packaging: validate genuine source RPM metadata

.github/workflows/ci.yml

@@ -469,6 +469,12 @@ jobs:
           test "$(rpm -qp --qf '%{ARCH}' "$gui_rpm")" = noarch
           rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $version"
           test "$(rpm -qp --qf '%{NAME}' "$gui_srpm")" = zupt-gui
+          test "$(rpm -qp --qf '%{VERSION}-%{RELEASE}' "$gui_srpm")" = "$version-1"
+          test "$(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm")" = 1
+          test "$(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm")" = '(none)'
+          test "$(rpm -qpl "$gui_srpm" | wc -l)" -eq 2
+          rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$version.tar.gz"
+          rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
       - name: Build the matching Fedora CLI RPM
         run: |
           version=$(sed -n 's/^#define ZUPT_VERSION_STRING "\([^"]*\)".*/\1/p' include/zupt.h)

.github/workflows/promote-release.yml

@@ -389,11 +389,17 @@ jobs:
           [[ $(rpm -qp --qf '%{VERSION}' "$rpm_file") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$rpm_file") == 0 ]]
           [[ $(rpm -qp --qf '%{ARCH}' "$rpm_file") == x86_64 ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$rpm_file") == '(none)' ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$rpm_file") == "$srpm_name" ]]
           srpm=$asset_dir/$srpm_name
           [[ $(rpm -qp --qf '%{NAME}' "$srpm") == zupt ]]
           [[ $(rpm -qp --qf '%{VERSION}' "$srpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$srpm") == 0 ]]
-          [[ $(rpm -qp --qf '%{ARCH}' "$srpm") == src ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$srpm") == 1 ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$srpm") == '(none)' ]]
+          [[ $(rpm -qpl "$srpm" | wc -l) -eq 2 ]]
+          rpm -qpl "$srpm" | grep -Fx "zupt-$VERSION.tar.gz"
+          rpm -qpl "$srpm" | grep -Fx zupt.spec
 
           gui_deb=$asset_dir/$gui_deb_name
           dpkg-deb --info "$gui_deb" >/dev/null
@@ -406,12 +412,18 @@ jobs:
           [[ $(rpm -qp --qf '%{VERSION}' "$gui_rpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$gui_rpm") == 1 ]]
           [[ $(rpm -qp --qf '%{ARCH}' "$gui_rpm") == noarch ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_rpm") == '(none)' ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_rpm") == "$gui_srpm_name" ]]
           rpm -qp --requires "$gui_rpm" | grep -Fx "zupt >= $VERSION"
           gui_srpm=$asset_dir/$gui_srpm_name
           [[ $(rpm -qp --qf '%{NAME}' "$gui_srpm") == zupt-gui ]]
           [[ $(rpm -qp --qf '%{VERSION}' "$gui_srpm") == "$VERSION" ]]
           [[ $(rpm -qp --qf '%{RELEASE}' "$gui_srpm") == 1 ]]
-          [[ $(rpm -qp --qf '%{ARCH}' "$gui_srpm") == src ]]
+          [[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$gui_srpm") == 1 ]]
+          [[ $(rpm -qp --qf '%{SOURCERPM}' "$gui_srpm") == '(none)' ]]
+          [[ $(rpm -qpl "$gui_srpm" | wc -l) -eq 2 ]]
+          rpm -qpl "$gui_srpm" | grep -Fx "zupt-gui-$VERSION.tar.gz"
+          rpm -qpl "$gui_srpm" | grep -Fx zupt-gui.spec
 
           linux_tar=$asset_dir/$linux_tar_name
           python3 - "$linux_tar" "zupt-$VERSION-linux-x86_64" <<'PY'

packaging/build-gui-rpm.sh

@@ -124,20 +124,45 @@ mapfile -t source_rpms < <(find "$top/SRPMS" -type f -name "zupt-gui-$version-*.
 [[ ${#main_rpms[@]} -eq 1 ]] || die "expected one GUI RPM, found ${#main_rpms[@]}"
 [[ ${#source_rpms[@]} -eq 1 ]] || die "expected one GUI source RPM, found ${#source_rpms[@]}"
 
-rpm -qpl "${main_rpms[0]}" >"$work/contents.txt"
+main_rpm=${main_rpms[0]}
+source_rpm=${source_rpms[0]}
+[[ $(rpm -qp --qf '%{NAME}' "$main_rpm") == zupt-gui ]] || \
+    die 'GUI binary RPM name metadata is not zupt-gui'
+[[ $(rpm -qp --qf '%{VERSION}' "$main_rpm") == "$version" ]] || \
+    die 'GUI binary RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$main_rpm") == '(none)' ]] || \
+    die 'GUI binary RPM is marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$main_rpm") == "$(basename -- "$source_rpm")" ]] || \
+    die 'GUI binary RPM does not reference the matching source RPM'
+[[ $(rpm -qp --qf '%{NAME}' "$source_rpm") == zupt-gui ]] || \
+    die 'GUI source RPM name metadata is not zupt-gui'
+[[ $(rpm -qp --qf '%{VERSION}' "$source_rpm") == "$version" ]] || \
+    die 'GUI source RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$source_rpm") == 1 ]] || \
+    die 'GUI source RPM is not marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$source_rpm") == '(none)' ]] || \
+    die 'GUI source RPM unexpectedly references another source RPM'
+mapfile -t source_members < <(rpm -qpl "$source_rpm" | sort)
+expected_source_members=("zupt-gui-${version}.tar.gz" zupt-gui.spec)
+mapfile -t expected_source_members < <(printf '%s\n' "${expected_source_members[@]}" | sort)
+[[ ${#source_members[@]} -eq 2 && \
+    ${source_members[*]} == "${expected_source_members[*]}" ]] || \
+    die 'GUI source RPM payload is not the exact Source0/spec pair'
+
+rpm -qpl "$main_rpm" >"$work/contents.txt"
 grep -q '^/usr/bin/zupt-gui$' "$work/contents.txt" || die 'GUI launcher missing from RPM'
 if grep -Eq '(^/usr/bin/vaptvupt-gui$|\.(o|obj|a|so|so\.[^/]+|dll|dylib|exe)$)' "$work/contents.txt"; then
     cat "$work/contents.txt" >&2
     die 'forbidden compatibility alias or compiled artifact in GUI RPM'
 fi
-(cd -- "$extract" && rpm2cpio "${main_rpms[0]}" | cpio -idm --quiet)
+(cd -- "$extract" && rpm2cpio "$main_rpm" | cpio -idm --quiet)
 PYTHONDONTWRITEBYTECODE=1 python3 - <<PY
 from pathlib import Path
 p = Path("$extract/usr/share/zupt-gui/zupt_gui.py")
 compile(p.read_text(encoding="utf-8"), str(p), "exec")
 PY
 
-for artifact in "${main_rpms[0]}" "${source_rpms[0]}"; do
+for artifact in "$main_rpm" "$source_rpm"; do
     destination=$dist_dir/$(basename -- "$artifact")
     [[ ! -e $destination ]] || die "refusing to overwrite existing output: $destination"
     cp -- "$artifact" "$destination"

packaging/build-rpm.sh

@@ -80,6 +80,29 @@ mapfile -t source_rpms < <(find "$top/SRPMS" -type f -name "zupt-${version}-*.sr
 [[ ${#source_rpms[@]} -eq 1 ]] || die "expected one source RPM, found ${#source_rpms[@]}"
 source_rpm=${source_rpms[0]}
 
+[[ $(rpm -qp --qf '%{NAME}' "$main_rpm") == zupt ]] || \
+    die 'binary RPM name metadata is not zupt'
+[[ $(rpm -qp --qf '%{VERSION}' "$main_rpm") == "$version" ]] || \
+    die 'binary RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$main_rpm") == '(none)' ]] || \
+    die 'binary RPM is marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$main_rpm") == "$(basename -- "$source_rpm")" ]] || \
+    die 'binary RPM does not reference the matching source RPM'
+[[ $(rpm -qp --qf '%{NAME}' "$source_rpm") == zupt ]] || \
+    die 'source RPM name metadata is not zupt'
+[[ $(rpm -qp --qf '%{VERSION}' "$source_rpm") == "$version" ]] || \
+    die 'source RPM version metadata does not match the release'
+[[ $(rpm -qp --qf '%{SOURCEPACKAGE}' "$source_rpm") == 1 ]] || \
+    die 'source RPM is not marked as a source package'
+[[ $(rpm -qp --qf '%{SOURCERPM}' "$source_rpm") == '(none)' ]] || \
+    die 'source RPM unexpectedly references another source RPM'
+mapfile -t source_members < <(rpm -qpl "$source_rpm" | sort)
+expected_source_members=("zupt-${version}.tar.gz" zupt.spec)
+mapfile -t expected_source_members < <(printf '%s\n' "${expected_source_members[@]}" | sort)
+[[ ${#source_members[@]} -eq 2 && \
+    ${source_members[*]} == "${expected_source_members[*]}" ]] || \
+    die 'source RPM payload is not the exact Source0/spec pair'
+
 rpm -qpi "$main_rpm" >/dev/null
 rpm -qpl "$main_rpm" > "$work/contents.txt"
 if grep -Eq '(^/usr/bin/vaptvupt$|\.(o|obj|a|so|so\.[^/]+|dll|dylib)$)' "$work/contents.txt"; then