Spec URL: https://github.com/hargoniX/openiked-copr/blob/master/openiked.spec SRPM URL: https://github.com/hargoniX/openiked-copr/blob/master/openiked.spec Description: OpenIKED is a free, permissively licensed Internet Key Exchange (IKEv2) implementation, developed as part of the OpenBSD project. It is intended to be a lean, secure and interoperable daemon that allows for easy setup and management of IPsec VPNs. Fedora Account System Username: hargonix I have a little question as well, I tried to build the SRPM here https://koji.fedoraproject.org/koji/taskinfo?taskID=68718747 but the thing failed with: error: line 20: Unknown tag: %systemd_requires However according to these docs: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/ this tag should be known (and it builds locally for me as well) so I'm slightly confused as to whether this is a bug on my side or on the build system? Furthermore as you can see I am downloading the .asc signature from the OpenBSD FTP servers but I'm not qutie sure as to how to verify them, I saw in the OpenSSH package that it is verified using some GPG key but I didn't exactly get where that GPG key is coming from. The idea with the openiked-keygen service is taken over from the OpenSSH package. Large parts of the installation process are also taken from here: https://github.com/openiked/openiked-arch-linux which is made by the official maintainer of iked-portable.
- BuildArch: x86_64 aarch64 BuildArch is not for this, you should use ExclusiveArch: ExclusiveArch: x86_64 aarch64 Also you should justify why you can't build on other arches. - Splitting one BR per line is preferred: BuildRequires: cmake BuildRequires: libevent-devel BuildRequires: openssl-devel BuildRequires: byacc BuildRequires: clang BuildRequires: systemd-rpm-macros - This is not necessary: Requires: libevent openssl It is automatically detected. - You are trying to to build with Clang: by default gcc is the Fedora compiler of choice. Only if you can't build with GCC you should use Clang. In that case, use: %global toolchain clang so that the Fedora default build flags for Clang are set up. Here since you haven't specified that, the build is performed with gcc. So you should BR gcc instead of Clang. - This is not required; %systemd_requires %{?sysusers_requires_compat} - You also need the following scriptlet in %preun: %preun %systemd_preun openiked.service - %attr(0755,root,root) and %attr(0644,root,root), should not be used, the default values are enough. Only keep %attr(0600,root,root) and %attr(0700,root,root) are they are specific. %files %license LICENSE %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/iked.conf %{_sbindir}/iked %{_sbindir}/ikectl %{_mandir}/man5/iked.conf.5.gz %{_mandir}/man8/ikectl.8.gz %{_mandir}/man8/iked.8.gz %{_unitdir}/openiked.service %{_sysusersdir}/openiked.conf %{_sysconfdir}/iked/ca %{_sysconfdir}/iked/certs %{_sysconfdir}/iked/crls %{_sysconfdir}/iked/pubkeys/ipv4 %{_sysconfdir}/iked/pubkeys/ipv6 %{_sysconfdir}/iked/pubkeys/fqdn %{_sysconfdir}/iked/pubkeys/ufqdn %attr(0700,root,root) %{_sysconfdir}/iked/private %{_libexecdir}/openiked/openiked-keygen %{_unitdir}/openiked-keygen.service %{_unitdir}/openiked-keygen.target - You could probably simplify that: %attr(0755,root,root) %{_sysconfdir}/iked/pubkeys/ipv4 %attr(0755,root,root) %{_sysconfdir}/iked/pubkeys/ipv6 %attr(0755,root,root) %{_sysconfdir}/iked/pubkeys/fqdn %attr(0755,root,root) %{_sysconfdir}/iked/pubkeys/ufqdn into %{_sysconfdir}/iked/pubkeys - Related to this, you do not own the following directories: Note: No known owner of /etc/iked/pubkeys, /usr/libexec/openiked, /etc/iked If you do the change above, you'll just need to add: %dir %{_sysconfdir}/iked/ %dir %{_libexecdir}/openiked/ Otherwise also add: %dir %{_sysconfdir}/iked/pubkeys - The extension for man pages should be globbed as the compression may change in the future. %{_mandir}/man5/iked.conf.5.* %{_mandir}/man8/ikectl.8.* %{_mandir}/man8/iked.8.* - Do not mix $RPM_BUILD_ROOT and %{buildroot}, choose only one and stick to it. - Shouldn't that be 755: install -p -D -m744 %{SOURCE4} $RPM_BUILD_ROOT/%{_libexecdir}/openiked/openiked-keygen - use install -p here too: install -p -m644 %{SOURCE5} $RPM_BUILD_ROOT/%{_unitdir}/openiked-keygen.service install -p -m644 %{SOURCE6} $RPM_BUILD_ROOT/%{_unitdir}/openiked-keygen.target - You download the asc as Source1 but never check the signature. The signature should be verified with OpenBSD signify utility but it is not packaged for Fedora. You could maybe drop the asc from the source. If not, please note that the asc must be uploaded to dit-git along with archive (fedpkg import will detect it, or don't forget to upload it with fedpkg new-sources). - You should write a Summary that describe what the package does, not simply mentioning that it is a OpenBSD port. Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated [ ] = Manual review needed Issues: ======= - Package uses either %{buildroot} or $RPM_BUILD_ROOT Note: Using both %{buildroot} and $RPM_BUILD_ROOT See: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_macros - systemd_post is invoked in %post, systemd_preun in %preun, and systemd_postun in %postun for Systemd service files. Note: Systemd service file(s) in openiked See: https://docs.fedoraproject.org/en-US/packaging- guidelines/Scriptlets/#_scriptlets ===== MUST items ===== C/C++: [x]: Package does not contain kernel modules. [x]: Package contains no static executables. [x]: If your application is a C or C++ application you must list a BuildRequires against gcc, gcc-c++ or clang. [x]: Header files in -devel subpackage, if present. [x]: Package does not contain any libtool archives (.la) [x]: Rpath absent or only used for internal libs. Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [x]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "ISC License", "*No copyright* ISC License", "Unknown or generated", "BSD 2-clause "Simplified" License", "ISC License BSD 2-clause "Simplified" License", "BSD 3-clause "New" or "Revised" License". 42 files have unknown license. Detailed output of licensecheck in /home/bob/packaging/review/openiked/review- openiked/licensecheck.txt [x]: License file installed when any subpackage combination is installed. [!]: Package requires other packages for directories it uses. Note: No known owner of /etc/iked/pubkeys, /usr/libexec/openiked, /etc/iked [x]: %build honors applicable compiler flags or justifies otherwise. [x]: Package contains no bundled libraries without FPC exception. [x]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [x]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [x]: Package contains systemd file(s) if in need. [x]: Useful -debuginfo package or justification otherwise. [x]: Package is not known to require an ExcludeArch tag. [x]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: Package does not own files or directories owned by other packages. [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 0 bytes in 0 files. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [-]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [x]: Final provides and requires are sane (see attachments). [?]: Package functions as described. [x]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [-]: Sources are verified with gpgverify first in %prep if upstream publishes signatures. Note: gpgverify is not used. [-]: Description and summary sections in the package spec file contains translations for supported Non-English languages, if available. [x]: Package should compile and build into binary rpms on all supported architectures. [x]: %check is present and all tests pass. [x]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Fully versioned dependency in subpackages if applicable. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on debuginfo package(s). Note: No rpmlint messages. [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Large data in /usr/share should live in a noarch subpackage if package is arched. [x]: Spec file according to URL is the same as in SRPM. Rpmlint ------- Checking: openiked-6.9.0-1.fc35.x86_64.rpm openiked-debuginfo-6.9.0-1.fc35.x86_64.rpm openiked-debugsource-6.9.0-1.fc35.x86_64.rpm openiked-6.9.0-1.fc35.src.rpm openiked.x86_64: E: explicit-lib-dependency libevent openiked.x86_64: W: name-repeated-in-summary C OpenIKED openiked.x86_64: W: spelling-error %description -l en_US interoperable -> inter operable, inter-operable, insuperable openiked.x86_64: E: non-readable /etc/iked.conf 600 openiked.src: W: name-repeated-in-summary C OpenIKED openiked.src: W: spelling-error %description -l en_US interoperable -> inter operable, inter-operable, insuperable 4 packages and 0 specfiles checked; 2 errors, 4 warnings.
I addressed the things you mentioned and published a new version here: - SRPM: https://github.com/hargoniX/openiked-copr/releases/download/rv2/openiked-6.9.0-1.fc34.src.rpm - Spec: https://github.com/hargoniX/openiked-copr/blob/master/openiked.spec
Package approved.
(fedscm-admin): The Pagure repository was created at https://src.fedoraproject.org/rpms/openiked
FEDORA-2021-c52fab53a9 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-c52fab53a9
FEDORA-2021-c52fab53a9 has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf install --enablerepo=updates-testing --advisory=FEDORA-2021-c52fab53a9 \*` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-c52fab53a9 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2021-c52fab53a9 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.