[rpms/libcap-ng] rawhide: Apply Zbigniew's patch

[Steve Grubb <sgrubb@redhat.com>]

A new commit has been pushed.

Repo   : rpms/libcap-ng
Branch : rawhide
Commit : 3c66f5632f60507d51f5ebfc125cdb15dba4baf1
Author : Steve Grubb <sgrubb@redhat.com>
Date   : 2026-08-03T15:17:12-04:00
Stats  : +160/-3 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/libcap-ng/c/3c66f5632f60507d51f5ebfc125cdb15dba4baf1?branch=rawhide

Log:
Apply Zbigniew's patch

---
diff --git a/0001-cap-audit-allow-supplying-vmlinux.h-for-reproducible.patch b/0001-cap-audit-allow-supplying-vmlinux.h-for-reproducible.patch
new file mode 100644
index 0000000..7da2241
--- /dev/null
+++ b/0001-cap-audit-allow-supplying-vmlinux.h-for-reproducible.patch
@@ -0,0 +1,139 @@
+From c87636e78cb101e3305b8b970f15e71b0fcfde4b Mon Sep 17 00:00:00 2001
+From: Daan De Meyer <daan@amutable.com>
+Date: Tue, 7 Jul 2026 09:57:57 +0200
+Subject: [PATCH] cap-audit: allow supplying vmlinux.h for reproducible builds
+
+By default cap-audit generates vmlinux.h from the running kernel's BTF
+data in /sys/kernel/btf/vmlinux, which makes the build depend on the host
+kernel and is therefore not reproducible.
+
+Add --with-vmlinux-h=auto|provided|generated and --with-vmlinux-h-path=PATH
+so a pre-generated vmlinux.h can be supplied at configure time instead. In
+provided mode the file is copied as-is and /sys is never read; generated
+mode keeps the existing behaviour.
+---
+ configure.ac                | 62 +++++++++++++++++++++++++++++++++++++
+ utils/cap-audit/Makefile.am |  8 +++++
+ 2 files changed, 70 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 44ef598d06..61cbb4e06b 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -70,6 +70,23 @@ AS_HELP_STRING([--enable-cap-audit],[build cap-audit [[default=no]]]),
+ [enable_cap_audit=$enableval],
+ [enable_cap_audit=no])
+ 
++dnl For reproducible builds cap-audit's vmlinux.h can be supplied at
++dnl configure time instead of being generated from the running kernel's BTF
++dnl data in /sys/kernel/btf/vmlinux.
++AC_ARG_WITH([vmlinux-h],
++AS_HELP_STRING([--with-vmlinux-h=MODE],
++[how to obtain cap-audit's vmlinux.h: auto, provided, or generated [[default=auto]]]),
++[with_vmlinux_h="$withval"],
++[with_vmlinux_h=auto])
++AC_ARG_WITH([vmlinux-h-path],
++AS_HELP_STRING([--with-vmlinux-h-path=PATH],
++[path to a pre-generated vmlinux.h to use for cap-audit]),
++[with_vmlinux_h_path="$withval"],
++[with_vmlinux_h_path=""])
++
++VMLINUX_H_PATH=""
++vmlinux_h_status="n/a (cap-audit disabled)"
++
+ if test "x$enable_cap_audit" = "xyes"; then
+ missing_cap_audit_deps=no
+ AC_CHECK_PROG([CLANG],[clang],[clang],[no])
+@@ -85,6 +102,48 @@ if test "$CLANG" = "no" -o "$BPFTOOL" = "no" -o \
+ "x$missing_cap_audit_deps" = "xyes"; then
+ AC_MSG_ERROR([cap-audit requires clang, bpftool, libbpf, and libaudit])
+ fi
++
++AC_MSG_CHECKING([how to obtain vmlinux.h])
++case "$with_vmlinux_h" in
++auto)
++if test "x$with_vmlinux_h_path" != "x"; then
++vmlinux_h_source=provided
++else
++vmlinux_h_source=generated
++fi
++;;
++provided)
++vmlinux_h_source=provided
++;;
++generated)
++vmlinux_h_source=generated
++;;
++*)
++AC_MSG_RESULT([error])
++AC_MSG_ERROR([invalid --with-vmlinux-h value '$with_vmlinux_h' (expected auto, provided, or generated)])
++;;
++esac
++
++if test "x$vmlinux_h_source" = "xprovided"; then
++if test "x$with_vmlinux_h_path" = "x"; then
++AC_MSG_RESULT([error])
++AC_MSG_ERROR([--with-vmlinux-h=provided requires --with-vmlinux-h-path=PATH])
++fi
++if test ! -f "$with_vmlinux_h_path"; then
++AC_MSG_RESULT([error])
++AC_MSG_ERROR([provided vmlinux.h not found: $with_vmlinux_h_path])
++fi
++dnl Resolve to an absolute path so the build works from any directory.
++case "$with_vmlinux_h_path" in
++/*) VMLINUX_H_PATH="$with_vmlinux_h_path" ;;
++*)  VMLINUX_H_PATH="`pwd`/$with_vmlinux_h_path" ;;
++esac
++vmlinux_h_status="provided ($VMLINUX_H_PATH)"
++AC_MSG_RESULT([provided ($VMLINUX_H_PATH)])
++else
++vmlinux_h_status="generated from /sys/kernel/btf/vmlinux"
++AC_MSG_RESULT([generated from /sys/kernel/btf/vmlinux])
++fi
+ fi
+ 
+ if test "x$BPF_ARCH" = "x"; then
+@@ -142,8 +201,10 @@ AC_SUBST(LIBBPF_CFLAGS)
+ AC_SUBST(LIBBPF_LIBS)
+ AC_SUBST(LIBAUDIT_CFLAGS)
+ AC_SUBST(LIBAUDIT_LIBS)
++AC_SUBST(VMLINUX_H_PATH)
+ 
+ AM_CONDITIONAL([BUILD_CAP_AUDIT], [test "x$enable_cap_audit" = "xyes"])
++AM_CONDITIONAL([PROVIDED_VMLINUX_H], [test "x$VMLINUX_H_PATH" != "x"])
+ AM_CONDITIONAL([BUILD_DEPRECATED], [test "x$enable_deprecated" = "xyes"])
+ 
+ echo .
+@@ -324,4 +385,5 @@ echo "
+ `echo $CFLAGS | fmt -w 50 | sed 's,^,                          ,'`
+   __attr_dealloc_free support:  $DEALLOC
+   netcap advanced mode:  $netcap_advanced_status
++  cap-audit vmlinux.h:   $vmlinux_h_status
+   "
+diff --git a/utils/cap-audit/Makefile.am b/utils/cap-audit/Makefile.am
+index 9fed078fcd..aea8c39547 100644
+--- a/utils/cap-audit/Makefile.am
++++ b/utils/cap-audit/Makefile.am
+@@ -45,6 +45,7 @@ cap_audit_util.$(OBJEXT) cap_audit_yaml.$(OBJEXT): cap_audit.skel.h
+ BPF_ARCH = @BPF_ARCH@
+ BPFTOOL = @BPFTOOL@
+ CLANG = @CLANG@
++VMLINUX_H_PATH = @VMLINUX_H_PATH@
+ 
+ BPF_CFLAGS = -g -O2 -target bpf -D__TARGET_ARCH_${BPF_ARCH} ${AM_CPPFLAGS}
+ 
+@@ -54,7 +55,14 @@ cap_audit.skel.h: cap_audit.bpf.o
+ cap_audit.bpf.o: cap_audit.bpf.c vmlinux.h
+ 	$(AM_V_CC)$(CLANG) $(BPF_CFLAGS) -c $< -o $@
+ 
++if PROVIDED_VMLINUX_H
++# Reproducible builds: use the vmlinux.h supplied at configure time via
++# --with-vmlinux-h-path instead of reading the running kernel's BTF data.
++vmlinux.h: $(VMLINUX_H_PATH)
++	$(AM_V_GEN)cp $< $@
++else
+ vmlinux.h:
+ 	$(AM_V_GEN)$(BPFTOOL) btf dump file /sys/kernel/btf/vmlinux format c > $@
++endif
+ 
+ man_MANS = cap-audit.8

diff --git a/libcap-ng.spec b/libcap-ng.spec
index 43121c6..078a6cc 100644
--- a/libcap-ng.spec
+++ b/libcap-ng.spec
@@ -2,12 +2,18 @@
 Summary: Alternate posix capabilities library
 Name: libcap-ng
 Version: 0.9.3
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: LGPL-2.0-or-later
 URL: https://github.com/stevegrubb/libcap-ng
 Source0: %{name}-%{version}.tar.gz
+# https://github.com/stevegrubb/libcap-ng/pull/81.patch
+Patch0: 0001-cap-audit-allow-supplying-vmlinux.h-for-reproducible.patch
+
 BuildRequires: gcc make
 BuildRequires: autoconf automake libtool
+%ifnarch %{ix86}
+BuildRequires: kernel-devel
+%endif
 BuildRequires: kernel-headers >= 2.6.11 
 BuildRequires: libattr-devel
 %ifarch %{bpf_supported_arches}
@@ -58,14 +64,23 @@ to determine the necessary capabilities for a program.
 
 %prep
 %setup -q
-touch NEWS
-autoreconf -fv --install
+touch -d @${SOURCE_DATE_EPOCH:?} NEWS
+%patch -P 0 -p1
 
 %build
+# Locate suitable vmlinux.h. In normal builds under mock,
+# there'll be just one. But in case multiple kernel-devel packages
+# are installed, sort alphabetically and pick the last version.
+vmlinux_h="$(ls -1 /usr/src/kernels/*/vmlinux.h | sort -g | tail -n 1)"
+
+autoreconf -fv --install
 %configure --libdir=%{_libdir} \
 %ifarch %{bpf_supported_arches}
 	 --enable-cap-audit=yes \
 %endif
+%ifnarch %{ix86}
+	--with-vmlinux-h-path="${vmlinux_h}" \
+%endif
 	--with-python3
 
 %make_build CFLAGS="%{optflags}"
@@ -118,6 +133,9 @@ make check
 %endif
 
 %changelog
+* Mon Aug 03 2026 Zbigniew Jędrzejewski-Szmek  <zbyszek@in.waw.pl> - 0.9.4-5
+- Use provided vmlinux.h to improve build reproducibility
+
 * Wed Jul 22 2026 Python Maint <python-maint@redhat.com> - 0.9.3-4
 - Rebuilt for Python 3.15.0b4 ABI change