From 5c330d35a452afacdde736c338bd734ae95f2d3b Mon Sep 17 00:00:00 2001 From: Autumn Nash Date: Thu, 2 Jul 2026 23:26:58 +0000 Subject: [PATCH] feat(telegraf): add curated telegraf 1.38.2 metrics agent for Azure Linux 4.0 Restore telegraf (absent from AzL 4.0) as a curated metrics agent, built via upstream's 'custom' build tag with a curated plugin set (full first-party Azure plugins + github input) to shrink the linked dependency/CVE surface while retaining the full vendor tree. Follows the Fedora Go guidelines (Go Vendor Tools, %gobuild). Ships the upstream systemd unit unmodified, sysusers with home /etc/telegraf, logrotate, generated default config, and a %check (license check + binary smoke test). The vendor tarball is produced by generate_source_tarball.sh, a reproducible out-of-band tool (not invoked during rpmbuild): inputs are hard-coded, the source is fetched from the pinned URI (optional path override), verified against a hard-coded SHA512, and emitted as a deterministic tarball. --- base/comps/components-publish-channels.toml | 1 + .../comps/telegraf/generate_source_tarball.sh | 201 ++++++++++++++++ base/comps/telegraf/go-vendor-tools.toml | 64 ++++++ base/comps/telegraf/telegraf.comp.toml | 26 +++ base/comps/telegraf/telegraf.default | 2 + base/comps/telegraf/telegraf.spec | 195 ++++++++++++++++ base/comps/telegraf/telegraf.sysusers | 12 + locks/telegraf.lock | 3 + specs/t/telegraf/go-vendor-tools.toml | 64 ++++++ specs/t/telegraf/sources | 2 + specs/t/telegraf/telegraf.default | 2 + specs/t/telegraf/telegraf.spec | 215 ++++++++++++++++++ specs/t/telegraf/telegraf.sysusers | 12 + 13 files changed, 799 insertions(+) create mode 100755 base/comps/telegraf/generate_source_tarball.sh create mode 100644 base/comps/telegraf/go-vendor-tools.toml create mode 100644 base/comps/telegraf/telegraf.comp.toml create mode 100644 base/comps/telegraf/telegraf.default create mode 100644 base/comps/telegraf/telegraf.spec create mode 100644 base/comps/telegraf/telegraf.sysusers create mode 100644 locks/telegraf.lock create mode 100644 specs/t/telegraf/go-vendor-tools.toml create mode 100644 specs/t/telegraf/sources create mode 100644 specs/t/telegraf/telegraf.default create mode 100644 specs/t/telegraf/telegraf.spec create mode 100644 specs/t/telegraf/telegraf.sysusers diff --git a/base/comps/components-publish-channels.toml b/base/comps/components-publish-channels.toml index 3d63e4f96c7..f30bf81d630 100644 --- a/base/comps/components-publish-channels.toml +++ b/base/comps/components-publish-channels.toml @@ -2436,6 +2436,7 @@ components = [ "tcpdump", "tcsh", "teckit", + "telegraf", "telnet", "testng", "texinfo", diff --git a/base/comps/telegraf/generate_source_tarball.sh b/base/comps/telegraf/generate_source_tarball.sh new file mode 100755 index 00000000000..7b841ddae61 --- /dev/null +++ b/base/comps/telegraf/generate_source_tarball.sh @@ -0,0 +1,201 @@ +#!/bin/bash +# Copyright (c) Microsoft Corporation. +# Licensed under the MIT License. +# +# Generates a reproducible vendored Go-module tarball for telegraf. +# +# NOTE: This is an out-of-band maintainer tool — it is NEVER invoked during rpmbuild. +# It is run by hand (or by the sources-upload pipeline) to (re)produce the vendor +# archive, which is then uploaded to the lookaside and pinned by hash as +# `Source1: %{archivename}-vendor.tar.bz2`. The spec's %build consumes that prebuilt +# archive; it never runs `go mod vendor`. Consequently the pinned timestamp here only +# affects reproducibility of this generation step, not the package build. +# +# The custom (minimal-plugin) build still vendors the *full* dependency tree so +# the build is hermetic and offline; only the selected plugins are compiled in +# (see %{buildtags} in telegraf.spec). Pruning vendor/ is intentionally NOT +# done — it would break reproducibility and `go mod verify`. +# +# --------------------------------------------------------------------------- +# Reproducibility contract +# --------------------------------------------------------------------------- +# For supply-chain reasons this vendor archive must be reproducible (within +# toolchain tolerance). Every input that determines the archive's contents is +# HARD-CODED below, so this script alone documents exactly how the pinned +# vendor tarball was produced — there are no version/output arguments to get +# wrong or forget to record. +# +# By default the script downloads the upstream source tarball itself from the +# hard-coded SRC_TARBALL_URI, so it controls the entire source path — the package +# version (hard-coded below) is the only thing that varies. An optional path +# argument overrides the download with a pre-fetched local copy (e.g. an +# air-gapped or lookaside mirror). In both cases the tarball's SHA512 is verified +# against the hard-coded value before vendoring. This is not a security mechanism +# (the script can be edited); it exists to stop us from accidentally vendoring the +# wrong input. +# +# The produced archive's SHA512 is compared against the hard-coded expected +# value at the end. A mismatch is a non-fatal warning: it almost always means a +# toolchain difference (the Go toolchain writes vendor/modules.txt, so the Go +# version dominates), which is the "certain tolerance" for reproducibility. To +# reproduce the pinned hash byte-for-byte, use the canonical toolchain below. +# +# Canonical toolchain used to produce EXPECTED_VENDOR_SHA512: +# go : go1.26.4 +# tar : tar (GNU tar) 1.35 +# bzip2 : bzip2 1.0.8 +# +# Bumping the telegraf version: update PKG_VERSION, SRC_TARBALL_URI, +# SRC_TARBALL_SHA512, and (after a canonical-toolchain run) EXPECTED_VENDOR_SHA512 +# below, then update the matching hashes in telegraf.comp.toml. +# +# Usage: +# ./generate_source_tarball.sh # download the pinned tarball +# ./generate_source_tarball.sh # use a pre-fetched copy + +set -euo pipefail + +# --------------------------------------------------------------------------- +# Hard-coded inputs — the complete, documented recipe +# --------------------------------------------------------------------------- +readonly PKG_NAME="telegraf" +readonly PKG_VERSION="1.38.2" + +# Upstream source archive (the one argument must match this): +readonly SRC_TARBALL_NAME="telegraf-${PKG_VERSION}.tar.gz" +readonly SRC_TARBALL_URI="https://github.com/influxdata/telegraf/archive/v${PKG_VERSION}/${SRC_TARBALL_NAME}" +readonly SRC_TARBALL_SHA512="36c419978e98da9809e18865053399dd2198abc3d650f54424e3eb359ff8dfcb615f8b0a82dba484d03acfe5abe51a160a41ef486e5602f99400bd69e7afe48d" + +# Expected output (verified, non-fatally, at the end). Reproducible with the +# canonical toolchain documented in the header; may differ otherwise. +readonly EXPECTED_VENDOR_SHA512="1108fe48086a7051c5cb89935c6de1c675c3ea8212a979d147ad0c03aef327c6234fa9eee292e4f9594ba9ec2cb757fc9eff46630aea43551bca3d948b30b27f" + +# Output lands next to this script (not committed; upload to the lookaside). +readonly OUT_FOLDER="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" + +usage() { + echo "Usage: ${0##*/} [path-to-${SRC_TARBALL_NAME}]" >&2 + echo >&2 + echo "Produces ${PKG_NAME}-${PKG_VERSION}-vendor.tar.bz2 (reproducible)." >&2 + echo "With no argument the pinned source tarball is downloaded from:" >&2 + echo " ${SRC_TARBALL_URI}" >&2 + echo "Pass a path to use a pre-fetched local copy instead (offline override)." >&2 +} + +# --------------------------------------------------------------------------- +# Argument: an OPTIONAL path to a pre-fetched source tarball. With no argument +# the script downloads the tarball itself from the pinned SRC_TARBALL_URI, so it +# controls the entire source path; only the (hard-coded) package version varies. +# --------------------------------------------------------------------------- +if [ "$#" -gt 1 ]; then + usage + exit 1 +fi +case "${1:-}" in + -h|--help) + usage + exit 0 + ;; +esac +SRC_OVERRIDE="${1:-}" + +echo "Package -> ${PKG_NAME}-${PKG_VERSION}" +echo "Output folder -> ${OUT_FOLDER}" + +echo "Creating a tempdir." +WORKDIR=$(mktemp -d) +function cleanup { + echo "Clean-up: removing tempdir (${WORKDIR})." + rm -rf "${WORKDIR}" +} +trap cleanup EXIT + +# --------------------------------------------------------------------------- +# Obtain the source tarball: use the offline override if given, otherwise +# download it from the pinned upstream URI. Either way it is hash-verified below. +# --------------------------------------------------------------------------- +if [ -n "${SRC_OVERRIDE}" ]; then + if [ ! -f "${SRC_OVERRIDE}" ]; then + echo "Error: source tarball not found: ${SRC_OVERRIDE}" >&2 + exit 1 + fi + SRC_TARBALL="$(realpath "${SRC_OVERRIDE}")" + echo "Source tarball -> ${SRC_TARBALL} (offline override)" +else + SRC_TARBALL="${WORKDIR}/${SRC_TARBALL_NAME}" + echo "Source tarball -> downloading ${SRC_TARBALL_URI}" + curl -fSL --retry 3 --retry-delay 2 -o "${SRC_TARBALL}" "${SRC_TARBALL_URI}" +fi + +# --------------------------------------------------------------------------- +# Verify the input against the hard-coded hash (accident prevention) +# --------------------------------------------------------------------------- +echo "Verifying input tarball against hard-coded SHA512..." +ACTUAL_SRC_SHA512="$(sha512sum "${SRC_TARBALL}" | awk '{print $1}')" +if [ "${ACTUAL_SRC_SHA512}" != "${SRC_TARBALL_SHA512}" ]; then + echo "Error: input tarball SHA512 does not match the hard-coded value." >&2 + echo " expected: ${SRC_TARBALL_SHA512}" >&2 + echo " actual: ${ACTUAL_SRC_SHA512}" >&2 + echo " file: ${SRC_TARBALL}" >&2 + echo >&2 + echo "This is not a security check; it prevents accidentally vendoring the wrong input." >&2 + echo "If you are intentionally bumping the version, update the hard-coded inputs in this" >&2 + echo "script (and telegraf.comp.toml) before re-running." >&2 + exit 1 +fi +echo " OK (${SRC_TARBALL_SHA512})" + +# --------------------------------------------------------------------------- +# Toolchain report — the documented "tolerance" for reproducibility +# --------------------------------------------------------------------------- +echo "Toolchain (canonical: go1.26.4 / tar (GNU tar) 1.35 / bzip2 1.0.8):" +echo " go -> $(go version 2>/dev/null || echo 'NOT FOUND')" +echo " tar -> $(tar --version | head -1)" +echo " bzip2 -> $(bzip2 --version 2>&1 | head -1)" + +pushd "${WORKDIR}" > /dev/null + +NAME_VER="${PKG_NAME}-${PKG_VERSION}" +# Fedora forge macros expect the vendor archive as %{archivename}-vendor.tar.bz2. +VENDOR_TARBALL="${OUT_FOLDER}/${NAME_VER}-vendor.tar.bz2" + +echo "Unpacking the source tarball." +tar -xf "${SRC_TARBALL}" + +cd "${NAME_VER}" + +echo "Getting the vendored modules." +go mod vendor + +echo "Tar vendored modules (deterministic flags for reproducibility)." +# Pin every archived timestamp to the Unix epoch (@0 = 1970-01-01): --mtime sets it and +# --clamp-mtime caps anything newer. --mode normalizes permission bits (0644 files / 0755 dirs) +# so the hash is independent of the maintainer's umask. Combined with --sort=name, fixed +# owner/group and stripped pax atime/ctime, the tarball's hash depends solely on file content, +# independent of the host clock, locale, umask, or how the source was unpacked. +tar --sort=name \ + --mode='go-w,u+rw,a+rX' \ + --mtime="@0" --clamp-mtime \ + --owner=0 --group=0 --numeric-owner \ + --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \ + -cjf "${VENDOR_TARBALL}" vendor + +popd > /dev/null + +# --------------------------------------------------------------------------- +# Verify the produced archive against the documented expected hash +# --------------------------------------------------------------------------- +ACTUAL_VENDOR_SHA512="$(sha512sum "${VENDOR_TARBALL}" | awk '{print $1}')" +echo "Telegraf vendored modules are available at (${VENDOR_TARBALL})." +echo "SHA512: ${ACTUAL_VENDOR_SHA512}" +if [ "${ACTUAL_VENDOR_SHA512}" = "${EXPECTED_VENDOR_SHA512}" ]; then + echo " MATCH: reproduces the pinned vendor archive." +else + echo " WARNING: does not match the pinned SHA512:" >&2 + echo " expected: ${EXPECTED_VENDOR_SHA512}" >&2 + echo " actual: ${ACTUAL_VENDOR_SHA512}" >&2 + echo " This usually means a toolchain difference (the Go version writes" >&2 + echo " vendor/modules.txt). Reproduce with the canonical toolchain above before" >&2 + echo " uploading, or update EXPECTED_VENDOR_SHA512 (and telegraf.comp.toml) if this" >&2 + echo " is an intentional change." >&2 +fi diff --git a/base/comps/telegraf/go-vendor-tools.toml b/base/comps/telegraf/go-vendor-tools.toml new file mode 100644 index 00000000000..e8e683b749a --- /dev/null +++ b/base/comps/telegraf/go-vendor-tools.toml @@ -0,0 +1,64 @@ +# Go Vendor Tools configuration (Fedora Go packaging guidelines). +# Drives %go_vendor_license_* macros: license detection + cumulative SPDX expression. +[licensing] +detector = "askalono" +[[licensing.licenses]] +path = "vendor/github.com/apache/arrow/go/v15/LICENSE.txt" +sha256sum = "bd939b3a0ca7ffedd7444240915f4f297f09739fa9d07bac8c85ec4ea8c94c35" +expression = "Apache-2.0" +[[licensing.licenses]] +path = "vendor/github.com/apache/inlong/inlong-sdk/dataproxy-sdk-twins/dataproxy-sdk-golang/LICENSE" +sha256sum = "9c36b16d6730c0d63b406f4af70c17a737b8d5010e276e737d7cbba2bb662520" +expression = "Apache-2.0" +[[licensing.licenses]] +path = "vendor/github.com/gosnmp/gosnmp/LICENSE" +sha256sum = "28b63cdfceda72f7b8c9a8db2d7ab07661eb4d6bb9fc020077925b6b4faf84fa" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/github.com/miekg/dns/COPYRIGHT" +sha256sum = "66550c0ad5ca7ec1e08683e5f872cc45c741f311eee3b8ee484206ecbf9c740d" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/github.com/shirou/gopsutil/v4/LICENSE" +sha256sum = "ad1e64b82c04fb2ee6bfe521bff01266971ffaa70500024d4ac767c6033aafb9" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/github.com/shopspring/decimal/LICENSE" +sha256sum = "b92ba0f6ee02f2309628bfdadb123668a17c016e475ba477b857d33470d9d625" +expression = "MIT" +[[licensing.licenses]] +path = "vendor/github.com/twmb/murmur3/LICENSE" +sha256sum = "4228ef1819124b490d2e6a88e8c5e1348bedf32ff05b8fb5deed49921600e503" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/go.yaml.in/yaml/v3/LICENSE" +sha256sum = "d18f6323b71b0b768bb5e9616e36da390fbd39369a81807cca352de4e4e6aa0b" +expression = "Apache-2.0 AND MIT" +[[licensing.licenses]] +path = "vendor/gopkg.in/yaml.v3/LICENSE" +sha256sum = "d18f6323b71b0b768bb5e9616e36da390fbd39369a81807cca352de4e4e6aa0b" +expression = "Apache-2.0 AND MIT" +[[licensing.licenses]] +path = "vendor/honnef.co/go/tools/LICENSE-THIRD-PARTY" +sha256sum = "3e7ed5dc00f1b3518b99284123bfc3e3c65b82c62988c0dcda5c86c13d913f7c" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/howett.net/plist/LICENSE" +sha256sum = "20d9b7d9372369484ecadae229d3e3efee8029b259e11c9a1b07d2e0a3c82e39" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/modernc.org/libc/LICENSE-3RD-PARTY.md" +sha256sum = "f597097efe3d97021f89170746bd3a0fb9a8b6fb26b82043ed68a4e0283bee6c" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/modernc.org/memory/LICENSE-LOGO" +sha256sum = "5ae5bee3072a841376451b48d8cfcec7188e10543926d5870828d36c8a750dc5" +expression = "CC-BY-SA-4.0" +[[licensing.licenses]] +path = "vendor/modernc.org/sqlite/SQLITE-LICENSE" +sha256sum = "8438c9c89b849131ead81d5435cb97fcf052df5b0b286dda8a2d4c29e6cb3fd0" +expression = "blessing" +[[licensing.licenses]] +path = "vendor/github.com/rootless-containers/proto/go-proto/rootlesscontainers.pb.go" +sha256sum = "023e4d6b705cc09f3c74d106889e60418bf0c05a5356dd2d3b16687f32bfb9e5" +expression = "Apache-2.0" diff --git a/base/comps/telegraf/telegraf.comp.toml b/base/comps/telegraf/telegraf.comp.toml new file mode 100644 index 00000000000..698faccfe1f --- /dev/null +++ b/base/comps/telegraf/telegraf.comp.toml @@ -0,0 +1,26 @@ +# Telegraf — agent for collecting, processing, aggregating, and writing metrics. +# Shipped in AzL 3.0 but missing from 4.0; this restores it as a general-purpose metrics +# agent. Not available in Fedora; maintained as a local spec with vendored Go dependencies. +# Curated ("Balanced") custom build keeps the binary's dependency/CVE surface small. +# Packaged per the Fedora Go packaging guidelines for upstreaming: +# https://docs.fedoraproject.org/en-US/packaging-guidelines/Golang/ +[components.telegraf] +spec = { type = "local", path = "telegraf.spec" } +# Local Go package authored by AzL: use rpmautospec (%autorelease / %autochangelog). + +[[components.telegraf.source-files]] +filename = "telegraf-1.38.2.tar.gz" +hash = "36c419978e98da9809e18865053399dd2198abc3d650f54424e3eb359ff8dfcb615f8b0a82dba484d03acfe5abe51a160a41ef486e5602f99400bd69e7afe48d" +hash-type = "SHA512" +origin = { type = "download", uri = "https://github.com/influxdata/telegraf/archive/v1.38.2/telegraf-1.38.2.tar.gz" } + +[[components.telegraf.source-files]] +filename = "telegraf-1.38.2-vendor.tar.bz2" +# Reproducible vendor archive (generate_source_tarball.sh / go_vendor_archive). +# Hosted in the AzL lookaside store (pkgs_modified) following the same scheme as other +# non-upstream sources, e.g. base/comps/espeak-ng/espeak-ng.comp.toml. The blob must be +# uploaded before CI source checks and package builds can fetch it; the merge queue's +# sources-upload pipeline publishes changed-component sources. +hash = "1108fe48086a7051c5cb89935c6de1c675c3ea8212a979d147ad0c03aef327c6234fa9eee292e4f9594ba9ec2cb757fc9eff46630aea43551bca3d948b30b27f" +hash-type = "SHA512" +origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/telegraf/telegraf-1.38.2-vendor.tar.bz2/sha512/1108fe48086a7051c5cb89935c6de1c675c3ea8212a979d147ad0c03aef327c6234fa9eee292e4f9594ba9ec2cb757fc9eff46630aea43551bca3d948b30b27f/telegraf-1.38.2-vendor.tar.bz2" } diff --git a/base/comps/telegraf/telegraf.default b/base/comps/telegraf/telegraf.default new file mode 100644 index 00000000000..a71d0a0c3d1 --- /dev/null +++ b/base/comps/telegraf/telegraf.default @@ -0,0 +1,2 @@ +# Extra command-line options passed to telegraf by the systemd unit. +#TELEGRAF_OPTS= diff --git a/base/comps/telegraf/telegraf.spec b/base/comps/telegraf/telegraf.spec new file mode 100644 index 00000000000..856e31ebc03 --- /dev/null +++ b/base/comps/telegraf/telegraf.spec @@ -0,0 +1,195 @@ +# Generated by go2rpm 1.19.0 — then curated for Azure Linux. +# +# BASELINE: this spec is rebased on the canonical Fedora Go scaffold emitted by +# `go2rpm --profile vendor -v 1.38.2 github.com/influxdata/telegraf` +# (modern Go guidelines: %%gometa -L -f, Go Vendor Tools, %%gobuild, full vendor archive). +# Everything below that diverges from that scaffold is marked `# AzL:` and is limited to: +# 1. A curated ("Balanced") custom build — only a general-purpose subset of telegraf's +# ~415 plugins is COMPILED IN (see %%{buildtags}); the vendor archive still ships the +# FULL dependency tree (curation only changes what is linked, not what is vendored). +# 2. Runtime packaging go2rpm omits for application binaries (systemd unit, sysusers, +# logrotate, default config, env file, state dir). +# 3. The real cumulative SPDX License: tag (go2rpm leaves it as a TODO). +# Keeping the scaffold visible makes our divergence auditable and upstreamable to Fedora. + +%bcond check 1 + +# https://github.com/influxdata/telegraf +%global goipath github.com/influxdata/telegraf +Version: 1.38.2 + +%gometa -L -f + + +Name: telegraf +Release: %autorelease +Summary: Agent for collecting, processing, aggregating, and writing metrics, logs, and other arbitrary data + +# AzL: go2rpm emits `License: TODO`. This cumulative SPDX expression was generated with +# `go_vendor_license report expression` (askalono detector) over the FULL vendor tree and is +# enforced by %%go_vendor_license_check in %%check. Regenerate on every version bump. +License: Apache-2.0 AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND CC-BY-SA-4.0 AND EPL-2.0 AND ISC AND MIT AND MIT-0 AND MPL-2.0 AND Unlicense AND blessing +URL: %{gourl} +Source0: %{gosource} +# Generated by go-vendor-tools +Source1: %{archivename}-vendor.tar.bz2 +Source2: go-vendor-tools.toml +# AzL: declarative system user (created at install time, before files are unpacked). +Source3: %{name}.sysusers +# AzL: optional environment file referenced by the unit (EnvironmentFile=-/etc/default/telegraf). +Source4: %{name}.default + +BuildRequires: go-vendor-tools +# AzL: for the systemd unit + sysusers scriptlet macros below. +BuildRequires: systemd-rpm-macros + +# AzL: %%{?systemd_requires} adds correctly-ordered Requires(post/preun/postun) for the unit +# scriptlets; %%{?sysusers_requires_compat} pulls the pre-time deps %%sysusers_create_compat +# needs (systemd-sysusers with a shadow-utils fallback). +%{?systemd_requires} +%{?sysusers_requires_compat} +Requires: logrotate +Requires: procps-ng + +%description +Agent for collecting, processing, aggregating, and writing metrics, logs, and +other arbitrary data. +This Azure Linux build compiles a curated, general-purpose subset of plugins to reduce +binary size and vulnerability surface. + +# AzL: --- Curated "Balanced" plugin set ------------------------------------------------ +# Upstream's custom builder uses Go build constraints (e.g. +# `//go:build !custom || inputs || inputs.cpu`): with the `custom` tag set, a plugin is +# compiled in ONLY when its category tag or specific `.` tag is passed. +# Tags are space-separated and consumed via GO_BUILDTAGS by %%gobuild (Fedora MANDATES +# GO_BUILDTAGS; the bare BUILDTAGS env var is forbidden). +# +# This list is AzL's curated general-purpose policy (Balanced level: ~108 plugins of ~415). +# It also includes the full first-party Azure plugin set (azure_monitor in/out, +# azure_storage_queue, eventhub_consumer, application_insights, azure_data_explorer) and the +# github input, since Azure Linux is an Azure/Microsoft (and GitHub) product and these +# integrations are expected to work out of the box. +# To add/remove a plugin, edit here. A config-derived subset can be auto-generated from a +# target telegraf.conf via `tools/custom_builder --config --dry-run --tags`. +%global buildtags custom \ + inputs.cpu inputs.disk inputs.diskio inputs.mem inputs.net inputs.netstat \ + inputs.system inputs.kernel inputs.kernel_vmstat inputs.processes inputs.procstat \ + inputs.swap inputs.temp inputs.sensors inputs.interrupts inputs.internal \ + inputs.linux_cpu inputs.linux_sysctl_fs inputs.conntrack inputs.ethtool inputs.nstat \ + inputs.mdstat inputs.smart inputs.smartctl inputs.ipmi_sensor inputs.infiniband \ + inputs.hugepages inputs.dmcache inputs.wireless inputs.systemd_units inputs.memcached \ + inputs.exec inputs.execd inputs.file inputs.tail inputs.http inputs.http_response \ + inputs.net_response inputs.ping inputs.dns_query inputs.socket_listener \ + inputs.filecount inputs.filestat inputs.x509_cert inputs.statsd inputs.syslog \ + inputs.nginx inputs.apache inputs.haproxy inputs.mysql inputs.postgresql inputs.redis \ + inputs.mongodb inputs.elasticsearch inputs.snmp inputs.prometheus inputs.docker \ + inputs.kafka_consumer inputs.mqtt_consumer \ + inputs.azure_monitor inputs.azure_storage_queue inputs.eventhub_consumer inputs.github \ + outputs.azure_monitor outputs.application_insights outputs.azure_data_explorer \ + outputs.file outputs.exec \ + outputs.socket_writer outputs.http outputs.prometheus_client outputs.influxdb \ + outputs.influxdb_v2 outputs.graphite outputs.elasticsearch outputs.kafka outputs.mqtt \ + outputs.opentelemetry \ + processors.converter processors.enum processors.regex processors.rename \ + processors.strings processors.override processors.parser \ + aggregators.basicstats aggregators.final aggregators.merge aggregators.histogram \ + parsers.influx parsers.json parsers.json_v2 parsers.prometheus parsers.csv \ + parsers.value parsers.graphite parsers.logfmt parsers.grok parsers.xpath \ + parsers.collectd parsers.dropwizard \ + serializers.influx serializers.json serializers.prometheus serializers.graphite \ + serializers.carbon2 serializers.csv serializers.splunkmetric + +# AzL: stamp the version/branch the same way upstream's Makefile does. +%global specldflags -X %{goipath}/internal.Version=%{version} -X %{goipath}/internal.Branch=azurelinux + +%prep +%goprep -p1 +tar -xf %{S:1} + +%generate_buildrequires +%go_vendor_license_buildrequires -c %{S:2} + +%build +%global gomodulesmode GO111MODULE=on +# AzL: go2rpm builds every cmd/* and all the upstream dev tools. We compile ONLY the +# curated telegraf binary, selecting plugins via GO_BUILDTAGS (the curation mechanism). +export GO_BUILDTAGS="%{buildtags}" +export GO_LDFLAGS="%{specldflags}" +%gobuild -o %{gobuilddir}/bin/%{name} %{goipath}/cmd/%{name} + +%install +# License files for the main project and ALL vendored modules (+ modules.txt for the +# bundled() provides generator). Populates %%{go_vendor_license_filelist}. +%go_vendor_license_install -c %{S:2} + +# Binary +install -Dpm 0755 %{gobuilddir}/bin/%{name} %{buildroot}%{_bindir}/%{name} + +# AzL: --- runtime packaging (omitted by the go2rpm scaffold) ------------------------- +# Systemd unit, shipped unmodified from upstream (runs as User=telegraf). +install -Dpm 0644 scripts/%{name}.service %{buildroot}%{_unitdir}/%{name}.service + +# Declarative system user +install -Dpm 0644 %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf + +# Logrotate fragment (shipped by upstream) +install -Dpm 0644 etc/logrotate.d/%{name} %{buildroot}%{_sysconfdir}/logrotate.d/%{name} + +# AzL: optional environment file referenced by the unit (EnvironmentFile=-...). Shipped as a +# Source file for consistency with the other drop-ins (go2rpm emits none of these). +install -Dpm 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/default/%{name} + +# Config tree. Generate a default config from THIS binary so it reflects the curated +# (compiled-in) plugin set rather than the full upstream catalog. Note: this executes the +# freshly-built target binary, so it assumes a native (non-cross/emulated) build, which is +# how AzL builds each arch in mock. +install -d -m 0755 %{buildroot}%{_sysconfdir}/%{name}/%{name}.d +%{gobuilddir}/bin/%{name} config > %{name}.conf +install -Dpm 0644 %{name}.conf %{buildroot}%{_sysconfdir}/%{name}/%{name}.conf + +# State directory for the optional agent statefile; 0770 root:telegraf to match upstream +# InfluxData (scripts/rpm/post-install.sh). +install -d -m 0770 %{buildroot}%{_localstatedir}/lib/%{name} + +%check +%go_vendor_license_check -c %{S:2} +%if %{with check} +# AzL: go2rpm runs `%%gotest ./...`; the full suite needs network and non-curated plugins, +# so we smoke-test the curated binary instead (executes the freshly-built target binary, +# i.e. assumes a native build, which is how AzL builds each arch in mock). +%{gobuilddir}/bin/%{name} --version +%endif + +# AzL: install-time scriptlets for the system user + systemd unit (go2rpm emits none). +%pre +%sysusers_create_compat %{SOURCE3} + +%post +%systemd_post %{name}.service + +%preun +%systemd_preun %{name}.service + +%postun +%systemd_postun_with_restart %{name}.service +# Intentionally do NOT delete the telegraf user/group on uninstall: per Fedora packaging +# guidelines, removing system users can orphan files under a later-reused UID. + +# AzL: go2rpm marks every plugin README as %%doc and ships all cmd/* + tool binaries. +# We ship only the curated binary and a minimal doc set. +%files -f %{go_vendor_license_filelist} +# AzL: vendor/modules.txt is already included in %%{go_vendor_license_filelist} (and is what +# the bundled(golang(...)) provides generator scans), so it is NOT listed again here. +%doc README.md +%{_bindir}/%{name} +%{_unitdir}/%{name}.service +%{_sysusersdir}/%{name}.conf +%config(noreplace) %{_sysconfdir}/logrotate.d/%{name} +%config(noreplace) %{_sysconfdir}/default/%{name} +%dir %{_sysconfdir}/%{name} +%dir %{_sysconfdir}/%{name}/%{name}.d +%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf +%dir %attr(0770,root,telegraf) %{_localstatedir}/lib/%{name} + +%changelog +%autochangelog diff --git a/base/comps/telegraf/telegraf.sysusers b/base/comps/telegraf/telegraf.sysusers new file mode 100644 index 00000000000..5617754badd --- /dev/null +++ b/base/comps/telegraf/telegraf.sysusers @@ -0,0 +1,12 @@ +# System user for the telegraf agent. Home is /etc/telegraf, matching upstream InfluxData and +# its Fedora/RHEL packaging (`useradd -r -M -d /etc/telegraf`). +# +# The home field has no effect on configuration: the systemd unit loads config via an explicit +# `-config /etc/telegraf/telegraf.conf -config-directory /etc/telegraf/telegraf.d`, independent +# of $HOME. /etc/telegraf is root-owned and not writable by telegraf (upstream ships it with -M, +# so it is never a writable home), and that is fine here because the curated plugin set writes +# nothing under $HOME: the Azure credentials in use (NewDefaultAzureCredential / +# NewManagedIdentityCredential) keep tokens in memory and azidentity's optional on-disk cache is +# not linked in. Agent state (the statefile) lives separately under /var/lib/telegraf. +# Type Name ID GECOS Home directory Shell +u telegraf - "Telegraf" /etc/telegraf /usr/sbin/nologin diff --git a/locks/telegraf.lock b/locks/telegraf.lock new file mode 100644 index 00000000000..85725c3eda7 --- /dev/null +++ b/locks/telegraf.lock @@ -0,0 +1,3 @@ +# Managed by azldev component update. Do not edit manually. +version = 1 +input-fingerprint = 'sha256:a1987e5e45e9d18ca3fa9878959bc1ff101a4b1c2a61b7cf17e3de8f5f5581e7' diff --git a/specs/t/telegraf/go-vendor-tools.toml b/specs/t/telegraf/go-vendor-tools.toml new file mode 100644 index 00000000000..e8e683b749a --- /dev/null +++ b/specs/t/telegraf/go-vendor-tools.toml @@ -0,0 +1,64 @@ +# Go Vendor Tools configuration (Fedora Go packaging guidelines). +# Drives %go_vendor_license_* macros: license detection + cumulative SPDX expression. +[licensing] +detector = "askalono" +[[licensing.licenses]] +path = "vendor/github.com/apache/arrow/go/v15/LICENSE.txt" +sha256sum = "bd939b3a0ca7ffedd7444240915f4f297f09739fa9d07bac8c85ec4ea8c94c35" +expression = "Apache-2.0" +[[licensing.licenses]] +path = "vendor/github.com/apache/inlong/inlong-sdk/dataproxy-sdk-twins/dataproxy-sdk-golang/LICENSE" +sha256sum = "9c36b16d6730c0d63b406f4af70c17a737b8d5010e276e737d7cbba2bb662520" +expression = "Apache-2.0" +[[licensing.licenses]] +path = "vendor/github.com/gosnmp/gosnmp/LICENSE" +sha256sum = "28b63cdfceda72f7b8c9a8db2d7ab07661eb4d6bb9fc020077925b6b4faf84fa" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/github.com/miekg/dns/COPYRIGHT" +sha256sum = "66550c0ad5ca7ec1e08683e5f872cc45c741f311eee3b8ee484206ecbf9c740d" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/github.com/shirou/gopsutil/v4/LICENSE" +sha256sum = "ad1e64b82c04fb2ee6bfe521bff01266971ffaa70500024d4ac767c6033aafb9" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/github.com/shopspring/decimal/LICENSE" +sha256sum = "b92ba0f6ee02f2309628bfdadb123668a17c016e475ba477b857d33470d9d625" +expression = "MIT" +[[licensing.licenses]] +path = "vendor/github.com/twmb/murmur3/LICENSE" +sha256sum = "4228ef1819124b490d2e6a88e8c5e1348bedf32ff05b8fb5deed49921600e503" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/go.yaml.in/yaml/v3/LICENSE" +sha256sum = "d18f6323b71b0b768bb5e9616e36da390fbd39369a81807cca352de4e4e6aa0b" +expression = "Apache-2.0 AND MIT" +[[licensing.licenses]] +path = "vendor/gopkg.in/yaml.v3/LICENSE" +sha256sum = "d18f6323b71b0b768bb5e9616e36da390fbd39369a81807cca352de4e4e6aa0b" +expression = "Apache-2.0 AND MIT" +[[licensing.licenses]] +path = "vendor/honnef.co/go/tools/LICENSE-THIRD-PARTY" +sha256sum = "3e7ed5dc00f1b3518b99284123bfc3e3c65b82c62988c0dcda5c86c13d913f7c" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/howett.net/plist/LICENSE" +sha256sum = "20d9b7d9372369484ecadae229d3e3efee8029b259e11c9a1b07d2e0a3c82e39" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/modernc.org/libc/LICENSE-3RD-PARTY.md" +sha256sum = "f597097efe3d97021f89170746bd3a0fb9a8b6fb26b82043ed68a4e0283bee6c" +expression = "BSD-3-Clause" +[[licensing.licenses]] +path = "vendor/modernc.org/memory/LICENSE-LOGO" +sha256sum = "5ae5bee3072a841376451b48d8cfcec7188e10543926d5870828d36c8a750dc5" +expression = "CC-BY-SA-4.0" +[[licensing.licenses]] +path = "vendor/modernc.org/sqlite/SQLITE-LICENSE" +sha256sum = "8438c9c89b849131ead81d5435cb97fcf052df5b0b286dda8a2d4c29e6cb3fd0" +expression = "blessing" +[[licensing.licenses]] +path = "vendor/github.com/rootless-containers/proto/go-proto/rootlesscontainers.pb.go" +sha256sum = "023e4d6b705cc09f3c74d106889e60418bf0c05a5356dd2d3b16687f32bfb9e5" +expression = "Apache-2.0" diff --git a/specs/t/telegraf/sources b/specs/t/telegraf/sources new file mode 100644 index 00000000000..7914fa24e63 --- /dev/null +++ b/specs/t/telegraf/sources @@ -0,0 +1,2 @@ +SHA512 (telegraf-1.38.2.tar.gz) = 36c419978e98da9809e18865053399dd2198abc3d650f54424e3eb359ff8dfcb615f8b0a82dba484d03acfe5abe51a160a41ef486e5602f99400bd69e7afe48d +SHA512 (telegraf-1.38.2-vendor.tar.bz2) = 1108fe48086a7051c5cb89935c6de1c675c3ea8212a979d147ad0c03aef327c6234fa9eee292e4f9594ba9ec2cb757fc9eff46630aea43551bca3d948b30b27f diff --git a/specs/t/telegraf/telegraf.default b/specs/t/telegraf/telegraf.default new file mode 100644 index 00000000000..a71d0a0c3d1 --- /dev/null +++ b/specs/t/telegraf/telegraf.default @@ -0,0 +1,2 @@ +# Extra command-line options passed to telegraf by the systemd unit. +#TELEGRAF_OPTS= diff --git a/specs/t/telegraf/telegraf.spec b/specs/t/telegraf/telegraf.spec new file mode 100644 index 00000000000..d95d3620c30 --- /dev/null +++ b/specs/t/telegraf/telegraf.spec @@ -0,0 +1,215 @@ +## START: Set by rpmautospec +## (rpmautospec version 0.8.3) +## RPMAUTOSPEC: autorelease, autochangelog +%define autorelease(e:s:pb:n) %{?-p:0.}%{lua: + release_number = 2; + base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); + print(release_number + base_release_number - 1); +}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} +## END: Set by rpmautospec + +# This spec file has been modified by azldev to include build configuration overlays. +# Do not edit manually; changes may be overwritten. + +# Generated by go2rpm 1.19.0 — then curated for Azure Linux. +# +# BASELINE: this spec is rebased on the canonical Fedora Go scaffold emitted by +# `go2rpm --profile vendor -v 1.38.2 github.com/influxdata/telegraf` +# (modern Go guidelines: %%gometa -L -f, Go Vendor Tools, %%gobuild, full vendor archive). +# Everything below that diverges from that scaffold is marked `# AzL:` and is limited to: +# 1. A curated ("Balanced") custom build — only a general-purpose subset of telegraf's +# ~415 plugins is COMPILED IN (see %%{buildtags}); the vendor archive still ships the +# FULL dependency tree (curation only changes what is linked, not what is vendored). +# 2. Runtime packaging go2rpm omits for application binaries (systemd unit, sysusers, +# logrotate, default config, env file, state dir). +# 3. The real cumulative SPDX License: tag (go2rpm leaves it as a TODO). +# Keeping the scaffold visible makes our divergence auditable and upstreamable to Fedora. + +%bcond check 1 + +# https://github.com/influxdata/telegraf +%global goipath github.com/influxdata/telegraf +Version: 1.38.2 + +%gometa -L -f + + +Name: telegraf +Release: %autorelease +Summary: Agent for collecting, processing, aggregating, and writing metrics, logs, and other arbitrary data + +# AzL: go2rpm emits `License: TODO`. This cumulative SPDX expression was generated with +# `go_vendor_license report expression` (askalono detector) over the FULL vendor tree and is +# enforced by %%go_vendor_license_check in %%check. Regenerate on every version bump. +License: Apache-2.0 AND BSD-2-Clause AND BSD-2-Clause-Views AND BSD-3-Clause AND CC-BY-SA-4.0 AND EPL-2.0 AND ISC AND MIT AND MIT-0 AND MPL-2.0 AND Unlicense AND blessing +URL: %{gourl} +Source0: %{gosource} +# Generated by go-vendor-tools +Source1: %{archivename}-vendor.tar.bz2 +Source2: go-vendor-tools.toml +# AzL: declarative system user (created at install time, before files are unpacked). +Source3: %{name}.sysusers +# AzL: optional environment file referenced by the unit (EnvironmentFile=-/etc/default/telegraf). +Source4: %{name}.default + +BuildRequires: go-vendor-tools +# AzL: for the systemd unit + sysusers scriptlet macros below. +BuildRequires: systemd-rpm-macros + +# AzL: %%{?systemd_requires} adds correctly-ordered Requires(post/preun/postun) for the unit +# scriptlets; %%{?sysusers_requires_compat} pulls the pre-time deps %%sysusers_create_compat +# needs (systemd-sysusers with a shadow-utils fallback). +%{?systemd_requires} +%{?sysusers_requires_compat} +Requires: logrotate +Requires: procps-ng + +%description +Agent for collecting, processing, aggregating, and writing metrics, logs, and +other arbitrary data. +This Azure Linux build compiles a curated, general-purpose subset of plugins to reduce +binary size and vulnerability surface. + +# AzL: --- Curated "Balanced" plugin set ------------------------------------------------ +# Upstream's custom builder uses Go build constraints (e.g. +# `//go:build !custom || inputs || inputs.cpu`): with the `custom` tag set, a plugin is +# compiled in ONLY when its category tag or specific `.` tag is passed. +# Tags are space-separated and consumed via GO_BUILDTAGS by %%gobuild (Fedora MANDATES +# GO_BUILDTAGS; the bare BUILDTAGS env var is forbidden). +# +# This list is AzL's curated general-purpose policy (Balanced level: ~108 plugins of ~415). +# It also includes the full first-party Azure plugin set (azure_monitor in/out, +# azure_storage_queue, eventhub_consumer, application_insights, azure_data_explorer) and the +# github input, since Azure Linux is an Azure/Microsoft (and GitHub) product and these +# integrations are expected to work out of the box. +# To add/remove a plugin, edit here. A config-derived subset can be auto-generated from a +# target telegraf.conf via `tools/custom_builder --config --dry-run --tags`. +%global buildtags custom \ + inputs.cpu inputs.disk inputs.diskio inputs.mem inputs.net inputs.netstat \ + inputs.system inputs.kernel inputs.kernel_vmstat inputs.processes inputs.procstat \ + inputs.swap inputs.temp inputs.sensors inputs.interrupts inputs.internal \ + inputs.linux_cpu inputs.linux_sysctl_fs inputs.conntrack inputs.ethtool inputs.nstat \ + inputs.mdstat inputs.smart inputs.smartctl inputs.ipmi_sensor inputs.infiniband \ + inputs.hugepages inputs.dmcache inputs.wireless inputs.systemd_units inputs.memcached \ + inputs.exec inputs.execd inputs.file inputs.tail inputs.http inputs.http_response \ + inputs.net_response inputs.ping inputs.dns_query inputs.socket_listener \ + inputs.filecount inputs.filestat inputs.x509_cert inputs.statsd inputs.syslog \ + inputs.nginx inputs.apache inputs.haproxy inputs.mysql inputs.postgresql inputs.redis \ + inputs.mongodb inputs.elasticsearch inputs.snmp inputs.prometheus inputs.docker \ + inputs.kafka_consumer inputs.mqtt_consumer \ + inputs.azure_monitor inputs.azure_storage_queue inputs.eventhub_consumer inputs.github \ + outputs.azure_monitor outputs.application_insights outputs.azure_data_explorer \ + outputs.file outputs.exec \ + outputs.socket_writer outputs.http outputs.prometheus_client outputs.influxdb \ + outputs.influxdb_v2 outputs.graphite outputs.elasticsearch outputs.kafka outputs.mqtt \ + outputs.opentelemetry \ + processors.converter processors.enum processors.regex processors.rename \ + processors.strings processors.override processors.parser \ + aggregators.basicstats aggregators.final aggregators.merge aggregators.histogram \ + parsers.influx parsers.json parsers.json_v2 parsers.prometheus parsers.csv \ + parsers.value parsers.graphite parsers.logfmt parsers.grok parsers.xpath \ + parsers.collectd parsers.dropwizard \ + serializers.influx serializers.json serializers.prometheus serializers.graphite \ + serializers.carbon2 serializers.csv serializers.splunkmetric + +# AzL: stamp the version/branch the same way upstream's Makefile does. +%global specldflags -X %{goipath}/internal.Version=%{version} -X %{goipath}/internal.Branch=azurelinux + +%prep +%goprep -p1 +tar -xf %{S:1} + +%generate_buildrequires +%go_vendor_license_buildrequires -c %{S:2} + +%build +%global gomodulesmode GO111MODULE=on +# AzL: go2rpm builds every cmd/* and all the upstream dev tools. We compile ONLY the +# curated telegraf binary, selecting plugins via GO_BUILDTAGS (the curation mechanism). +export GO_BUILDTAGS="%{buildtags}" +export GO_LDFLAGS="%{specldflags}" +%gobuild -o %{gobuilddir}/bin/%{name} %{goipath}/cmd/%{name} + +%install +# License files for the main project and ALL vendored modules (+ modules.txt for the +# bundled() provides generator). Populates %%{go_vendor_license_filelist}. +%go_vendor_license_install -c %{S:2} + +# Binary +install -Dpm 0755 %{gobuilddir}/bin/%{name} %{buildroot}%{_bindir}/%{name} + +# AzL: --- runtime packaging (omitted by the go2rpm scaffold) ------------------------- +# Systemd unit, shipped unmodified from upstream (runs as User=telegraf). +install -Dpm 0644 scripts/%{name}.service %{buildroot}%{_unitdir}/%{name}.service + +# Declarative system user +install -Dpm 0644 %{SOURCE3} %{buildroot}%{_sysusersdir}/%{name}.conf + +# Logrotate fragment (shipped by upstream) +install -Dpm 0644 etc/logrotate.d/%{name} %{buildroot}%{_sysconfdir}/logrotate.d/%{name} + +# AzL: optional environment file referenced by the unit (EnvironmentFile=-...). Shipped as a +# Source file for consistency with the other drop-ins (go2rpm emits none of these). +install -Dpm 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/default/%{name} + +# Config tree. Generate a default config from THIS binary so it reflects the curated +# (compiled-in) plugin set rather than the full upstream catalog. Note: this executes the +# freshly-built target binary, so it assumes a native (non-cross/emulated) build, which is +# how AzL builds each arch in mock. +install -d -m 0755 %{buildroot}%{_sysconfdir}/%{name}/%{name}.d +%{gobuilddir}/bin/%{name} config > %{name}.conf +install -Dpm 0644 %{name}.conf %{buildroot}%{_sysconfdir}/%{name}/%{name}.conf + +# State directory for the optional agent statefile; 0770 root:telegraf to match upstream +# InfluxData (scripts/rpm/post-install.sh). +install -d -m 0770 %{buildroot}%{_localstatedir}/lib/%{name} + +%check +%go_vendor_license_check -c %{S:2} +%if %{with check} +# AzL: go2rpm runs `%%gotest ./...`; the full suite needs network and non-curated plugins, +# so we smoke-test the curated binary instead (executes the freshly-built target binary, +# i.e. assumes a native build, which is how AzL builds each arch in mock). +%{gobuilddir}/bin/%{name} --version +%endif + +# AzL: install-time scriptlets for the system user + systemd unit (go2rpm emits none). +%pre +%sysusers_create_compat %{SOURCE3} + +%post +%systemd_post %{name}.service + +%preun +%systemd_preun %{name}.service + +%postun +%systemd_postun_with_restart %{name}.service +# Intentionally do NOT delete the telegraf user/group on uninstall: per Fedora packaging +# guidelines, removing system users can orphan files under a later-reused UID. + +# AzL: go2rpm marks every plugin README as %%doc and ships all cmd/* + tool binaries. +# We ship only the curated binary and a minimal doc set. +%files -f %{go_vendor_license_filelist} +# AzL: vendor/modules.txt is already included in %%{go_vendor_license_filelist} (and is what +# the bundled(golang(...)) provides generator scans), so it is NOT listed again here. +%doc README.md +%{_bindir}/%{name} +%{_unitdir}/%{name}.service +%{_sysusersdir}/%{name}.conf +%config(noreplace) %{_sysconfdir}/logrotate.d/%{name} +%config(noreplace) %{_sysconfdir}/default/%{name} +%dir %{_sysconfdir}/%{name} +%dir %{_sysconfdir}/%{name}/%{name}.d +%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf +%dir %attr(0770,root,telegraf) %{_localstatedir}/lib/%{name} + +%changelog +## START: Generated by rpmautospec +* Thu Jul 02 2026 Autumn Nash - 1.38.2-2 +- feat(telegraf): add curated telegraf 1.38.2 metrics agent for Azure Linux + 4.0 + +* Thu Jan 01 1970 azldev <> - 1.38.2-1 +- Initial sources +## END: Generated by rpmautospec diff --git a/specs/t/telegraf/telegraf.sysusers b/specs/t/telegraf/telegraf.sysusers new file mode 100644 index 00000000000..5617754badd --- /dev/null +++ b/specs/t/telegraf/telegraf.sysusers @@ -0,0 +1,12 @@ +# System user for the telegraf agent. Home is /etc/telegraf, matching upstream InfluxData and +# its Fedora/RHEL packaging (`useradd -r -M -d /etc/telegraf`). +# +# The home field has no effect on configuration: the systemd unit loads config via an explicit +# `-config /etc/telegraf/telegraf.conf -config-directory /etc/telegraf/telegraf.d`, independent +# of $HOME. /etc/telegraf is root-owned and not writable by telegraf (upstream ships it with -M, +# so it is never a writable home), and that is fine here because the curated plugin set writes +# nothing under $HOME: the Azure credentials in use (NewDefaultAzureCredential / +# NewManagedIdentityCredential) keep tokens in memory and azidentity's optional on-disk cache is +# not linked in. Agent state (the statefile) lives separately under /var/lib/telegraf. +# Type Name ID GECOS Home directory Shell +u telegraf - "Telegraf" /etc/telegraf /usr/sbin/nologin