Skip to content

feat(elf-metadata): embed os, osVersion, and moduleVersion in .note.package#17671

Open
anphel31 wants to merge 1 commit into
4.0from
anphel/elf-metadata-updates
Open

feat(elf-metadata): embed os, osVersion, and moduleVersion in .note.package#17671
anphel31 wants to merge 1 commit into
4.0from
anphel/elf-metadata-updates

Conversation

@anphel31

@anphel31 anphel31 commented Jun 10, 2026

Copy link
Copy Markdown
Member

Summary

Adds three structured fields — os, osVersion, and moduleVersion — to the
.note.package ELF section that the package-notes linker spec injects into
every dynamically-linked binary built with our LDFLAGS. These sit alongside the
existing osCpe and give SBOM and crash-analysis tooling a pre-parsed view of
the build's OS identity and package version without having to crack the CPE
string.

Example .note.package payload after this change (/usr/bin/tar):

{
    "type": "rpm",
    "name": "tar",
    "version": "1.35-7.azl4",
    "architecture": "x86_64",
    "osCpe": "cpe:2.3:o:microsoft:azure_linux:4.0:*:*:*:*:*:*:*",
    "os": "azure_linux",
    "osVersion": "4.0",
    "moduleVersion": "1.35.0.0"
}

Before this change:

{
    "type": "rpm",
    "name": "tar",
    "version": "1.35-7.azl4",
    "architecture": "x86_64",
    "osCpe": "cpe:/o:microsoft:azurelinux:4.0"
}

Note related PR #17685

@anphel31 anphel31 marked this pull request as ready for review June 10, 2026 00:33
Copilot AI review requested due to automatic review settings June 10, 2026 00:33

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR extends the package-notes linker spec JSON payload embedded in .note.package to include structured OS identity (os, osVersion) and a normalized moduleVersion, and wires rpmbuild macro hooks to ensure the needed environment is present across build phases.

Changes:

  • Extend redhat-package-notes.in JSON payload with os, osVersion, and moduleVersion.
  • Add an rpmbuild hook (%_generate_package_note_file) to export RPM_MODULE_VERSION, and ensure it runs during %install as well.
  • Introduce a dedicated package-notes component definition with overlays + build-time self-tests; update locks and rendered specs accordingly.

Reviewed changes

Copilot reviewed 8 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
specs/p/package-notes/redhat-package-notes.in Adds the new JSON keys to the linker spec template.
specs/p/package-notes/package-notes.spec Updates %build generation and adds self-test checks for the injected fields/hook.
specs/p/package-notes/macros.package-notes-srpm Implements %_generate_package_note_file to export RPM_MODULE_VERSION.
specs/a/azurelinux-rpm-config/macros Expands %{?_generate_package_note_file} in %__spec_install_pre to cover install-time relinks.
specs/a/azurelinux-rpm-config/azurelinux-rpm-config.spec Adds a build-time guard to detect missing hook expansions in macros.
locks/package-notes.lock Updates input fingerprint after component customization.
locks/azurelinux-rpm-config.lock Updates input fingerprint after overlay changes.
base/comps/package-notes/package-notes.comp.toml New dedicated component with overlays to inject fields and enforce self-tests.
base/comps/components.toml Removes inline package-notes entry now that it has a dedicated comp file.
base/comps/azurelinux-rpm-config/azurelinux-rpm-config.comp.toml Adds overlay to wire the hook into %__spec_install_pre and adds a guard in %install.

Comment thread base/comps/package-notes/package-notes.comp.toml Outdated
Comment thread specs/p/package-notes/package-notes.spec Outdated
Comment thread base/comps/azurelinux-rpm-config/azurelinux-rpm-config.comp.toml Outdated
@anphel31 anphel31 force-pushed the anphel/elf-metadata-updates branch from fe5a977 to f673668 Compare June 10, 2026 01:59
…pe in .note.package

Enrich the FDO_PACKAGING_METADATA ELF note emitted into every binary built
with the Azure Linux LDFLAGS so SBOM and crash-analysis tools (e.g. Azure
Watson) get a parsed view of the build's OS identity and package version.

package-notes:
- Add structured "os", "osVersion" and "moduleVersion" keys to the
  .note.package JSON payload, alongside "osCpe".
- Hardcode osCpe to the canonical CPE 2.3 string
  "cpe:2.3:o:microsoft:azure_linux:4.0:*:*:*:*:*:*:*" and set os to
  "azure_linux" / osVersion to "4.0", instead of reading
  /usr/lib/system-release-cpe. During Stage 1 the buildroot is seeded from
  the Fedora package set, so that file reports the Fedora CPE and would bake
  the wrong identity into every binary; hardcoding guarantees correct
  metadata regardless of the seed.
- Derive moduleVersion as a 4-part, zero-padded numeric form of
  RPM_PACKAGE_VERSION, truncating each dot-separated field at the first
  non-digit (so prerelease/git suffixes are dropped, not folded in).
  Exported via the %_generate_package_note_file hook in
  macros.package-notes-srpm.
- Self-test in %build that the generated linker spec contains the expected
  fields, failing the build loudly on overlay regression.

azurelinux-rpm-config:
- Hook %{?_generate_package_note_file} into %__spec_install_pre so
  RPM_MODULE_VERSION is exported during %install as well as %build/%check.
  Packages that relink during %install (e.g. avahi's libtool --relink for
  PIE libraries) otherwise fail because the package-notes GCC linker spec
  uses a strict %:getenv() lookup that aborts the link when the var is unset.
@anphel31 anphel31 force-pushed the anphel/elf-metadata-updates branch from f673668 to 43bedfc Compare June 11, 2026 18:17
@anphel31 anphel31 requested a review from a team as a code owner June 11, 2026 18:17

@ddstreetmicrosoft ddstreetmicrosoft left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Er, no.

What problem is this attempting to fix?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants