Add RPM packaging

auditbeat/magefile.go

@@ -44,6 +44,9 @@ func Build() error {
 // GolangCrossBuild build the Beat binary inside of the golang-builder.
 // Do not use directly, use crossBuild instead.
 func GolangCrossBuild() error {
+	if d, ok := deps[mage.Platform.Name]; ok {
+		mg.Deps(d)
+	}
 	return mage.GolangCrossBuild(mage.DefaultGolangCrossBuildArgs())
 }
 
@@ -120,6 +123,83 @@ func GoTestIntegration(ctx context.Context) error {
 // -----------------------------------------------------------------------------
 // Customizations specific to Auditbeat.
 // - Config files are Go templates.
+var (
+	deps = map[string]func() error{
+		"linux/386":      installLinux386,
+		"linux/amd64":    installLinuxAMD64,
+		"linux/arm64":    installLinuxARM64,
+		"linux/armv5":    installLinuxARMLE,
+		"linux/armv6":    installLinuxARMLE,
+		"linux/armv7":    installLinuxARMHF,
+		"linux/mips":     installLinuxMIPS,
+		"linux/mipsle":   installLinuxMIPSLE,
+		"linux/mips64le": installLinuxMIPS64LE,
+		"linux/ppc64le":  installLinuxPPC64LE,
+		"linux/s390x":    installLinuxS390X,
+
+		//"linux/ppc64":  installLinuxPpc64,
+		//"linux/mips64": installLinuxMips64,
+	}
+)
+
+const (
+	librpmDevPkgName = "librpm-dev"
+)
+
+func installLinuxAMD64() error {
+	return installDependencies(librpmDevPkgName, "")
+}
+
+func installLinuxARM64() error {
+	return installDependencies(librpmDevPkgName+":arm64", "arm64")
+}
+
+func installLinuxARMHF() error {
+	return installDependencies(librpmDevPkgName+":armhf", "armhf")
+}
+
+func installLinuxARMLE() error {
+	return installDependencies(librpmDevPkgName+":armel", "armel")
+}
+
+func installLinux386() error {
+	return installDependencies(librpmDevPkgName+":i386", "i386")
+}
+
+func installLinuxMIPS() error {
+	return installDependencies(librpmDevPkgName+":mips", "mips")
+}
+
+func installLinuxMIPS64LE() error {
+	return installDependencies(librpmDevPkgName+":mips64el", "mips64el")
+}
+
+func installLinuxMIPSLE() error {
+	return installDependencies(librpmDevPkgName+":mipsel", "mipsel")
+}
+
+func installLinuxPPC64LE() error {
+	return installDependencies(librpmDevPkgName+":ppc64el", "ppc64el")
+}
+
+func installLinuxS390X() error {
+	return installDependencies(librpmDevPkgName+":s390x", "s390x")
+}
+
+func installDependencies(pkg, arch string) error {
+	if arch != "" {
+		err := sh.Run("dpkg", "--add-architecture", arch)
+		if err != nil {
+			return errors.Wrap(err, "error while adding architecture")
+		}
+	}
+
+	if err := sh.Run("apt-get", "update"); err != nil {
+		return err
+	}
+
+	return sh.Run("apt-get", "install", "-y", "--no-install-recommends", pkg)
+}
 
 const (
 	configTemplateGlob      = "module/*/_meta/config*.yml.tmpl"

x-pack/auditbeat/module/system/packages/packages.go

@@ -204,8 +204,10 @@ func convertToCacheable(packages []*Package) []cache.Cacheable {
 func getPackages(osFamily string) (packages []*Package, err error) {
 	switch osFamily {
 	case redhat:
-		// TODO: Implement RPM
-		err = errors.New("RPM not yet supported")
+		packages, err = listRPMPackages()
+		if err != nil {
+			err = errors.Wrap(err, "error getting DEB packages")
+		}
 	case debian:
 		packages, err = listDebPackages()
 		if err != nil {

x-pack/auditbeat/module/system/packages/rpm_common_test.go

@@ -0,0 +1,67 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package packages
+
+import (
+	"fmt"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+)
+
+func rpmPackagesByExec() ([]*Package, error) {
+	format := "%{NAME}|%{VERSION}|%{RELEASE}|%{ARCH}|%{LICENSE}|%{INSTALLTIME}|%{SIZE}|%{URL}|%{SUMMARY}\\n"
+	out, err := exec.Command("/usr/bin/rpm", "--qf", format, "-qa").Output()
+	if err != nil {
+		return nil, fmt.Errorf("Error running rpm -qa command: %v", err)
+	}
+
+	lines := strings.Split(string(out), "\n")
+	var packages []*Package
+	for _, line := range lines {
+		if len(strings.TrimSpace(line)) == 0 {
+			continue
+		}
+		words := strings.SplitN(line, "|", 9)
+		if len(words) < 9 {
+			return nil, fmt.Errorf("line '%s' doesn't have enough elements", line)
+		}
+		pkg := Package{
+			Name:    words[0],
+			Version: words[1],
+			Release: words[2],
+			Arch:    words[3],
+			License: words[4],
+			// install time - 5
+			// size - 6
+			URL:     words[7],
+			Summary: words[8],
+		}
+		ts, err := strconv.ParseInt(words[5], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("error converting %s to string: %v", words[5], err)
+		}
+		pkg.InstallTime = time.Unix(ts, 0)
+
+		pkg.Size, err = strconv.ParseUint(words[6], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("error converting %s to string: %v", words[6], err)
+		}
+
+		// Avoid "(none)" in favor of empty strings
+		if pkg.URL == "(none)" {
+			pkg.URL = ""
+		}
+		if pkg.Arch == "(none)" {
+			pkg.Arch = ""
+		}
+
+		packages = append(packages, &pkg)
+
+	}
+
+	return packages, nil
+}