[rpms/mstflint] rawhide: Sanitize upstream tarball to strip non-free blobs before packaging

[rpms/mstflint] rawhide: Sanitize upstream tarball to strip non-free blobs before packaging

[Michal Schmidt]

            A new commit has been pushed.

            Repo   : rpms/mstflint
            Branch : rawhide
            Commit : 3f2a55a7ededc7951307bf838e1ea5daedc0d47c
            Author : Michal Schmidt <mschmidt@redhat.com>
            Date   : 2026-09-21T16:56:11+02:00
            Stats  : +58/-5 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/mstflint/c/3f2a55a7ededc7951307bf838e1ea5daedc0d47c?branch=rawhide

            Log:
            Sanitize upstream tarball to strip non-free blobs before packaging

The upstream tarball ships prebuilt libdpa_elf blobs that must not
appear in the source RPM at all, not even transiently as removing them
in %prep would allow. Add generate-tarball.sh to repack the upstream
release with those blobs stripped, and switch Source0 to the resulting
mstflint-4.37.0-1.1.free.tar.gz.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---
diff --git a/.gitignore b/.gitignore
index 6c38209..16cee53 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,4 @@ noarch/
 /mstflint-4.35.0-1.tar.gz
 /mstflint-4.36.0-1.tar.gz
 /mstflint-4.37.0-1.1.tar.gz
+/mstflint-4.37.0-1.1.free.tar.gz

diff --git a/generate-tarball.sh b/generate-tarball.sh
new file mode 100755
index 0000000..434c6d1
--- /dev/null
+++ b/generate-tarball.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-only OR Linux-OpenIB
+# Fetches the upstream mstflint release tarball and repacks it with the
+# non-free, prebuilt libdpa_elf blobs removed, so that those blobs never
+# end up in our source RPM (not even transiently, as %prep would allow).
+#
+# The result is named after the upstream tarball with a ".free" suffix
+# inserted before the extension, to make clear it is not the pristine
+# upstream artifact. It is meant to be uploaded to the lookaside cache
+# as Source0:
+#
+#   ./generate-tarball.sh
+#   fedpkg new-sources mstflint-4.37.0-1.1.free.tar.gz
+
+set -eu
+
+scriptdir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+spec="$scriptdir/mstflint.spec"
+
+mainver=$(sed -n 's/^%global mainver[[:space:]]\+//p' "$spec")
+subver=$(sed -n 's/^%global subver[[:space:]]\+//p' "$spec")
+if [ -z "$mainver" ] || [ -z "$subver" ]; then
+	echo "Could not parse mainver/subver from $spec" >&2
+	exit 1
+fi
+
+name=mstflint
+tarball="${name}-${mainver}-${subver}.tar.gz"
+out_tarball="${name}-${mainver}-${subver}.free.tar.gz"
+url="https://github.com/Mellanox/${name}/releases/download/v${mainver}-${subver}/${tarball}"
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+curl -fL -o "$workdir/$tarball" "$url"
+tar -C "$workdir" -xzf "$workdir/$tarball"
+
+# Non-free, prebuilt ELF blobs. mstflint builds and works fine without
+# them; only the ability to embed a default DPA ELF via mstflint-format
+# is lost, which we don't need.
+find "$workdir/${name}-${mainver}" -path '*/mlxdpa/dpa_elf/*/libdpa_elf' -print -delete
+
+tar -C "$workdir" \
+	--sort=name --owner=0 --group=0 --numeric-owner --mtime='UTC 1970-01-01' \
+	-czf "$out_tarball" "${name}-${mainver}"
+
+echo "Wrote $(pwd)/$out_tarball"

diff --git a/mstflint.spec b/mstflint.spec
index 6e4964b..55ed2cd 100644
--- a/mstflint.spec
+++ b/mstflint.spec
@@ -13,7 +13,15 @@ Release:	%autorelease
 # ext_libs/sqlite/ has the SQLite blessing.
 License:	(GPL-2.0-only OR Linux-OpenIB) AND BSD-3-Clause AND MIT AND blessing
 Url:		https://github.com/Mellanox/%{name}
-Source0: 	https://github.com/Mellanox/%{name}/releases/download/v%{mainver}-%{subver}/%{name}-%{mainver}-%{subver}.tar.gz
+# The upstream tarball at
+# https://github.com/Mellanox/%{name}/releases/download/v%{mainver}-%{subver}/%{name}-%{mainver}-%{subver}.tar.gz
+# ships prebuilt, non-free libdpa_elf blobs (mlxdpa/dpa_elf/*/libdpa_elf).
+# Removing them in %%prep is not enough, since they would still be present
+# in the source RPM. Instead, Source0 is a repacked version with the
+# blobs stripped out by generate-tarball.sh, distinguished from the
+# pristine upstream tarball by a ".free" suffix.
+Source0:	%{name}-%{mainver}-%{subver}.free.tar.gz
+Source1:	generate-tarball.sh
 
 # jsoncpp and muParser are not in the RHEL/ELN content set, so we must
 # bundle them there. On Fedora, use the system libraries.
@@ -75,9 +83,6 @@ for network adapters based on Mellanox Technologies chips.
 %prep
 %autosetup -p1 -n %{name}-%{mainver}
 
-# Delete blobs
-rm mlxdpa/dpa_elf/*/libdpa_elf
-
 # Make sure system libraries are used where possible. Delete the bundled
 # sources. Exception: Keep */Makefile.am files because Makefiles are listed
 # as AC_CONFIG_FILES in configure.ac unconditionally.

diff --git a/sources b/sources
index 2cef648..95895b6 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (mstflint-4.37.0-1.1.tar.gz) = b0e50867d98481d70989faa06ddae38b46afca813e48dda29ae4b20b1725e3ac42e0995d13d9a07c6f954c4472a00e5d7773dd5423912647e3b60cbd6c9c57fe
+SHA512 (mstflint-4.37.0-1.1.free.tar.gz) = 17ca55deafd107ff97e261c333c7fc05c903d9e558dc3ba0a0bd88c0e1ab9b6d8a0e559331ae389c50b54ee947ec3d227ae94b823a569785179dee09a160f7e2