rpm: add fluent-release package for yum/dnf update

In the previous versions, .repo file was assumed to
be created via fluent-package installation script.

For migration from packages.treasuredata.com to fluentd.cdn.cncf.io
in the future, it might be better to setup proper fluent-release
package for it.

Signed-off-by: Kentaro Hayashi <[email protected]>

Author: kenhys

.github/workflows/yum-arm.yml

@@ -34,6 +34,7 @@ jobs:
         with:
           path: |
             fluent-package/yum/repositories
+            fluent-release/yum/repositories
           key: ${{ runner.os }}-cache-${{ matrix.rake-job }}-aarch64-${{ hashFiles('**/config.rb', '**/Rakefile', '**/Gemfile*', '**/*.spec.in', 'fluent-package/templates/**', 'fluent-package/yum/**/Dockerfile') }}
       - name: Install dependencies
         if: ${{ ! steps.cache-rpm.outputs.cache-hit }}
@@ -51,6 +52,11 @@ jobs:
         with:
           name: packages-${{ matrix.rake-job }}-aarch64
           path: fluent-package/yum/repositories
+      - name: Upload fluent-release rpm
+        uses: actions/upload-artifact@master
+        with:
+          name: packages-${{ matrix.rake-job }}-aarch64
+          path: fluent-release/yum/repositories
   check_package_size:
     name: Check Package Size
     runs-on: ubuntu-24.04-arm

.github/workflows/yum.yml

@@ -35,6 +35,7 @@ jobs:
         with:
           path: |
             fluent-package/yum/repositories
+            fluent-release/yum/repositories
             v6-test/fluent-package/yum/repositories
           key: ${{ runner.os }}-cache-${{ matrix.rake-job }}-${{ hashFiles('**/config.rb', '**/Rakefile', '**/Gemfile*', '**/*.spec.in', 'fluent-package/templates/**', 'fluent-package/yum/**/Dockerfile') }}
       - name: Install dependencies
@@ -65,6 +66,11 @@ jobs:
         with:
           name: packages-${{ matrix.rake-job }}
           path: fluent-package/yum/repositories
+      - name: Upload fluent-release rpm
+        uses: actions/upload-artifact@v4
+        with:
+          name: packages-${{ matrix.rake-job }}
+          path: fluent-release/yum/repositories
       - name: Upload v6 fluent-package rpm
         uses: actions/upload-artifact@v4
         with:

Rakefile

@@ -24,10 +24,15 @@ APT_SOURCE_PACKAGES = [
   "fluent-lts-apt-source",
 ]
 
+YUM_RELEASE_PACKAGES = [
+  "fluent-release"
+]
+
 ALL_PACKAGE = [
   "fluent-package",
   "fluent-apt-source",
   "fluent-lts-apt-source",
+  "fluent-release",
 ]
 
 def define_bulked_task(name, description, packages = PACKAGES)
@@ -59,6 +64,7 @@ end
 
 [
   ["apt:build", "Build fluent-apt-source deb packages", APT_SOURCE_PACKAGES],
+  ["yum:build", "Build fluent-release rpm packages", YUM_RELEASE_PACKAGES],
 ].each do |params|
   define_bulked_task(*params)
 end

fluent-release/RPM-GPG-KEY-fluent-package

@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGSbzFkBEADhPkZICm+ilfPuvGUM5eJZRII/ZHO8vWFbesS22to52JELB2mO
+HqzwK4A9PQwuZY1LyUS9KnP6gyUGYfcLxvG3Rnr+QFup7zjMvj8qSfv4L3mSVlKg
+6tG+jbS/lwnCS+WbbB+5giMQud4NFSYhZP57+jQK+vmxy0HZxReB7XP90xWdpF0y
+B1MUHSnOviBtEX0OEDSEWPIsIDu6LX83Wu4NeRMOXBsDALYo32jEem/QpTjUL6jP
+k3xMDIcLa/HwZkY8EzdruBL1lZh5CbV2dyrLFnNy2FrHzjzDHWd9PzvAzjtACXXP
+XUBm2eu4S9Vr9r7KfrRHpPzl56kYevv270dOfxxKKajPJQjSdp9gLEOCh5PJCuX8
+q8V1k/dRf5o+oh+6PlDl9UFYtoodT1KoioCVBriVHc9pmFXzDOwwzKD3Odp0nkh4
+0MH1B6OFX0Vfm7y8b934RuBjiNLjZ9iBi8/tuxgV/KSNsriRCMvLbwhwhyVLnjLU
+zlcVtAtubaJYpYVk1jEpjXOLNWbFOxICOQnrgg2Mt4AjojfqcCmqVAkUb3xDvD+l
+s3HJ0bhbAzOAluRzee9qoW1LlSX1Ss4S1bHP+HZdL8G0CuJWtniSvOaMDa5scEa3
+fhQy1QiZJfX9NrBVwQLFfhYh861TCXUx3VwZs2dIzEsTojXfE8GOQXVSmwARAQAB
+tFNGbHVlbnRkIGRldmVsb3BlcnMgKEZsdWVudCBQYWNrYWdlIE9mZmljaWFsIFNp
+Z25pbmcgS2V5KSA8Zmx1ZW50ZEBnb29nbGVncm91cHMuY29tPokCTgQTAQoAOBYh
+BLQJSLajuA6Q9A6EH5d9eglD+jIOBQJkm8xZAhsDBQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEJd9eglD+jIO01YP/0ESmowdvQgYcUKyM4maEpkRhmbusz/hxSzG
+rX9Kh2IjZYsDbrH28XXas/KM/Us9p1UTfQNbanGuutnx9lm0Q//NGWmwkmjp396g
+/+qLQS9ShUDtjAmbilbj1c7bzMwaJGuKIBaLojDNwsE0L9U3frvs7HV+lMf7hMBY
+xinR59rQY3RmA295jdi9t50gNkW3P67SE/Peu8f4pdIRWwHAqXIzDgmw5WA5DjHb
+TLQu40GMtE7Jqygyefq59rqnJlEV7ET6MOoy4BHyRNO1ZdL8IhGrMlpcRUpTgC48
+FZKEFCBj8pX4AyI7nEoI2ljMPpHRZoL80QSN5tcsaWIE/f6IBix7A/Q2m0oNpf9s
+XQXGgDxmu3y0PPUD/Eda+fKuMq1W/NFBdFIfpeUsPS/8Ha5xuonVtMxNVk6mx2Xz
+oixop4xaZChA23qHt1dLii6rVOcOkcRB8qgKKUG0p5RNmLSSSaOBRXNNdCa4l4x6
+ymLsdaGmP432paByXjjD3/1GmXevMSPgFXSmFF80yQqIYjT+gHEnkDEuinP8tpX9
+D26bh2RyGQ4ZM7HH9fQq82TYB8Lc0iqcihxuCA710WElW6g3ydrULiUvidhMT7AH
+HL7yxGbGlax/160zauskYF2vQ8pH0tEgCfWF+Uni6OqysHvzuQLxQ+ERJbQyixbB
+pqFETdA8uQINBGSbzFkBEADbGgYzIrbwUqnh2w++JUvV3rwnPeY01dIiXlez1FwK
+J+NyW+tQlC7pHu8ruEsBUGC6v0a7op8MkbVR8GKLy2TIsq+9M27SubrxEpQsLp9x
+7oJ2TSRbwKNd7Zc26xN04Y0TZkmXFYuwpWixLgRTZc4LSOUeOM9AhnGrUkYE/51z
+ZcF1iqA1MkvZ6Oz9j24hNAWwHdKsgF1+ZbLvqsuN0JpgR3BjyIcAga147iKRijZF
+xP+/lMHlGY+HXUMcAmeydhwcEnHCpnOxqlkHNg5PnZ+x9roudx549OHmIUyCTly9
+kHWXIrCRRn2jtCHKkIxuMY/mVigTEmiNiGHzjBjFlNwI05OMILUQ1xzJoW9MC670
+//YvgbJXk9/PL0ChFDauy3Vg5dpvsVM26EIuKBmoswt6Hr9yC/qbTzwrB2Z1OiaV
+Q2olK5iSS3Jkvjz0EXq88oxWe54YHbYIZ/SavUasAmFIpQXKKvunpdcoLercwvcA
+iUOFD+LM5QhPa7OyCkEJaPb5JFNCrArLd3B7Q8BBZz+z0kuSeF8E+xWUeWn8fP1V
+tz7hjMscwiEjgrRZZXQAi68hbqL2CcgMUvlmCHxYFGpD6t7WZn+dBO1qyCz0wzQt
+GvXuwG7NeOGjs0iI2qJMWp9evNkWcHXwCEE5qJ5y4w2nLCby8mn35hnhTIIUn6qm
+hQARAQABiQI2BBgBCgAgFiEEtAlItqO4DpD0DoQfl316CUP6Mg4FAmSbzFkCGwwA
+CgkQl316CUP6Mg44bhAAldChcMjOgH8adLDNx6OFFQB4Xu76/uxbjuhE4lbO/412
++WDK6QCLsKjsR8SBTQDCuakb4iKJDLUpeRG6Bw7AI8RqvHz4IZtgvnom6/UtnYID
+eAb5DEYodz1rftelKqanqM34x/1fUJxPRU9ii6jkzVPMfI1V90rjlws5T8YDrKu+
+doGrNP5AYRgYxfy9OE8pzx/2DtEpwHaTK2QfjMYbTiPJkc+H9ECh47hWFh5un+Wa
+CiJLouURD1FnbEiNQ+fzGcJTaetTNOYFRw6yJgAUh7JNYvyAqToDilP5zUgop+/T
+x0sLSr4HbeVZg/R1JDmYhVlcJw3+D6gA8vN7baqbUxomTzpVAuMYBOE21EakTQPd
+T+Qpfz68zSxGGr7HolMy5D4R4EXI53ijKOgy7utMLvEHOmOubZG75pUMDkbMAltb
++bCednbSXr31IhcdmIfqklQw55ak3PX222i4hkajTSPosoiO9Yfd9ZEtt8TT83aF
+a4VZT9vDzqyEG1Z52zLA+nx69VLolNeLv/9ViOM0WNbmaN9F1ruDQ7Mku7ZWCExW
+b1iKF7/N1qceF3k4K87LI/SxIvNAxhyLi13i6cATQuPiUZoAvCaWmn70qImR5H+L
+wBZ3uruCU1F15VXY5LL+v7JwzwhT9PQvsYnRBClOtd35gq5oBBqt8QIGeg3kY+8=
+=nE26
+-----END PGP PUBLIC KEY BLOCK-----

fluent-release/RPM-GPG-KEY-td-agent

@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFhiI8wBEADThWLNd8IKPRw7Ygu3DHS4Sb/Yc6vSZSaMGJ6Wkj245jScvI+C
+nG4C4rtO/8ObUj5cUpb4CyfYZX8W4tp9x+W68c4paXevG4s+X4EE3uUsgdwTnFXi
+GMa57QDzR4p/JvjUjfGJ2UAr4Bfj8Q2S54LmIu6UAe82ce2B4tEHCeYSxkmVUDAZ
+utfmgKoVTbnceTemU0m5ANS6IC1/53KEhgB1sKm5G/FjRJGslHWb3mf+bLrhmlkP
+pA4BOKF2w3eFYH3LhWskxMS0SPM7J6aq+6LyNNqtlKL6lUS7qVjRQ6PlgFcmtG4J
+tijsZI62bDn1f44DmeLY+LMS/nM0xyIx94lYumGH5EYmjUECagqMool98/+Wx79A
+Thtg/1pYNzo8Z76qr0i3xLSRtsQ2Om2Rfal7VGadOrx4sqlkSaUaGI+hBc1r4tNy
+tERvBEMGSf78bWDbdzxSNEW4LUDUpniNQb0DrURfWkqRa3q4WcTJr8lpQM/NmAru
+owayAXQwKob+OIZ09/O69EaqVJ9MqsM3keQouSHShKvzNrppuo3D3z+Dpy05FsYw
+MAiIN7auXxy+XQwCVsKF083YaDHcC0I22GReEgt43yZXQ/b/J9QNrm5nJ+3Cpso3
+jJnMzubuniSOOdd3mXQ6MwgZvWgtH/nPF8oUX9VSGwqNohiKWcxQDxW7qQARAQAB
+tFRUcmVhc3VyZSBEYXRhLCBJbmMgKFRyZWFzdXJlIEFnZW50IE9mZmljaWFsIFNp
+Z25pbmcga2V5KSA8c3VwcG9ydEB0cmVhc3VyZS1kYXRhLmNvbT6JAjcEEwEIACEF
+AlhiI8wCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQkB+Rd6uXrL5GrhAA
+nh82+caSu9Qu/LW256gN5UjPUFhph66ElT1OVyAR2FoOmz2pJH3t8YYD5cUV2W6/
+xqJDmjl+vnL2HBgxjHKRCo2K3hrq6z4LoU7SpWDI1cZ03lkjh1yNx13S+9JvZNlp
+jit0WRIspke0n0vWSpNo4nh19Yg3EA1c+vGeHnmlYo6xwRHu6XOhhCwywtFRGC3a
+iMJzAV4N69ZU6P5VZZkC6LjYYQtF4aI10COLZ4AcObH2htGAZTj2KlZfdJHmr+Oa
+wY57giUYz7OF45LLCuqe+VwpGp2d3UK/MtCnXRLi5InMVJKDvyt18MzRDFuyA27e
+WSt+JumVqhEjawh3hmdzIS1cHKmv19gdeE8On2i2Lf8lyek8fsB/YPgADAmp2oSe
+cjLu0ocGbgxRjuCR29+6IG+DiUDFCkqFZNdLiGVqzjpjpYHaPhVe77ciwA8TCPru
+3dh5t/qv2HglSd7lj95IApZBtny5AK8NS4qtaOeZbBbbDRuOPL0c7fU3bqyIPy57
+zvdYi3KdjWZVCawcAmk3ILP83eFSivCRPRoyCqO+HX8U647BBWvlFuEbPa+Y1sgE
+12MEF/Y6VVJh3Ptw+h/qKRbra4LdA+5Y30q/9l6WGgbO/4h3NKmGeVCrAFvS3h92
+fS0ABYD1nAP7fSNS9RfYIqfBXtJem+tJ14YKJwWiAYW5Ag0EWGIjzAEQAMw5EMJu
+RBFRdhXD5UeA7I7wwkql/iYof8ydUALBxh9NSpmwaACkb4Me6h/rHdVsPRO3vIoo
+uXftSjkRk2frjziihfEdeYxYU5PPawZxwCRDInr/OLZmcCCA2yCkRnFBhZxQy8NW
+iJz0tlJtohhuJ7NRK7+HVJ3rPrtoV1lZVricDrB7DdVySp+7VciEM/XQhKKlesyd
+gYXic4fx7xvPS6hRmH/fNVdvFobIhQBNUuPfKJeKpeJqPHeqkCNRz1Kl6NW9XXBq
+hNyAlC7SPdKmjsv4UVIcFLUXP5wv7nprtEh15LoDlJCvFEF/iDJzaWI3QeVqY8XS
+EI77WNsA/w7nlVNO3lGOPMjW8cxn4Jd2s4lpNa/e+RfrG/PD+ODSS92ISkuihBIU
+Z2XeFa1xjQ1ayint4lVe3FGWTBJjqK8qX3JaOVeUD0AlSWqFcJzI7KxfNtVZCOaZ
+WL/PVG124A118AUMFEWfb3r2Le8ddl+AKFP5Etsb+00VEWL06VPDampJIHanGjyX
+h3dZkzORO3l3dt/P6embimic2QDOmO5x+wESnD8spITPKDl9OuqebCB8Z2oShnnG
++xhKDl045UFCPMVOXLb4kHonBmN2wBT/GIh4qqZj/7mm6r4P194HzN8LQuZsloJs
+A6tnEpEmSe33xBDfGAeS0eNxFiATGwAcCRyRABEBAAGJAh8EGAEIAAkFAlhiI8wC
+GwwACgkQkB+Rd6uXrL559w/9GfoTxZS+VJQsQc1inW9YKZaWl99Hd4u8CGhE057S
+zvzMnIH6fcgib3m+TelevplSEN1QN1GGTvn95n8JQ8RX36xy8SQVzrPIlO4gXGAF
+J1uHmSp3SSplrwKIBQk3MORrfbTg78CN9527GCQHih8+qgB3IYe23NhsKLre3mbZ
+h9NAWOeMsBF0jG0c0Cu3/F8muY2XSTqENB8R263YJsQSC3qaiaq9TtstisOe/HWK
+yQix2Hofg3H96dZXsqbQEvxgyema+A6ptCm7S66eSYoPPeXQaraTsz6nLlVtvhSD
+kll2axjAK4NDbSjJuZI/54CkO+FB00bkXDxPFgnfDPWgvPMF1cBuuX0QN1BO8n4C
+eA9zyBBdTw9bbzO1kRdeBHLa7n845ecVbEh15Hvtf20/CJB9ua+qRlcXtgxhUf3+
+pm/xbAM22z/F3+RsLwGOG8T0Vy2q//VVqLxSFlawiZW9RkClKyV6A1KH0EA6W84d
+GcxiDgwrBHd+d40s3VDE/Wlmj0w73xeebEaXCmaTO/Hp5DIA64LfXHB2ckvwv15I
+ISQV2g55+ghnwaD/02uGCGpJl0zJgQ+PKvrFAz+wIUqrQJxXP4epqWycmzG98T7g
+pi20lwzO87S6b1GIL9t6Q/Zge8bbB7lG5mBR2U5XyGhfHXGaHTb6nQQYh3hCet8G
+5Ow=
+=Me4L
+-----END PGP PUBLIC KEY BLOCK-----

fluent-release/Rakefile

@@ -0,0 +1,215 @@
+# -*- ruby -*-
+
+require_relative "../lib/package-task"
+require "rake/clean"
+require "time"
+
+CLEAN.include("yum/tmp")
+CLEAN.include("yum/build.sh")
+CLEAN.include("yum/env.sh")
+CLOBBER.include("yum/repositories")
+
+class FluentReleasePackageTask < PackageTask
+  def initialize
+    super("fluent-release",
+          repository_version,
+          latest_commit_time(File.join(__dir__, "..")))
+    CLEAN.include(@archive_name)
+  end
+
+  def git_directory?(directory)
+    candidate_paths = [".git", "HEAD"]
+    candidate_paths.any? do |candidate_path|
+      File.exist?(File.join(directory, candidate_path))
+    end
+  end
+
+  def latest_commit_time(git_directory)
+    return nil unless git_directory?(git_directory)
+    Dir.chdir(git_directory) do
+      return Time.iso8601(`git log -n 1 --format=%aI`.chomp).utc
+    end
+  end
+
+  def repository_version
+    "2025.5.29"
+  end
+
+  def repository_label
+    "Fluentd Project"
+  end
+
+  def repository_description
+    "Fluentd Project related packages"
+  end
+
+  def repository_url
+    # Navigate to R2
+    # "https://packages.treasuredata.com"
+    "https://fluentd.cdn.cncf.io"
+  end
+
+  def td_agent_key_id
+    "BEE682289B2217F45AF4CC3F901F9177AB97ACBE"
+  end
+
+  def fluent_package_key_id
+    "B40948B6A3B80E90F40E841F977D7A0943FA320E"
+  end
+
+  def rpm_gpg_key_path(id)
+    case id
+    when td_agent_key_id
+      "RPM-GPG-KEY-td-agent"
+    when fluent_package_key_id
+      "RPM-GPG-KEY-fluent-package"
+    end
+  end
+
+
+  def define
+    super
+    define_yum_latest_task
+  end
+
+  def generate_gpg_keys
+    repository_gpg_key_ids.each do |gpg_key_id|
+        unless system("gpg", "--list-keys", gpg_key_id, out: IO::NULL)
+          sh("gpg",
+             "--keyserver", "keyserver.ubuntu.com",
+             "--recv-key", gpg_key_id)
+        end
+      end
+      sh("gpg", "--armor", "--export", td_agent_key_id, out: "#{@archive_base_name}/RPM-GPG-KEY-td-agent")
+      sh("gpg", "--armor", "--export", fluent_package_key_id, out: "#{@archive_base_name}/RPM-GPG-KEY-fluent-package")
+  end
+
+  def generate_repo_files
+    targets = [
+      {
+        id: "rhel-compat",
+        label: "RHEL $releasever compatible distribution",
+        distribution: "redhat",
+        version: "$releasever",
+        enabled: "0",
+      },
+      {
+        id: "amazonlinux2023",
+        label: "Amazon Linux 2023",
+        distribution: "amazon",
+        version: "2023",
+        enabled: "0",
+      },
+      # For v5
+      {
+        id: "amazonlinux2",
+        label: "Amazon Linux 2",
+        distribution: "amazon",
+        version: "2",
+        enabled: "0",
+      },
+    ]
+    targets.each do |target|
+      repo_path = "#{@archive_base_name}/fluent-package-#{target[:id]}.repo"
+      File.open(repo_path, "w") do |repo|
+        repo.puts(<<-REPOSITORY)
+[fluent-package]
+name=#{repository_label}
+baseurl=#{repository_url}/5/#{target[:distribution]}/#{target[:version]}/$basearch/
+gpgcheck=1
+enabled=#{target[:enabled]}
+        REPOSITORY
+        prefix = "gpgkey="
+        repository_gpg_key_ids.each do |gpg_key_id|
+          repo.puts(<<-REPOSITORY)
+#{prefix}file:///etc/pki/rpm-gpg/#{rpm_gpg_key_path(gpg_key_id)}
+          REPOSITORY
+          prefix = " " * prefix.size
+        end
+      end
+    end
+  end
+
+  private
+
+  def repository_gpg_key_ids
+    [td_agent_key_id, fluent_package_key_id]
+  end
+
+  def define_archive_task
+    file @archive_name do
+      rm_rf(@archive_base_name)
+      mkdir(@archive_base_name)
+      generate_gpg_keys
+      generate_repo_files
+      cp("yum/fluent-release.spec.in", "#{@archive_base_name}/fluent-release.spec.in")
+      sh("tar", "czf", @archive_name, @archive_base_name)
+    end
+  end
+
+  def yum_targets_default
+    [
+      "rockylinux-8",
+      "almalinux-9",
+      "amazonlinux-2",
+      "amazonlinux-2023"
+    ]
+  end
+
+  def define_yum_latest_task
+    namespace :yum do
+      task :build do
+        yum_targets.each do |target|
+          distribution, version, arch = target.split("-", 3)
+          arch = "x86_64" if arch.nil?
+          suffix = case version
+                   when "2"
+                     "amzn2"
+                   when "2023"
+                     "amzn2023"
+                   else
+                     "el#{version}"
+                   end
+          distribution = case distribution
+                         when "rockylinux"
+                           "rocky"
+                         when "amazonlinux"
+                           "amazon"
+                         else
+                           distribution
+                         end
+          rpm = [
+            yum_dir,
+            "repositories",
+            distribution,
+            version,
+            arch,
+            "Packages",
+            "#{@package}-#{@rpm_version}-#{@rpm_release}.#{suffix}.noarch.rpm",
+          ].join("/")
+          rpm_dir = File.dirname(rpm)
+          directory rpm_dir
+
+          latest_rpm = [
+            yum_dir,
+            "repositories",
+            distribution,
+            version,
+            arch,
+            "Packages",
+            "#{@package}-latest.#{suffix}.noarch.rpm",
+          ].join("/")
+
+          cp(rpm, latest_rpm)
+        end
+      end
+    end
+  end
+
+  def enable_apt?
+    false
+  end
+end
+
+task = FluentReleasePackageTask.new
+task.define