Challenges building the SP in UBI containers [WAS Shibboleth developer call 2023-07-21]

[John W. O'Brien]

On 7/20/23 11:59, Cantor, Scott via dev wrote:
>> We (our customers and internal) are committed (forced?) to support RHEL
>> and (by hook or crook some other identical EL) - happy to support with
>> resources or opinions....
> 
[...]
> 
> The SP side is more troublesome, at some point if we have to get packages built for RH natively we probably can, it's just a challenge right now to get the Docker build doing that so we've been using the clones to avoid the problem. We will probably have to get that working one way or the other with OSS or individual developer accounts to get access to the repositories for building the images.
> 

Hi Jason,

As we discussed on the developer call this morning, my efforts to enable 
building [0] the SP in a container on any version of Red Hat's UBI have 
gotten bogged down in satisfying the build dependencies. This includes 
some build tools as well as a handful of *-devel RPMs.

Here is a summary of the as-yet unmet dependencies by UBI version, where 
"x" means unmet and "-" means met or not applicable.

     RPM                 UBI7    UBI8    UBI9
     boost-devel         x       x       x
     chrpath             x       -       -
     createrepo_c        x       x       x
     doxygen             x       x       x
     groff               x       x       x
     httpd-devel         x       -       -
     libidn-devel        x       -       -
     libmemcached-devel  x       -       -
     rpm-build           x       -       -
     systemd-devel       x       -       -
     unixODBC-devel      -       -       x

If you and your team have solved any part of this, or have insight into 
what a good solution would look like, I would welcome the input.

FWIW, one of the things I've learned so far is that createrepo_c appears 
in none of the repos available in the stock UBI, but it does appear from 
the perspective of an EC2 instance launched from a Red Hat AMI. So much 
for the U in UBI.

Oh, and to respond to a point Ian raised, the set of missing RPMs is 
unchanged if I run the UBI container on the Red Hat EC2 instance instead 
of my customary Rocky instance.

Have a nice weekend,
John

[0] https://git.shibboleth.net/view/?p=cpp-linbuild.git;a=summary
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x33C4D64B895DBF3B.asc
Type: application/pgp-keys
Size: 13270 bytes
Desc: OpenPGP public key
URL: <http://shibboleth.net/pipermail/dev/attachments/20230721/2ef650db/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20230721/2ef650db/attachment.sig>