Bug 1778390

Summary:	Review Request: apache-sshd - Apache SSHD
Product:	[Fedora] Fedora	Reporter:	Mat Booth <mat.booth>
Component:	Package Review	Assignee:	Nobody's working on this, feel free to take it <nobody>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	decathorpe, mhroncok, package-review
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-02 10:58:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1766626

Description Mat Booth 2019-11-30 15:45:29 UTC

Spec URL: https://fedorapeople.org/~mbooth/reviews/apache-sshd.spec
SRPM URL: https://fedorapeople.org/~mbooth/reviews/apache-sshd-2.2.0-2.fc31.src.rpm

Description:
Apache SSHD is a 100% pure java library to support the SSH protocols on both
the client and server side.

Fedora Account System Username: mbooth

Rawhide scratch build: https://koji.fedoraproject.org/koji/taskinfo?taskID=39403213

This is a re-review for unretirement of a retired package. Accompanying releng bug is here: https://pagure.io/releng/issue/9066

Comment 1 Fabio Valentini 2019-11-30 15:52:30 UTC

Hey Mat,

According to the wiki [0], package re-reviews are only necessary after 8 weeks of retirement, and this package was retired on Oct 13, which was only 7 weeks ago. So I think you can request unretirement with releng without having to go through a re-review.

But if a re-review is really necessary, I can review the package for you :)

[0]: https://fedoraproject.org/wiki/Orphaned_package_that_need_new_maintainers#Claiming_Ownership_of_a_Retired_Package

Comment 2 Mat Booth 2019-11-30 16:01:41 UTC

(In reply to Fabio Valentini from comment #1)
> Hey Mat,
> 
> According to the wiki [0], package re-reviews are only necessary after 8
> weeks of retirement, and this package was retired on Oct 13, which was only
> 7 weeks ago. So I think you can request unretirement with releng without
> having to go through a re-review.
> 
> But if a re-review is really necessary, I can review the package for you :)
> 
> [0]:
> https://fedoraproject.org/wiki/
> Orphaned_package_that_need_new_maintainers#Claiming_Ownership_of_a_Retired_Pa
> ckage


Oh! I didn't realise I could skip the review. TBH this review package is almost identical to the package in F30 and should have no rpmlint complaints -- a review should be pretty quick job if you wanted to review it :-)

Comment 3 Mat Booth 2019-11-30 16:08:05 UTC

I asked to proceed with unretirement on the releng ticket. I will leave this bug open just in case we pass the 8 week mark while we are waiting.

Comment 4 Miro Hrončok 2019-11-30 17:54:44 UTC

> I will leave this bug open just in case we pass the 8 week mark while we are waiting.

I think that the date you requested the unretirement counts. I.e. if releng doesn't unretire the package in couple weeks, it's not your fault and no re-review is needed. At least that how I always understood the policy.
 Do you think it needs clarifying?

Comment 5 Miro Hrončok 2019-11-30 17:56:29 UTC

I see assembly/src/main/legal/licenses/jbcrypt.txt listed as %license. Is jbcrypt bundled?

Comment 6 Mat Booth 2019-12-02 10:47:07 UTC

(In reply to Miro Hrončok from comment #5)
> I see assembly/src/main/legal/licenses/jbcrypt.txt listed as %license. Is
> jbcrypt bundled?

See the comment attached to the License directive:

# One file has ISC licensing:
#   sshd-common/src/main/java/org/apache/sshd/common/config/keys/loader/openssh/kdf/BCrypt.java
License:        ASL 2.0 and ISC


It is one file taken from jbcrypt, with modifications specific for Apache SSHd project.

Comment 7 Mat Booth 2019-12-02 10:58:02 UTC

(In reply to Miro Hrončok from comment #4)
> > I will leave this bug open just in case we pass the 8 week mark while we are waiting.
> 
> I think that the date you requested the unretirement counts. I.e. if releng
> doesn't unretire the package in couple weeks, it's not your fault and no
> re-review is needed. At least that how I always understood the policy.
>  Do you think it needs clarifying?

I don't know -- I did not actually read the policy myself :-o However it looks as though releng has already acted so I will close this bug. I am still happy to receive feedback on the package however and will make any changes accordingly.