%global forgeurl https://github.com/cvmfs/cvmfs
# Pin devel snapshots so the forge archive name and contents are immutable.
# Update commit/date together, or replace them with a release tag, e.g.
#   %%global tag cvmfs-2.15.0-pre1
# and keep Version/Release below in sync.
%global commit 707fa2e825b595d3b7c03bc4357fe4cd06f54e28
%global date 20260807
%forgemeta

%global selinuxtype targeted
%global modulename cvmfs
%global _unitdir %{_prefix}/lib/systemd/system

Summary: CernVM File System client
Name: cvmfs
Version: 2.15.0~pre1
%global base_version %(echo %{version} | cut -d'~' -f1)
Release: 1%{?dist}
URL: %{forgeurl}
Source: %{forgesource}
# GitHub-generated source archives do not contain the FetchContent download
# cache.  Keep the two intentionally vendored client dependencies reproducible
# and available without network access during the build phase.
Source1: https://github.com/manugarg/pacparser/archive/refs/tags/v1.5.1.tar.gz
Source2: https://ecsft.cern.ch/dist/cvmfs/build_externals/zlib-1.2.8.tar.gz
License: BSD

# Fedora-only client build dependencies.  Except for pacparser, LibreSSL, and
# zlib, every dependency participating in the client build comes from Fedora.
# Fedora currently does not ship pacparser-devel; LibreSSL remains vendored
# until the upstream OpenSSL migration lands.  zlib remains vendored because
# CVMFS hashes its byte-exact deflate output.
BuildRequires: cmake
BuildRequires: forge-srpm-macros
BuildRequires: gcc
BuildRequires: gcc-c++
BuildRequires: make
BuildRequires: bzip2
BuildRequires: help2man
BuildRequires: pkgconf-pkg-config
BuildRequires: libuuid-devel
BuildRequires: fuse3-devel >= 3.3.0
BuildRequires: libattr-devel
BuildRequires: libcap-devel
BuildRequires: nettle-devel >= 3.10
BuildRequires: openssl-devel
BuildRequires: libcurl-devel
BuildRequires: c-ares-devel
BuildRequires: sqlite-devel
BuildRequires: leveldb-devel
BuildRequires: sparsehash-devel
BuildRequires: json-devel
BuildRequires: protobuf-devel
BuildRequires: protobuf-compiler
BuildRequires: libarchive-devel
BuildRequires: valgrind-devel
BuildRequires: systemd-rpm-macros

Requires: bash
Requires: coreutils
Requires: grep
Requires: gawk
Requires: sed
Requires: psmisc
Requires: lsof
Requires: autofs
Requires: fuse3
Requires: curl
Requires: attr
Requires: glibc-common
Requires: procps-ng
Requires: util-linux
Requires: which
Requires: shadow-utils
Requires: cvmfs-config
Requires: cvmfs-libs = %{version}-%{release}
Requires: cvmfs-fuse3 = %{version}-%{release}
# Pull the independent policy only on systems that carry targeted SELinux.
Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
Requires(post): systemd
Requires(postun): systemd

%description
CernVM-FS is a read-only HTTP file system for distributing software.  This
Fedora package contains only the client and client libraries.

%package libs
Summary: CernVM-FS client libraries
%description libs
Common utility and client libraries for CernVM-FS.

%package fuse3
Summary: CernVM-FS FUSE 3 libraries
Requires: cvmfs-libs = %{version}-%{release}
Requires: fuse3-libs >= 3.3.0
%description fuse3
Shared libraries implementing the CernVM-FS client using FUSE 3.

%package devel
Summary: CernVM-FS client development files
Requires: cvmfs-libs = %{version}-%{release}
%description devel
Headers for the CernVM-FS userspace client and cache plugin APIs.

%package selinux
Summary: CernVM-FS SELinux policy
BuildArch: noarch
Requires: selinux-policy-%{selinuxtype}
Requires(post): selinux-policy-%{selinuxtype}
%{?selinux_requires_min}

%description selinux
Independent SELinux policy module for the CernVM-FS client.

%prep
%forgesetup

mkdir SELinux
cp packaging/rpm/cvmfs.te packaging/rpm/cvmfs.fc SELinux

mkdir -p externals/download
cp %{SOURCE1} externals/download/v1.5.1.tar.gz
cp %{SOURCE2} externals/download/zlib-1.2.8.tar.gz

%build
cmake -DCMAKE_INSTALL_LIBDIR:PATH=%{_lib} \
  -DCMAKE_INSTALL_PREFIX:PATH=%{_prefix} \
  -DBUILTIN_EXTERNALS:BOOL=ON \
  -DBUILTIN_EXTERNALS_LIST:STRING='libcrypto' \
  -DBUILTIN_EXTERNALS_EXCLUDE:STRING='libarchive;json;protobuf;sparsehash;leveldb;sqlite3;nettle;c-ares;curl' \
  -DBUILD_CVMFS:BOOL=ON \
  -DBUILD_LIBCVMFS:BOOL=ON \
  -DBUILD_LIBCVMFS_CACHE:BOOL=ON \
  -DBUILD_LIBFUSE2:BOOL=OFF \
  -DBUILD_SERVER:BOOL=OFF \
  -DBUILD_SERVER_DEBUG:BOOL=OFF \
  -DBUILD_RECEIVER:BOOL=OFF \
  -DBUILD_RECEIVER_DEBUG:BOOL=OFF \
  -DBUILD_GEOAPI:BOOL=OFF \
  -DBUILD_SHRINKWRAP:BOOL=OFF \
  -DBUILD_PRELOADER:BOOL=OFF \
  -DBUILD_GATEWAY:BOOL=OFF \
  -DBUILD_DUCC:BOOL=OFF \
  -DBUILD_SNAPSHOTTER:BOOL=OFF \
  -DBUILD_UNITTESTS:BOOL=OFF \
  -DBUILD_UNITTESTS_DEBUG:BOOL=OFF \
  -DBUILD_UBENCHMARKS:BOOL=OFF \
  -DBUILD_QC_TESTS:BOOL=OFF \
  -DBUILD_STRESS_TESTS:BOOL=OFF \
  .

%make_build

pushd SELinux
make -f %{_datadir}/selinux/devel/Makefile %{modulename}.pp
bzip2 -9 %{modulename}.pp
popd

%install
%make_install

install -d %{buildroot}/var/lib/cvmfs
install -d %{buildroot}/cvmfs
install -d %{buildroot}%{_sysconfdir}/cvmfs/config.d
install -d %{buildroot}%{_sysconfdir}/cvmfs/repositories.d
install -d %{buildroot}%{_sysconfdir}/bash_completion.d
install -d %{buildroot}%{_sysusersdir}
cat > %{buildroot}%{_sysusersdir}/cvmfs.conf <<'EOF'
u! cvmfs - "CernVM-FS service account" /var/lib/cvmfs /sbin/nologin
EOF

# CMake installs an absolute link; use an equivalent relocatable link to keep
# Fedora's RPM symlink check quiet.
ln -sfn ../usr/libexec/cvmfs/auto.cvmfs %{buildroot}%{_sysconfdir}/auto.cvmfs

# Keys and site configuration belong to a cvmfs-config provider.
rm -rf %{buildroot}%{_sysconfdir}/cvmfs/keys/*
rm -f %{buildroot}%{_sysconfdir}/cvmfs/config.d/README
rm -f %{buildroot}%{_sysconfdir}/cvmfs/config.d/*.conf
rm -f %{buildroot}%{_sysconfdir}/cvmfs/domain.d/*.conf
rm -f %{buildroot}%{_sysconfdir}/cvmfs/default.d/*.conf
rm -f %{buildroot}%{_sysconfdir}/cvmfs/serverorder.sh
rm -rf %{buildroot}%{_docdir}/%{name}-%{base_version}

install -D -p -m 0644 SELinux/%{modulename}.pp.bz2 \
  %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2

install -d %{buildroot}%{_unitdir}/autofs.service.d
cat > %{buildroot}%{_unitdir}/autofs.service.d/50-cvmfs.conf <<'EOF'
[Service]
KillMode=process
EOF

%pretrans
[ -d /var/spool/cvmfs ] || exit 0
[ -d /etc/cvmfs/repositories.d ] || exit 0
for repo in /var/spool/cvmfs/*; do
  [ -d "${repo}" ] || continue
  [ ! -f "/etc/cvmfs/repositories.d/$(basename "${repo}")/replica.conf" ] || continue
  if [ -e "${repo}/in_transaction.lock" ] || [ -e "${repo}/in_transaction" ]; then
    echo "Found an open CernVM-FS repository transaction." >&2
    echo "Abort or publish it before updating CernVM-FS." >&2
    exit 1
  fi
done

%post
if [ "$1" -eq 1 ]; then
  install -d -m 0755 /cvmfs
fi
systemctl daemon-reload >/dev/null 2>&1 || :
systemctl start cvmfs-reload.service >/dev/null 2>&1 || :

%preun
if [ "$1" -eq 0 ]; then
  /usr/bin/cvmfs_config umount || :
fi

%postun
if [ "$1" -eq 0 ]; then
  sed -i '/added by CernVM-FS/d' /etc/fuse.conf 2>/dev/null || :
  rm -f /etc/systemd/system/autofs.service.d/cvmfs-autosetup.conf
  if grep -q 'automatically generated by CernVM-FS' \
      /etc/auto.master.d/cvmfs.autofs 2>/dev/null; then
    rm -f /etc/auto.master.d/cvmfs.autofs
  fi
  rmdir /cvmfs 2>/dev/null || :
fi
systemctl daemon-reload >/dev/null 2>&1 || :

%pre selinux
%selinux_relabel_pre -s %{selinuxtype}

%post selinux
# Migrate the module installed at semodule's default priority (400) by older
# cvmfs RPMs.  The old package-owned policy file makes this distinguishable
# from an administrator-provided override.
if [ -f %{_datadir}/selinux/%{selinuxtype}/%{modulename}.pp ]; then
  semodule -n -s %{selinuxtype} -X 400 -r %{modulename} >/dev/null 2>&1 || :
fi
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
%selinux_relabel_post -s %{selinuxtype}

%postun selinux
if [ "$1" -eq 0 ]; then
  %selinux_modules_uninstall -s %{selinuxtype} %{modulename}
  %selinux_relabel_post -s %{selinuxtype}
fi

%files
%{_bindir}/cvmfs2
%{_bindir}/cvmfs_talk
%{_bindir}/cvmfs_fsck
%{_bindir}/cvmfs_config
%{_libexecdir}/cvmfs/auto.cvmfs
%{_libexecdir}/cvmfs/authz/cvmfs_allow_helper
%{_libexecdir}/cvmfs/authz/cvmfs_deny_helper
%{_libexecdir}/cvmfs/cache/cvmfs_cache_ram
%{_libexecdir}/cvmfs/cache/cvmfs_cache_posix
%{_sysconfdir}/auto.cvmfs
%{_sysconfdir}/cvmfs/config.sh
%{_unitdir}/autofs.service.d/50-cvmfs.conf
%{_unitdir}/cvmfs-reload.service
%{_sysusersdir}/cvmfs.conf
/sbin/mount.cvmfs
%dir %{_sysconfdir}/cvmfs/config.d
%dir %{_sysconfdir}/cvmfs/domain.d
%dir %{_sysconfdir}/bash_completion.d
%dir %{_sysconfdir}/cvmfs/default.d
%{_sysconfdir}/cvmfs/default.d/README
%config %{_sysconfdir}/cvmfs/default.conf
%config(noreplace) %{_sysconfdir}/bash_completion.d/cvmfs
%attr(0700,cvmfs,cvmfs) %dir /var/lib/cvmfs
%doc COPYING CITATION.cff README.md ChangeLog
%doc %{_mandir}/man1/cvmfs2.1.gz
%doc %{_mandir}/man1/cvmfs_config.1.gz

%files libs
%{_libdir}/libcvmfs_cache.so
%{_libdir}/libcvmfs_cache.so.%{base_version}
%{_libdir}/libcvmfs_client.so
%{_libdir}/libcvmfs_client.so.%{base_version}
%{_libdir}/libcvmfs_crypto.so
%{_libdir}/libcvmfs_crypto.so.%{base_version}
%{_libdir}/libcvmfs_crypto_debug.so
%{_libdir}/libcvmfs_crypto_debug.so.%{base_version}
%{_libdir}/libcvmfs_util.so
%{_libdir}/libcvmfs_util.so.%{base_version}
%{_libdir}/libcvmfs_util_debug.so
%{_libdir}/libcvmfs_util_debug.so.%{base_version}
%doc COPYING CITATION.cff README.md ChangeLog

%files fuse3
%{_libdir}/libcvmfs_fuse3_stub.so
%{_libdir}/libcvmfs_fuse3_stub.so.%{base_version}
%{_libdir}/libcvmfs_fuse3.so
%{_libdir}/libcvmfs_fuse3.so.%{base_version}
%{_libdir}/libcvmfs_fuse3_debug.so
%{_libdir}/libcvmfs_fuse3_debug.so.%{base_version}
%doc COPYING CITATION.cff README.md ChangeLog

%files devel
%{_includedir}/libcvmfs.h
%{_includedir}/libcvmfs_cache.h
%doc COPYING CITATION.cff README.md ChangeLog

%files selinux
%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.*
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
%license COPYING

%changelog
* Mon Aug 17 2026 CernVM-FS maintainers <cvmfs-talk@cern.ch> - 2.15.0~pre1-1
- Build Fedora client packages only
- Use all available Fedora client dependencies
- Keep the byte-compatible vendored zlib