Bug 2012612 (perl-Authen-ModAuthPubTkt) - Review Request: perl-Authen-ModAuthPubTkt - Generate Tickets (Signed HTTP Cookies) for mod_auth_pubtkt protected websitesGenerate Tickets (Signed HTTP Cookies) for mod_auth_pubtkt protected websites
Summary: Review Request: perl-Authen-ModAuthPubTkt - Generate Tickets (Signed HTTP Coo...
Keywords:
Status: CLOSED ERRATA
Alias: perl-Authen-ModAuthPubTkt
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Petr Pisar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2013287
TreeView+ depends on / blocked
 
Reported: 2021-10-10 17:17 UTC by Robert-André Mauchin 🐧
Modified: 2022-01-19 02:11 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-01-19 01:53:55 UTC
Type: ---
Embargoed:
ppisar: fedora-review+


Attachments (Terms of Use)

Description Robert-André Mauchin 🐧 2021-10-10 17:17:22 UTC
Spec URL: https://eclipseo.fedorapeople.org/for-review/perl-Authen-ModAuthPubTkt.spec
SRPM URL: https://eclipseo.fedorapeople.org/for-review/perl-Authen-ModAuthPubTkt-0.1.1-1.fc36.src.rpm

Description:
This module generates and verify a mod_auth_pubtkt-compatible ticket string, which should be used as a cookie with the rest of the mod_auth_pubtkt ( https://neon1.net/mod_auth_pubtkt/ ) system.This module generates and verify a mod_auth_pubtkt-compatible ticket string, which should be used as a cookie with the rest of the mod_auth_pubtkt ( https://neon1.net/mod_auth_pubtkt/ ) system.

Fedora Account System Username: eclipseo

Comment 1 Petr Pisar 2021-10-27 14:22:38 UTC
URL and Source addresses are Ok.
TODO: I recommend you replace search.cpan.org URLs with metacpan.org. search.cpan.org is deprecated and redirects to MetaCPAN:
https://metacpan.org/dist/Authen-ModAuthPubTkt
https://cpan.metacpan.org/authors/id/A/AG/AGORDON/Authen-ModAuthPubTkt-%{version}.tar.gz

Source0 archive (SHA512: 4e99ee35f8c33f03182831478b2d00e184fd5f21e6c3f6413298479c9e127e584ec38abd9af328c764bb87c101b1490b38d7c60f684624df0159f4644b2875b0) is original. Ok.
Summary verified from lib/Authen/ModAuthPubTkt.pm. Ok.

Description verified from lib/Authen/ModAuthPubTkt.pm.
FIX: Replace "verify" with "verifies" in the description text.
TODO: You can also remove spaces between the "https://neon1.net/mod_auth_pubtkt/" address and the surrounding parentheses.

License verified from README, lib/Authen/ModAuthPubTkt.pm: "Apache License, same as the rest of mod_auth_pubtkt". That license <https://github.com/manuelkasper/mod_auth_pubtkt/blob/master/LICENSE> is "ASL 1.0".
License verified from META.json, Makefile.PL: perl_5. That is "GPL+ or Artistic".
FIX: Change the License tag to "ASL 1.0 and (GPL+ or Artistic)".
TODO: Please ask the software author for a clarification: The perl_5 in Makefile.PL is probably unintended. The "same as the rest of mod_auth_pubtkt" should be replaced with a license name. I cannot know which if the copies of mod_auth_pubtkt on the Internet the author refers to.
FATAL: ASL 1.0 license requires a copy of the license provided with the sources:

 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
[...]
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the Apache Group
 *    for use in the Apache HTTP server project (http://www.apache.org/)."

The software violates the license.
FIX: Report it to the author and wait for a new release you could package, or copy that license text as Source1 file in this package.

I will continue in this review once the license issue is fixed.

Comment 2 Robert-André Mauchin 🐧 2021-12-10 18:13:34 UTC
Thanks for your review, I have sent an inquiry upstream: https://github.com/agordon/Authen-ModAuthPubTkt/issues/1

Comment 6 Robert-André Mauchin 🐧 2022-01-08 16:27:54 UTC
Koji scratch build: https://koji.fedoraproject.org/koji/taskinfo?taskID=80992681

Comment 7 Robert-André Mauchin 🐧 2022-01-08 17:05:34 UTC
Hi @ppisar 

The author got back to me and relicensed the package as Perl.
I also fixed the tests which were not running because of a missing openssl dep.
Could you please continue this review?
Thank you.

Comment 8 Petr Pisar 2022-01-10 13:12:27 UTC
I will look at the new package.

Comment 9 Petr Pisar 2022-01-10 14:01:00 UTC
The standalone spec file and the spec file from the source RPM package differ. There is some rpmautospec cruft. I will use the standalone one because it does not contain a changelog broken by rpmautospec:

$ rpmbuild -ba perl-Authen-ModAuthPubTkt.spec 
error: bad date in %changelog: sam. janv. 08 2022 Robert-André Mauchin <zebob.m> 0.1.1-2
error: Failed build dependencies:
        perl(IPC::Run3) is needed by perl-Authen-ModAuthPubTkt-0.1.1-2.fc36.noarch

URL and Source0 addresses are usable. Ok.
TODO: Please change Source0 address to <https://cpan.metacpan.org/authors/id/A/AG/AGORDON/Authen-ModAuthPubTkt-0.1.1.tar.gz> as listed on the home page. Or at least change the protocol from HTTP to HTTPS.
Source archive (SHA-512: 4e99ee35f8c33f03182831478b2d00e184fd5f21e6c3f6413298479c9e127e584ec38abd9af328c764bb87c101b1490b38d7c60f684624df0159f4644b2875b0) is original. Ok.
Author changed a license to "GPL+ or Artistic" as documented in the patch and in the upstream's ticket. Ok.
Summary verified from lib/Authen/ModAuthPubTkt.pm. Ok.
Description verified from lib/Authen/ModAuthPubTkt.pm. Ok.
License verified from README, Makefile.PL, lib/Authen/ModAuthPubTkt.pm, and eg/mod_auth_pubtkt.pl. Ok.
No XS code, noarch BuildArch is Ok.
A dependency on openssl is Ok.

FIX: Build-require 'perl(Exporter)' (lib/Authen/ModAuthPubTkt.pm:2).
FIX: Build-require 'coreutils' (perl-Authen-ModAuthPubTkt.spec:48).

Test::CheckManifest not used. Ok.

All tests pass. Ok.

$ rpmlint perl-Authen-ModAuthPubTkt.spec ../SRPMS/perl-Authen-ModAuthPubTkt-0.1.1-1.fc36.src.rpm ../RPMS/noarch/perl-Authen-ModAuthPubTkt-0.1.1-1.fc36.noarch.rpm 
================================= rpmlint session starts =================================
rpmlint: 2.2.0
configuration:
    /usr/lib/python3.10/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/licenses.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
checks: 32, packages: 3

perl-Authen-ModAuthPubTkt.noarch: W: no-manual-page-for-binary mod_auth_pubtkt.pl
== 2 packages and 1 specfiles checked; 0 errors, 1 warnings, 0 badness; has taken 0.5 s ==
rpmlint is Ok.

$ rpm -q -lv -p ../RPMS/noarch/perl-Authen-ModAuthPubTkt-0.1.1-1.fc36.noarch.rpm 
-rwxr-xr-x    1 root     root                     4899 Jan 10 14:48 /usr/bin/mod_auth_pubtkt.pl
drwxr-xr-x    2 root     root                        0 Jan 10 14:48 /usr/share/doc/perl-Authen-ModAuthPubTkt
-rw-r--r--    1 root     root                       90 Jun 21  2012 /usr/share/doc/perl-Authen-ModAuthPubTkt/Changes
-rw-r--r--    1 root     root                     1019 Jun 21  2012 /usr/share/doc/perl-Authen-ModAuthPubTkt/META.json
-rw-r--r--    1 root     root                     6902 Jan 10 14:48 /usr/share/doc/perl-Authen-ModAuthPubTkt/README
-rw-r--r--    1 root     root                      130 Jun 21  2012 /usr/share/doc/perl-Authen-ModAuthPubTkt/ignore.txt
-rw-r--r--    1 root     root                     3896 Jan 10 14:48 /usr/share/man/man3/Authen::ModAuthPubTkt.3pm.gz
drwxr-xr-x    2 root     root                        0 Jan 10 14:48 /usr/share/perl5/vendor_perl/Authen
-rw-r--r--    1 root     root                    10601 Jan 10 14:48 /usr/share/perl5/vendor_perl/Authen/ModAuthPubTkt.pm
TODO: Do not package META.JSON and ignore.txt files. Those are not helpful for a user.

$ rpm -q --requires -p ../RPMS/noarch/perl-Authen-ModAuthPubTkt-0.1.1-1.fc36.noarch.rpm | sort -f | uniq -c
      1 /usr/bin/perl
      1 openssl
      1 perl(:MODULE_COMPAT_5.34.0)
      1 perl(Authen::ModAuthPubTkt)
      1 perl(Carp)
      1 perl(Exporter)
      1 perl(File::Basename)
      1 perl(File::Temp)
      1 perl(Getopt::Long)
      1 perl(IPC::Run3)
      1 perl(MIME::Base64)
      1 perl(strict)
      1 perl(warnings)
      1 rpmlib(CompressedFileNames) <= 3.0.4-1
      1 rpmlib(FileDigests) <= 4.6.0-1
      1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1
      1 rpmlib(PayloadIsZstd) <= 5.4.18-1
Binary requires are Ok.

$ rpm -q --provides -p ../RPMS/noarch/perl-Authen-ModAuthPubTkt-0.1.1-1.fc36.noarch.rpm | sort -f | uniq -c
      1 perl(Authen::ModAuthPubTkt) = 0.1.1
      1 perl-Authen-ModAuthPubTkt = 0.1.1-1.fc36
Binary provides are Ok.

$ resolvedeps rawhide ../RPMS/noarch/perl-Authen-ModAuthPubTkt-0.1.1-1.fc36.noarch.rpm 
Binary dependencies are resolvable. Ok.
The package builds in Fedora 36 <https://koji.fedoraproject.org/koji/taskinfo?taskID=81062780>. Ok.

Otherwise the package is in line with Fedora and Perl packaging guidelines.
Please correct the FIX items before building this package.
Resolution: Package APPROVED.

Comment 10 Robert-André Mauchin 🐧 2022-01-10 17:33:33 UTC
Thank you so much!

I have applied the requested change and will be building it like this:

New Spec URL: https://eclipseo.fedorapeople.org/for-review/perl-Authen-ModAuthPubTkt.spec
New SRPM URL: https://eclipseo.fedorapeople.org/for-review/perl-Authen-ModAuthPubTkt-0.1.1-2.fc36.src.rpm

Comment 11 Gwyn Ciesla 2022-01-10 18:02:15 UTC
(fedscm-admin):  The Pagure repository was created at https://src.fedoraproject.org/rpms/perl-Authen-ModAuthPubTkt

Comment 12 Fedora Update System 2022-01-10 20:29:22 UTC
FEDORA-2022-bbc5b35a55 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2022-bbc5b35a55

Comment 13 Fedora Update System 2022-01-10 20:59:37 UTC
FEDORA-2022-087a8119a3 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2022-087a8119a3

Comment 14 Fedora Update System 2022-01-11 01:34:49 UTC
FEDORA-2022-087a8119a3 has been pushed to the Fedora 34 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf install --enablerepo=updates-testing --advisory=FEDORA-2022-087a8119a3 \*`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-087a8119a3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2022-01-11 01:45:04 UTC
FEDORA-2022-bbc5b35a55 has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf install --enablerepo=updates-testing --advisory=FEDORA-2022-bbc5b35a55 \*`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-bbc5b35a55

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 16 Fedora Update System 2022-01-19 01:53:55 UTC
FEDORA-2022-087a8119a3 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 17 Fedora Update System 2022-01-19 02:11:02 UTC
FEDORA-2022-bbc5b35a55 has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.