Install Fedora Source package on RHEL / CentOS

Question

I'm attempting to upgrade curl on RHEL / CentOS machines. I've found what seems to be the appropriate source packages in a number of repos. (ie, http://mirror.centos.org/centos/6/os/SRPMS/Packages/curl-7.19.7-16.el6.src.rpm)

When attempting to make an rpm from the source package using rpmbuild, I get the following output;

# rpmbuild --rebuild curl-7.19.7-16.el6.src.rpm
Installing curl-7.19.7-16.el6.src.rpm
warning: InstallSourcePackage: Header V3 RSA/SHA256 signature: NOKEY, key ID c105b9de
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
error: unpacking of archive failed on file /usr/src/redhat/SOURCES/curl-7.15.3-multilib.patch;4e984633: cpio: MD5 sum mismatch
error: curl-7.19.7-16.el6.src.rpm cannot be installed

The issue seems to be that the source is meant for Fedora, which uses SHA-256. There's a bug filed here that has comments indicating there's a means to circumvent the md5 checksum. However, it's not very detailed.

Is there a way to install this package?

Answer 1

I assume you want to upgrade CentOS5 curl to a version from CentOS6. I think the problem is not with SHA256 signature but with XZ/LZMA compression which is not supported by CentOS5.

You'd need to:

• run CentOS6 on a spare computer or virtual machine — LiveCD is enough
• on CentOS6: yum install rpm-build yum-utils
• on CentOS6: yumdownloader --source curl
• on CentOS6: rpm -i curl-*.src.rpm
• on CentOS6: scp -pr ~/rpmbuild your_username@your_centos_ip:
• on CentOS5: rpmbuild -ba ~/rpmbuild/SPECS/curl.spec

Answer 2

If you don't have a CentOS 6 box available as @Tometzky suggests, this will work :

cd ~/rpmbuild/SOURCES
rpm2cpio ~/path/to/your/curl-*.src.rpm | cpio -idmv
mv *.spec ~/rpmbuild/SPECS/
rpmbuild -ba ~/rpmbuild/SPECS/curl.spec

Unfortunately, rebuilding curl from CentOS 6 on CentOS 5 involves a lot more complexity beyond just this first hurdle including :

• Rebuliding libssh2 from CentOS 6 on CentOS 5
• Installing lzma
• Other things I haven't figured out yet

Answer 3

Try:

rpmbuild --rebuild --define "_source_filedigest_algorithm md5" --define "_binary_filedigest_algorithm md5" curl-7.19.7-16.el6.src.rpm

If that doesn't work, you may need to extract the RPM and then rebuild it:

rpm -i --nomd5 curl-7.19.7-16.el6.src.rpm
rpmbuild -ba --define "_source_filedigest_algorithm md5" --define "_binary_filedigest_algorithm md5" /usr/src/redhat/SPECS/curl.spec

I may have the spec file name wrong on the last command.

Answer 4

I think you are talking about this bug: https://bugzilla.redhat.com/show_bug.cgi?id=490613#c15

FYI: The SRPMs that contain rpm with back-ported strong hashes + xz payload support are available from the Fedora Infrastructure repositories:

http://infrastructure.fedoraproject.org/builder-rpms/SRPMS/

I've been using those for a very long time on my builders and they work nicely. It would be great if they were officially accepted into RHEL5.

you want rpm-4.6.0-4.0.notting.1.el5

src.rpm or binaries are in :

http://infrastructure.fedoraproject.org/builder-rpms/SRPMS/

http://infrastructure.fedoraproject.org/builder-rpms/i386/

http://infrastructure.fedoraproject.org/builder-rpms/x86_64/