From 12544770142bf229e742e323f76763f5bcee5305 Mon Sep 17 00:00:00 2001
From: Gus Luxton <gus@gravitational.com>
Date: Mon, 31 May 2021 13:52:30 -0300
Subject: [PATCH] rpm: Don't include build-id artifacts in packages (#7080)

Fixes #7040
---
 Makefile                        | 1 +
 build.assets/build-package.sh   | 9 ++++++---
 build.assets/rpm-sign/rpmmacros | 4 +++-
 build.assets/rpm/rpmmacros      | 2 ++
 4 files changed, 12 insertions(+), 4 deletions(-)
 create mode 100644 build.assets/rpm/rpmmacros

diff --git a/Makefile b/Makefile
index 0257304ea7a..2105fc75c32 100644
--- a/Makefile
+++ b/Makefile
@@ -651,6 +651,7 @@ rpm:
 	mkdir -p $(BUILDDIR)/
 	cp ./build.assets/build-package.sh $(BUILDDIR)/
 	chmod +x $(BUILDDIR)/build-package.sh
+	cp -a ./build.assets/rpm $(BUILDDIR)/
 	cp -a ./build.assets/rpm-sign $(BUILDDIR)/
 	cd $(BUILDDIR) && ./build-package.sh -t oss -v $(VERSION) -p rpm -a $(ARCH) $(RUNTIME_SECTION) $(TARBALL_PATH_SECTION)
 	if [ -f e/Makefile ]; then $(MAKE) -C e rpm; fi
diff --git a/build.assets/build-package.sh b/build.assets/build-package.sh
index e038e5a90ab..6a5d191fc58 100755
--- a/build.assets/build-package.sh
+++ b/build.assets/build-package.sh
@@ -62,11 +62,11 @@ LINUX_CONFIG_DIR=/etc
 LINUX_DATA_DIR=/var/lib/teleport
 
 # extra package information for linux
-MAINTAINER="info@gravitational.com"
+MAINTAINER="info@goteleport.com"
 LICENSE="Apache-2.0"
 VENDOR="Gravitational"
-DESCRIPTION="Gravitational Teleport is a gateway for managing access to clusters of Linux servers via SSH or the Kubernetes API"
-DOCS_URL="https://gravitational.com/teleport/docs"
+DESCRIPTION="Teleport is a gateway for managing access to clusters of Linux servers via SSH or the Kubernetes API"
+DOCS_URL="https://goteleport.com/docs"
 
 # signing IDs to use for mac (must be pre-loaded into the keychain on the build box)
 DEVELOPER_ID_APPLICATION="Developer ID Application: Gravitational Inc." # used for signing binaries
@@ -249,6 +249,8 @@ else
     if [[ "${PACKAGE_TYPE}" == "rpm" ]]; then
         OUTPUT_FILENAME="${TAR_PATH}-${TELEPORT_VERSION}-1${OPTIONAL_RUNTIME_SECTION}.${ARCH}.rpm"
         FILE_PERMISSIONS_STANZA="--rpm-user root --rpm-group root --rpm-use-file-permissions "
+        # the rpm/rpmmacros file suppresses the creation of .build-id files (see https://github.com/gravitational/teleport/issues/7040)
+        EXTRA_DOCKER_OPTIONS="-v $(pwd)/rpm/rpmmacros:/root/.rpmmacros"
         # if we set this environment variable, don't sign RPMs (can be useful for building test RPMs
         # without having the signing keys)
         if [ "${UNSIGNED_RPM}" == "true" ]; then
@@ -257,6 +259,7 @@ else
             # the GNUPG_DIR location here is assumed to contain a complete ~/.gnupg directory structure
             # with pubring.kbx and trustdb.gpg files, plus a private-keys-v1.d directory with signing keys
             # it needs to contain the "Gravitational, Inc" private key and signing key.
+            # we also use the rpm-sign/rpmmacros file instead which contains extra directives used for signing.
             EXTRA_DOCKER_OPTIONS="-v $(pwd)/rpm-sign/rpmmacros:/root/.rpmmacros -v $(pwd)/rpm-sign/popt-override:/etc/popt.d/rpmsign-override -v ${GNUPG_DIR}:/root/.gnupg"
             RPM_SIGN_STANZA="--rpm-sign"
         fi
diff --git a/build.assets/rpm-sign/rpmmacros b/build.assets/rpm-sign/rpmmacros
index 809e734a341..b9e477c16c7 100644
--- a/build.assets/rpm-sign/rpmmacros
+++ b/build.assets/rpm-sign/rpmmacros
@@ -4,4 +4,6 @@
 %_gpgbin /usr/bin/gpg
 %_gpg_pass -
 # Use SHA512 to sign RPMs
-%__gpg_sign_cmd %{__gpg} gpg --no-verbose --no-armor --batch --pinentry-mode loopback --passphrase '' --no-secmem-warning -u "%{_gpg_name}" --digest-algo sha512 -sbo %{__signature_filename} %{__plaintext_filename}
\ No newline at end of file
+%__gpg_sign_cmd %{__gpg} gpg --no-verbose --no-armor --batch --pinentry-mode loopback --passphrase '' --no-secmem-warning -u "%{_gpg_name}" --digest-algo sha512 -sbo %{__signature_filename} %{__plaintext_filename}
+# Don't include build-id artifacts
+%_build_id_links none
\ No newline at end of file
diff --git a/build.assets/rpm/rpmmacros b/build.assets/rpm/rpmmacros
new file mode 100644
index 00000000000..d2607026bbf
--- /dev/null
+++ b/build.assets/rpm/rpmmacros
@@ -0,0 +1,2 @@
+# Don't include build-id artifacts
+%_build_id_links none
\ No newline at end of file