Bug 171289

Summary: Review Request: dirmngr: Client for Managing/Downloading CRLs
Product: [Fedora] Fedora Reporter: Rex Dieter <rdieter>
Component: Package ReviewAssignee: Jason Tibbitts <j>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Package Reviews List <fedora-package-review>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: scop
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.gnupg.org/
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-06-26 18:56:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 163779    

Description Rex Dieter 2005-10-20 13:49:32 UTC
Spec Name or Url: http://apt.kde-redhat.org/apt/kde-redhat/SPECS/dirmngr-0.9.2-1.spec
SRPM Name or Url: http://apt.kde-redhat.org/apt/kde-redhat/all/SRPMS.stable/dirmngr-0.9.2-1.src.rpm
Description: 
Dirmngr is a server for managing and downloading certificate
revocation lists (CRLs) for X.509 certificates and for downloading
the certificates themselves. Dirmngr also handles OCSP requests as
an alternative to CRLs. Dirmngr is either invoked internaly by
gpgsm (from gnupg2) or when running as a system daemon through
the dirmngr-client tool.

Comment 1 Ville Skyttä 2005-10-20 14:39:58 UTC
- libgpg-error-devel is pulled in by libgcrypt-devel (and its minimum version  
appears to be incorrect), remove?  
- According to configure output, libksba-devel >= 0.9.11 is needed (not >=  
0.9.10), and libassuan-devel >= 0.6.8 (not >= 0.6.9).  
- BR: texinfo not needed since the patch modifies the .info too  
- Spelling error in description: "internaly".  
- Cosmetic: s/buildRequires/BuildRequires/  
- What's the purpose of the unusual install/install-strip stuff?  Is there  
something special in this package that warrants it?  
- ChangeLog is not too useful as it lists only changes from the top-level  
source dir, and a user oriented NEWS file is included.  
- If you want the package to follow the FHS, /usr/libexec could be changed to  
%{_libdir}/dirmngr. 
- Configuring with --disable-dependency-tracking would result in a bit cleaner 
build output and possibly a miniscule build speedup 
  
Not actually tested yet.  

Comment 2 Rex Dieter 2005-10-20 16:02:00 UTC
Spec Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/SPECS/dirmngr-0.9.2-2.spec
SRPM Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/all/SRPMS.stable/dirmngr-0.9.2-2.src.rpm

%changelog
* Thu Oct 20 2005 Rex Dieter <rexdieter[AT]users.sf.net> 0.9.2-2
- drop BR: libgpg-error-devel, texinfo
- drop goofy conditional 'make install-strip'
- BR: libksba-devel >= 0.9.11
- BR: libassuan-devel >= 0.6.8
- fix spelling error(s) in %%description
- --disable-dependancy-tracking
- FIXME/TODO: follow FHS, use %%_libdir instead of %%_libexecdir
  (will try to get this handled upstream for future version(s))


Comment 3 Ville Skyttä 2005-10-20 16:45:06 UTC
I bet upstream will just point out that the libexecdir is already configurable 
with "./configure --libexecdir=...".  But there are many packages that install 
stuff into /usr/libexec today anyway so IMO that's a non-blocker, up to you. 
 
 
When trying to actually test this for something, I got this: 
 
# dirmngr --daemon 
dirmngr[4122]: error opening `/etc/dirmngr/ldapservers.conf': No such file or 
directory 
dirmngr[4123]: can't access directory `/etc/dirmngr/trusted-certs': No such 
file or directory 
DIRMNGR_INFO=/var/run/dirmngr/socket:4123:1; export DIRMNGR_INFO; 
dirmngr[4123]: can't access directory `/var/lib/dirmngr/extra-certs': No such 
file or directory 
dirmngr[4123]: permanently loaded certificates: 0 
dirmngr[4123]:     runtime cached certificates: 0 
dirmngr[4123]: failed to open cache dir file 
`/var/cache/dirmngr/crls.d/DIR.txt': No such file or directory 
dirmngr[4123]: creating directory `/var/cache/dirmngr' 
dirmngr[4123]: creating directory `/var/cache/dirmngr/crls.d' 
dirmngr[4123]: new cache dir file `/var/cache/dirmngr/crls.d/DIR.txt' created 
 
I wonder if those dirs should be owned by this package, and also maybe an init 
script added?  Other pointers how to test the functionality are welcome too... 

Comment 4 Rex Dieter 2005-10-20 16:49:43 UTC
Hmm... I thought dirmngr was supposed to get autolaunched from gnupg2/gpgme. 
I'll take a closer look.

Comment 5 Ville Skyttä 2005-10-20 18:15:21 UTC
I thought so too until I read the description of this package and noticed it's 
not exclusively for that and started to figure out how to use dirmngr-client 
to test the functionality. 

Comment 6 Rex Dieter 2005-10-20 18:18:32 UTC
Looks like it's got 2 modes, standalone and daemon.  I'll get to work on
creating/owning all those dirs, and make a preliminary init script for daemon mode.

Comment 7 Rex Dieter 2005-10-22 18:05:35 UTC
%changelog
* Sat Oct 22 2005 Rex Dieter <rexdieter[AT]users.sf.net> 0.9.2-3
- create/own more files/dirs for --daemon mode
- TODO: proper init script

Spec Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/SPECS/dirmngr-0.9.2-3.spec
SRPM Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/all/SRPMS.stable/dirmngr-0.9.2-3.src.rpm

Comment 8 Ville Skyttä 2005-10-22 18:47:06 UTC
Looks ok in a brief look, still waiting for clues how to actually test this. 
 
In the meantime, a couple of nitpicky comments: 
 
%configure passes %{_localstatedir}, not %{_var} to --localstatedir, and that 
is used by the build, see src/Makefile.am.  And the default socket path uses a 
hardcoded /var. 
 
I think /var/lib is ok for all archs, multilib or not. 
 
If you want, the hardcoded .gz could be dropped from the install-info's. 

Comment 9 Ville Skyttä 2006-01-10 19:32:25 UTC
Back to FE-NEW due to lack of time and info.

Comment 10 Rex Dieter 2006-06-15 17:41:28 UTC
Adding update lost from bugzilla crash...

Spec Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/SPECS/dirmngr-0.9.3-1.spec
SRPM Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/all/SRPMS.stable/dirmngr-0.9.3-1.src.rpm

%changelog
* Tue May 16 2006 Rex Dieter <rexdieter[AT]users.sf.net> 0.9.3-1
- 0.9.3

Comment 11 Jason Tibbitts 2006-06-25 22:42:50 UTC
Builds in mock; rpmlint has this to day:

E: dirmngr zero-length /etc/dirmngr/ldapservers.conf
Is is possible to add a comment or something to this file indicating what its
purpose is?

W: dirmngr file-not-utf8 /usr/share/info/dirmngr.info.gz
Just a few non-ascii charaters; a run through iconv should fix it up.

W: dirmngr log-files-without-logrotate /var/log/dirmngr.log
You'll want to make sure these get rotated properly.

W: dirmngr non-standard-dir-in-usr libexec
This seems OK given the currently accepted uses of /usr/libexec.

Did you ever decide what do to about running this as a daemon?
You don't seem to package the COPYING file.

Note that 0.9.4 is out.  Care to make an update that fixes the above issues?

Review:
* package meets naming and packaging guidelines.
* specfile is properly named, is cleanly written and uses macros consistently.
* dist tag is present.
* build root is correct.
* license field matches the actual license.
X license is open source-compatible.  License text included in tarball but not
in package.
* source files match upstream:
   54df92f0548918af89c8c7dcca2d1911  dirmngr-0.9.3.tar.bz2
X latest version is not being packaged (0.9.4 is out)
* BuildRequires are proper.
* package builds in mock (x86_64, development).
X rpmlint has valid complaints
* final provides and requires are sane:
   config(dirmngr) = 0.9.3-1.fc6
   dirmngr = 0.9.3-1.fc6
  =
   /bin/sh
   /sbin/install-info
   config(dirmngr) = 0.9.3-1.fc6
   libgcrypt.so.11()(64bit)
   libgcrypt.so.11(GCRYPT_1.2)(64bit)
   libgpg-error.so.0()(64bit)
   libksba.so.8()(64bit)
   libksba.so.8(KSBA_0.9)(64bit)
   liblber-2.3.so.0()(64bit)
   libldap-2.3.so.0()(64bit)
   libpth.so.20()(64bit)
* no shared libraries are present.
* package is not relocatable.
* owns the directories it creates.
* doesn't own any directories it shouldn't.
* no duplicates in %files.
* file permissions are appropriate.
* %clean is present.
* %check not present; no test suite upstream.  There are some tests, but they
don't seem to be anything that runs in an automatic fashoin.
* scriptlets present and OK (install-info)
* code, not content.
* documentation is small, so no -docs subpackage is necessary.
* %docs are not necessary for the proper functioning of the package.
* no headers.
* no pkgconfig files.
* no libtool .la droppings.
* not a GUI app.

Comment 12 Rex Dieter 2006-06-26 14:59:08 UTC
Spec Name or Url
http://apt.kde-redhat.org/apt/kde-redhat/SPECS/dirmngr.spec
SRPM Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/all/SRPMS.stable/dirmngr-0.9.4-1.src.rpm

%changelog
* Mon Jun 26 2006 Rex Dieter <rexdieter[AT]users.sf.net> 0.9.4-1
- 0.9.4
- %%doc COPYING
- drop upstreamed info patch
- use logrotate on dirmngr.log
- add comment to (previously) empty ldapservers.conf

Re: daemon mode bits.  I'm leaving that alone (for now), at least until upstream
documents it's purpose and use (which is a complete mystery to me). 

Comment 13 Jason Tibbitts 2006-06-26 16:29:50 UTC
Now we have
W: dirmngr non-conffile-in-etc /etc/logrotate.d/dirmngr
so just mark it as %config

and we still have:
W: dirmngr file-not-utf8 /usr/share/info/dirmngr.info.gz

Everything else does look good now.

Comment 14 Rex Dieter 2006-06-26 16:37:07 UTC
> and we still have:
> W: dirmngr file-not-utf8 /usr/share/info/dirmngr.info.gz

My rpmlint doesn't say that. ??  ah, I'm (still) using rpmlint-0.70

Comment 15 Rex Dieter 2006-06-26 16:46:05 UTC
Hmm, I can't get iconv to cooperate.  I always get:
iconv: illegal input sequence
when trying to work on either dirmngr.texi or dirmngr.info.

Comment 16 Rex Dieter 2006-06-26 16:47:06 UTC
I guess I'll just use: iconv -c

Comment 17 Rex Dieter 2006-06-26 16:53:06 UTC
Spec Name or Url
http://apt.kde-redhat.org/apt/kde-redhat/SPECS/dirmngr.spec
SRPM Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/all/SRPMS.stable/dirmngr-0.9.4-2.src.rpm

%changelog
* Mon Jun 26 2006 Rex Dieter <rexdieter[AT]users.sf.net> 0.9.4-2
- remove non-ASCII chars from dirmngr.info
- %%config %%_sysconfdir/logrotate.d/dirmngr

Comment 18 Ville Skyttä 2006-06-26 17:21:00 UTC
iconv -f iso-8859-1 -t utf-8 works fine here.  Stripping non-ASCII messes up the
name of the copyright holder, which is not nice at all.

Comment 19 Rex Dieter 2006-06-26 18:27:46 UTC
Spec Name or Url
http://apt.kde-redhat.org/apt/kde-redhat/SPECS/dirmngr.spec
SRPM Name or Url:
http://apt.kde-redhat.org/apt/kde-redhat/all/SRPMS.stable/dirmngr-0.9.4-3.src.rpm

%changelog
* Mon Jun 26 2006 Rex Dieter <rexdieter[AT]users.sf.net> 0.9.4-3
- use 'iconv -f iso-8859-1 -t utf-8' to avoid dropping characters


Comment 20 Jason Tibbitts 2006-06-26 18:51:11 UTC
Ugh, now we have this:
W: dirmngr conffile-without-noreplace-flag /etc/logrotate.d/dirmngr

Everything else is fine; I'm going to go ahead and approve and leave it to you
to make the decsion about that file.

APPROVED

Comment 21 Rex Dieter 2006-06-26 18:56:43 UTC
I"m of a mind to allow a local admin to keep their local changes, so I'll mark 
it %config(noreplace) before requesting builds.