packaging: ship ban publisher in common

eterban.spec

@@ -134,6 +134,7 @@ cp -a prod-server/usr/share/%name/* %buildroot%_datadir/%name/
 %files common
 %config(noreplace) %attr(0600,root,root) /etc/%name/settings.ini
 %config(noreplace) /etc/%name/whitelist.txt
+%_datadir/%name/ban.py
 
 %files gateway
 %systemd_unitdir/eterban.service
@@ -156,7 +157,6 @@ cp -a prod-server/usr/share/%name/* %buildroot%_datadir/%name/
 %config(noreplace) /etc/nginx/sites-enabled.d/eterban.conf
 
 %files fail2ban
-%_datadir/%name/ban.py
 %config(noreplace) /etc/fail2ban/action.d/eterban.conf
 
 %changelog

tests/static-checks.sh

@@ -73,3 +73,16 @@ for unit in gateway/etc/systemd/system/eterban.service gateway/etc/systemd/syste
         }
     done
 done
+
+awk '
+    $0 == "%files common" { section = "common"; next }
+    /^%files/ { section = "other" }
+    $0 == "%_datadir/%name/ban.py" {
+        if (section == "common") common_ban = 1
+        else misplaced_ban = 1
+    }
+    END { exit !(common_ban && !misplaced_ban) }
+' eterban.spec || {
+    echo 'ban.py must be owned by eterban-common for the public CLI and fail2ban' >&2
+    exit 1
+}