Bug 1945159 - Review Request: rizin - reverse engineering framework, fork of radare2
Summary: Review Request: rizin - reverse engineering framework, fork of radare2
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zbigniew Jędrzejewski-Szmek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1929231
TreeView+ depends on / blocked
 
Reported: 2021-03-31 12:46 UTC by Riccardo Schirone
Modified: 2021-05-04 14:33 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-04 14:33:11 UTC
Type: ---
Embargoed:
zbyszek: fedora-review+


Attachments (Terms of Use)

Description Riccardo Schirone 2021-03-31 12:46:49 UTC
Spec URL: https://raw.githubusercontent.com/ret2libc/rizin-specs-fedora/master/rizin.spec
SRPM URL: https://github.com/ret2libc/rizin-specs-fedora/raw/master/rizin-0.1.2-1.fc33.src.rpm

Description:
Rizin is a free and open-source Reverse Engineering framework, providing a complete binary analysis experience with features like Disassembler, Hexadecimal editor, Emulation, Binary inspection, Debugger, and more.

Rizin is a fork of radare2 with a focus on usability, working features and code cleanliness.


Fedora Account System Username: ret2libc

Comment 1 Riccardo Schirone 2021-03-31 12:49:13 UTC
For the licenses part, with the new release 0.2.0 that is probably going out quite soon, we have switched almost all files to SPDX and I'll be able to generate better reports which specify how each file is licensed.

Comment 2 Zbigniew Jędrzejewski-Szmek 2021-04-01 06:43:13 UTC
(In reply to Riccardo Schirone from comment #1)
> For the licenses part, with the new release 0.2.0 that is probably going out
> quite soon, we have switched almost all files to SPDX and I'll be able to
> generate better reports which specify how each file is licensed.

Maybe try https://github.com/keszybz/repo-license-summary and tell me if it works for you\
(a shameless plug).

Comment 3 Zbigniew Jędrzejewski-Szmek 2021-04-01 06:53:43 UTC
License:        LGPLv3+ and GPLv2+ and BSD and MIT and ASL 2.0 and MPLv2.0 and zlib
# Rizin as a package is targeting to be licensed/compiled as LGPLv3+
# however during build for Fedora the GPL code is not omitted so effectively it
# is GPLv2+.

Please be aware that the License field describes the binary package, not the sources
[https://fedoraproject.org/wiki/Licensing:FAQ#Does_the_License:_tag_cover_the_SRPM_or_the_binary_RPM.3F].
And if sources with "permissive" licenses are mixed with GPL in a single binary, then the effective
license is most likely GPLv2. So maybe this license list can be simplified?

Comment 4 Zbigniew Jędrzejewski-Szmek 2021-04-01 10:24:45 UTC
+ package name is OK
+ license is acceptable (a mix, as discussed above)
? license is specified correctly:

  Not sure about this one. As mentioned above, I strongly suspect it can be simplified.
  Over-specifying the license is not a very big issue… If it's the last issue remaining,
  I think we can proceed with the package, and maybe fix that later.

+ builds and installs correctly
+ fedora-review doesn't find any issues
+ R/P/BR look correct

  Specifying all the versions of the bundled provides is the righteous thing to do, and
  what the guidelines recommend. Nevertheless, with some many items, keeping this updated 
  is going to be chore. Additional motivation to unbundle ;)

rpmlint:
rizin.src:120: W: setup-not-quiet
Oh, you need -q so that a list of files is not printed. Seems reasonable to add that.

rizin.x86_64: W: shared-lib-calls-exit /usr/lib64/librz_core.so.0.1.2 exit.5
rizin.x86_64: W: shared-lib-calls-exit /usr/lib64/librz_crypto.so.0.1.2 exit.5
rizin.x86_64: W: shared-lib-calls-exit /usr/lib64/librz_egg.so.0.1.2 exit.5
rizin.x86_64: W: shared-lib-calls-exit /usr/lib64/librz_main.so.0.1.2 exit.5
rizin.x86_64: W: shared-lib-calls-exit /usr/lib64/librz_socket.so.0.1.2 exit.5
Libraries should not called exit… Unless it's a false positive, seems like an upstream bug.

rizin.x86_64: W: no-manual-page-for-binary rz-sign
rizin-common.noarch: W: no-documentation
rizin-devel.x86_64: W: no-documentation
6 packages and 0 specfiles checked; 0 errors, 10 warnings.

In -devel, files are under /usr/include/librz/. And in general, everything is either in private directories
or namespaced under "rz_" / "rz-" / "librz_", so there should be no conflicts.

Package is APPROVED.

Comment 5 Gwyn Ciesla 2021-04-01 15:03:40 UTC
(fedscm-admin):  The Pagure repository was created at https://src.fedoraproject.org/rpms/rizin

Comment 6 Mamoru TASAKA 2021-05-04 14:33:11 UTC
This package is already in distribution.


Note You need to log in before you can comment on or make changes to this bug.