Bug 1372785 - Review Request: EPEL7 ONLY python3-pyOpenSSL- a python3x build of the pyOpenSSL included in the base distro
Summary: Review Request: EPEL7 ONLY python3-pyOpenSSL- a python3x build of the pyOpen...
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Orion Poplawski
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2016-09-02 16:42 UTC by Jim Perrin
Modified: 2019-04-26 06:19 UTC (History)
4 users (show)

Fixed In Version: python3-pyOpenSSL-17.3.0-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2019-04-26 04:22:49 UTC
Type: ---
orion: fedora-review?

Attachments (Terms of Use)

Description Jim Perrin 2016-09-02 16:42:09 UTC
Spec URL: https://people.centos.org/jperrin/python-pyOpenSSL/python-pyOpenSSL.spec
SRPM URL: https://people.centos.org/jperrin/python-pyOpenSSL/python34-pyOpenSSL-0.13.1-3.el7.src.rpm
Description: This package builds pyOpenSSL for the python3x(currently python34) included in EPEL. It is based on the pyOpenSSL package included in the base distribution, but does not conflict with or override it. 
Fedora Account System Username: jperrin

Comment 1 Orion Poplawski 2016-09-02 17:11:21 UTC
Some comments:

- This needs to be named python3-pyOpenSSL, and don't use python3_pkgversion in the Name field.  Make a %package entry for it.
- python3_pkgversion macros are in Fedora
- Your filtering is way out of date, and may no longer be needed.  See https://fedoraproject.org/wiki/Packaging:AutoProvidesAndRequiresFiltering if it is.
- don't use py3dir, that's old and deprecated and not needed here.
- use %py3_build, %py3_install, etc from current python packaging guidelines.
- no license file?

Comment 2 Jim Perrin 2016-09-08 13:04:27 UTC
Thanks for taking a look at this. 

It's reasonably minimal editing from the base el7 pyOpenSSL src.rpm, so I take no responsibility for the lack of license file. If it's in the el7 srpm, I'll see about making sure it's not deleted. Please keep in mind this is for EPEL only, so not all the fedora enhancements are available. That said, I'll work through your suggestions.

Comment 3 Jim Perrin 2016-09-08 20:11:55 UTC
Changes made, updated spec and packages are now in https://people.centos.org/jperrin/python3-pyOpenSSL/

if you'd care to take another look.

Comment 4 Orion Poplawski 2016-09-08 23:01:49 UTC
I'm resetting the product to Fedora, because you can't sync to a Fedora EPEL bug in pkgdb when you go to add the component.

Package Review

[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated
[ ] = Manual review needed

- Permissions on files are set properly.
  Note: See rpmlint output
  See: http://fedoraproject.org/wiki/Packaging/Guidelines#FilePermissions
- Non UTF-8 file
- Latest is 0.14
- Are there tests that can be run?
- You shouldn't need BR python-devel.
- You really don't need to conditionally define python3_pkgversion - it's defined everywhere, and this in an EPEL only package anyway.
- There are no comments with the patches indicating what they do or linking to any upstream bug reports
- doc sub-package needs %license 
- Update the URL

===== MUST items =====

[-]: Package does not contain kernel modules.
[-]: Package contains no static executables.
[x]: Development (unversioned) .so files in -devel subpackage, if present.
     Note: Unversioned so-files in private %_libdir subdirectory (see
     attachment). Verify they are not in ld path.
[x]: Package does not contain any libtool archives (.la)
[x]: Rpath absent or only used for internal libs.

[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
[x]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "Unknown or generated", "*No copyright* Public domain". 78
     files have unknown license. Detailed output of licensecheck in
[!]: License file installed when any subpackage combination is installed.
[x]: Package requires other packages for directories it uses.
[x]: Package must own all directories that it creates.
[x]: %build honors applicable compiler flags or justifies otherwise.
[x]: Package contains no bundled libraries without FPC exception.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[-]: Package contains desktop file if it is a GUI application.
[-]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[-]: Package contains systemd file(s) if in need.
[x]: Useful -debuginfo package or justification otherwise.
[x]: Package is not known to require an ExcludeArch tag.
[x]: Package complies to the Packaging Guidelines
[x]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: If (and only if) the source package includes the text of the
     license(s) in its own file, then that file, containing the text of the
     license(s) for the package is included in %license.
[x]: Package does not own files or directories owned by other packages.
[x]: All build dependencies are listed in BuildRequires, except for any
     that are listed in the exceptions section of Packaging Guidelines.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Dist tag is present.
[x]: Package does not contain duplicates in %files.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
[x]: Package is named using only allowed ASCII characters.
[x]: Package does not use a name that already exists.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
[x]: File names are valid UTF-8.
[x]: Large documentation must go in a -doc subpackage. Large could be size
     (~1MB) or number of files.
     Note: Documentation size is 0 bytes in 0 files.
[x]: Packages must not store files under /srv, /opt or /usr/local

[x]: Python eggs must not download any dependencies during the build
[x]: A package which is used by another package via an egg interface should
     provide egg info.
[x]: Package meets the Packaging Guidelines::Python
[x]: Binary eggs must be removed in %prep

===== SHOULD items =====

[-]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[x]: Fully versioned dependency in subpackages if applicable.
[x]: Package functions as described.
[!]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[!]: Patches link to upstream bugs/comments/lists or are otherwise
[-]: Description and summary sections in the package spec file contains
     translations for supported Non-English languages, if available.
[x]: Package should compile and build into binary rpms on all supported
[!]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: Reviewer should test that the package builds in mock.
[x]: Buildroot is not present
[x]: Package has no %clean section with rm -rf %{buildroot} (or
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: SourceX is a working URL.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

[x]: Rpmlint is run on debuginfo package(s).
     Note: No rpmlint messages.
[x]: Rpmlint is run on all installed packages.
     Note: There are rpmlint messages (see attachment).
[x]: Large data in /usr/share should live in a noarch subpackage if package
     is arched.
[x]: Spec file according to URL is the same as in SRPM.

Checking: python34-pyOpenSSL-0.13.1-4.el7.x86_64.rpm
python34-pyOpenSSL.x86_64: W: no-documentation
python34-pyOpenSSL.x86_64: E: non-standard-executable-perm /usr/lib64/python3.4/site-packages/OpenSSL/SSL.cpython-34m.so 0775L
python34-pyOpenSSL.x86_64: E: non-standard-executable-perm /usr/lib64/python3.4/site-packages/OpenSSL/rand.cpython-34m.so 0775L
python34-pyOpenSSL.x86_64: E: non-standard-executable-perm /usr/lib64/python3.4/site-packages/OpenSSL/crypto.cpython-34m.so 0775L
python34-pyOpenSSL-doc.noarch: W: file-not-utf8 /usr/share/doc/python34-pyOpenSSL-doc-0.13.1/pyOpenSSL.tex

Rpmlint (debuginfo)
Checking: python3-pyOpenSSL-debuginfo-0.13.1-4.el7.x86_64.rpm
1 packages and 0 specfiles checked; 0 errors, 0 warnings.

Rpmlint (installed packages)
python34-pyOpenSSL-doc.noarch: W: file-not-utf8 /usr/share/doc/python34-pyOpenSSL-doc-0.13.1/pyOpenSSL.tex
python34-pyOpenSSL.x86_64: W: no-documentation
python34-pyOpenSSL.x86_64: E: non-standard-executable-perm /usr/lib64/python3.4/site-packages/OpenSSL/SSL.cpython-34m.so 0775L
python34-pyOpenSSL.x86_64: E: non-standard-executable-perm /usr/lib64/python3.4/site-packages/OpenSSL/rand.cpython-34m.so 0775L
python34-pyOpenSSL.x86_64: E: non-standard-executable-perm /usr/lib64/python3.4/site-packages/OpenSSL/crypto.cpython-34m.so 0775L

python34-pyOpenSSL-doc (rpmlib, GLIBC filtered):

python34-pyOpenSSL (rpmlib, GLIBC filtered):



Unversioned so-files
python34-pyOpenSSL: /usr/lib64/python3.4/site-packages/OpenSSL/SSL.cpython-34m.so
python34-pyOpenSSL: /usr/lib64/python3.4/site-packages/OpenSSL/crypto.cpython-34m.so
python34-pyOpenSSL: /usr/lib64/python3.4/site-packages/OpenSSL/rand.cpython-34m.so

Source checksums
http://pypi.python.org/packages/source/p/pyOpenSSL/pyOpenSSL-0.13.1.tar.gz :
  CHECKSUM(SHA256) this package     : ba06ec710414f6dfe5566ec24c81882547c3e6fc48458d64315b73a0d5142fdb
  CHECKSUM(SHA256) upstream package : ba06ec710414f6dfe5566ec24c81882547c3e6fc48458d64315b73a0d5142fdb

Generated by fedora-review 0.5.3 (bcf15e3) last change: 2015-05-04
Command line :/usr/bin/fedora-review -n python3-pyOpenSSL -m epel-7-x86_64
Buildroot used: epel-7-x86_64
Active plugins: Python, Generic, Shell-api, C/C++
Disabled plugins: Java, SugarActivity, fonts, Haskell, Ocaml, Perl, R, PHP, Ruby

Comment 5 Orion Poplawski 2016-09-08 23:09:12 UTC
actually the latest is 16.1.0.

Comment 6 Jim Perrin 2016-09-08 23:15:15 UTC
Correct. I was intentionally matching what available for python 2.x in the base distro (and initially starting from that srpm). I wanted to keep the features/function consistent between the two. If we want to say that "python3 is newer and so the tooling should be newer" I could certainly be convinced.

Comment 7 Orion Poplawski 2016-09-09 03:20:14 UTC
It's definitely a bit of a mixed bag (especially since some packages are python3 only like this one and some are mixed) - but for the most part we've been treating the python3 stack in EPEL7 as completely separate and taking the opportunity to update versions.  It probably makes sense to take a look at what would be making use of it to help guide choosing the appropriate version to package, but I would learn towards packaging newer rather than older.

Comment 8 Jim Perrin 2016-09-12 19:10:16 UTC
The newer version (16.1.0) has some updated BuildRequires that I need to work through. Would it be possible to proceed with the current el7 version, and I'll work to bump to the newer version afterward?

Comment 9 Orion Poplawski 2016-09-12 19:34:10 UTC
The trick is that we need to maintain API stability in EPEL.  No idea how well pyOpenSSL does with that.  So it's worth some thought as to what version goes in initially.

Comment 10 Jim Perrin 2016-09-13 14:44:52 UTC
Okay. In order to do this, we'll need a python3-cryptography package. python-cryptography is tagged for epel7, but is also a base package. What would you recommend to move forward? Adapting the existing python-cryptography to only produce a python34-* package, or creating a new package entirely, as I'm working to do with python3-pyOpenSSL?

Comment 11 Orion Poplawski 2016-09-13 14:51:23 UTC
We will need a separate python3-cryptography package just like you are doing for python3-PyOpenSSL.

Comment 12 Orion Poplawski 2018-01-31 23:47:53 UTC
So, python3-cryptography 1.7.2 is now in EPEL7.  So we can get 17.0.0 in.  If we update it to 1.9 we could get in 17.3.0, see bug #1540756.


Comment 13 Orion Poplawski 2018-11-16 18:11:34 UTC
Ping - Jim are you still interested in this?

Comment 14 Jim Perrin 2018-11-16 18:53:17 UTC
Nope. I no longer have a need for this.

Comment 15 Dag Heyman 2019-04-24 12:59:44 UTC
I'm very much interested in a python36-pyopenssl package for EPEL.

Comment 16 Dag Heyman 2019-04-25 11:04:46 UTC
To clarify my statement above, I'm interested in this because I'm investigating packaging yubikey-manager for CentOS 7, and pyopenssl is a dependency of that project.

Comment 17 Orion Poplawski 2019-04-26 04:22:49 UTC
I pushed this to EPEL7 a while back, but never closed this.  I also was working on yubikey-manager for EL7 - which I forgot to build for EPEL7 once I could (just had a local version).  Submitted an update now:


Comment 18 Dag Heyman 2019-04-26 06:19:19 UTC
Oh, that's great. Thanks.

Note You need to log in before you can comment on or make changes to this bug.