Bug 2130734

Summary: Review Request: Chezmoi - Manage your dotfiles across multiple diverse machines, securely.
Product: [Fedora] Fedora Reporter: Anthony Rabbito <hello>
Component: Package ReviewAssignee: Nobody's working on this, feel free to take it <nobody>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: hello, mikel, package-review, poperigby, quantum.analyst, twpayne
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2045475, 2056006, 2119976, 2120419, 2120452, 2120454, 2120459, 2120461, 2120462, 2120464, 2130733, 2131402, 2131497, 2132377, 2142022    
Bug Blocks:    

Description Anthony Rabbito 2022-09-29 02:42:20 UTC
Spec URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi.spec
SRPM URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi-2.21.1-1.fc37.src.rpm
Description: Chezmoi provides many features beyond symlinking dotfiles or using a bare git repo including: dotfile templates (to handle small differences between machines), password manager support (to store your secrets securely), importing files from archives (great for shell and editor plugins), full file encryption (using gpg or age), and running scripts (to handle everything else).
Fedora Account System Username: anthr76

Comment 1 Tom Payne 2022-10-05 10:20:48 UTC
Since chezmoi v2.24.0, the dependency on github.com/google/gops has been removed (https://github.com/twpayne/chezmoi/pull/2389) so the dependency of this bug on https://bugzilla.redhat.com/show_bug.cgi?id=2120460 can be removed.

If it helps, I can move the code from github.com/twpayne/go-shell into chezmoi to remove the dependency on https://bugzilla.redhat.com/show_bug.cgi?id=2120462.

Comment 2 Anthony Rabbito 2022-10-05 12:16:07 UTC
Hi Tom, thanks for the update.

I have updated the spec to v2.24.0 which indeed removes the gops dependency. As for integrating go-shell into Chezmoi.. I will let that up to you. It would avoid one more package review here, but in the grand scheme I don't think it will change the time significantly as far as getting Chezmoi into the repos.

Thanks again for giving an update!

Spec URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi.spec
SRPM URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi-2.24.0-1.fc37.src.rpm

Comment 3 Elliott Sales de Andrade 2022-12-18 03:54:29 UTC
golang-github-google-go-github is updated now, so I guess you should be able to bump this to the latest version?

Comment 4 Mikel Olasagasti Uranga 2023-04-22 19:46:12 UTC
Hi Anthony,

I found that some of the deps that were already reviewed and added to Fedora were retired because they had no dependencies. For example github.com/twpayne/go-xdg/v6 or howett.net/plist.

If you plan to continue working for adding Chezmoi to Fedora we can make a last effort and review whatever is missing. If not I can continue over your work.

Comment 5 Tom Payne 2023-06-19 10:46:46 UTC
Author of chezmoi here.

As I understand it, the Fedora packaging policy is to package each dependency separately and have a single version of each dependency installed on each machine.

If this is the case, then it will likely be hard or impossible to package chezmoi for Fedora for the following reasons:
1. chezmoi has many dependencies: about 50 direct dependencies, and about 70 indirect dependencies. Packaging all of these will be a huge amount of work.
2. chezmoi regularly updates its dependencies to the latest version for security fixes, bug fixes, and features. chezmoi's set of dependencies changes on each patch release of chezmoi, which is roughly every two weeks.
3. chezmoi blacklists specific versions of certain dependencies due to critical bugs in specif versions of those dependencies or removed features.

chezmoi's go.mod file lists all of chezmoi's dependencies, and the exclude section at the end lists the blacklisted versions:
  https://github.com/twpayne/chezmoi/blob/master/go.mod