Spec URL: https://jlayton.fedorapeople.org/spooky-c/spooky-c.spec SRPM URL: https://jlayton.fedorapeople.org/spooky-c/spooky-c-1.0.0-1.fc21.src.rpm Description: This package is Andi Kleen's C port of Bob Jenkins' spooky hash algorithm. It's a very fast, 64-bit-arch-only hashing algorithm. Bob's original version was written in C++ and is available here: http://www.burtleburtle.net/bob/hash/spooky.html Fedora Account System Username: jlayton
I've updated the SRPM and specfile to allow it to build on i686 and ARM, and done some other cleanups. I've also submitted it to a scratch build in koji and that seemed to work: http://koji.fedoraproject.org/koji/taskinfo?taskID=9320090
Also, fwiw there are no distribution tarballs for this, so I'm just hosting a tarball for it on my fedorapeople page. That was generated using git archive on the upstream git repo for the project.
Hello Jeff, I don't have permission to sponsor your package but I made a review anyway. I did not consider every item on the list below because I'm quite a newbie in the process and of those items where I was not sure, I simply left the item open - someone more experienced please fill the missing parts (and correct the ones that are clearly wrong :) -- Antti Järvinen Review report follows: Issues: ======= - All build dependencies are listed in BuildRequires, except for any that are listed in the exceptions section of Packaging Guidelines. Note: These BR are not needed: gcc See: http://fedoraproject.org/wiki/Packaging/Guidelines#Exceptions_2 - Static libraries in -static or -devel subpackage, providing -devel if present. Note: Package has .a files: spooky-c-devel. Does not provide -static: spooky-c-devel. See: http://fedoraproject.org/wiki/Packaging/Guidelines#StaticLibraries - There is some discussion below about different licenses found in source - As this is a library, as a sw developer myself I'd love to see documentation of some kind, like a manual page in section 3 or something. - Rpmlint is taking person-names as spelling errors, maybe it is not good idea to ask those persons to correct their names to something that passes the dictionary-test. ===== MUST items ===== C/C++: [x]: Package does not contain kernel modules. [x]: Package contains no static executables. [x]: Header files in -devel subpackage, if present. [x]: ldconfig called in %post and %postun if required. [x]: Package does not contain any libtool archives (.la) [x]: Rpath absent or only used for internal libs. [x]: Development (unversioned) .so files in -devel subpackage, if present. Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %doc. [!]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "GPL (v2 or later)", "Unknown or generated". 3 files have unknown license. Detailed output of licensecheck in /tmp/review-1202063/1205376-spooky-c/licensecheck.txt Note: there is at least one file with LGPL boilerplate but the license given in spec file is PD ; I think it is required to list all licenses somehow, https://fedoraproject.org/wiki/Packaging:LicensingGuidelines?rd=Packaging/LicensingGuidelines might be helpful. [!]: License file installed when any subpackage combination is installed. Note: But I do not know how this applies to PD license that is not really a license. There is still the issue with LGPL file.. the LGPL file is not part of the binary rpm:s so [x]: %build honors applicable compiler flags or justifies otherwise. [x]: Package contains no bundled libraries without FPC exception. [x]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. Note: supposing the license hassle is somehow solved, the content itself seems all permissible to me. [-]: Package contains desktop file if it is a GUI application. [x]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [x]: If the package is a rename of another package, proper Obsoletes and Provides are present. [?]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [-]: Package contains systemd file(s) if in need. [x]: Useful -debuginfo package or justification otherwise. [x]: Package is not known to require an ExcludeArch tag. [x]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 10240 bytes in 2 files. [x]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: Package requires other packages for directories it uses. [x]: Package must own all directories that it creates. [x]: Package does not own files or directories owned by other packages. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package use %makeinstall only when make install' ' DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package do not use a name that already exist [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [ ]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [x]: Final provides and requires are sane (see attachments). [-]: Fully versioned dependency in subpackages if applicable. Note: No Requires: %{name}%{?_isa} = %{version}-%{release} in spooky-c-devel [x]: Package functions as described. [x]: Latest version is packaged. [ ]: Package does not include license text files separate from upstream. [ ]: Scriptlets must be sane, if used. [-]: Description and summary sections in the package spec file contains translations for supported Non-English languages, if available. [x]: Package should compile and build into binary rpms on all supported architectures. Note: tried only amd64 ; it does. [!]: %check is present and all tests pass. Note: there is test code in the package, it takes quite long time to run the tests so I don't know if it is applicable to have those tests run at package build time. [x]: Packages should try to preserve timestamps of original installed files. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: Dist tag is present (not strictly required in GL). [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Uses parallel make %{?_smp_mflags} macro. [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Large data in /usr/share should live in a noarch subpackage if package is arched. [x]: Package should not use obsolete m4 macros [x]: Spec file according to URL is the same as in SRPM. Rpmlint ------- Checking: spooky-c-1.0.0-1.fc21.x86_64.rpm spooky-c-devel-1.0.0-1.fc21.x86_64.rpm spooky-c-1.0.0-1.fc21.src.rpm spooky-c.x86_64: W: spelling-error %description -l en_US endian -> Indian, Dianne, Diane spooky-c.x86_64: W: install-file-in-docs /usr/share/doc/spooky-c/INSTALL spooky-c-devel.x86_64: W: no-documentation spooky-c.src: W: spelling-error %description -l en_US endian -> Indian, Dianne, Diane 3 packages and 0 specfiles checked; 0 errors, 4 warnings. Rpmlint (installed packages) ---------------------------- Cannot parse rpmlint output: Requires -------- spooky-c-devel (rpmlib, GLIBC filtered): spooky-c(x86-64) spooky-c (rpmlib, GLIBC filtered): /sbin/ldconfig libc.so.6()(64bit) rtld(GNU_HASH) Provides -------- spooky-c-devel: spooky-c-devel spooky-c-devel(x86-64) spooky-c: libspooky-c.so.1()(64bit) spooky-c spooky-c(x86-64) Source checksums ---------------- https://jlayton.fedorapeople.org/spooky-c/spooky-c-1.0.0.tar.xz : CHECKSUM(SHA256) this package : c8dc8fec133fd49a1712ce0308c78891f5bd6c765c69066a7a69a59bb1f9ba97 CHECKSUM(SHA256) upstream package : c8dc8fec133fd49a1712ce0308c78891f5bd6c765c69066a7a69a59bb1f9ba97 Generated by fedora-review 0.5.2 (63c24cb) last change: 2014-07-14 Command line :/usr/bin/fedora-review -b 1205376 Buildroot used: fedora-21-x86_64 Active plugins: Generic, Shell-api, C/C++ Disabled plugins: Java, Python, fonts, SugarActivity, Ocaml, Perl, Haskell, R, PHP, Ruby Disabled flags: EXARCH, EPEL5, BATCH, DISTTAG
Thanks for the review! - I'll remove the static lib for the Fedora package. - I'm pretty sure the license is public domain as that's what all of the source files say, but I'll try to verify that with Andi. The GPL stuff you're seeing is likely stuff that has been generated by autoconf/automake. Worst case, I can just ship what's in the git repo and we can rely on the koji build host to run autoreconf or something if that's a problem. I wouldn't think that it is though. - I'll also plan to roll up a manpage. It shouldn't be too difficult.
Ok, new specfile/srpm here: https://jlayton.fedorapeople.org/spooky-c/ ...you'll want the '-2' package. This should cover all of the above concerns. It adds a manpage and removes the static lib. I've got a question to the upstream maintainer about licensing I'll note that fedora-review licensecheck.txt says: GPL (v2 or later) ----------------- spooky-c-1.0.0/ltmain.sh Unknown or generated -------------------- spooky-c-1.0.0/spooky-c.c spooky-c-1.0.0/spooky-c.h spooky-c-1.0.0/testspooky-c.c ...so the only file that's listed as GPLv2 is ltmain.sh which is generated by libtool. That file is just used to build the library and has no bearing on the licensing on the library itself.
Antti, mind taking a look at the newer package?
Just a drive-by comment: There are specific guidelines how to package github sources[1], and you are better off using those. [1] https://fedoraproject.org/wiki/Packaging:SourceURL?rd=Packaging/SourceURL#Github
(In reply to Alec Leamas from comment #7) > Just a drive-by comment: There are specific guidelines how to package github > sources[1], and you are better off using those. > > [1] > https://fedoraproject.org/wiki/Packaging:SourceURL?rd=Packaging/ > SourceURL#Github Thanks, I'll take a look at those and respin the package. Stay tuned...
Ok, I githubisized the specfile: Spec URL: https://jlayton.fedorapeople.org/spooky-c/spooky-c.spec SRPM URL: https://jlayton.fedorapeople.org/spooky-c/spooky-c-1.0.0-3.fc21.src.rpm Thanks for the review so far!
While I'm on it: All patches should have an upstream reference: http://fedoraproject.org/wiki/Packaging:Guidelines#Patch_Guidelines
Pull request for the manpage patch is here: https://github.com/andikleen/spooky-c/pull/6 I'm not going to bother respinning the package for that now, but I'll add if it there are more substantive things that need changing.
I'll review this in exchange for Ahven: https://bugzilla.redhat.com/show_bug.cgi?id=1064564 The review request is over a year old because I became very busy just after I posted it and didn't have time to arrange a review swap. Now I have time.
Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Unknown ===== MUST items ===== C/C++: [x]: Package does not contain kernel modules. [x]: Package contains no static executables. [x]: Header files in -devel subpackage, if present. [x]: ldconfig called in %post and %postun if required. [x]: Package does not contain any libtool archives (.la) [x]: Rpath absent or only used for internal libs. [x]: Development (unversioned) .so files in -devel subpackage, if present. Generic: [?]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [-]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %doc. [?]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "Unknown or generated". 9 files have unknown license. [-]: License file installed when any subpackage combination is installed. [x]: %build honors applicable compiler flags or justifies otherwise. [x]: Package contains no bundled libraries without FPC exception. [x]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [x]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [x]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [-]: Package contains systemd file(s) if in need. [x]: Useful -debuginfo package or justification otherwise. [x]: Package is not known to require an ExcludeArch tag. [x]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 10240 bytes in 1 files. [?]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: Package requires other packages for directories it uses. [x]: Package must own all directories that it creates. [x]: Package does not own files or directories owned by other packages. [x]: All build dependencies are listed in BuildRequires, except for any that are listed in the exceptions section of Packaging Guidelines. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package use %makeinstall only when make install' ' DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package do not use a name that already exist [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [!]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [x]: Final provides and requires are sane (see attachments). [x]: Fully versioned dependency in subpackages if applicable. [?]: Package functions as described. [x]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [!]: Patches link to upstream bugs/comments/lists or are otherwise justified. [x]: Scriptlets must be sane, if used. [-]: Description and summary sections in the package spec file contains translations for supported Non-English languages, if available. [x]: Package should compile and build into binary rpms on all supported architectures. [!]: %check is present and all tests pass. [x]: Packages should try to preserve timestamps of original installed files. [x]: Sources can be downloaded from URI in Source: tag [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: Dist tag is present (not strictly required in GL). [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Uses parallel make %{?_smp_mflags} macro. [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Large data in /usr/share should live in a noarch subpackage if package is arched. [x]: Package should not use obsolete m4 macros [x]: Spec file according to URL is the same as in SRPM. Rpmlint ------- Checking: spooky-c-1.0.0-3.fc21.x86_64.rpm spooky-c-devel-1.0.0-3.fc21.x86_64.rpm spooky-c-1.0.0-3.fc21.src.rpm spooky-c.x86_64: W: spelling-error %description -l en_US endian -> Indian, Dianne, Diane spooky-c-devel.x86_64: W: spelling-error %description -l en_US manpages -> manages, man pages, man-pages spooky-c-devel.x86_64: W: only-non-binary-in-usr-lib spooky-c.src: W: spelling-error %description -l en_US endian -> Indian, Dianne, Diane 3 packages and 0 specfiles checked; 0 errors, 4 warnings. Things to do: ------------- · The only really blocking problem is that the licensing is unclear. It is stated quite clearly that Bob Jenkins has placed his C++ code in the public domain, but nothing clear is said about the licensing of Andi Kleen's and Ziga Zupanec's C code. Even in the C files, the only place where the words "public domain" occur is right next to "by Bob Jenkins". As I understand the policy you need to contact Andi and if possible get a new release with a license statement, or else include his reply in the package as a license file. https://fedoraproject.org/wiki/Packaging:LicensingGuidelines#License_Clarification · Development/Libraries is the right group for the -devel subpackage, but I think the main package should be in System Environment/Libraries. · Add a comment about the manpage patch. Additional notes: ----------------- · The warnings from RPMlint are all false alarms. · I don't think you're required to define shortcommit if you don't use it. · The modification time of spooky-c.h is not preserved, but that's not because of anything the spec file does. I guess it's the Autoconf-generated makefile that doesn't preserve the modification times of files it installs. · I tried running the test program with "make check". It consumed 100% of one CPU core until I killed it. I don't know whether it's supposed to do that or not. Thus I can't tell whether the library functions as described. If it's meant to be a reasonably quick function test, then you should probably run it in %check. If it's a benchmark, then you probably shouldn't.
(In reply to Björn Persson from comment #13) > > > Things to do: > ------------- > > · The only really blocking problem is that the licensing is unclear. It is > stated quite clearly that Bob Jenkins has placed his C++ code in the public > domain, but nothing clear is said about the licensing of Andi Kleen's and > Ziga Zupanec's C code. Even in the C files, the only place where the words > "public domain" occur is right next to "by Bob Jenkins". As I understand the > policy you need to contact Andi and if possible get a new release with a > license statement, or else include his reply in the package as a license > file. > > https://fedoraproject.org/wiki/Packaging: > LicensingGuidelines#License_Clarification > Good point. I emailed Andi to get some clarification. Hopefully we can sort it out soon. I mentioned that if he really wanted a PD license then using the CC0 license might be better. > · Development/Libraries is the right group for the -devel subpackage, but I > think the main package should be in System Environment/Libraries. > Ok, I'll fix that. > · Add a comment about the manpage patch. > Yep, will do since I'm respinning for other reasons. > > Additional notes: > ----------------- > > · The warnings from RPMlint are all false alarms. > > · I don't think you're required to define shortcommit if you don't use it. > Fair enough. I'll remove it. > · The modification time of spooky-c.h is not preserved, but that's not > because of anything the spec file does. I guess it's the Autoconf-generated > makefile that doesn't preserve the modification times of files it installs. > Yes, I expect so. > · I tried running the test program with "make check". It consumed 100% of > one CPU core until I killed it. I don't know whether it's supposed to do > that or not. Thus I can't tell whether the library functions as described. > If it's meant to be a reasonably quick function test, then you should > probably run it in %check. If it's a benchmark, then you probably shouldn't. Yes, it's more of a benchmark than an test program. I stuck it in TESTS when I did the autotools patches for the thing, but I don't think we want to run that on each build. Thanks for review so far! I'll update the package once I get clarification from Andi.
I haven't forgotten about this, but I haven't been able to get Andi to respond to my efforts to clarify the licensing yet. I'm hoping that it's just because he's busy.
After a very long delay, the maintainer finally responded and moved the code to be BSD licensed: Spec URL: https://jlayton.fedorapeople.org/spooky-c/spooky-c.spec SRPM URL: https://jlayton.fedorapeople.org/spooky-c/spooky-c-1.0.0-5.fc22.src.rpm ...does this resolve the licensing issue?
Yes, that takes care of the licensing. I still think the shared library should be in the group System Environment/Libraries, and the development files in Development/Libraries, but since the groups aren't formally specified I won't consider this a blocker.
I've no objection to making that change. I'll do that before the first official package builds. Thanks for the review!
New Package SCM Request ======================= Package Name: spooky-c Short Description: C port of Bob Jenkins' spooky hash Upstream URL: https://github.com/andikleen/spooky-c Owners: jlayton Branches: f21 f22 epel7 InitialCC:
Git done (by process-git-requests).
All done as far as I can see.