%global distro GPOS
%global major 9
%global minor 0
%global cversion 9.99
%global crelease 99.el9

Name: gpos-release
Version: %{major}.%{minor}
Release: 13.eel9
Summary: %{distro} release files
License: GPLv2
URL: https://esds.co.in
BuildArch: noarch

Provides: gpos-release = %{version}-%{release}
# Required for a lorax run (to generate install media)
Requires: gpos-repos(%{major})
Provides: gpos-release-eula

# required by dnf
# https://github.com/rpm-software-management/dnf/blob/4.2.23/dnf/const.py.in#L26
Provides: system-release = %{cversion}-%{crelease}
Provides: system-release(releasever) = %{major}
Conflicts: redhat-release

# Remove CentOS/Rocky/Alma/RedHat branding packages completely
Conflicts: centos-release
Conflicts: centos-stream-release
Conflicts: centos-stream-repos
Conflicts: centos-gpg-keys

Conflicts: rocky-release
Conflicts: rocky-repos
Conflicts: rocky-gpg-keys

Conflicts: alma-release
Conflicts: alma-repos
Conflicts: alma-gpg-keys

Conflicts: redhat-release
Conflicts: redhat-release-eula
Conflicts: redhat-release-server
Conflicts: redhat-release-client

Conflicts: redhat-repos
Obsoletes: redhat-repos

# Replace CentOS / Stream branding completely
Obsoletes: centos-release <= %{cversion}-%{crelease}
Obsoletes: centos-stream-release <= %{cversion}-%{crelease}
Obsoletes: centos-stream-repos <= %{cversion}-%{crelease}
Obsoletes: centos-gpg-keys <= %{cversion}-%{crelease}

Obsoletes: rocky-release <= %{cversion}-%{crelease}
Obsoletes: rocky-repos <= %{cversion}-%{crelease}
Obsoletes: rocky-gpg-keys <= %{cversion}-%{crelease}

Obsoletes: alma-release <= %{cversion}-%{crelease}
Obsoletes: alma-repos <= %{cversion}-%{crelease}
Obsoletes: alma-gpg-keys <= %{cversion}-%{crelease}

# only have releasever_major, do not add releasever_minor
# https://issues.redhat.com/browse/RHEL-102725
Provides: system-release(releasever_major) = %{major}
Conflicts: system-release

# required by libdnf
# https://github.com/rpm-software-management/libdnf/blob/0.48.0/libdnf/module/ModulePackage.cpp#L472
Provides: base-module(platform:el9)
Provides: base-module(platform:eel9)

Source200: EULA
Source201: LICENSE
Source202: Contributors
Source300: 85-display-manager.preset
Source301: 90-default.preset
Source302: 90-default-user.preset
Source303: 99-default-disable.preset
Source304: 50-redhat.conf
Source400: gpossecurebootca2.cer
# kernel signing certificate
Source401: gpossecureboot201.cer
# grub2 signing certificate
Source402: gpossecureboot202.cer
# Fwupd signing certificate
Source403: gpossecureboot203.cer
# UKI-VIRT signing certificate
Source404: gpossecureboot204.cer
Source500: gpos.repo
Source501: gpos-source.repo
Source600: RPM-GPG-KEY-GPOS

%package -n gpos-sb-certs
Summary: %{distro} public secureboot certificates
Group: System Environment/Base
Provides: system-sb-certs = %{cversion}-%{crelease}
Conflicts: centos-sb-certs
Obsoletes: centos-sb-certs <= %{cversion}-%{crelease}

%package -n gpos-repos
Summary: GPOS package repositories
Provides: gpos-repos(%{major}) = %{version}
Requires: gpos-gpg-keys = %{version}-%{release}
Provides: system-repos = %{cversion}-%{crelease}
Provides: gpos-stream-repos(%{major}) = %{cversion}

%package -n gpos-gpg-keys
Summary: GPOS RPM keys

%description
%{distro} release files.

%description -n gpos-sb-certs
%{distro} secureboot certificates

%description -n gpos-repos
This package provides the package repository files for GPOS.

%description -n gpos-gpg-keys
This package provides the RPM signature keys for GPOS.

%install
# copy license and contributors doc here for %%license and %%doc macros
mkdir -p ./docs
cp %{SOURCE201} %{SOURCE202} ./docs

# create /etc/system-release
install -d -m 0755 %{buildroot}%{_sysconfdir}
echo "%{distro} release %{major}" > %{buildroot}%{_sysconfdir}/gpos-release
ln -s gpos-release %{buildroot}%{_sysconfdir}/system-release

# -------------------------------------------------------------------------
# Definitions for /etc/os-release and for macros in macros.dist. These
# macros are useful for spec files where distribution-specific identifiers
# are used to customize packages.
# Name of vendor / name of distribution. Typically used to identify where
# the binary comes from in --help or --version messages of programs.
# Examples: gdb.spec, clang.spec
%global dist_vendor GPOS
%global dist_name %{distro}

# URL of the homepage of the distribution
# Example: gstreamer1-plugins-base.spec
%global dist_home_url https://esds.co.in/

# Bugzilla / bug reporting URLs shown to users.
# Examples: gcc.spec
%global dist_bug_report_url https://esds.co.in/

# debuginfod server, as used in elfutils.spec.
%global dist_debuginfod_url https://debuginfod.esds.co.in/

# -------------------------------------------------------------------------
# Create the os-release file
install -d -m 0755 %{buildroot}%{_prefix}/lib
cat > %{buildroot}%{_prefix}/lib/os-release << EOF
NAME="%{dist_name}"
VERSION="%{major}"
ID="gpos"
ID_LIKE="rhel fedora"
VERSION_ID="%{major}"
PLATFORM_ID="platform:eel9"
PRETTY_NAME="%{distro} %{major}"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:gpos:gpos:%{major}"
HOME_URL="%{dist_home_url}"
BUG_REPORT_URL="%{dist_bug_report_url}"
EOF

# Create the symlink for /etc/os-release
ln -s ../usr/lib/os-release %{buildroot}%{_sysconfdir}/os-release

# write cpe to /etc/system/release-cpe
echo "cpe:/o:gpos:gpos:%{major}" > %{buildroot}%{_sysconfdir}/system-release-cpe

# create /etc/issue, /etc/issue.net and /etc/issue.d
echo '\S' > %{buildroot}%{_sysconfdir}/issue
echo 'Kernel \r on an \m' >> %{buildroot}%{_sysconfdir}/issue
cp %{buildroot}%{_sysconfdir}/issue{,.net}
echo >> %{buildroot}%{_sysconfdir}/issue
mkdir -p %{buildroot}%{_sysconfdir}/issue.d

# set up the dist tag macros
mkdir -p %{buildroot}%{_rpmmacrodir}
cat > %{buildroot}%{_rpmmacrodir}/macros.dist << EOF
# dist macros.
%%__bootstrap ~bootstrap
%%gpos_ver %{major}
%%gpos %{major}
%%rhel 9
%%dist %%{!?distprefix0:%%{?distprefix}}%%{expand:%%{lua:for i=0,9999 do print("%%{?distprefix" .. i .."}") end}}.eel9%%{?distsuffix}%%{?with_bootstrap:%{__bootstrap}}
%%eel9 1
%%dist_vendor %{dist_vendor}
%%dist_name %{dist_name}
%%dist_home_url %{dist_home_url}
%%dist_bug_report_url %{dist_bug_report_url}
%%dist_debuginfod_url %{dist_debuginfod_url}
EOF

# use unbranded datadir
install -d -m 0755 %{buildroot}%{_datadir}/gpos-release
install -p -m 0644 %{SOURCE200} %{buildroot}%{_datadir}/gpos-release/

# copy systemd presets
install -d -m 0755 %{buildroot}%{_prefix}/lib/systemd/system-preset/
install -d -m 0755 %{buildroot}%{_prefix}/lib/systemd/user-preset
install -p -m 0644 %{SOURCE300} %{buildroot}%{_prefix}/lib/systemd/system-preset/
install -p -m 0644 %{SOURCE301} %{buildroot}%{_prefix}/lib/systemd/system-preset/
install -p -m 0644 %{SOURCE302} %{buildroot}%{_prefix}/lib/systemd/user-preset/
# installing the same file for both system and user presets to set the same behavior for both
install -p -m 0644 %{SOURCE303} %{buildroot}%{_prefix}/lib/systemd/system-preset/
install -p -m 0644 %{SOURCE303} %{buildroot}%{_prefix}/lib/systemd/user-preset/

# copy sysctl presets
mkdir -p %{buildroot}/%{_prefix}/lib/sysctl.d/
install -m 0644 %{SOURCE304} %{buildroot}/%{_prefix}/lib/sysctl.d/

# Create stub yum repos
mkdir %{buildroot}%{_sysconfdir}/yum.repos.d

# Copy secureboot certificates
install -d -m 0755 %{buildroot}%{_sysconfdir}/pki/sb-certs/
install -d -m 0755 %{buildroot}%{_datadir}/pki/sb-certs/

# Install aarch64 certs
install -m 644 %{SOURCE400} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-aarch64.cer
install -m 644 %{SOURCE401} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-aarch64.cer
install -m 644 %{SOURCE402} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-grub2-aarch64.cer
install -m 644 %{SOURCE403} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-fwupd-aarch64.cer
install -m 644 %{SOURCE404} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-aarch64.cer

# Install x86_64 certs
install -m 644 %{SOURCE400} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-x86_64.cer
install -m 644 %{SOURCE401} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-x86_64.cer
install -m 644 %{SOURCE402} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-grub2-x86_64.cer
install -m 644 %{SOURCE403} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-fwupd-x86_64.cer
install -m 644 %{SOURCE404} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-x86_64.cer

# Install ppc64le certs
install -m 644 %{SOURCE400} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-ppc64le.cer
install -m 644 %{SOURCE401} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-ppc64le.cer
install -m 644 %{SOURCE402} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-grub2-ppc64le.cer
install -m 644 %{SOURCE404} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-ppc64le.cer

# Install s390x certs
install -m 644 %{SOURCE400} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-s390x.cer
install -m 644 %{SOURCE401} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-s390x.cer
install -m 644 %{SOURCE404} %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-s390x.cer

# Link x86_64 certs
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-x86_64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-ca-x86_64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-x86_64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-kernel-x86_64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-grub2-x86_64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-grub2-x86_64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-fwupd-x86_64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-fwupd-x86_64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-x86_64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-uki-virt-x86_64.cer

# Link aarch64 certs
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-aarch64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-ca-aarch64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-aarch64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-kernel-aarch64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-grub2-aarch64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-grub2-aarch64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-fwupd-aarch64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-fwupd-aarch64.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-aarch64.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-uki-virt-aarch64.cer

# Link ppc64le certs
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-ppc64le.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-ca-ppc64le.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-ppc64le.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-kernel-ppc64le.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-grub2-ppc64le.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-grub2-ppc64le.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-ppc64le.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-uki-virt-ppc64le.cer

# Link s390x certs
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-ca-s390x.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-ca-s390x.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-kernel-s390x.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-kernel-s390x.cer
ln -sr %{buildroot}%{_datadir}/pki/sb-certs/secureboot-uki-virt-s390x.cer %{buildroot}%{_sysconfdir}/pki/sb-certs/secureboot-uki-virt-s390x.cer

# copy yum repos
install -d -m 0755 %{buildroot}%{_sysconfdir}/yum.repos.d
install -p -m 0644 %{SOURCE500} %{buildroot}%{_sysconfdir}/yum.repos.d/
install -p -m 0644 %{SOURCE501} %{buildroot}%{_sysconfdir}/yum.repos.d/

# dnf variables
install -d -m 0755 %{buildroot}%{_sysconfdir}/dnf/vars
echo "%{major}-stream" > %{buildroot}%{_sysconfdir}/dnf/vars/stream

# copy GPG keys
install -d -m 0755 %{buildroot}%{_sysconfdir}/pki/rpm-gpg
install -p -m 0644 %{SOURCE600} %{buildroot}%{_sysconfdir}/pki/rpm-gpg/

%files
%license docs/LICENSE
%doc docs/Contributors
%{_sysconfdir}/system-release
%{_sysconfdir}/gpos-release
%config(noreplace) %{_sysconfdir}/os-release
%config %{_sysconfdir}/system-release-cpe
%config(noreplace) %{_sysconfdir}/issue
%config(noreplace) %{_sysconfdir}/issue.net
%dir %{_sysconfdir}/issue.d
%dir %{_sysconfdir}/yum.repos.d
%{_rpmmacrodir}/macros.dist
%{_datadir}/gpos-release
%{_prefix}/lib/os-release
%{_prefix}/lib/systemd/system-preset/*
%{_prefix}/lib/systemd/user-preset/*
%{_prefix}/lib/sysctl.d/50-redhat.conf

%files -n gpos-sb-certs
# Note to future packagers:
# resetting the symlinks in /etc/pki/sb-certs on upgrade is the intended behavior here
%dir %{_sysconfdir}/pki/sb-certs
%dir %{_datadir}/pki/sb-certs/
%{_sysconfdir}/pki/sb-certs/*.cer
%{_datadir}/pki/sb-certs/*.cer

%files -n gpos-repos
%config(noreplace) %{_sysconfdir}/yum.repos.d/gpos.repo
%config(noreplace) %{_sysconfdir}/yum.repos.d/gpos-source.repo
%config(noreplace) %{_sysconfdir}/dnf/vars/stream

%files -n gpos-gpg-keys
%{_sysconfdir}/pki/rpm-gpg

%changelog
* Fri Mar 6 2026 Devesh B <devesh.b@esds.co.in> - 9.0-13
- Bumped release to 13.eel9
- Renamed secureboot cert source filenames from centossecureboot* to gpossecureboot*
- Updated README build prerequisite naming

* Wed Feb 25 2026 Release Team - 9.0-12
- Fixed gpos-apps repo: enabled=1, gpgcheck=0, corrected name and metadata fields

* Fri Feb 7 2026 Release Team - 9.0-11
- Added gpos-extras repository to gpos.repo

* Wed Jan 21 2026 Release Team - 9.0-10
- Updated url in gpos-source.repo to point to correct url.

* Fri Jan 9 2026 Release Team - 9.0-9
- Updated url in gpos.repo and gpos-source.repo for public repo

* Fri Jan 9 2026 Release Team - 9.0-8
- Updated url in gpos.repo for Apps access
- Added gpos-source.repo in SOURCES to allow access for sources of rpms

* Thu Jan 8 2026 Release Team - 9.0-7
- Updated gpos.repo in sources to make Apps repo accessible

* Tue Dec 30 2025 Release Team - 9.0-6
- Updated cversion from 9.0.30 to 9.99.99 to obsolete higher versions
- Modified crelease to 99.el9 for proper version precedence

* Thu Nov 20 2025 Release Team - 9.0-5
- RHEL support added
- Rocky support added

* Wed Nov 19 2025 Release Team - 9.0-4
- Removed RedHat release files
- Added GPG key support for package signing

* Tue Nov 18 2025 Release Team - 9.0-3
- Updated the version and post script
- Updated obsoletes so that it uses cversion and crelease

* Mon Nov 17 2025 Release Team - 9.0-2
- Updated with Obsoletes

* Sun Nov 16 2025 Release Team - 9.0-1
- Provide release files