Bug 2418895

Summary: Review Request: gobuster - Directory/File, DNS and VHost busting tool written in Go
Product: [Fedora] Fedora Reporter: Emir Akdag <infraw.linux>
Component: Package ReviewAssignee: Mikel Olasagasti Uranga <mikel>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: rawhideCC: mikel, package-review
Target Milestone: ---Flags: mikel: fedora-review+
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-12-22 00:52:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
The .spec file difference from Copr build 9865794 to 9877660 none

Description Emir Akdag 2025-12-04 17:05:02 UTC
Spec URL: https://raw.githubusercontent.com/Infraw/fedora-gobuster/main/gobuster.spec
SRPM URL: https://github.com/Infraw/fedora-gobuster/raw/main/gobuster-3.8.2-1.fc43.src.rpm

Description:
Gobuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains. It helps security professionals and penetration testers enumerate hidden resources on web servers.

Federation Rationale:
This package was previously in Fedora but was retired/orphaned. I am un-retiring it and updating it to the latest upstream version (3.8.2).

Notes:
- Updated to version 3.8.2.
- Rebuilt to fix CVE-2025-58188 (Go stdlib panic).
- Vendored dependencies because 'golang-github-pin-tftp' and others are currently orphaned in Fedora.
- Verified build in Mock (Rawhide).

Fedora Account System Username: infraw

Comment 1 Fedora Review Service 2025-12-04 17:09:52 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/9865794
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2418895-gobuster/fedora-rawhide-x86_64/09865794-gobuster/fedora-review/review.txt

Found issues:

- A package with this name already exists. Please check https://src.fedoraproject.org/rpms/gobuster
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Naming/#_conflicting_package_names

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 2 Mikel Olasagasti Uranga 2025-12-05 15:34:55 UTC
Please, use latest go2rpm to generate the spec. Try with the following:

$ go2rpm -p vendor --name gobuster -f https://github.com/OJ/gobuster github.com/OJ/gobuster/v3

Comment 3 Emir Akdag 2025-12-05 16:36:40 UTC
(In reply to Mikel Olasagasti Uranga from comment #2)
> Please, use latest go2rpm to generate the spec. Try with the following:
> 
> $ go2rpm -p vendor --name gobuster -f https://github.com/OJ/gobuster
> github.com/OJ/gobuster/v3

I have updated the spec to use go2rpm.

Spec: https://raw.githubusercontent.com/Infraw/fedora-gobuster/main/gobuster.spec
SRPM: https://github.com/Infraw/fedora-gobuster/raw/main/gobuster-3.8.2-1.fc43.src.rpm

Verified build in Mock (Rawhide).

Comment 4 Fedora Review Service 2025-12-05 16:42:08 UTC
Created attachment 2117647 [details]
The .spec file difference from Copr build 9865794 to 9877660

Comment 5 Fedora Review Service 2025-12-05 16:42:11 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/9877660
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2418895-gobuster/fedora-rawhide-x86_64/09877660-gobuster/fedora-review/review.txt

Found issues:

- A package with this name already exists. Please check https://src.fedoraproject.org/rpms/gobuster
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Naming/#_conflicting_package_names

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 6 Mikel Olasagasti Uranga 2025-12-06 21:34:50 UTC
Golang Package Review
==============

This package was generated using go2rpm and Go Vendor Tools, which simplifies
the review.

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated


- [x] The latest version is packaged or packaging an earlier version is justified.
- [x] The License tag reflects the package contents and uses the correct identifiers.
- [x] The package builds successfully in mock.
- [x] Package is installable (checked by fedora-review).
- [x] There are no relevant rpmlint errors.
- [x] The package runs tests in %check.
- [x] `%goipath` is set correctly.
- [x] The package's binaries don't conflict with binaries already in the distribution. (Some Go projects include utility binaries with very generic names)
- [x] There are no `%{_bindir}/*` wildcards in %files. (go2rpm includes these by default)
- [x] The package does not use `%gometa -f` if it has dependents that still build for %ix86.
- [x] The package complies with the Golang and general Packaging Guidelines.
- [x] GO_LDFLAGS are set correctly.

Package approved! On import, don't forget to do the following:

- [ ] Add the package to release-monitoring.org
- [ ] Give go-sig privileges (at least commit) on the package
- [ ] Close the review bug by referencing its ID in the rpm changelog and the Bodhi ticket.
- [ ] Consider configuring Packit service to help with maintenance

Comment 7 Emir Akdag 2025-12-07 00:23:18 UTC
Thank you for the review and approval

Since this is my first package contribution to Fedora, I need a sponsor to be added to the packager group so I can proceed with the import steps.

Could you please sponsor me?

Comment 9 Emir Akdag 2025-12-09 11:43:56 UTC
Thanks Mikel. I have followed the guides.

My FAS account (infraw) is active, CLA is signed, and SSH and GPG keys are uploaded.
I have already introduced myself on the devel mailing list (Dec 4th).
I have opened a formal sponsorship request here: https://pagure.io/packager-sponsors/issue/746

I am ready for sponsorship

Comment 10 Fedora Update System 2025-12-20 13:55:16 UTC
FEDORA-2025-723b7f2990 (gobuster-3.8.2-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-723b7f2990

Comment 11 Fedora Update System 2025-12-20 14:34:04 UTC
FEDORA-2025-36b3527937 (gobuster-3.8.2-2.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-36b3527937

Comment 12 Fedora Update System 2025-12-20 15:44:47 UTC
FEDORA-EPEL-2025-0abe7a3da8 (gobuster-3.8.2-1.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-0abe7a3da8

Comment 13 Fedora Update System 2025-12-20 16:46:50 UTC
FEDORA-EPEL-2025-6a38045e00 (gobuster-3.8.2-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-6a38045e00

Comment 14 Fedora Update System 2025-12-21 03:09:04 UTC
FEDORA-EPEL-2025-0abe7a3da8 has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-0abe7a3da8

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2025-12-21 03:18:03 UTC
FEDORA-EPEL-2025-6a38045e00 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-6a38045e00

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 16 Fedora Update System 2025-12-21 03:40:18 UTC
FEDORA-2025-36b3527937 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-36b3527937`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-36b3527937

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 17 Fedora Update System 2025-12-21 04:07:02 UTC
FEDORA-2025-723b7f2990 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-723b7f2990`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-723b7f2990

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 18 Fedora Update System 2025-12-22 00:52:34 UTC
FEDORA-2025-723b7f2990 (gobuster-3.8.2-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 19 Fedora Update System 2025-12-22 01:06:46 UTC
FEDORA-2025-36b3527937 (gobuster-3.8.2-2.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 20 Fedora Update System 2025-12-29 17:23:59 UTC
FEDORA-EPEL-2025-0abe7a3da8 (gobuster-3.8.2-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 21 Fedora Update System 2025-12-29 17:24:04 UTC
FEDORA-EPEL-2025-6a38045e00 (gobuster-3.8.2-1.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.