Building packages: .deb and .rpm
You turn your own tools and configuration into signed .deb and .rpm packages, getting maintainer scripts, dependencies and reproducible builds right.
Level 501 · 18 lessons · 15 practice labs
Lessons
Why package
- Why you package your own software: installation, removal and audit
- File layout through a packager's eyes
- Short task: unpack an existing package and review its contents and scripts
Debian packages
- Anatomy of a .deb: control, data and maintainer scripts
- The simplest package with dpkg-deb
- A proper package with debhelper and dpkg-buildpackage
- postinst, prerm and safe maintainer scripts
- conffiles: keeping settings the user changed
- Checking packages with lintian
- Short task: package the team's script and its service unit as a .deb
RPM packages
- Anatomy of a spec file
- Building with rpmbuild and source packages
- Scriptlets and %config(noreplace)
- rpmlint and building in a clean root with mock
- Short task: package the same tool as an .rpm
Distribution
- Signing packages and verifying signatures
- Reproducible builds
- Capstone: package a monitoring agent for both families, sign it and publish it to the internal repository
Practice labs
- Look inside a package without installing it: Extract the file list, dependencies and install scripts of a .deb and an .rpm without installing them.
- Turn a hand-copied script into a package: Turn a backup script copied to servers by hand into a simple package with a config file and version that installs and removes cleanly.
- Audit a package's install scripts for safety: Review the post-install script in an in-house package, find the unnecessary things it does as root and rewrite it with least privilege.
- Build a minimal Debian package: Build a package with a single binary and a control file, install it and confirm it shows in a package query.
- Build a package with a service using debhelper: Package a small daemon with debhelper rules so that install creates the service user and enables the systemd unit.
- Clear a package of lintian warnings: Fix the copyright, changelog, permission and conffile problems of a package with warnings and show clean lintian output.
- Write your first spec file and build an RPM: Write a minimal spec file for a ready source archive, build the package and install it in the Rocky container.
- Write scriptlets that preserve data on upgrade: Fix a package's install and removal scriptlets so an upgrade does not delete the service user or configuration.
- Build a package in a clean environment with mock: Use mock to find the missing build dependencies of a package that builds on a developer machine but fails clean, and pass rpmlint.
- Publish a new version with a changelog entry: Bump the package version, add a changelog entry, rebuild and confirm it appears as an upgrade on a client.
- Sign a package and publish it in the internal repository: Sign the built package, add it to the internal repository, refresh the metadata and install it on a client with signature verification.
- Set up a build that produces .deb and .rpm from one source: Set up a scripted build that produces both formats from one source tree, runs the linters and stops on any error.
- Make a config file survive upgrades: Mark a package's config file correctly, then change it locally and upgrade to show it is not overwritten.
- Resolve a file conflict between two packages: Examine two in-house packages that try to install the same file, move it into one package and declare the right relationship.
- Split a package without breaking the upgrade path: Split one package into server and client parts and prove on both distributions that a system with the old version upgrades cleanly.
About this course
You turn your own tools and configuration into signed .deb and .rpm packages, getting maintainer scripts, dependencies and reproducible builds right.
What you will learn
- Why package
- Debian packages
- RPM packages
- Distribution
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.