Spec URL: https://github.com/projectatomic/bubblewrap/blob/master/packaging/bubblewrap.spec SRPM URL: You can generate one Description: Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Fedora Account System Username: walters
Note: I am not (yet) a packager so this should be considered an informal review/comment TL;DR version: * Provide a srpm so fedora-review works * Fix your spec file so that it actually builds Longer version: You'll probably be more likely to get reviews on this if you provide a "plain" spec link and an SRPM package. This is so the fedora-review tools works nicely. That said, eyeballing the spec file I have a couple of comments: * You might want to consider forming the version number from the date of the git sha as per https://fedoraproject.org/wiki/Packaging:NamingGuidelines#NonNumericRelease * once I created a srpm file, it didn't build for me. cd: bubblewrap-0: No such file or directory This will be because the tarball extracts to a folder named bubblewrap-66d12bb23b04e201c5846e325f0b10930ed802f8 so you need %autosetup -Sgit -n %{name}-%{commit0} rather than %autosetup -Sgit -n %{name}-%{version} then, I get this error: cp -pr COPYING /builddir/build/BUILDROOT/bubblewrap-0-1.fc23.x86_64/usr/share/licenses/bubblewrap cp: cannot stat 'COPYING': No such file or directory no doubt because the COPYING file doesn't exist until two commits later. So now I have a package. rpmlint takes exception at a couple of things: bubblewrap.src: W: spelling-error %description -l en_US usr -> use, us, user bubblewrap.src: W: spelling-error %description -l en_US bwrap -> wrap, b wrap bubblewrap.src: W: spelling-error %description -l en_US setuid -> setup bubblewrap.src: W: spelling-error %description -l en_US namespaces -> name spaces, name-spaces, names paces bubblewrap.src: E: no-changelogname-tag bubblewrap.x86_64: W: spelling-error %description -l en_US setuid -> setup bubblewrap.x86_64: W: spelling-error %description -l en_US namespaces -> name spaces, name-spaces, names paces bubblewrap.x86_64: E: no-changelogname-tag bubblewrap.x86_64: E: non-executable-script /usr/share/bash-completion/completions/bwrap 644 /bin/bash bubblewrap-debuginfo.x86_64: E: no-changelogname-tag 3 packages and 0 specfiles checked; 4 errors, 6 warnings. Ignoring the spelling warnings (which are not correct) we have two problems: bubblewrap.x86_64: E: no-changelogname-tag bubblewrap.x86_64: E: non-executable-script /usr/share/bash-completion The first is because you have no changelog, the second is because the conditional around setting the file permissions on RHEL also seems to be needed on Fedora. (why is this conditional?)
> The first is because you have no changelog, Just to be clear, I mean no changelog tag in the spec file
I should have noted a high level of two things: - I normally use https://github.com/cgwalters/rpmdistro-gitoverlay which automatically manages the spec file versions from git, but I'll indeed change it so it's more ready for the "manual" koji/fedora process - I don't keep a %changelog in the package git spec file because I don't think RPM changelog makes sense in modern times - the git log of the spec file + Bodhi is better. But when I do import it into Fedora I'll add one until such time as Fedora is fixed to drop it.
Isn't there a tool to copy git log to changelog in spec file? There ought to be! Changelog is used many places, including updating the package. Fedora packages are snapshots of the source so that the builds are repeatable, and building from git does not meet that requirement (although the git hash could ensure the correct source is extracted, and maybe rpmbuild should be able to automate verifying that when git hash is included in a spec file). Ask upstream to tag a release, and use that for a version. Suggest the git hash you've chosen.
Use https://raw.githubusercontent.com/projectatomic/bubblewrap/master/packaging/bubblewrap.spec to get the "plain" spec file from github.
We have made a release now: https://github.com/projectatomic/bubblewrap/releases/tag/v0.1.0 Can you agree to ignore the git/rpm stuff - again, when it's imported into Fedora I'll update the `commit0` in *that* copy, and I will make a %changelog.
Posting default fedora-review text and I'll go through un-checked items in a bit. We can ignore the lack of changelog and older git commit values for now as Colin mentioned an official Fedora spec will have those updates. (I hate changelogs in the spec file myself, but seems it's essential for downstreams like CentOS which rebuild srpms and not dist-git, but anyway) Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated [ ] = Manual review needed ===== MUST items ===== C/C++: [ ]: Package does not contain kernel modules. [ ]: Package contains no static executables. [x]: Header files in -devel subpackage, if present. [x]: Package does not contain any libtool archives (.la) [x]: Rpath absent or only used for internal libs. Generic: [ ]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [ ]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "LGPL (v2 or later)", "Unknown or generated". 10 files have unknown license. Detailed output of licensecheck in /mnt/repositories/pkgs/review/bubblewrap/packaging/bubblewrap/licensecheck.txt [ ]: License file installed when any subpackage combination is installed. [ ]: Package must own all directories that it creates. Note: Directories without known owners: /usr/share/bash-completion, /usr/share/bash-completion/completions [ ]: %build honors applicable compiler flags or justifies otherwise. [ ]: Package contains no bundled libraries without FPC exception. [ ]: Changelog in prescribed format. [ ]: Sources contain only permissible code or content. [ ]: Package contains desktop file if it is a GUI application. [ ]: Development files must be in a -devel package [ ]: Package uses nothing in %doc for runtime. [ ]: Package consistently uses macros (instead of hard-coded directory names). [ ]: Package is named according to the Package Naming Guidelines. [ ]: Package does not generate any conflict. [ ]: Package obeys FHS, except libexecdir and /usr/target. [ ]: If the package is a rename of another package, proper Obsoletes and Provides are present. [ ]: Requires correct, justified where necessary. [ ]: Spec file is legible and written in American English. [ ]: Package contains systemd file(s) if in need. [ ]: Useful -debuginfo package or justification otherwise. [ ]: Package is not known to require an ExcludeArch tag. [ ]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 20480 bytes in 1 files. [ ]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: Package requires other packages for directories it uses. [x]: Package does not own files or directories owned by other packages. [x]: All build dependencies are listed in BuildRequires, except for any that are listed in the exceptions section of Packaging Guidelines. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [ ]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [ ]: Final provides and requires are sane (see attachments). [ ]: Fully versioned dependency in subpackages if applicable. Note: No Requires: %{name}%{?_isa} = %{version}-%{release} in bubblewrap-debuginfo [ ]: Package functions as described. [ ]: Latest version is packaged. [ ]: Package does not include license text files separate from upstream. [ ]: Description and summary sections in the package spec file contains translations for supported Non-English languages, if available. [ ]: Package should compile and build into binary rpms on all supported architectures. [ ]: %check is present and all tests pass. [ ]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Uses parallel make %{?_smp_mflags} macro. [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on debuginfo package(s). Note: There are rpmlint messages (see attachment). [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Large data in /usr/share should live in a noarch subpackage if package is arched. [x]: Package should not use obsolete m4 macros Rpmlint ------- Checking: bubblewrap-0-1.fc25.x86_64.rpm bubblewrap-debuginfo-0-1.fc25.x86_64.rpm bubblewrap-0-1.fc25.src.rpm bubblewrap.x86_64: W: spelling-error %description -l en_US setuid -> setup bubblewrap.x86_64: W: spelling-error %description -l en_US namespaces -> name spaces, name-spaces, names paces bubblewrap.x86_64: E: no-changelogname-tag bubblewrap.x86_64: E: missing-call-to-chdir-with-chroot /usr/bin/bwrap bubblewrap.x86_64: E: non-executable-script /usr/share/bash-completion/completions/bwrap 644 /bin/bash bubblewrap-debuginfo.x86_64: E: no-changelogname-tag 2 packages and 0 specfiles checked; 4 errors, 2 warnings. Rpmlint (debuginfo) ------------------- Checking: bubblewrap-debuginfo-0-1.fc25.x86_64.rpm bubblewrap-debuginfo.x86_64: E: no-changelogname-tag 1 packages and 0 specfiles checked; 1 errors, 0 warnings. Rpmlint (installed packages) ---------------------------- bubblewrap-debuginfo.x86_64: E: no-changelogname-tag bubblewrap.x86_64: W: spelling-error %description -l en_US setuid -> setup bubblewrap.x86_64: W: spelling-error %description -l en_US namespaces -> name spaces, name-spaces, names paces bubblewrap.x86_64: E: no-changelogname-tag bubblewrap.x86_64: E: missing-call-to-chdir-with-chroot /usr/bin/bwrap bubblewrap.x86_64: E: non-executable-script /usr/share/bash-completion/completions/bwrap 644 /bin/bash 2 packages and 0 specfiles checked; 4 errors, 2 warnings. Requires -------- bubblewrap-debuginfo (rpmlib, GLIBC filtered): bubblewrap (rpmlib, GLIBC filtered): libc.so.6()(64bit) libgcc_s.so.1()(64bit) libgcc_s.so.1(GCC_3.0)(64bit) libgcc_s.so.1(GCC_3.3.1)(64bit) libselinux.so.1()(64bit) rtld(GNU_HASH) Provides -------- bubblewrap-debuginfo: bubblewrap-debuginfo bubblewrap-debuginfo(x86-64) bubblewrap: bubblewrap bubblewrap(x86-64) Source checksums ---------------- https://github.com/projectatomic/bubblewrap/archive/f64a1917d13d9df8930fa5a767859b4e5328367f.tar.gz#/bubblewrap-f64a191.tar.gz : CHECKSUM(SHA256) this package : 390aa920bb948f6ed32e7559d6824d071976f759d26f2dca95dc4fa0007821a5 CHECKSUM(SHA256) upstream package : 390aa920bb948f6ed32e7559d6824d071976f759d26f2dca95dc4fa0007821a5 Generated by fedora-review 0.6.1 (f03e4e7) last change: 2016-05-02 Command line :/usr/bin/fedora-review -m fedora-rawhide-x86_64 --rpm-spec -n bubblewrap-0-1.fc25.src.rpm Buildroot used: fedora-rawhide-x86_64 Active plugins: Generic, Shell-api, C/C++ Disabled plugins: Java, Python, fonts, SugarActivity, Ocaml, Perl, Haskell, R, PHP Disabled flags: EXARCH, DISTTAG, EPEL5, BATCH, EPEL6
===== MUST items ===== C/C++: [x]: Package does not contain kernel modules. [x]: Package contains no static executables. Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [!]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "LGPL (v2 or later)", "Unknown or generated". 10 files have unknown license. Detailed output of licensecheck in /mnt/repositories/pkgs/review/bubblewrap/packaging/bubblewrap/licensecheck.txt Colin, looks like the COPYING file is a GPLv2 and not LGPLv2. Could you take a look please? [x]: License file installed when any subpackage combination is installed. [!]: Package must own all directories that it creates. Note: Directories without known owners: /usr/share/bash-completion, /usr/share/bash-completion/completions Think we'll need to own these dirs, though I feel bash dirs should be exempt from this. [x]: %build honors applicable compiler flags or justifies otherwise. [x]: Package contains no bundled libraries without FPC exception. [x]: Changelog in prescribed format. NOTE: No changelog yet, though this will be fixed when the package officially enters Fedora. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [x]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [x]: If the package is a rename of another package, proper Obsoletes and Provides are present. [x]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [-]: Package contains systemd file(s) if in need. [x]: Useful -debuginfo package or justification otherwise. [x]: Package is not known to require an ExcludeArch tag. [-]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 20480 bytes in 1 files. [x]: Package complies to the Packaging Guidelines
Hum? It's clearly LGPLv2. https://github.com/projectatomic/bubblewrap/blob/master/COPYING What is the output of /mnt/repositories/pkgs/review/bubblewrap/packaging/bubblewrap/licensecheck.txt ?
Regarding the bash completion dir...I dunno, shouldn't bash-completion own it? We have a lot of packages ignoring this right now anyways. (Aside: the whole rpm "directory ownership" thing is a truly ridiculous workaround for default yum/rpm combo to clean things up without lots of hand holding. It's one of several problems rpm-ostree doesn't have.)
(In reply to Colin Walters from comment #9) > Hum? It's clearly LGPLv2. > https://github.com/projectatomic/bubblewrap/blob/master/COPYING I see that source files do mention LGPLv2, but the COPYING file has this on top: "GNU LIBRARY GENERAL PUBLIC LICENSE" > > What is the output of > /mnt/repositories/pkgs/review/bubblewrap/packaging/bubblewrap/licensecheck. > txt ? ------------------------------------------------------------------------------ LGPL (v2 or later) ------------------ bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/bind-mount.c bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/bind-mount.h bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/bubblewrap.c bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/network.c bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/network.h bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/utils.c bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/utils.h Unknown or generated -------------------- bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/.dir-locals.el bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/COPYING bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/LICENSE bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/README.md bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/autogen.sh bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/completions/bash/bwrap bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/demos/bubblewrap-shell.sh bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/demos/xdg-app-run.sh bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/tests/test-basic.sh bubblewrap-f64a1917d13d9df8930fa5a767859b4e5328367f/uncrustify.sh ------------------------------------------------------------------------------ RE: bash-completion ownership, we'll ignore it.
(In reply to Lokesh Mandvekar from comment #11) > (In reply to Colin Walters from comment #9) > > Hum? It's clearly LGPLv2. > > https://github.com/projectatomic/bubblewrap/blob/master/COPYING > > I see that source files do mention LGPLv2, but the COPYING file has this on > top: > > "GNU LIBRARY GENERAL PUBLIC LICENSE" That's the *L*GPL, note the LIBRARY. Although it is an older version - in version 2.1 they called it LESSER, not LIBRARY. But it's the same thing.
More info: https://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License#History https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
> bubblewrap.x86_64: E: non-executable-script /usr/share/bash-completion/completions/bwrap 644 /bin/bash remove shebang from there also own directory for completions.
(In reply to Colin Walters from comment #13) > More info: > > https://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License#History > https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html Thanks, I wasn't aware it was originally called Library. (In reply to Igor Gnatenko from comment #14) > > bubblewrap.x86_64: E: non-executable-script /usr/share/bash-completion/completions/bwrap 644 /bin/bash > > remove shebang from there Ah yes, agreed. > > also own directory for completions. Since /usr/share/bash-completion is owned by dnf (and bash-completion of course), I really think we should start exempting this requirement. Just like packages don't own /usr/lib/systemd/system. Let me know if you think otherwise. Approving bubblewrap.
Package request has been approved: https://admin.fedoraproject.org/pkgdb/package/rpms/bubblewrap