Spec URL: https://jjames.fedorapeople.org/gap-pkg-scscp/gap-pkg-scscp.spec SRPM URL: https://jjames.fedorapeople.org/gap-pkg-scscp/gap-pkg-scscp-2.1.4-1.fc25.src.rpm Fedora Account System Username: jjames Description: This package implements the Symbolic Computation Software Composability Protocol (SCSCP) for the GAP system in accordance with the SCSCP specification, described at http://www.symbolic-computing.org/scscp, and OpenMath dictionaries scscp1 and scscp2.
Can you please clarify the points raised in Issues in the review below? Since some of these will be common across your others in the review swap I'll hold off the formal review of them until this is satisfied. Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated ===== Issues ===== * License field in spec - The GPL file included only seems to specify GPL2 not GPL2+ - Please fix this in the spec or clarify where the + comes from - Incorrect fsf address found in license - please report upstream * Documentation in %{_gap_dir} which is /usr/lib/gap - As per comments on bz1332605#c2 docs are here for runtime documentation browser - Accepted as per previous packages, perhaps draft gap guildelines to FPC useful? * The PackageInfo.g fiel (and upstream website) specifies GAPDoc as a requirement - GAPDoc-latex is a BR but no GAPDoc in requires? * There are %config files in %{_gap_dir} - Are these files marked as %config meant to be user editable? - If they are can GAP packages be built with them in /etc ? - If they need to be in /usr/lib/gap/%{pkgname} can that be a symlink to etc? - Seems to highlight the need for a GAP packaging draft guideline. * Assuming functional based on %check passing * Latest version is hard to check - The upstream URL shows 2.1.2, the download on that page it 2.1.0 and this is 2.1.4 - How can we verify the latest version accurately? ===== MUST items ===== Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [!]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "Unknown or generated". 13 files have unknown license. Detailed output of licensecheck in /home/james/workspace/fedora-scm/1332607 -gap-pkg-scscp/licensecheck.txt [x]: Package contains no bundled libraries without FPC exception. [x]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [!]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [!]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [-]: Package contains systemd file(s) if in need. [x]: Package is not known to require an ExcludeArch tag. [-]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 10240 bytes in 1 files. [!]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: Package requires other packages for directories it uses. [x]: Package must own all directories that it creates. [x]: Package does not own files or directories owned by other packages. [x]: All build dependencies are listed in BuildRequires, except for any that are listed in the exceptions section of Packaging Guidelines. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: %config files are marked noreplace or the reason is justified. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [!]: No %config files under /usr. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [-]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [!]: Final provides and requires are sane (see attachments). [?]: Package functions as described. [!]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [-]: Description and summary sections in the package spec file contains translations for supported Non-English languages, if available. [x]: Package should compile and build into binary rpms on all supported architectures. [x]: %check is present and all tests pass. [x]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Spec file according to URL is the same as in SRPM. Rpmlint ------- Checking: gap-pkg-scscp-2.1.4-1.fc25.noarch.rpm gap-pkg-scscp-2.1.4-1.fc25.src.rpm gap-pkg-scscp.noarch: W: only-non-binary-in-usr-lib gap-pkg-scscp.noarch: W: non-etc-or-var-file-marked-as-conffile /usr/lib/gap/pkg/scscp/config.g gap-pkg-scscp.noarch: W: non-etc-or-var-file-marked-as-conffile /usr/lib/gap/pkg/scscp/configpar.g gap-pkg-scscp.noarch: E: incorrect-fsf-address /usr/share/licenses/gap-pkg-scscp/GPL 2 packages and 0 specfiles checked; 1 errors, 3 warnings. Rpmlint (installed packages) ---------------------------- sh: /usr/bin/python: No such file or directory gap-pkg-scscp.noarch: W: invalid-url URL: https://alexk.host.cs.st-andrews.ac.uk/scscp/ <urlopen error [Errno -3] Temporary failure in name resolution> gap-pkg-scscp.noarch: W: only-non-binary-in-usr-lib gap-pkg-scscp.noarch: W: non-etc-or-var-file-marked-as-conffile /usr/lib/gap/pkg/scscp/config.g gap-pkg-scscp.noarch: W: non-etc-or-var-file-marked-as-conffile /usr/lib/gap/pkg/scscp/configpar.g gap-pkg-scscp.noarch: E: incorrect-fsf-address /usr/share/licenses/gap-pkg-scscp/GPL 1 packages and 0 specfiles checked; 1 errors, 4 warnings. Requires -------- gap-pkg-scscp (rpmlib, GLIBC filtered): /bin/sh config(gap-pkg-scscp) gap-core gap-pkg-io gap-pkg-openmath Provides -------- gap-pkg-scscp: config(gap-pkg-scscp) gap-pkg-scscp Source checksums ---------------- http://www.gap-system.org/pub/gap/gap4/tar.bz2/packages/scscp-2.1.4.tar.bz2 : CHECKSUM(SHA256) this package : 3e8db26d29daa4114c2f93594eeacea8362672df43896c0f48d4c64d20e8aa5c CHECKSUM(SHA256) upstream package : 3e8db26d29daa4114c2f93594eeacea8362672df43896c0f48d4c64d20e8aa5c Generated by fedora-review 0.6.1 (f03e4e7) last change: 2016-05-02 Command line :/usr/bin/fedora-review -m fedora-rawhide-x86_64 -b 1332607 Buildroot used: fedora-rawhide-x86_64 Active plugins: Generic, Shell-api Disabled plugins: Java, C/C++, Python, fonts, SugarActivity, Ocaml, Perl, Haskell, R, PHP Disabled flags: EXARCH, DISTTAG, EPEL5, BATCH, EPEL6
(In reply to James Hogarth from comment #1) > * License field in spec > - The GPL file included only seems to specify GPL2 not GPL2+ > - Please fix this in the spec or clarify where the + comes from In doc/manual.xml, the <Copyright> section includes the "any later version" language. > - Incorrect fsf address found in license - please report upstream Will do. I notice that doc/manual.xml uses a modern style web address instead of a street address, so the old address in GPL is probably an oversight. > * Documentation in %{_gap_dir} which is /usr/lib/gap > - As per comments on bz1332605#c2 docs are here for runtime > documentation browser > - Accepted as per previous packages, perhaps draft gap guildelines to > FPC useful? Yes, I should definitely take that step. I have not done so yet because I've been kind of feeling my way into a set of best practices for GAP packages. I'm still not sure I've arrived there, but I've certainly built up a set of common practices that should be codified. I will take a stab at this and submit to FPC. > * The PackageInfo.g fiel (and upstream website) specifies GAPDoc as a > requirement > - GAPDoc-latex is a BR but no GAPDoc in requires? GAP itself won't even start unless GAPDoc is installed, so it is required by gap-core. On the other hand, the big pile of LaTeX packages required by GAPDoc-latex is not needed for normal day-to-day use of GAP, which is why they have been split out into the GAPDoc-latex subpackage. > * There are %config files in %{_gap_dir} > - Are these files marked as %config meant to be user editable? > - If they are can GAP packages be built with them in /etc ? > - If they need to be in /usr/lib/gap/%{pkgname} can that be a symlink to > etc? > - Seems to highlight the need for a GAP packaging draft guideline. Yes, they are meant to be user editable. They are read from init.g when the package is loaded. I'm not sure what the best option is here. Putting them into /etc implies that there is a single system-wide configuration that all users will want, which is not necessarily the case. Those files really ought to live under $HOME somewhere. So ... how about we put them in /etc, with either a patch to init.g to point to their new home or a symlink from /usr/lib/gap/%{pkgname}, and then have init.g also attempt to read files of the same names from, say, $HOME/.gap, with no error if those files don't exist? That will require a README to explain the situation to Fedora users. The idea is that users can override the system-wide settings that way. Honestly, I'm not sure that a system-wide setting even makes sense. Maybe we should dispense with the /etc versions, tell users that we're providing example config files, and they need to create the $HOME versions before this package will function at all. You know what? Debian has this packaged already. Just for laughs, I'm going to see what they did. > * Assuming functional based on %check passing > * Latest version is hard to check > - The upstream URL shows 2.1.2, the download on that page it 2.1.0 and > this is 2.1.4 > - How can we verify the latest version accurately? It appears that this author considers the GAP package repository at http://www.gap-system.org/Packages/packages.html to be the primary download site, and only updates the supposed package home page once in awhile. I will monitor that site for updates to this package. (This is the case with many of the GAP packages, by the way. The authors update their home pages only sporadically, but always upload the latest tarball to gap-system.org, because that is where GAP users look for new package versions.) Thank you for the review.
This package is now a full blown service, following Debian's lead. The major difference is that the Debian version uses SysV-style init scripts, where this package uses systemd. I have otherwise tried to remain compatible with the Debian version, on the theory that cross-distro compatibility is a good thing. Now rpmlint issues some complaints: 1. gap-pkg-scscp.noarch: W: dangerous-command-in-%postun userdel Yes, it is dangerous. Other packages that create users, such as openssh, also remove those users in %postun, so there is precedent for this. 2. gap-pkg-scscp.src: W: strange-permission gapd.sh 755 Apparently rpmlint doesn't like seeing an executable script under /usr/lib/gap, as these are exactly the permission bits an executable should have. New URLs: Spec URL: https://jjames.fedorapeople.org/gap-pkg-scscp/gap-pkg-scscp.spec SRPM URL: https://jjames.fedorapeople.org/gap-pkg-scscp/gap-pkg-scscp-2.1.4-2.fc25.src.rpm
James, do I need to do anything to get this review moving forward?
Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated ===== Issues ===== * Unowned created directory /etc/logrotate.d * Missing requires on logrotate - Since it has a logrotate configuration it needs a Requires on logrotate * Documentation in /usr (%{_gap_dir}) - This is standard for GAP packages as it's used for runtime online docs * Deletes the user it creates - userdel in %postun is not permitted: https://fedoraproject.org/wiki/Packaging:UsersAndGroups#Allocation_Strategies * Cannot test "functions correctly" - Assuming works by %check results and clean upstream build ===== MUST items ===== Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [x]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "Unknown or generated". 13 files have unknown license. Detailed output of licensecheck in /home/james/workspace/fedora-scm/1332607 -gap-pkg-scscp/licensecheck.txt [!]: Package must own all directories that it creates. Note: Directories without known owners: /etc/logrotate.d [x]: Package contains no bundled libraries without FPC exception. [x]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [!]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [!]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [x]: Package contains systemd file(s) if in need. [x]: Package is not known to require an ExcludeArch tag. [-]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 10240 bytes in 1 files. [!]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: Package requires other packages for directories it uses. [x]: Package does not own files or directories owned by other packages. [x]: All build dependencies are listed in BuildRequires, except for any that are listed in the exceptions section of Packaging Guidelines. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: %config files are marked noreplace or the reason is justified. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: No %config files under /usr. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [-]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [!]: Final provides and requires are sane (see attachments). [?]: Package functions as described. [x]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [-]: Description and summary sections in the package spec file contains translations for supported Non-English languages, if available. [x]: Package should compile and build into binary rpms on all supported architectures. [x]: %check is present and all tests pass. [x]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Spec file according to URL is the same as in SRPM. Rpmlint ------- Checking: gap-pkg-scscp-2.1.4-2.fc25.noarch.rpm gap-pkg-scscp-2.1.4-2.fc25.src.rpm gap-pkg-scscp.noarch: E: incorrect-fsf-address /usr/share/licenses/gap-pkg-scscp/GPL gap-pkg-scscp.noarch: W: dangerous-command-in-%postun userdel gap-pkg-scscp.src: W: strange-permission gapd.sh 755 2 packages and 0 specfiles checked; 1 errors, 2 warnings. Rpmlint (installed packages) ---------------------------- gap-pkg-scscp.noarch: E: incorrect-fsf-address /usr/share/licenses/gap-pkg-scscp/GPL gap-pkg-scscp.noarch: W: dangerous-command-in-%postun userdel 1 packages and 0 specfiles checked; 1 errors, 1 warnings. Requires -------- gap-pkg-scscp (rpmlib, GLIBC filtered): /bin/sh config(gap-pkg-scscp) gap-core gap-pkg-io gap-pkg-openmath shadow-utils systemd Provides -------- gap-pkg-scscp: config(gap-pkg-scscp) gap-pkg-scscp Source checksums ---------------- http://www.gap-system.org/pub/gap/gap4/tar.bz2/packages/scscp-2.1.4.tar.bz2 : CHECKSUM(SHA256) this package : 3e8db26d29daa4114c2f93594eeacea8362672df43896c0f48d4c64d20e8aa5c CHECKSUM(SHA256) upstream package : 3e8db26d29daa4114c2f93594eeacea8362672df43896c0f48d4c64d20e8aa5c Generated by fedora-review 0.6.1 (f03e4e7) last change: 2016-05-02 Command line :/usr/bin/fedora-review -m fedora-rawhide-x86_64 -b 1332607 Buildroot used: fedora-rawhide-x86_64 Active plugins: Generic, Shell-api Disabled plugins: Java, C/C++, Python, fonts, SugarActivity, Ocaml, Perl, Haskell, R, PHP Disabled flags: EXARCH, DISTTAG, EPEL5, BATCH, EPEL6 ===== Results ===== Package is NOT APPROVED at this time. Blockers to fix are the missing requires on logrotate and the userdel in %postun Note that the openssh package does not remove the ssh user: http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/tree/openssh.spec#n732
(In reply to James Hogarth from comment #5) > ===== Issues ===== > > * Unowned created directory /etc/logrotate.d Fixed. > * Missing requires on logrotate > - Since it has a logrotate configuration it needs a Requires on logrotate I don't think so. Of the 20 packages that dropped files into /etc/logrotate.d on my machine, only 2 of them (rsyslog and rpmorphan) depend on logrotate. The other packages drop config files in there for logrotate to use if it is installed, but function without it being installed. I believe this package falls into that category. Logrotate is not necessary for proper functioning. > * Documentation in /usr (%{_gap_dir}) > - This is standard for GAP packages as it's used for runtime online docs > * Deletes the user it creates > - userdel in %postun is not permitted: > https://fedoraproject.org/wiki/Packaging:UsersAndGroups#Allocation_Strategies I was not aware of that wiki page. Thanks for pointing it out. I have removed the offending command. New URLs: Spec URL: https://jjames.fedorapeople.org/gap-pkg-scscp/gap-pkg-scscp.spec SRPM URL: https://jjames.fedorapeople.org/gap-pkg-scscp/gap-pkg-scscp-2.1.4-3.fc25.src.rpm
On conferring with others in fedora-devel I'm inclined to agree with you on (1) that co-owning the directory is sufficient. With those two things fixed package is APPROVED
Package request has been approved: https://admin.fedoraproject.org/pkgdb/package/rpms/gap-pkg-scscp
gap-pkg-scscp-2.1.4-3.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-39819ec5e6
gap-pkg-scscp-2.1.4-3.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-39819ec5e6
gap-pkg-scscp-2.1.4-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.