Bug 2333620

Summary: Review Request: eask - Emacs Lisp dependency manager
Product: [Fedora] Fedora Reporter: Peter Oliver <mavit>
Component: Package ReviewAssignee: Benson Muite <benson_muite>
Status: ASSIGNED --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: benson_muite, furyinbox+fedoraproject, package-review
Target Milestone: ---Flags: benson_muite: fedora-review?
Target Release: ---   
Hardware: All   
OS: Linux   
URL: https://github.com/emacs-eask/cli
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2438831    
Bug Blocks:    
Attachments:
Description Flags
The .spec file difference from Copr build 8431153 to 10109340
none
The .spec file difference from Copr build 10109340 to 10117519 none

Description Peter Oliver 2024-12-21 00:07:18 UTC 
Spec URL: https://pagure.io/eask/raw/main/f/eask.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/mavit/eask/fedora-rawhide-x86_64/08431108-eask/eask-0.10.2-2.fc42.src.rpm
Description: CLI for building, running, testing, and managing your Emacs Lisp dependencies.
Fedora Account System Username: mavit
Comment 1 Fedora Review Service 2024-12-21 00:10:58 UTC 
Copr build:
https://copr.fedorainfracloud.org/coprs/build/8431153
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2333620-eask/fedora-rawhide-x86_64/08431153-eask/fedora-review/review.txt

Found issues:

- License file LICENSE.txt is not marked as %license
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/#_license_text

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.
Comment 2 Package Review 2025-12-21 00:45:28 UTC 
This is an automatic check from review-stats script.

This review request ticket hasn't been updated for some time. We're sorry
it is taking so long. If you're still interested in packaging this software
into Fedora repositories, please respond to this comment clearing the
NEEDINFO flag.

You may want to update the specfile and the src.rpm to the latest version
available and to propose a review swap on Fedora devel mailing list to increase
chances to have your package reviewed. If this is your first package and you
need a sponsor, you may want to post some informal reviews. Read more at
https://fedoraproject.org/wiki/How_to_get_sponsored_into_the_packager_group.

Without any reply, this request will shortly be considered abandoned
and will be closed.
Thank you for your patience.
Comment 3 Ruslan Bekenev 2026-01-26 06:08:57 UTC 
hey Peter, It's probably considered a long ticket, but I wonder what happened to this one? 
I would like to resurrect emacs-php-mode and it depends on eask which isn't packaged yet. 

What are the steps to move this forward and are there anything I can help with?
Comment 4 Peter Oliver 2026-02-06 14:10:02 UTC 
I don't think there's anything preventing this from moving forward.  It just needs an interested person to do the review.

SRPM URL: https://download.copr.fedorainfracloud.org/results/mavit/eask/fedora-rawhide-x86_64/10100016-eask/eask-0.12.4-1.fc45.src.rpm
Comment 5 Benson Muite 2026-02-07 07:02:41 UTC 
Ruslan, might you be willing to do an initial mock review?
Comment 6 Ruslan Bekenev 2026-02-08 05:23:58 UTC 
Thank you, Benson! 
I looked at the guidelines and manually checked what I could and only after that I discovered fedora-review package. 
Here is my note and the review report
-------------

Looks good! The only difficulty I have here is to understand why /usr/lib/node_modules is marked as a directory without owner.
The directory is %{nodejs_sitelib} macro, I would assume it is owned by node isn't it? 
I ran "dnf provides /usr/lib/node_modules" and got two nodejs related packages: nodejs-cjs-module-lexer and nodejs-undici. Non of them is nodejs itself. I'm not sure how to interpret this. 

Also rpmlint has 5 errors that say "incorrect-fsf-address" but I can't find any emails in the files mentioned. Sounds like false-positive.

Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated
[ ] = Manual review needed


Issues:
=======
- Dist tag is present.
- If (and only if) the source package includes the text of the license(s)
  in its own file, then that file, containing the text of the license(s)
  for the package is included in %license.
  Note: License file LICENSE.txt is not marked as %license
  See: https://docs.fedoraproject.org/en-US/packaging-
  guidelines/LicensingGuidelines/#_license_text


===== MUST items =====

Generic:
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.
[x]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "Unknown or generated", "*No copyright* GNU General Public
     License, Version 3", "*No copyright* ISC License and/or MIT License",
     "GNU General Public License v3.0 or later", "*No copyright* Academic
     Free License v3.0 and/or Apache License 2.0", "MIT License", "*No
     copyright* MIT License", "ISC License", "*No copyright* ISC License".
     307 files have unknown license. Detailed output of licensecheck in
     /var/home/krydos/Projects/fedora-
     review/eask/2333620-eask/licensecheck.txt
[x]: If the package is under multiple licenses, the licensing breakdown
     must be documented in the spec.
[?]: Package must own all directories that it creates.
     Note: Directories without known owners: /usr/lib/node_modules
[x]: Package contains no bundled libraries or specifies bundled libraries
     with Provides: bundled(<libname>) if unbundling is not possible.
[-]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[-]: Package contains desktop file if it is a GUI application.
[-]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
     names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[x]: Package contains systemd file(s) if in need.
[x]: Package is not known to require an ExcludeArch tag.
[x]: Large documentation must go in a -doc subpackage. Large could be size
     (~1MB) or number of files.
     Note: Documentation size is 11029 bytes in 1 files.
[x]: Package complies to the Packaging Guidelines
[x]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: The License field must be a valid SPDX expression.
[x]: Package requires other packages for directories it uses.
[x]: Package does not own files or directories owned by other packages.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Package does not contain duplicates in %files.
[x]: Permissions on files are set properly.
[x]: Package must not depend on deprecated() packages.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: Package does not use a name that already exists.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Packages must not store files under /srv, /opt or /usr/local

===== SHOULD items =====

Generic:
[x]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[x]: Package functions as described.
[x]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[-]: Sources are verified with gpgverify first in %prep if upstream
     publishes signatures.
     Note: gpgverify is not used.
[x]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed
     files.
[x]: Reviewer should test that the package builds in mock.
[x]: Buildroot is not present
[x]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: SourceX is a working URL.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

Generic:
[!]: Spec file according to URL is the same as in SRPM.
     Note: Spec file as given by url is not the same as in SRPM (see
     attached diff).
     See: (this test has no URL)
[x]: Rpmlint is run on all installed packages.
     Note: There are rpmlint messages (see attachment).


Rpmlint
-------
Checking: eask-0.12.4-1.fc45.noarch.rpm
          eask-0.12.4-1.fc45.src.rpm
============================ rpmlint session starts ============================
rpmlint: 2.8.0
configuration:
    /usr/lib/python3.14/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora-spdx-licenses.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
rpmlintrc: [PosixPath('/tmp/tmpqnaukf0q')]
checks: 32, packages: 2

eask.noarch: W: wrong-file-end-of-line-encoding /usr/share/doc/eask/README.md
eask.noarch: W: only-non-binary-in-usr-lib
eask.noarch: W: no-manual-page-for-binary eask
eask.spec: W: no-%build-section
eask.spec: W: invalid-url Source1: @emacs-eask-cli-0.12.4-nm-prod.tgz
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/ansi.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build-badges.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe-mode.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe.el
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.package-lock.json
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.jshintrc
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.npmignore
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.travis.yml
 2 packages and 0 specfiles checked; 5 errors, 12 warnings, 27 filtered, 5 badness; has taken 0.3 s 




Rpmlint (installed packages)
----------------------------
============================ rpmlint session starts ============================
rpmlint: 2.8.0
configuration:
    /usr/lib/python3.14/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora-spdx-licenses.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
checks: 32, packages: 1

eask.noarch: W: wrong-file-end-of-line-encoding /usr/share/doc/eask/README.md
eask.noarch: W: only-non-binary-in-usr-lib
eask.noarch: W: no-manual-page-for-binary eask
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/ansi.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build-badges.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe-mode.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe.el
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.package-lock.json
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.jshintrc
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.npmignore
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.travis.yml
 1 packages and 0 specfiles checked; 5 errors, 10 warnings, 23 filtered, 5 badness; has taken 0.1 s 



Source checksums
----------------
https://registry.npmjs.org/@emacs-eask/cli/-/cli-0.12.4.tgz :
  CHECKSUM(SHA256) this package     : 80910c2cec6af14e102ff19ee0d05991d11cf8ad4394de5ad8444f2f201e048b
  CHECKSUM(SHA256) upstream package : 80910c2cec6af14e102ff19ee0d05991d11cf8ad4394de5ad8444f2f201e048b
Using local file /var/home/krydos/Projects/fedora-review/eask/@emacs-eask-cli-0.12.4-nm-prod.tgz as upstream
file:///var/home/krydos/Projects/fedora-review/eask/@emacs-eask-cli-0.12.4-nm-prod.tgz :
  CHECKSUM(SHA256) this package     : 80d13ddd0ee8df8bb317bddf7058b3861531a9969b0bbb085eaa8490f296962e
  CHECKSUM(SHA256) upstream package : 80d13ddd0ee8df8bb317bddf7058b3861531a9969b0bbb085eaa8490f296962e
Using local file /var/home/krydos/Projects/fedora-review/eask/@emacs-eask-cli-0.12.4-bundled-licenses.txt as upstream
file:///var/home/krydos/Projects/fedora-review/eask/@emacs-eask-cli-0.12.4-bundled-licenses.txt :
  CHECKSUM(SHA256) this package     : d432bd46910594facf19d6765da133dd4762a92b349a00e04d078f298e1adfea
  CHECKSUM(SHA256) upstream package : d432bd46910594facf19d6765da133dd4762a92b349a00e04d078f298e1adfea


Requires
--------
eask (rpmlib, GLIBC filtered):
    /usr/bin/node
    nodejs
    nodejs(engine)



Provides
--------
eask:
    bundled(nodejs-ansi-regex)
    bundled(nodejs-ansi-styles)
    bundled(nodejs-cliui)
    bundled(nodejs-color-convert)
    bundled(nodejs-color-name)
    bundled(nodejs-emoji-regex)
    bundled(nodejs-escalade)
    bundled(nodejs-get-caller-file)
    bundled(nodejs-is-fullwidth-code-point)
    bundled(nodejs-isexe)
    bundled(nodejs-require-directory)
    bundled(nodejs-string-width)
    bundled(nodejs-strip-ansi)
    bundled(nodejs-which)
    bundled(nodejs-wrap-ansi)
    bundled(nodejs-y18n)
    bundled(nodejs-yargs)
    bundled(nodejs-yargs-parser)
    eask
    npm(@emacs-eask/cli)



Diff spec file in url and in SRPM
---------------------------------
--- /var/home/krydos/Projects/fedora-review/eask/2333620-eask/srpm/eask.spec	2026-02-08 15:42:20.420342274 +1100
+++ /var/home/krydos/Projects/fedora-review/eask/2333620-eask/srpm-unpacked/eask.spec	2026-02-06 11:00:00.000000000 +1100
@@ -1,2 +1,12 @@
+## START: Set by rpmautospec
+## (rpmautospec version 0.8.1)
+## RPMAUTOSPEC: autorelease, autochangelog
+%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
+    release_number = 1;
+    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
+    print(release_number + base_release_number - 1);
+}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
+## END: Set by rpmautospec
+
 %global npm_scope emacs-eask
 %global npm_name  cli
@@ -66,3 +76,15 @@
 
 %changelog
-%{autochangelog}
+## START: Generated by rpmautospec
+* Fri Feb 06 2026 Peter Oliver <git.uk> - 0.12.4-1
+- Update to version 0.12.4.
+
+* Fri Feb 06 2026 Peter Oliver <git.uk> - 0.12.0-2
+- BuildRequires: /usr/bin/node
+
+* Sun Dec 21 2025 Peter Oliver <git.uk> - 0.12.0-1
+- Update to version 0.12.0.
+
+* Fri Dec 20 2024 Peter Oliver <git.uk> - 0.10.2-1
+- Initial package.
+## END: Generated by rpmautospec


Generated by fedora-review 0.11.0 (05c5b26) last change: 2025-11-29
Command line :/usr/sbin/fedora-review -b 2333620
Buildroot used: fedora-rawhide-x86_64
Active plugins: Generic, Shell-api
Disabled plugins: Ocaml, R, SugarActivity, Haskell, Java, fonts, C/C++, Perl, PHP, Python
Disabled flags: EXARCH, EPEL6, EPEL7, DISTTAG, BATCH
Comment 7 Peter Oliver 2026-02-09 15:15:41 UTC 
Thanks for the review.


The issue regarding LICENSE.txt seems reasonable to me, even though it is not addressed by the guidelines for bundled Node.js packages (https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/#_bundled_licenses).  I have updated the spec and SRPM to address this.


Copr lightly mangles the .spec file it includes in its SRPM.  This is harmless.  Nevertheless, here is an unmangled copy of the SRPM:

SRPM URL: https://mavit.fedorapeople.org/rpm/eask-0.12.4-2.fc45.src.rpm


"Dist tag is present" appears incorrect to me.  I think fedora-review is confused by %{autorelease} (or perhaps by Copr's expansion of %{autorelease} in the SRPM).


Rpmlint detects an outdated address for the Free Software Foundation in some files.  I have sent a patch upstream (https://github.com/emacs-eask/cli/pull/390).


The missing directory /usr/lib/node_modules doesn't occur on Fedora 42 or 43, so I assume is somehow related to https://fedoraproject.org/wiki/Changes/NodejsAlternativesSystem.  I have asked the Node.js SIG about this: https://lists.fedoraproject.org/archives/list/nodejs@lists.fedoraproject.org/thread/PCCOHMTV2UYKNWCBO4IJWNFSDDBU3QGK/
Comment 8 Fedora Review Service 2026-02-09 15:22:16 UTC 
Created attachment 2128768 [details]
The .spec file difference from Copr build 8431153 to 10109340
Comment 9 Fedora Review Service 2026-02-09 15:22:18 UTC 
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10109340
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2333620-eask/fedora-rawhide-x86_64/10109340-eask/fedora-review/review.txt

Found issues:

- License file license.js is not marked as %license
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/#_license_text

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.
Comment 10 Ruslan Bekenev 2026-02-11 09:43:15 UTC 
Peter thank you for updating the FSF contacts in the upstream repo. 

Benson, is there anything else that should be done?
Comment 11 Peter Oliver 2026-02-11 15:10:29 UTC 
The unowned directory is bug #2438831, so we don't need to worry about that.
Comment 12 Benson Muite 2026-02-11 16:37:22 UTC 
Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated
[ ] = Manual review needed


Issues:
=======
- Dist tag is present.
- Package does not contain duplicates in %files.
  Note: warning: File listed twice:
  /usr/lib/node_modules/eask/node_modules_prod/cliui/LICENSE.txt
  See: https://docs.fedoraproject.org/en-US/packaging-
  guidelines/#_duplicate_files
- If (and only if) the source package includes the text of the license(s)
  in its own file, then that file, containing the text of the license(s)
  for the package is included in %license.
  Note: License file license.js is not marked as %license
  See: https://docs.fedoraproject.org/en-US/packaging-
  guidelines/LicensingGuidelines/#_license_text


===== MUST items =====

Generic:
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.
[!]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "Unknown or generated", "*No copyright* GNU General Public
     License, Version 3", "*No copyright* ISC License and/or MIT License",
     "GNU General Public License v3.0 or later", "*No copyright* Academic
     Free License v3.0 and/or Apache License 2.0", "MIT License", "*No
     copyright* MIT License", "ISC License", "*No copyright* ISC License".
     307 files have unknown license. Detailed output of licensecheck in
     /home/fedora-packaging/reviews/eask/2333620-eask/licensecheck.txt
[ ]: If the package is under multiple licenses, the licensing breakdown
     must be documented in the spec.
[ ]: Package must own all directories that it creates.
     Note: Directories without known owners: /usr/lib/node_modules
[ ]: Package contains no bundled libraries or specifies bundled libraries
     with Provides: bundled(<libname>) if unbundling is not possible.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[-]: Package contains desktop file if it is a GUI application.
[-]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
     names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[-]: Package contains systemd file(s) if in need.
[ ]: Package is not known to require an ExcludeArch tag.
[-]: Large documentation must go in a -doc subpackage. Large could be size
     (~1MB) or number of files.
     Note: Documentation size is 11029 bytes in 1 files.
[ ]: Package complies to the Packaging Guidelines
[x]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: The License field must be a valid SPDX expression.
[x]: Package requires other packages for directories it uses.
[x]: Package does not own files or directories owned by other packages.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Permissions on files are set properly.
[x]: Package must not depend on deprecated() packages.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: Package does not use a name that already exists.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Packages must not store files under /srv, /opt or /usr/local

===== SHOULD items =====

Generic:
[ ]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[ ]: Package functions as described.
[x]: Latest version is packaged.
[ ]: Package does not include license text files separate from upstream.
[ ]: Sources are verified with gpgverify first in %prep if upstream
     publishes signatures.
     Note: gpgverify is not used.
[ ]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed
     files.
[x]: Reviewer should test that the package builds in mock.
[x]: Buildroot is not present
[x]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: SourceX is a working URL.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

Generic:
[!]: Spec file according to URL is the same as in SRPM.
     Note: Spec file as given by url is not the same as in SRPM (see
     attached diff).
     See: (this test has no URL)
[x]: Rpmlint is run on all installed packages.
     Note: There are rpmlint messages (see attachment).


Rpmlint
-------
Checking: eask-0.12.4-2.fc45.noarch.rpm
          eask-0.12.4-2.fc45.src.rpm
============================ rpmlint session starts ============================
rpmlint: 2.8.0
configuration:
    /usr/lib/python3.14/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora-spdx-licenses.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
rpmlintrc: [PosixPath('/tmp/tmprc1dok7y')]
checks: 32, packages: 2

eask.noarch: W: wrong-file-end-of-line-encoding /usr/share/doc/eask/README.md
eask.noarch: W: only-non-binary-in-usr-lib
eask.noarch: W: no-manual-page-for-binary eask
eask.spec: W: no-%build-section
eask.spec: W: invalid-url Source1: @emacs-eask-cli-0.12.4-nm-prod.tgz
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/ansi.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build-badges.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe-mode.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe.el
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.package-lock.json
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.jshintrc
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.npmignore
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.travis.yml
 2 packages and 0 specfiles checked; 5 errors, 12 warnings, 27 filtered, 5 badness; has taken 1.7 s 




Rpmlint (installed packages)
----------------------------
============================ rpmlint session starts ============================
rpmlint: 2.8.0
configuration:
    /usr/lib/python3.14/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora-spdx-licenses.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
checks: 32, packages: 1

eask.noarch: W: wrong-file-end-of-line-encoding /usr/share/doc/eask/README.md
eask.noarch: W: only-non-binary-in-usr-lib
eask.noarch: W: no-manual-page-for-binary eask
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/ansi.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build-badges.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-build.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe-mode.el
eask.noarch: E: incorrect-fsf-address /usr/lib/node_modules/eask/lisp/extern/package-build/24/package-recipe.el
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.bin
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.package-lock.json
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.jshintrc
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.npmignore
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.travis.yml
 1 packages and 0 specfiles checked; 5 errors, 10 warnings, 23 filtered, 5 badness; has taken 0.2 s 



Source checksums
----------------
https://registry.npmjs.org/@emacs-eask/cli/-/cli-0.12.4.tgz :
  CHECKSUM(SHA256) this package     : 80910c2cec6af14e102ff19ee0d05991d11cf8ad4394de5ad8444f2f201e048b
  CHECKSUM(SHA256) upstream package : 80910c2cec6af14e102ff19ee0d05991d11cf8ad4394de5ad8444f2f201e048b


Requires
--------
eask (rpmlib, GLIBC filtered):
    /usr/bin/node
    nodejs
    nodejs(engine)



Provides
--------
eask:
    bundled(nodejs-ansi-regex)
    bundled(nodejs-ansi-styles)
    bundled(nodejs-cliui)
    bundled(nodejs-color-convert)
    bundled(nodejs-color-name)
    bundled(nodejs-emoji-regex)
    bundled(nodejs-escalade)
    bundled(nodejs-get-caller-file)
    bundled(nodejs-is-fullwidth-code-point)
    bundled(nodejs-isexe)
    bundled(nodejs-require-directory)
    bundled(nodejs-string-width)
    bundled(nodejs-strip-ansi)
    bundled(nodejs-which)
    bundled(nodejs-wrap-ansi)
    bundled(nodejs-y18n)
    bundled(nodejs-yargs)
    bundled(nodejs-yargs-parser)
    eask
    npm(@emacs-eask/cli)



Diff spec file in url and in SRPM
---------------------------------
--- /home/fedora-packaging/reviews/eask/2333620-eask/srpm/eask.spec	2026-02-11 12:49:43.792830288 +0300
+++ /home/fedora-packaging/reviews/eask/2333620-eask/srpm-unpacked/eask.spec	2026-02-09 03:00:00.000000000 +0300
@@ -1,2 +1,12 @@
+## START: Set by rpmautospec
+## (rpmautospec version 0.8.1)
+## RPMAUTOSPEC: autorelease, autochangelog
+%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
+    release_number = 2;
+    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
+    print(release_number + base_release_number - 1);
+}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
+## END: Set by rpmautospec
+
 %global npm_scope emacs-eask
 %global npm_name  cli
@@ -68,3 +78,18 @@
 
 %changelog
-%{autochangelog}
+## START: Generated by rpmautospec
+* Mon Feb 09 2026 Peter Oliver <git.uk> - 0.12.4-2
+- Mark all licence files as such.
+
+* Fri Feb 06 2026 Peter Oliver <git.uk> - 0.12.4-1
+- Update to version 0.12.4.
+
+* Fri Feb 06 2026 Peter Oliver <git.uk> - 0.12.0-2
+- BuildRequires: /usr/bin/node
+
+* Sun Dec 21 2025 Peter Oliver <git.uk> - 0.12.0-1
+- Update to version 0.12.0.
+
+* Fri Dec 20 2024 Peter Oliver <git.uk> - 0.10.2-1
+- Initial package.
+## END: Generated by rpmautospec


Generated by fedora-review 0.11.0 (05c5b26) last change: 2025-11-29
Command line :/usr/bin/fedora-review -b 2333620
Buildroot used: fedora-rawhide-x86_64
Active plugins: Shell-api, Generic
Disabled plugins: fonts, Perl, SugarActivity, Ocaml, C/C++, Java, PHP, R, Haskell, Python
Disabled flags: EXARCH, EPEL6, EPEL7, DISTTAG, BATCH

Comments:
a) Some javascript files are under the Blue Oak license, this license needs to be listed
https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/#_bundled_licenses
Comment 13 Peter Oliver 2026-02-11 20:35:58 UTC 
(In reply to Benson Muite from comment #12)

> - Dist tag is present.

I believe this is a false positive.  If not, could you point it out for me?

> - Package does not contain duplicates in %files.
>   Note: warning: File listed twice:
>   /usr/lib/node_modules/eask/node_modules_prod/cliui/LICENSE.txt

I think the cure might be worse than the disease, here, but okay.

SRPM URL: https://mavit.fedorapeople.org/rpm/eask-0.12.4-3.fc45.src.rpm

>   Note: License file license.js is not marked as %license

It's not a licence file.

> [!]: License field in the package spec file matches the actual license.
>      Note: Checking patched sources after %prep for licenses. Licenses
>      found: 
>      ...
>      "*No copyright* GNU General Public License, Version 3",

I think this is caused by a typo in package.json.  I have raised it upstream at https://github.com/emacs-eask/cli/pull/396

>      "*No copyright* Academic Free License v3.0 and/or Apache License 2.0",

This is a false positive caused by lisp/lint/license.el, which contains the names of many licences because its purpose is to scan Emacs packages for them.

> a) Some javascript files are under the Blue Oak license, this license needs
> to be listed

AFAICT, this licence is only used for development dependencies which aren't bundled.
Comment 14 Fedora Review Service 2026-02-11 20:39:38 UTC 
Created attachment 2129142 [details]
The .spec file difference from Copr build 10109340 to 10117519
Comment 15 Fedora Review Service 2026-02-11 20:39:41 UTC 
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10117519
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2333620-eask/fedora-rawhide-x86_64/10117519-eask/fedora-review/review.txt

Found issues:

- License file license.js is not marked as %license
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/#_license_text

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.
Comment 16 Benson Muite 2026-02-12 06:23:37 UTC 
(In reply to Peter Oliver from comment #13)
> (In reply to Benson Muite from comment #12)
> 
> > - Dist tag is present.
> 
> I believe this is a false positive.  If not, could you point it out for me?

This is fine.  If you want to avioid rasing this, use
rpmbuild -bs eask.spec

to create the src.rpm file instead of fedpkg srpm

> 
> > - Package does not contain duplicates in %files.
> >   Note: warning: File listed twice:
> >   /usr/lib/node_modules/eask/node_modules_prod/cliui/LICENSE.txt
> 
> I think the cure might be worse than the disease, here, but okay.
> 
> SRPM URL: https://mavit.fedorapeople.org/rpm/eask-0.12.4-3.fc45.src.rpm
> 

Thanks for the cleanup. Was not going to insist on this.

> >   Note: License file license.js is not marked as %license
> 
> It's not a licence file.
> 
> > [!]: License field in the package spec file matches the actual license.
> >      Note: Checking patched sources after %prep for licenses. Licenses
> >      found: 
> >      ...
> >      "*No copyright* GNU General Public License, Version 3",
> 
> I think this is caused by a typo in package.json.  I have raised it upstream
> at https://github.com/emacs-eask/cli/pull/396
> 
> >      "*No copyright* Academic Free License v3.0 and/or Apache License 2.0",
> 
> This is a false positive caused by lisp/lint/license.el, which contains the
> names of many licences because its purpose is to scan Emacs packages for
> them.
> 

Ok.

> > a) Some javascript files are under the Blue Oak license, this license needs
> > to be listed
> 
> AFAICT, this licence is only used for development dependencies which aren't
> bundled.

nodejs-isexe is bundled and is under Blue Oak license:
https://www.npmjs.com/package/isexe


b) For directory ownership, until the bug is fixed in rawhide consider replacing

BuildRequires:  /usr/bin/node
BuildRequires:  /usr/bin/perl
BuildRequires:  nodejs-devel

Requires:       nodejs

by

BuildRequires:  /usr/bin/node
BuildRequires:  /usr/bin/perl
BuildRequires:  nodejs22-devel

Requires:       nodejs22

c) The files

eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/.package-lock.json
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.jshintrc
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.npmignore
eask.noarch: W: hidden-file-or-dir /usr/lib/node_modules/eask/node_modules_prod/require-directory/.travis.yml

can probably be removed

d) Consider using dos2unix to prevent the line ending warning on:
/usr/share/doc/eask/README.md
Comment 17 Peter Oliver 2026-02-12 14:28:56 UTC 
(In reply to Benson Muite from comment #16)

> > > a) Some javascript files are under the Blue Oak license, this license needs
> > > to be listed
> > 
> > AFAICT, this licence is only used for development dependencies which aren't
> > bundled.
> 
> nodejs-isexe is bundled and is under Blue Oak license:
> https://www.npmjs.com/package/isexe

Thanks.  That was a recent addition which slipped through.  I have added a check to prevent this from happening again.

> b) For directory ownership, until the bug is fixed in rawhide consider
> replacing
> 
> BuildRequires:  /usr/bin/node
> BuildRequires:  /usr/bin/perl
> BuildRequires:  nodejs-devel
> 
> Requires:       nodejs
> 
> by
> 
> BuildRequires:  /usr/bin/node
> BuildRequires:  /usr/bin/perl
> BuildRequires:  nodejs22-devel
> 
> Requires:       nodejs22

I'm not sure that that would help, since it neither provides /usr/lib/node_modules nor overrides modifies the value of %{nodejs_sitelib}.

> c) The files
> 
> eask.noarch: W: hidden-file-or-dir
> /usr/lib/node_modules/eask/node_modules_prod/.package-lock.json
> eask.noarch: W: hidden-file-or-dir
> /usr/lib/node_modules/eask/node_modules_prod/require-directory/.jshintrc
> eask.noarch: W: hidden-file-or-dir
> /usr/lib/node_modules/eask/node_modules_prod/require-directory/.npmignore
> eask.noarch: W: hidden-file-or-dir
> /usr/lib/node_modules/eask/node_modules_prod/require-directory/.travis.yml
> 
> can probably be removed

Probably, but other packages contain similar files, so it feels like something that needs tackling in nodejs-packaging-bundler or the Node.js packaging guidelines, rather than in this one package.

> d) Consider using dos2unix to prevent the line ending warning on:
> /usr/share/doc/eask/README.md

Done.

SRPM URL: https://mavit.fedorapeople.org/rpm/eask-0.12.6-2.fc45.src.rpm