Bug 1467052 - Review Request: gnome-password-generator - Graphical secure password generator
Review Request: gnome-password-generator - Graphical secure password generator
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: Package Review (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: Björn "besser82" Esser
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-07-02 05:41 EDT by Julien Enselme
Modified: 2017-07-17 00:51 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-07-17 00:51:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
besser82: fedora‑review+


Attachments (Terms of Use)

  None (edit)
Description Julien Enselme 2017-07-02 05:41:58 EDT
Spec URL: https://dl.jujens.eu/SPECS/gnome-password-generator.spec
SRPM URL: https://dl.jujens.eu/SRPMS/gnome-password-generator-2.0.0-1.git0436b6d.fc26.src.rpm
Description:
Gnome Password Generator is a GUI based secure password generator. It allows
the user to generate a specified number of random passwords of a specified
length.

Disclaimer: I am the new upstream maintainer of gnome-password-manager
Comment 1 Iwicki Artur 2017-07-02 06:41:10 EDT
>Release: 1.git%{shortcommit}%{dist}
I believe this could cause problems if you want to update the package and the new commit shorthash turns out to be something that alphabetically comes before the old hash. Either way, the versioning guidelines say that for snapshots, the Release: tag must contain a date.
https://fedoraproject.org/wiki/Packaging:Versioning#Snapshots

Also, the %{dist} tag should be %{?dist} (with a question mark).
Comment 2 Julien Enselme 2017-07-02 07:37:26 EDT
> I believe this could cause problems if you want to update the package and the new commit shorthash turns out to be something that alphabetically comes before the old hash.

I don't think so since the release number will increase (eg from 1 to 2). From my experience, this works fine. I maintain and use several packages that use this scheme and it works fine.

> Either way, the versioning guidelines say that for snapshots, the Release: tag must contain a date.

It does. It also states for snapshot "An archive taken from upstream's source code control system which is not associated with any release version." Whereas here, it is associated to a version (2.0.0 to be precise). Does it apply in this case? I tried to find a page explaining how release should be made when we take the sources from github but didn't find any. I though there was one. Do you have more info on this?

> Also, the %{dist} tag should be %{?dist} (with a question mark).

True. Fixed.

- SPRM Url: https://dl.jujens.eu/SRPMS/gnome-password-generator-2.0.0-2.git0436b6d.fc26.src.rpm
- SPEC Url: https://dl.jujens.eu/SPECS/gnome-password-generator.spec
Comment 3 Zbigniew Jędrzejewski-Szmek 2017-07-02 18:27:36 EDT
appdata? [https://fedoraproject.org/wiki/Packaging:AppData]

make all → %make_build
make install DESTDIR=%{buildroot} → %make_install

> I tried to find a page explaining how release should be made when we take the sources from github but didn't find any.

I think your current versioning is OK. As long as you bump the release number, there is no ambiguity.
Comment 4 Vít Ondruch 2017-07-03 06:09:19 EDT
(In reply to Julien Enselme from comment #2)
> > Either way, the versioning guidelines say that for snapshots, the Release: tag must contain a date.
> 
> It does. It also states for snapshot "An archive taken from upstream's
> source code control system which is not associated with any release
> version." Whereas here, it is associated to a version (2.0.0 to be precise).
> Does it apply in this case? I tried to find a page explaining how release
> should be made when we take the sources from github but didn't find any. I
> though there was one. Do you have more info on this?

Is this the guideline you are looking for?

https://fedoraproject.org/wiki/Packaging:SourceURL#Git_Tags
Comment 5 Björn "besser82" Esser 2017-07-03 07:29:13 EDT
(In reply to Julien Enselme from comment #2)
> It does. It also states for snapshot "An archive taken from upstream's
> source code control system which is not associated with any release
> version." Whereas here, it is associated to a version (2.0.0 to be precise).
> Does it apply in this case? I tried to find a page explaining how release
> should be made when we take the sources from github but didn't find any. I
> though there was one. Do you have more info on this?

If it is a associated to release version (git tag), then you do not need any specific additions to the release-version:


Name:           foo
Version:        X.Y.Z
Release:        1%{?dist}

URL:            https://github.com/some_upstream/%{name}
Source0:        %{url}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz


It's pretty much the same way as with any other release-tarball, but if you are packaging from an arbitrary snapshot:


%global commit 1234567890abcdef0987654321
%global shortcommit %(c=%{commit}; echo ${c:0:7})
%global commit_date YYYYMMDD
%global git_ver git%{commit_date}.%{shortcommit}
%global git_rel .%{git_ver}


Name:           foo
Version:        X.Y.Z
Release:        0.1%{?git_rel}%{?dist}

URL:            https://github.com/some_upstream/%{name}
Source0:        %{url}/commit/%{commit}.tar.gz#/%{name}-%{version}-%{git_ver}.tar.gz


I hope, I could clarify this a bit…
Comment 6 Julien Enselme 2017-07-03 14:41:39 EDT
>_appdata? [https://fedoraproject.org/wiki/Packaging:AppData]

Added, thanks.

> make all → %make_build
> make install DESTDIR=%{buildroot} → %make_install

Fixed, thanks.


> Is this the guideline you are looking for?

Yes, thanks.

@ Björn "besser82" Esser

Thanks for your explanation.

SPEC Url: https://dl.jujens.eu/SPECS/gnome-password-generator.spec
SRPM URL: https://dl.jujens.eu/SRPMS/gnome-password-generator-2.0.1-1.fc26.src.rpm
Comment 7 Björn "besser82" Esser 2017-07-05 06:57:54 EDT
Some remarks on the spec file:

* You are using `github_name` macro, although it seems `%github_name == %name`.
  This could be simplified, I think…

* `%setup -qn %{github_name}-%{version}`:  The %setup-macro shoud not be used
  anymore, execept you need to handle applying patches in a custom way.  Using
  `%autosetup -p 1` is the preferred way now.

* `install -m0644` should be `install -pm0644` to preserve timestamps.

* You can create all needed dirs in a row within one invokation of `mkdir -p`:

  mkdir -p %{buildroot}%{_datadir}/appdata \
           %{buildroot}%{_datadir}/icons/hicolor/{96x96,scalable}/apps

* `%doc AUTHORS` should be `%license AUTHORS`, since AUTHORS is information that
  has a strong connection with licensing.

* You might want to strip some 10 years old information from %changelog…


***


Detailed review report will follow soon…
Comment 8 Björn "besser82" Esser 2017-07-05 08:33:07 EDT
Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated


Issues:
=======
- Package does not use a name that already exists.
  Note: A package with this name already exists. Please check
  https://admin.fedoraproject.org/pkgdb/package/gnome-password-generator
  See:
  https://fedoraproject.org/wiki/Packaging/NamingGuidelines#Conflicting_Package_Names

  --->  This is an un-retirement review, so it is to be expected there's
        already the same package present.

- Desktop-file-install adds vendorization.

  ---> This was banned from Fedora about 4 years ago.
       See: https://pagure.io/fesco/issue/1077

- Installed appdata files must be validated.

  ---> https://fedoraproject.org/wiki/Packaging:AppData#app-data-validate_usage


===== MUST items =====

Generic:
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.
[x]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "GPL (v2 or later)", "Unknown or generated". 12 files have
     unknown license. Detailed output of licensecheck in
     /home/besser82/vm_shared/fedora/review/1467052-gnome-password-
     generator/licensecheck.txt
[x]: Package contains no bundled libraries without FPC exception.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[-]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
     names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[-]: Package contains systemd file(s) if in need.
[x]: gtk-update-icon-cache is invoked in %postun and %posttrans if package
     contains icons.
     Note: icons in gnome-password-generator

     ---> Scriptlets are fine.

[x]: Package is not known to require an ExcludeArch tag.
[-]: Large documentation must go in a -doc subpackage. Large could be size
     (~1MB) or number of files.
     Note: Documentation size is 10240 bytes in 4 files.
[!]: Package complies to the Packaging Guidelines

     ---> Issues are present.

[x]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: If (and only if) the source package includes the text of the
     license(s) in its own file, then that file, containing the text of the
     license(s) for the package is included in %license.
[x]: Package requires other packages for directories it uses.
[x]: Package must own all directories that it creates.
[x]: Package does not own files or directories owned by other packages.
[x]: All build dependencies are listed in BuildRequires, except for any
     that are listed in the exceptions section of Packaging Guidelines.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Package contains desktop file if it is a GUI application.
[x]: Package installs a %{name}.desktop using desktop-file-install or
     desktop-file-validate if there is such a file.
[x]: Dist tag is present.
[x]: Package does not contain duplicates in %files.
[x]: Permissions on files are set properly.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Packages must not store files under /srv, /opt or /usr/local


===== SHOULD items =====

Generic:
[-]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[x]: Package functions as described.
[x]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[-]: Description and summary sections in the package spec file contains
     translations for supported Non-English languages, if available.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[-]: %check is present and all tests pass.
[!]: Packages should try to preserve timestamps of original installed
     files.

     ---> Timestamps are not preserved, neither by Makefile, nor when
          invoking install from spec file.

[x]: Reviewer should test that the package builds in mock.
[x]: Buildroot is not present
[x]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: SourceX is a working URL.
[x]: Spec use %global instead of %define unless justified.


===== EXTRA items =====

Generic:
[x]: Rpmlint is run on all installed packages.
     Note: There are rpmlint messages (see attachment).
[x]: Spec file according to URL is the same as in SRPM.


Rpmlint
-------
Checking: gnome-password-generator-2.0.1-1.fc27.noarch.rpm
          gnome-password-generator-2.0.1-1.fc27.src.rpm
gnome-password-generator.noarch: W: no-manual-page-for-binary gnome-password-generator
2 packages and 0 specfiles checked; 0 errors, 1 warnings.


Rpmlint (installed packages)
----------------------------
sh: /usr/bin/python: No such file or directory
gnome-password-generator.noarch: W: no-manual-page-for-binary gnome-password-generator
1 packages and 0 specfiles checked; 0 errors, 1 warnings.


Requires
--------
gnome-password-generator (rpmlib, GLIBC filtered):
    /bin/sh
    /usr/bin/python3
    hicolor-icon-theme
    python3-gobject


Provides
--------
gnome-password-generator:
    appdata()
    appdata(gnome-password-generator.appdata.xml)
    application()
    application(gnome-password-generator.desktop)
    gnome-password-generator


Source checksums
----------------
https://github.com/Jenselme/gnome-password-generator/archive/v2.0.1/gnome-password-generator-2.0.1.tar.gz :
  CHECKSUM(SHA256) this package     : b077b4ba9571738aa1976d9d4a6e17412e883392b872b786edd715dc48e9e472
  CHECKSUM(SHA256) upstream package : b077b4ba9571738aa1976d9d4a6e17412e883392b872b786edd715dc48e9e472


Generated by fedora-review 0.6.1 (f03e4e7) last change: 2016-05-02
Command line :/usr/bin/fedora-review -m fedora-rawhide-x86_64 -b 1467052
Buildroot used: fedora-rawhide-x86_64
Active plugins: Generic, Shell-api
Disabled plugins: Java, C/C++, Python, fonts, SugarActivity, Ocaml, Perl, Haskell, R, PHP, Ruby
Disabled flags: EXARCH, DISTTAG, EPEL5, BATCH, EPEL6


===== Solution =====

NOT approved.


===== Additional information =====

You should add a %check section running `desktop-file-validate %{buildroot}/%{_datadir}/applications/*.desktop` (as desktop file is installed from Makefile) and `appstream-util validate-relax --nonet %{buildroot}/%{_datadir}/appdata/*.appdata.xml`.  You can drop `desktop-file-install` from %install section then.

Maybe you want to consider my previous comments and merge my pull request on github, release another version and update your package to this.
Comment 9 Julien Enselme 2017-07-05 13:42:25 EDT
Thanks for you contribution. See my comment on the PR for the AUTHORS file.

Spec updated. Normally, all your issues are fixed.

SPEC URL: https://dl.jujens.eu/SPECS/gnome-password-generator.spec
SRPM URL: https://dl.jujens.eu/SRPMS/gnome-password-generator-2.0.3-1.fc26.src.rpm
Comment 10 Julien Enselme 2017-07-05 13:48:13 EDT
Update to 2.0.4

SRPM URL: https://dl.jujens.eu/SRPMS/gnome-password-generator-2.0.4-1.fc26.src.rpm
Comment 11 Björn "besser82" Esser 2017-07-05 14:10:01 EDT
Three things that caught my eyes:

* You missed to add:
  `desktop-file-validate %{buildroot}/%{_datadir}/applications/*.desktop`
  in the %check section.

* You can remove the install cmd in %install section, which creates the
  directories;  the Makefile handles this now.

* You are using %license with two files in a line and %doc with one file
  per line.  Technically this is correct, I'd just fix it for the matter of
  keeping the same style across the spec file.


***


Anyways, those are no real blockers and you can fix them during import.

Package APPROVED!
Comment 12 Julien Enselme 2017-07-05 16:59:41 EDT
Thanks for the review. I have just corrected my SPEC file to correct the last 3 issues (same link as before).
Comment 13 Björn "besser82" Esser 2017-07-05 17:02:00 EDT
Allrighty,  you forgot to remove the `mkdir` in %install, but that doesn't hurt, it's just superfluous, since %make_install would create them anyways…  ;)
Comment 14 Julien Enselme 2017-07-06 13:05:13 EDT
> you forgot to remove the `mkdir` in %install, but that doesn't hurt, it's just superfluous, since %make_install would create them anyways…  ;)

I really thought I did it. Really fixed for import.
Comment 15 Fedora Update System 2017-07-06 16:45:56 EDT
gnome-password-generator-2.0.4-3.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-58751e422c
Comment 16 Fedora Update System 2017-07-08 22:52:54 EDT
gnome-password-generator-2.0.4-3.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-58751e422c
Comment 17 Fedora Update System 2017-07-17 00:51:28 EDT
gnome-password-generator-2.0.4-3.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.