Add rancher selinux policies as standalone package

manifest.yaml

@@ -23,3 +23,5 @@ build:
  - utils/nerdctl
  - utils/k9s
  - recovery/cos
+ - selinux/rancher
+ - selinux/k3s

packages/selinux/build.yaml

@@ -0,0 +1,29 @@
+requires:
+- name: "base"
+  category: "distro"
+  version: ">=0"
+env:
+- GITHUB_ORG={{ ( index .Values.labels "github.owner" ) }}
+- GITHUB_REPO={{ ( index .Values.labels "github.repo" ) }}
+
+{{ if .Values.distribution }}
+{{if eq .Values.distribution "opensuse" }}
+prelude:
+- zypper ar https://download.opensuse.org/repositories/security:/SELinux/openSUSE_Leap_15.3/security:SELinux.repo
+- zypper --gpg-auto-import-keys in -y --allow-vendor-change --allow-downgrade container-selinux -libsemanage1
+
+steps:
+- |
+    PACKAGE_VERSION=${PACKAGE_VERSION%\+*} && \
+    mkdir /tmp/rpm && \
+    cd /tmp/rpm && \
+    curl -L -O https://github.com/${GITHUB_ORG}/${GITHUB_REPO}/releases/download/v{{ ( index .Values.labels "github.tag" ) }}/{{.Values.name}}-{{.Values.category}}-${PACKAGE_VERSION}.el7.noarch.rpm && \
+    echo "{{ ( index .Values.labels "package.checksum" ) }}  {{.Values.name}}-{{.Values.category}}-${PACKAGE_VERSION}.el7.noarch.rpm" | sha256sum -c && \
+    rpm -ivh --nodeps *.rpm && \
+    cd / && \
+    rm -rf /tmp/rpm
+{{end}}
+{{end}}
+excludes:
+- ^/tmp
+- ^/var/lib/selinux/targeted/tmp

packages/selinux/collection.yaml

@@ -0,0 +1,17 @@
+packages:
+- name: "k3s"
+  category: "selinux"
+  version: 0.3-0
+  labels:
+    github.repo: "k3s-selinux"
+    github.owner: "k3s-io"
+    github.tag: "0.3.testing.0"
+    package.checksum: "6c6a23a146dfecf8fd834689e11da3e3841be3ce624fd5044811c9f95c5fcd17"
+- name: "rancher"
+  category: "selinux"
+  version: 0.2.rc1-1
+  labels:
+    github.repo: "rancher-selinux"
+    github.owner: "rancher"
+    github.tag: "0.2-rc1.testing.1"
+    package.checksum: "1b0537f5c372b3b965c91bd7dffdec3c377e6de27cb15c26659c65114a89a64f"