suse

scripts/build-freebsd-release.sh

@@ -47,7 +47,7 @@ FREEBSD_PACKAGE_FILE="$OUT/rustproxy-${FREEBSD_PACKAGE_VERSION}.pkg"
 "$BUILDER_ROOT/scripts/package-freebsd.sh" \
     "$SRC" "$FREEBSD_BINARY" "$FREEBSD_PACKAGE_FILE" "$FREEBSD_PACKAGE_VERSION"
 
-mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
+mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/suse/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
 CURRENT_TARGET=""
 if [[ -L "$REPOSITORY/current" ]]; then
     CURRENT_LINK=$(readlink "$REPOSITORY/current")
@@ -56,12 +56,12 @@ fi
 
 log 'staging native FreeBSD repository snapshot'
 if [[ -n "$CURRENT_TARGET" ]]; then
-    for component in apt rpm opnsense freebsd; do
+    for component in apt rpm suse opnsense freebsd; do
         if [[ -d "$CURRENT_TARGET/$component" ]]; then
             rsync -a --delete --link-dest="$CURRENT_TARGET/$component"/ "$CURRENT_TARGET/$component"/ "$RELEASE_DIR/$component"/
         fi
     done
-    for copied in repo-key.gpg index.html LINUX-BUILD-INFO.txt; do
+    for copied in repo-key.gpg index.html LINUX-BUILD-INFO.txt SUSE-BUILD-INFO.txt; do
         if [[ -f "$CURRENT_TARGET/$copied" ]]; then
             cp -a "$CURRENT_TARGET/$copied" "$RELEASE_DIR/$copied"
         fi

scripts/build-linux-release.sh

@@ -124,6 +124,9 @@ DEB_FILE="$OUT/${PACKAGE_NAME}_${VERSION}-${PACKAGE_RELEASE}_amd64.deb"
 RPM_FILE="$OUT/${PACKAGE_NAME}-${VERSION}-${PACKAGE_RELEASE}.x86_64.rpm"
 AGENT_DEB_FILE="$OUT/rustproxy-docker-agent_${VERSION}-${PACKAGE_RELEASE}_amd64.deb"
 AGENT_RPM_FILE="$OUT/rustproxy-docker-agent-${VERSION}-${PACKAGE_RELEASE}.x86_64.rpm"
+SUSE_RPM_FILE="$OUT/suse/${PACKAGE_NAME}-${VERSION}-${PACKAGE_RELEASE}.x86_64.rpm"
+SUSE_AGENT_RPM_FILE="$OUT/suse/rustproxy-docker-agent-${VERSION}-${PACKAGE_RELEASE}.x86_64.rpm"
+mkdir -p "$OUT/suse"
 
 log "creating RustProxy and Docker Agent deb packages"
 nfpm package --config "$PKG/nfpm-deb.yaml" --packager deb --target "$DEB_FILE"
@@ -131,11 +134,14 @@ nfpm package --config "$AGENT_PKG/nfpm-deb.yaml" --packager deb --target "$AGENT
 log "creating RustProxy and Docker Agent rpm packages"
 nfpm package --config "$PKG/nfpm-rpm.yaml" --packager rpm --target "$RPM_FILE"
 nfpm package --config "$AGENT_PKG/nfpm-rpm.yaml" --packager rpm --target "$AGENT_RPM_FILE"
+log "creating SUSE/openSUSE RPM packages"
+nfpm package --config "$PKG/nfpm-suse.yaml" --packager rpm --target "$SUSE_RPM_FILE"
+nfpm package --config "$AGENT_PKG/nfpm-suse.yaml" --packager rpm --target "$SUSE_AGENT_RPM_FILE"
 
 for deb in "$DEB_FILE" "$AGENT_DEB_FILE"; do
     ar t "$deb" | grep '^_gpgorigin$' >/dev/null || fatal "DEB package is not signed: $deb"
 done
-for rpm_file in "$RPM_FILE" "$AGENT_RPM_FILE"; do
+for rpm_file in "$RPM_FILE" "$AGENT_RPM_FILE" "$SUSE_RPM_FILE" "$SUSE_AGENT_RPM_FILE"; do
     rpm -qpi "$rpm_file" | awk -F: '/^Signature/ && $0 !~ /\(none\)/ {ok=1} END{exit !ok}' \
         || fatal "RPM package is not signed: $rpm_file"
 done
@@ -143,6 +149,7 @@ log "Linux package signatures verified"
 
 cp -f "$DEB_FILE" "$AGENT_DEB_FILE" "$DATA_DIR/packages/deb/"
 cp -f "$RPM_FILE" "$AGENT_RPM_FILE" "$DATA_DIR/packages/rpm/x86_64/"
+cp -f "$SUSE_RPM_FILE" "$SUSE_AGENT_RPM_FILE" "$DATA_DIR/packages/suse/x86_64/"
 
 log "updating aptly internal repository"
 aptly -config="$APTLY_CONF" repo add -force-replace package-builder "$DEB_FILE" "$AGENT_DEB_FILE" >/dev/null
@@ -167,7 +174,7 @@ APT_PUBLIC="$DATA_DIR/aptly/public"
 gpg --batch --verify "$APT_PUBLIC/dists/$REPO_DISTRIBUTION/Release.gpg" "$APT_PUBLIC/dists/$REPO_DISTRIBUTION/Release" >/dev/null 2>&1 \
     || fatal "APT Release signature verification failed"
 
-mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
+mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/suse/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
 CURRENT_TARGET=""
 if [[ -L "$REPOSITORY/current" ]]; then
     CURRENT_LINK=$(readlink "$REPOSITORY/current")
@@ -185,17 +192,22 @@ fi
 
 rsync -a --delete "$APT_PUBLIC"/ "$RELEASE_DIR/apt"/
 rsync -a --delete "$DATA_DIR/packages/rpm"/ "$RELEASE_DIR/rpm"/
-rm -rf "$RELEASE_DIR/rpm/x86_64/repodata"
-createrepo_c --update "$RELEASE_DIR/rpm/x86_64" >/dev/null
+rsync -a --delete "$DATA_DIR/packages/suse"/ "$RELEASE_DIR/suse"/
+for rpm_root in "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/suse/x86_64"; do
+    rm -rf "$rpm_root/repodata"
+    createrepo_c --update "$rpm_root" >/dev/null
+done
 
 GPG_SIGN_ARGS=(--batch --yes --pinentry-mode loopback)
 if [[ -r "$GPG_PASSPHRASE_FILE" ]]; then
     GPG_SIGN_ARGS+=(--passphrase-file "$GPG_PASSPHRASE_FILE")
 fi
-gpg "${GPG_SIGN_ARGS[@]}" --armor --detach-sign --local-user "$GPG_KEY_ID" \
-    --output "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml.asc" "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml"
-gpg --batch --verify "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml.asc" "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml" >/dev/null 2>&1 \
-    || fatal "RPM metadata signature verification failed"
+for rpm_root in "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/suse/x86_64"; do
+    gpg "${GPG_SIGN_ARGS[@]}" --armor --detach-sign --local-user "$GPG_KEY_ID" \
+        --output "$rpm_root/repodata/repomd.xml.asc" "$rpm_root/repodata/repomd.xml"
+    gpg --batch --verify "$rpm_root/repodata/repomd.xml.asc" "$rpm_root/repodata/repomd.xml" >/dev/null 2>&1 \
+        || fatal "RPM metadata signature verification failed: $rpm_root"
+done
 
 gpg --batch --armor --export "$GPG_KEY_ID" > "$RELEASE_DIR/repo-key.gpg"
 [[ -s "$RELEASE_DIR/repo-key.gpg" ]] || fatal "public GPG key export failed"
@@ -206,15 +218,20 @@ built_at=$(date -u "+%Y-%m-%dT%H:%M:%SZ")
 package_release=$PACKAGE_RELEASE
 packaging_revision=$PACKAGING_REVISION
 linux_packages=$PACKAGE_NAME,rustproxy-docker-agent
+linux_rpm_flavors=dnf,suse
 source_url=$SOURCE_REPO
 source_ref=$SOURCE_BRANCH
 source_commit=$SHA
 build_reason=$BUILD_REASON
 INFO
+cp -f "$RELEASE_DIR/LINUX-BUILD-INFO.txt" "$RELEASE_DIR/SUSE-BUILD-INFO.txt"
+printf '%s\n' 'rpm_flavor=suse' 'platforms=SLES_15_SP6+,SLES_16+,Leap_15.6+,Tumbleweed' >> "$RELEASE_DIR/SUSE-BUILD-INFO.txt"
 
 [[ -s "$RELEASE_DIR/index.html" ]]
 [[ -f "$RELEASE_DIR/apt/dists/$REPO_DISTRIBUTION/InRelease" ]]
 [[ -f "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml" ]]
+[[ -f "$RELEASE_DIR/suse/x86_64/repodata/repomd.xml" ]]
+[[ -s "$RELEASE_DIR/SUSE-BUILD-INFO.txt" ]]
 
 log "publishing Linux repository branch"
 rm -f "$REPOSITORY/current.new"

scripts/build-opnsense-release.sh

@@ -50,7 +50,7 @@ OPNSENSE_PACKAGE_FILE="$OUT/os-rustproxy-${OPNSENSE_PACKAGE_VERSION}.pkg"
 /opt/rust-package-builder/scripts/package-opnsense.sh \
     "$SRC" "$FREEBSD_BINARY" "$OPNSENSE_PACKAGE_FILE" "$OPNSENSE_PACKAGE_VERSION"
 
-mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
+mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/suse/x86_64" "$RELEASE_DIR/opnsense" "$RELEASE_DIR/freebsd"
 CURRENT_TARGET=""
 if [[ -L "$REPOSITORY/current" ]]; then
     CURRENT_LINK=$(readlink "$REPOSITORY/current")
@@ -59,12 +59,12 @@ fi
 
 log "staging OPNsense repository snapshot"
 if [[ -n "$CURRENT_TARGET" ]]; then
-    for component in apt rpm opnsense freebsd; do
+    for component in apt rpm suse opnsense freebsd; do
         if [[ -d "$CURRENT_TARGET/$component" ]]; then
             rsync -a --delete --link-dest="$CURRENT_TARGET/$component"/ "$CURRENT_TARGET/$component"/ "$RELEASE_DIR/$component"/
         fi
     done
-    for file in repo-key.gpg index.html LINUX-BUILD-INFO.txt; do
+    for file in repo-key.gpg index.html LINUX-BUILD-INFO.txt SUSE-BUILD-INFO.txt; do
         if [[ -f "$CURRENT_TARGET/$file" ]]; then
             cp -a "$CURRENT_TARGET/$file" "$RELEASE_DIR/$file"
         fi

scripts/check-and-build.sh

@@ -10,12 +10,16 @@ linux_release_complete_for_commit() {
     [[ -d "$CURRENT" ]] || return 1
     [[ -f "$CURRENT/apt/dists/$REPO_DISTRIBUTION/InRelease" ]] || return 1
     [[ -f "$CURRENT/rpm/x86_64/repodata/repomd.xml" ]] || return 1
+    [[ -f "$CURRENT/suse/x86_64/repodata/repomd.xml" ]] || return 1
+    [[ -f "$CURRENT/SUSE-BUILD-INFO.txt" ]] || return 1
     # Both standalone packages must exist in the current Linux snapshot.
     find "$CURRENT/rpm/x86_64" -maxdepth 1 -type f -name 'rustproxy-docker-agent-*.rpm' -print -quit | grep -q . || return 1
+    find "$CURRENT/suse/x86_64" -maxdepth 1 -type f -name 'rustproxy-docker-agent-*.rpm' -print -quit | grep -q . || return 1
     find "$CURRENT/apt/pool" -type f -name 'rustproxy-docker-agent_*.deb' -print -quit | grep -q . || return 1
     # A new builder revision must repackage even when RustProxy's SHA is unchanged.
     [[ -f "$CURRENT/LINUX-BUILD-INFO.txt" ]] || return 1
     grep -Fqx "packaging_revision=$PACKAGING_REVISION" "$CURRENT/LINUX-BUILD-INFO.txt" || return 1
+    grep -Fqx "packaging_revision=$PACKAGING_REVISION" "$CURRENT/SUSE-BUILD-INFO.txt" || return 1
     grep -Fq ',rustproxy-docker-agent' "$CURRENT/LINUX-BUILD-INFO.txt" || return 1
 
     if grep -Fqx "source_commit=$sha" "$CURRENT/LINUX-BUILD-INFO.txt"; then

scripts/entrypoint.sh

@@ -62,6 +62,7 @@ mkdir -p \
     "$DATA_DIR/go/cache" \
     "$DATA_DIR/work" \
     "$DATA_DIR/packages/rpm/x86_64" \
+    "$DATA_DIR/packages/suse/x86_64" \
     "$DATA_DIR/packages/deb"
 mkdir -p "$GNUPGHOME"
 chmod 0700 "$GNUPGHOME"

scripts/generate-index.sh

@@ -36,8 +36,8 @@ a{{color:inherit}} .meta{{display:flex;gap:16px;flex-wrap:wrap;opacity:.82;font-
 </head>
 <body>
 <h1>{h(package)} — package repository</h1>
-<p class="lead">Signed DEB and RPM packages for x86_64/amd64.</p>
-<div class="meta"><span class="ok">Repository active</span><span>{h(url)}</span><span>APT + RPM/DNF</span></div>
+<p class="lead">Signed DEB, DNF RPM and SUSE RPM packages for x86_64/amd64.</p>
+<div class="meta"><span class="ok">Repository active</span><span>{h(url)}</span><span>APT + RPM/DNF + RPM/Zypper</span></div>
 
 <div class="card">
 <h2>Debian / Ubuntu</h2>
@@ -68,6 +68,17 @@ REPO
 sudo dnf install {h(package)}</code></pre>
 </div>
 
+<div class="card">
+<h2>SUSE Linux Enterprise / openSUSE Leap / Tumbleweed</h2>
+<p>Signed dedicated SUSE RPM repository (x86_64; glibc 2.34 or newer).</p>
+<pre><code>sudo rpm --import {h(url)}/repo-key.gpg
+sudo zypper addrepo --refresh --gpgcheck {h(url)}/suse/x86_64/ rustproxy-suse
+sudo zypper refresh rustproxy-suse
+sudo zypper install {h(package)}
+# Optional Docker host agent:
+sudo zypper install rustproxy-docker-agent</code></pre>
+</div>
+
 <div class="card">
 <h2>Docker discovery agent — separate Linux package</h2>
 <p>Install <code>rustproxy-docker-agent</code> on the Docker host (systemd, Docker Engine, amd64/x86_64). This is independent from the RustProxy server and has no FreeBSD pkg.</p>
@@ -95,9 +106,10 @@ sudo systemctl status rustproxy-docker-agent</code></pre>
 <ul>
 <li><a href="{h(url)}/repo-key.gpg">Public GPG key</a></li>
 <li><a href="{h(url)}/apt/dists/{h(dist)}/InRelease">APT InRelease</a></li>
-<li><a href="{h(url)}/rpm/x86_64/repodata/repomd.xml">RPM repomd.xml</a></li>
+<li><a href="{h(url)}/rpm/x86_64/repodata/repomd.xml">DNF RPM repomd.xml</a></li>
+<li><a href="{h(url)}/suse/x86_64/repodata/repomd.xml">SUSE RPM repomd.xml</a></li>
 </ul>
-<p>Supported targets: Debian 12/13, Ubuntu 24.04/26.04, RHEL 9/10; architecture: amd64/x86_64.</p>
+<p>Supported targets: Debian 12/13, Ubuntu 24.04/26.04, RHEL 9/10, SLES 15 SP6+, SLES 16+, openSUSE Leap 15.6+/Tumbleweed; architecture: amd64/x86_64.</p>
 </div>
 </body>
 </html>

scripts/init-storage.sh

@@ -34,7 +34,7 @@ if ! aptly -config="$APTLY_CONF" repo list -raw | grep -Fx package-builder >/dev
         package-builder >/dev/null
 fi
 
-for item in apt rpm opnsense freebsd repo-key.gpg index.html LINUX-BUILD-INFO.txt; do
+for item in apt rpm suse opnsense freebsd repo-key.gpg index.html LINUX-BUILD-INFO.txt SUSE-BUILD-INFO.txt; do
     if [[ -e "$REPOSITORY/$item" && ! -L "$REPOSITORY/$item" ]]; then
         fatal "$REPOSITORY/$item exists and is not a symlink; refusing to overwrite"
     fi
@@ -42,8 +42,10 @@ done
 
 ln -sfn current/apt "$REPOSITORY/apt"
 ln -sfn current/rpm "$REPOSITORY/rpm"
+ln -sfn current/suse "$REPOSITORY/suse"
 ln -sfn current/opnsense "$REPOSITORY/opnsense"
 ln -sfn current/freebsd "$REPOSITORY/freebsd"
 ln -sfn current/repo-key.gpg "$REPOSITORY/repo-key.gpg"
 ln -sfn current/index.html "$REPOSITORY/index.html"
 ln -sfn current/LINUX-BUILD-INFO.txt "$REPOSITORY/LINUX-BUILD-INFO.txt"
+ln -sfn current/SUSE-BUILD-INFO.txt "$REPOSITORY/SUSE-BUILD-INFO.txt"

scripts/lib.sh

@@ -2,7 +2,7 @@
 set -Eeuo pipefail
 
 # Increment when package payload/installation semantics change without a source commit.
-PACKAGING_REVISION=5
+PACKAGING_REVISION=6
 OPNSENSE_PACKAGING_REVISION=4
 FREEBSD_NATIVE_PACKAGING_REVISION=2
 

scripts/prepare-agent-package.sh

@@ -189,4 +189,32 @@ rpm:
     key_file: $GPG_Q
 YAML
 
-log "prepared signed Linux DEB/RPM metadata for $AGENT_NAME $VERSION-$PACKAGE_RELEASE"
+cat > "$PKG_AGENT/nfpm-suse.yaml" <<YAML
+name: $AGENT_NAME_Q
+arch: amd64
+platform: linux
+version: $VERSION_Q
+release: "$PACKAGE_RELEASE"
+section: net
+priority: optional
+maintainer: $MAINTAINER_Q
+description: "RustProxy Docker discovery agent (HTTPS and bearer token)"
+license: "Proprietary"
+homepage: $HOMEPAGE_Q
+contents:
+$(cat "$PKG_AGENT/contents.yaml")
+depends:
+  - ca-certificates
+  - shadow
+  - systemd
+scripts:
+  postinstall: "$PKG_AGENT/scripts/rpm-postinstall.sh"
+  preremove: "$PKG_AGENT/scripts/rpm-preremove.sh"
+  postremove: "$PKG_AGENT/scripts/rpm-postremove.sh"
+rpm:
+  compression: gzip
+  signature:
+    key_file: $GPG_Q
+YAML
+
+log "prepared signed Linux DEB/RPM/SUSE metadata for $AGENT_NAME $VERSION-$PACKAGE_RELEASE"

scripts/prepare-package.sh

@@ -239,6 +239,17 @@ deb:
     type: origin
 YAML
 
+# The SUSE flavor keeps the RPM name/version identical but uses native
+# dependencies and an isolated Python launcher for Leap/SLES 15 systems.
+# SUSE may ship /usr/bin/python3 older than the separately installed python311.
+install -D -m 0755 "$BUILDER_ROOT/packaging/suse-python3" \
+    "$PKG/payload/usr/libexec/$PACKAGE_NAME/python3"
+mkdir -p "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service.d"
+cat > "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service.d/50-suse-python.conf" <<SUSE_UNIT
+[Service]
+Environment=PATH=/usr/libexec/${PACKAGE_NAME}:/usr/local/bin:/usr/bin:/bin
+SUSE_UNIT
+
 cat > "$PKG/nfpm-rpm.yaml" <<YAML
 name: $NAME_Q
 arch: amd64
@@ -270,3 +281,47 @@ rpm:
   signature:
     key_file: $GPG_KEY_Q
 YAML
+
+# SUSE Linux Enterprise, openSUSE Leap and Tumbleweed use shadow (not
+# RHEL's shadow-utils). Versioned Python enables Leap/SLES 15 installations.
+# Compression gzip is understood by older rpm clients as well as current ones.
+cat > "$PKG/nfpm-suse.yaml" <<YAML
+name: $NAME_Q
+arch: amd64
+platform: linux
+version: $VERSION_Q
+release: "$PACKAGE_RELEASE"
+section: net
+priority: optional
+maintainer: $MAINTAINER_Q
+description: $DESC_Q
+license: $LICENSE_Q
+homepage: $HOMEPAGE_Q
+vendor: $NAME_Q
+contents:
+$(cat "$CONTENTS_FILE")
+  - src: $(yaml_quote "$PKG/payload/usr/libexec/$PACKAGE_NAME/python3")
+    dst: /usr/libexec/$PACKAGE_NAME/python3
+    file_info:
+      mode: 0755
+  - src: $(yaml_quote "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service.d/50-suse-python.conf")
+    dst: /usr/lib/systemd/system/${PACKAGE_NAME}.service.d/50-suse-python.conf
+    file_info:
+      mode: 0644
+depends:
+  - ca-certificates
+  - 'glibc >= 2.34'
+  - gzip
+  - logrotate
+  - shadow
+  - systemd
+  - '((python310 and python310-pip) or (python311 and python311-pip) or (python312 and python312-pip) or (python313 and python313-pip) or (python314 and python314-pip) or (python3 >= 3.10 and python3-pip))'
+scripts:
+  postinstall: "$PKG/scripts/rpm-postinstall.sh"
+  preremove: "$PKG/scripts/rpm-preremove.sh"
+  postremove: "$PKG/scripts/rpm-postremove.sh"
+rpm:
+  compression: gzip
+  signature:
+    key_file: $GPG_KEY_Q
+YAML