRequires: systemd-rpm-macros. Themake-rpmjob runs in a barequay.io/centos/centos:stream9container and its "Build RPMs" step only installsgit make rpm-build rust-toolsetbefore runningmake rpm—systemd-rpm-macrosis never installed, sorpmbuildfails dependency resolution before it builds anything.Fix
Use
dnf builddep -y greenboot-rs.spec(after installingdnf-plugins-corefor the plugin) instead of hardcoding package names in the workflow. This readsBuildRequiresstraight from the spec — including the conditionalrust-toolset/cargo-rpm-macrosbranch — so the job stays correct automatically if the spec's dependencies ever change, instead of needing a parallel hardcoded list kept in sync by hand.Validation
Verified locally against the exact
quay.io/centos/centos:stream9image the job uses:dnf install -y git make rpm-build dnf-plugins-core && dnf builddep -y greenboot-rs.specresolvesrust-toolsetandsystemd-rpm-macroscleanly, andmake rpmcompletes and produces all four expected RPMs (greenboot,greenboot-default-health-checks,greenboot-rs-debugsource,greenboot-debuginfo).Also checked this doesn't regress the Fedora build path:
dnf builddepalone only sees the spec's staticBuildRequires, not the per-craterust-*-develpackages that%generate_buildrequires/%cargo_generate_buildrequiresenumerate dynamically during%prepon Fedora. That's fine here because this CI job only ever runs in the CentOS Stream 9 container above — the Fedora build path is handled entirely separately by the Makefile's own Fedora-conditionaldnf installofGREENBOOT_RUST_DEPENDENCIES, which this change doesn't touch.🤖 Assisted-by: OpenCode (Claude Sonnet 5)