Build updates (#1016)

Upstream related updates to build and dependencies

- webkit2gtk4.1
- pyo3 0.21
- pyo3-log 0.10
- fixes el9 build
- pyo3 0.21 Bound smart pointer
- flit-core 3.9.0
- do not update hugo deps


Closes #903
Closes #1015 
Closes #1017

.github/rpm-matrix.json

@@ -2,29 +2,29 @@
   "props": [
     {
       "platform": "fedora",
-      "dist": "fc40",
+      "dist": "fc41",
       "spec": "fapolicy-analyzer.spec",
-      "image": "registry.fedoraproject.org/fedora:40",
+      "image": "registry.fedoraproject.org/fedora:41",
       "chroot": "fedora-rawhide-x86_64",
-      "version": "40",
+      "version": "41",
       "prerelease": true
     },
     {
       "platform": "fedora",
-      "dist": "fc39",
+      "dist": "fc40",
       "spec": "fapolicy-analyzer.spec",
-      "image": "registry.fedoraproject.org/fedora:39",
-      "chroot": "fedora-39-x86_64",
-      "version": "39",
+      "image": "registry.fedoraproject.org/fedora:40",
+      "chroot": "fedora-40-x86_64",
+      "version": "40",
       "prerelease": false
     },
     {
       "platform": "fedora",
-      "dist": "fc38",
+      "dist": "fc39",
       "spec": "fapolicy-analyzer.spec",
-      "image": "registry.fedoraproject.org/fedora:38",
-      "chroot": "fedora-38-x86_64",
-      "version": "38",
+      "image": "registry.fedoraproject.org/fedora:39",
+      "chroot": "fedora-39-x86_64",
+      "version": "39",
       "prerelease": false
     },
     {

.github/workflows/pages.yml

@@ -47,7 +47,7 @@ jobs:
 
       - name: Install Hugo modules
         run: |
-          hugo mod get -u
+          hugo config
         working-directory: doc/site
 
       - name: Hugo build

.github/workflows/rpm.yml

@@ -100,7 +100,7 @@ jobs:
     steps:
       - name: Install RPM build dependencies
         run: |
-          dnf install -y git dnf-plugins-core cargo2rpm
+          dnf install -y git dnf5-plugins dnf-plugins-core cargo2rpm
 
       - uses: actions/checkout@v3
         with:
@@ -309,7 +309,7 @@ jobs:
           echo "token = ${COPR_TOKEN}" >> $HOME/.config/copr
           echo "copr_url = https://copr.fedorainfracloud.org" >> $HOME/.config/copr
         env:
-          COPR_USER:  ${{ secrets.COPR_API_USER }}
+          COPR_USER: ${{ secrets.COPR_API_USER }}
           COPR_LOGIN: ${{ secrets.COPR_API_LOGIN }}
           COPR_TOKEN: ${{ secrets.COPR_API_TOKEN }}
 

crates/pyo3/Cargo.toml

@@ -10,12 +10,12 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-pyo3 = { version = "0.20", features = ["abi3", "auto-initialize"] }
+pyo3 = { version = "0.21", features = ["abi3", "auto-initialize"] }
 similar = "2.1"
 chrono = "0.4"
 tempfile = "3.3"
 log = "0.4"
-pyo3-log = "0.9"
+pyo3-log = "0.10"
 
 fapolicy-analyzer = { path = "../analyzer" }
 fapolicy-auparse = { path = "../auparse" }

crates/pyo3/src/acl.rs

@@ -87,7 +87,7 @@ impl PyGroup {
     }
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_class::<PyUser>()?;
     m.add_class::<PyGroup>()?;
     Ok(())

crates/pyo3/src/analysis.rs

@@ -326,7 +326,7 @@ mod tests {
     }
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_class::<PyEvent>()?;
     m.add_class::<PySubject>()?;
     m.add_class::<PyObject>()?;

crates/pyo3/src/auparse.rs

@@ -14,7 +14,7 @@ fn is_audit_available() -> bool {
     cfg!(feature = "audit")
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(is_audit_available, m)?)?;
     Ok(())
 }

crates/pyo3/src/check.rs

@@ -196,7 +196,7 @@ fn calculate_batch_config(rec_sz: usize) -> BatchConfig {
     }
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(check_system_trust, m)?)?;
     m.add_function(wrap_pyfunction!(check_ancillary_trust, m)?)?;
     m.add_function(wrap_pyfunction!(check_all_trust, m)?)?;

crates/pyo3/src/config.rs

@@ -40,7 +40,7 @@ fn app_config_dir() -> String {
     cfg::config_dir()
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(config_file_path, m)?)?;
     m.add_function(wrap_pyfunction!(app_log_dir, m)?)?;
     m.add_function(wrap_pyfunction!(app_data_dir, m)?)?;

crates/pyo3/src/daemon.rs

@@ -238,7 +238,7 @@ fn conf_text_error_check(txt: &str) -> Option<String> {
     }
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_class::<PyHandle>()?;
     m.add_class::<PyChangeset>()?;
     m.add_class::<PyConfigInfo>()?;

crates/pyo3/src/lib.rs

@@ -20,7 +20,7 @@ pub mod system;
 pub mod trust;
 
 #[pymodule]
-fn rust(_py: Python, m: &PyModule) -> PyResult<()> {
+fn rust(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     auparse::init_module(_py, m)?;
     acl::init_module(_py, m)?;
     analysis::init_module(_py, m)?;

crates/pyo3/src/profiler.rs

@@ -131,11 +131,11 @@ impl PyProfiler {
     }
 
     fn profile(&self, target: &str) -> PyResult<ProcHandle> {
-        self.profile_all(vec![target])
+        self.profile_all(vec![target.to_owned()])
     }
 
     // accept callback for exec control (eg kill), and done notification
-    fn profile_all(&self, targets: Vec<&str>) -> PyResult<ProcHandle> {
+    fn profile_all(&self, targets: Vec<String>) -> PyResult<ProcHandle> {
         log::debug!("profile_all {}", targets.join(";"));
         // the working dir must exist prior to execution
         if let Some(pwd) = self.pwd.as_ref() {
@@ -494,7 +494,7 @@ fn reload_profiler_rules(system: &PySystem) -> PyResult<()> {
         .map_err(|e| exceptions::PyRuntimeError::new_err(format!("Reload failed: {:?}", e)))
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_class::<PyProfiler>()?;
     m.add_class::<ProcHandle>()?;
     m.add_class::<ExecHandle>()?;

crates/pyo3/src/rules.rs

@@ -230,7 +230,7 @@ pub(crate) fn text_for_entry(e: &Entry) -> String {
 // #[pyfunction]
 // fn text_to_rule_db(txt: &str) -> PyResult<PyDict> {}
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_class::<PyRule>()?;
     m.add_class::<PyRuleInfo>()?;
     m.add_class::<PyChangeset>()?;

crates/pyo3/src/system.rs

@@ -274,7 +274,7 @@ pub fn rule_identity(system: &PySystem) -> PyResult<String> {
         .map_err(|e| exceptions::PyRuntimeError::new_err(format!("{:?}", e)))
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_class::<PySystem>()?;
     m.add_function(wrap_pyfunction!(config_difference, m)?)?;
     m.add_function(wrap_pyfunction!(rules_difference, m)?)?;

crates/pyo3/src/trust.rs

@@ -202,7 +202,7 @@ fn signal_rule_reload() -> PyResult<()> {
         .map_err(|e| PyRuntimeError::new_err(format!("failed to signal rules reload: {:?}", e)))
 }
 
-pub fn init_module(_py: Python, m: &PyModule) -> PyResult<()> {
+pub fn init_module(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_class::<PyChangeset>()?;
     m.add_class::<PyTrust>()?;
     m.add_class::<PyActual>()?;

fapolicy-analyzer.spec

@@ -55,8 +55,12 @@ Requires:      gtksourceview3
 Requires:      gnome-icon-theme
 
 # runtime required for rendering user guide
-Requires:      webkit2gtk3
 Requires:      mesa-dri-drivers
+%if 0%{?fedora} < 40
+Requires:      webkit2gtk3
+%else
+Requires:      webkit2gtk4.1
+%endif
 
 %global module          fapolicy_analyzer
 # pep440 versions handle dev and rc differently, so we call them out explicitly here

help/__init__.py

@@ -19,7 +19,6 @@
 import shutil
 import subprocess
 import urllib.request
-from distutils import dir_util
 from glob import glob
 from os import makedirs, path
 from typing import Optional, Sequence
@@ -157,7 +156,6 @@ def html_file(md, html):
         # Also include relative media
         media_urls = _parse_media_urls(html, media_url)
         for url in media_urls:
-
             # Construct path to relative media in help staging area
             url_tuple = urlparse(url)
             filename = path.basename(url_tuple.path)
@@ -267,9 +265,9 @@ def build_help(
             # copy media to language directory
             source_media = path.join(source, "C", "media")
             build_media = path.join(build_path, "media")
-            dir_util.copy_tree(source_media, build_media)
+            shutil.copytree(source_media, build_media, dirs_exist_ok=True)
         else:
-            dir_util.copy_tree(source_path, build_path)
+            shutil.copytree(source_path, build_path, dirs_exist_ok=True)
 
 
 def install_help(
@@ -283,7 +281,7 @@ def install_help(
         print(f"\t{lang}")
         lang_source = path.join(source, lang)
         lang_dest = path.join(dest, lang, name)
-        dir_util.copy_tree(lang_source, lang_dest)
+        shutil.copytree(lang_source, lang_dest, dirs_exist_ok=True)
 
 
 def _args():

news/1016.packaging.md

@@ -0,0 +1 @@
+Supporting Fedora 41, 40, 39, dropped support for 38.

scripts/srpm/fapolicy-analyzer.el9.spec

@@ -21,7 +21,7 @@ Source15:      %{pypi_source semantic_version 2.8.2}
 Source16:      %{pypi_source packaging 21.3}
 Source17:      %{pypi_source pyparsing 2.1.0}
 Source18:      %{pypi_source tomli 1.2.3}
-Source19:      %{pypi_source flit_core 3.7.1}
+Source19:      %{pypi_source flit_core 3.9.0}
 Source20:      %{pypi_source typing_extensions 3.7.4.3}
 
 BuildRequires: python3-devel
@@ -162,17 +162,15 @@ ln -sf  %{python3_sitelib}/{Babel*,babel} %{venv_lib}
 # /usr/share/cargo/registry so we work around this by linking the contents
 # of the default registry into a new writable location, and then extract
 # the contents of the vendor tarball to this new writable dir.
-# The extraction favor the system crates by untaring with --skip-old-files
+# The extraction favors the system crates by untaring with --skip-old-files
 # Later the Cargo config will be updated to point to this new registry dir
+# The crates in the vendor tarball are collected from Rawhide.
 CARGO_REG_DIR=%{_builddir}/vendor-rs
 mkdir -p ${CARGO_REG_DIR}
 for d in %{cargo_registry}/*; do ln -sf ${d} ${CARGO_REG_DIR} || true; done
 tar -xzf %{SOURCE2} -C ${CARGO_REG_DIR} --skip-old-files --strip-components=2
 
-%cargo_prep
-
-# here the Cargo config is updated to point to the new registry dir
-sed -i "s#%{cargo_registry}#${CARGO_REG_DIR}#g" .cargo/config
+%cargo_prep -v ${CARGO_REG_DIR}
 
 %autosetup -n %{name}