Bug 2075850 - Review Request: zeek - network analysis framework
Summary: Review Request: zeek - network analysis framework
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Davide Cavalca
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-04-15 17:07 UTC by Marco Rizzi
Modified: 2022-07-12 03:06 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-07-12 03:03:36 UTC
Type: ---
Embargoed:
davide: fedora-review+


Attachments (Terms of Use)

Description Marco Rizzi 2022-04-15 17:07:22 UTC
Spec URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-35-x86_64/03954914-zeek/zeek.spec

SRPM URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-35-x86_64/03954914-zeek/zeek-4.2.0-1.fc35.src.rpm

Description: Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.  While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyberinfrastructure. Zeek's user
community includes major universities, research labs, supercomputing centers,
and open-science communities.

Fedora Account System Username: marcor

This is my first submission, so apologies in advance for my n00b mistakes.

Build was successful in copr: https://copr.fedorainfracloud.org/coprs/marcor/zeek/

Comment 1 Davide Cavalca 2022-04-15 17:09:47 UTC
Taking this review

Comment 2 Davide Cavalca 2022-04-15 17:17:35 UTC
This is failing to build on Rawhide: https://paste.centos.org/view/1a0986fb

/builddir/build/BUILD/zeek-4.2.0/src/script_opt/ZAM/Gen-ZAM.cc: In member function 'void TemplateInput::Gripe(const char*, const std::string&) const':
/builddir/build/BUILD/zeek-4.2.0/src/script_opt/ZAM/Gen-ZAM.cc:1896:17: error: 'strlen' was not declared in this scope
 1896 |         int n = strlen(input_s);
      |                 ^~~~~~
/builddir/build/BUILD/zeek-4.2.0/src/script_opt/ZAM/Gen-ZAM.cc:7:1: note: 'strlen' is defined in header '<cstring>'; did you forget to '#include <cstring>'?
    6 | #include <regex>
  +++ |+#include <cstring>
    7 |
/builddir/build/BUILD/zeek-4.2.0/src/script_opt/ZAM/Gen-ZAM.cc: In constructor 'ZAMGen::ZAMGen(int, char**)':
/builddir/build/BUILD/zeek-4.2.0/src/script_opt/ZAM/Gen-ZAM.cc:1922:18: error: 'strcmp' was not declared in this scope
 1922 |         auto f = strcmp(file_name, "-") ? fopen(file_name, "r") : stdin;
      |                  ^~~~~~
/builddir/build/BUILD/zeek-4.2.0/src/script_opt/ZAM/Gen-ZAM.cc:1922:18: note: 'strcmp' is defined in header '<cstring>'; did you forget to '#include <cstring>'?

This looks like a missing include that's being triggered by GCC 12, and there's already an upstream fix for it in https://github.com/zeek/zeek/commit/acaa9ec01e00447b0deca37385f08797895b00b1 so it should be enough to backport that as a patch.

Comment 3 Marco Rizzi 2022-04-16 01:07:10 UTC
good catch and thanks a lot for the pointer! 

I have put together a patch and run a rawhide build on copr: 

https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-rawhide-x86_64/04223111-zeek/

Comment 4 Davide Cavalca 2022-04-17 16:14:12 UTC
Whenever you update this, you'll want to repeat the URLs again so that fedora-review can pick them up, like this:

Spec URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-rawhide-x86_64/04223111-zeek/zeek.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-rawhide-x86_64/04223111-zeek/zeek-4.2.0-1.fc37.src.rpm

Changelog:
- Backported GCC 12 compatibility patch

Comment 5 Davide Cavalca 2022-04-17 17:02:21 UTC
Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated
[ ] = Manual review needed


Issues:
=======
- No %config files under /usr.
  Note: %config /usr/share/zeek/site/local.zeek
  See: https://docs.fedoraproject.org/en-US/packaging-
  guidelines/#_configuration_files
- Large documentation must go in a -doc subpackage. Large could be size
  (~1MB) or number of files.
  Note: Documentation size is 1228800 bytes in 3 files.
  See: https://docs.fedoraproject.org/en-US/packaging-
  guidelines/#_documentation


===== MUST items =====

C/C++:
[x]: Package does not contain kernel modules.
[x]: Package contains no static executables.
[x]: Development (unversioned) .so files in -devel subpackage, if present.
     Note: Unversioned so-files in private %_libdir subdirectory (see
     attachment). Verify they are not in ld path.
[x]: If your application is a C or C++ application you must list a
     BuildRequires against gcc, gcc-c++ or clang.
[x]: Header files in -devel subpackage, if present.
[x]: ldconfig not called in %post and %postun for Fedora 28 and later.
[x]: Package does not contain any libtool archives (.la)
[x]: Rpath absent or only used for internal libs.

Generic:
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.
[!]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "Unknown or generated", "ISC License BSD 2-Clause License",
     "BSD 3-Clause License", "*No copyright* Creative Commons Attribution
     4.0", "*No copyright* [generated file]", "*No copyright* NTP License",
     "University of Illinois/NCSA Open Source License", "*No copyright*
     Apache License 2.0", "ISC License", "*No copyright* University of
     Illinois/NCSA Open Source License", "MIT License JSON License BSD
     3-Clause License", "*No copyright* ISC License", "ISC License BSD
     4-Clause License BSD 2-clause NetBSD License", "MIT License [generated
     file]", "BSD 4-Clause License", "BSD-4-Clause (University of
     California-Specific)", "*No copyright* Mozilla Public License 2.0
     [generated file]", "Apache License 2.0", "BSD 2-Clause License", "BSD
     1-Clause License", "BSD 3-Clause License Boost Software License 1.0",
     "GNU Lesser General Public License v3.0 or later", "MIT License",
     "Mozilla Public License 2.0 [generated file]", "*No copyright* Apache
     License", "BSD 3-Clause License [generated file]". 10306 files have
     unknown license. Detailed output of licensecheck in
     /tmp/2075850-zeek/licensecheck.txt
[x]: License file installed when any subpackage combination is installed.
[!]: Package requires other packages for directories it uses.
     Note: No known owner of /usr/lib64/zeek, /var/log/zeek
[!]: Package must own all directories that it creates.
     Note: Directories without known owners: /usr/lib/sysusers.d,
     /var/log/zeek, /usr/lib64/zeek
[x]: %build honors applicable compiler flags or justifies otherwise.
[!]: Package contains no bundled libraries without FPC exception.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[!]: %config files are marked noreplace or the reason is justified.
     Note: No (noreplace) in %config /usr/share/zeek/site/local.zeek
[x]: Each %files section contains %defattr if rpm < 4.4
     Note: %defattr present but not needed
[-]: Package contains desktop file if it is a GUI application.
[x]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
     names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[x]: Package contains systemd file(s) if in need.
[x]: Useful -debuginfo package or justification otherwise.
[x]: Package is not known to require an ExcludeArch tag.
[x]: Package complies to the Packaging Guidelines
[x]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: If (and only if) the source package includes the text of the
     license(s) in its own file, then that file, containing the text of the
     license(s) for the package is included in %license.
[x]: Package does not own files or directories owned by other packages.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Dist tag is present.
[x]: Package does not contain duplicates in %files.
[x]: Permissions on files are set properly.
[x]: Package must not depend on deprecated() packages.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: Package does not use a name that already exists.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Packages must not store files under /srv, /opt or /usr/local

===== SHOULD items =====

Generic:
[x]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[x]: Fully versioned dependency in subpackages if applicable.
     Note: No Requires: %{name}%{?_isa} = %{version}-%{release} in zeek-
     core , zeek-devel , zeek-libcaf , zeek-libcaf-devel , libbroker ,
     libbroker-devel , libbinpac , zeekctl , zeek-zkg , zeek-btest , zeek-
     btest-data
[x]: Package functions as described.
[x]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[!]: Patches link to upstream bugs/comments/lists or are otherwise
     justified.
[x]: Scriptlets must be sane, if used.
[x]: Sources are verified with gpgverify first in %prep if upstream
     publishes signatures.
     Note: gpgverify is not used.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[-]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed
     files.
[x]: Reviewer should test that the package builds in mock.
[x]: Buildroot is not present
[x]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: SourceX is a working URL.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

Generic:
[!]: Large data in /usr/share should live in a noarch subpackage if package
     is arched.
     Note: Arch-ed rpms have a total of 5713920 bytes in /usr/share
[x]: Rpmlint is run on debuginfo package(s).
     Note: There are rpmlint messages (see attachment).
[x]: Rpmlint is run on all installed packages.
     Note: There are rpmlint messages (see attachment).
[x]: Spec file according to URL is the same as in SRPM.


Rpmlint
-------
Cannot parse rpmlint output:


Rpmlint (debuginfo)
-------------------
Cannot parse rpmlint output:



Rpmlint (installed packages)
----------------------------
Cannot parse rpmlint output:


Unversioned so-files
--------------------
zeekctl: /usr/lib64/zeek/python/_SubnetTree.so
zeekctl: /usr/lib64/zeek/python/broker/_broker.so

Source checksums
----------------
https://download.zeek.org/zeek-4.2.0.tar.gz :
  CHECKSUM(SHA256) this package     : 8d9a028ca9fec7ad4a9e48a763e296052384cf402ea4cd371577bff183c27451
  CHECKSUM(SHA256) upstream package : 8d9a028ca9fec7ad4a9e48a763e296052384cf402ea4cd371577bff183c27451


Requires
--------
zeek-core (rpmlib, GLIBC filtered):
    /bin/sh
    /usr/bin/bash
    /usr/bin/python3
    /usr/bin/sh
    config(zeek-core)
    ld-linux-x86-64.so.2()(64bit)
    libbinpac.so.0()(64bit)
    libbroker.so.4()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libcrypto.so.3()(64bit)
    libcrypto.so.3(OPENSSL_3.0.0)(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libkrb5.so.3()(64bit)
    libkrb5.so.3(krb5_3_MIT)(64bit)
    libm.so.6()(64bit)
    libmaxminddb.so.0()(64bit)
    libpcap.so.1()(64bit)
    libresolv.so.2()(64bit)
    libssl.so.3()(64bit)
    libssl.so.3(OPENSSL_3.0.0)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.1)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.7)(64bit)
    libstdc++.so.6(CXXABI_1.3.8)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    libz.so.1()(64bit)
    rtld(GNU_HASH)

zeek-devel (rpmlib, GLIBC filtered):
    /usr/bin/sh
    libbinpac.so.0()(64bit)
    libbroker-devel(x86-64)
    libc.so.6()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libpcap-devel
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    openssl-devel
    rtld(GNU_HASH)
    zeek-libcaf-devel(x86-64)
    zlib-devel

zeek-libcaf (rpmlib, GLIBC filtered):
    ld-linux-x86-64.so.2()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcrypto.so.3()(64bit)
    libcrypto.so.3(OPENSSL_3.0.0)(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libm.so.6()(64bit)
    libssl.so.3()(64bit)
    libssl.so.3(OPENSSL_3.0.0)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.13)(64bit)
    libstdc++.so.6(CXXABI_1.3.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.7)(64bit)
    libstdc++.so.6(CXXABI_1.3.8)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    rtld(GNU_HASH)

zeek-libcaf-devel (rpmlib, GLIBC filtered):
    cmake-filesystem(x86-64)
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcaf_openssl.so.0.18.5()(64bit)

libbroker (rpmlib, GLIBC filtered):
    ld-linux-x86-64.so.2()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcaf_openssl.so.0.18.5()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.8)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    rtld(GNU_HASH)

libbroker-devel (rpmlib, GLIBC filtered):
    libbroker.so.4()(64bit)

libbinpac (rpmlib, GLIBC filtered):
    libc.so.6()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    rtld(GNU_HASH)

zeekctl (rpmlib, GLIBC filtered):
    /usr/bin/bash
    /usr/bin/python3
    config(zeekctl)
    libbroker.so.4()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libpcap.so.1()(64bit)
    libpython3.10.so.1.0()(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.11)(64bit)
    libstdc++.so.6(CXXABI_1.3.13)(64bit)
    libstdc++.so.6(CXXABI_1.3.2)(64bit)
    libstdc++.so.6(CXXABI_1.3.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    python3
    rtld(GNU_HASH)
    zeek-core(x86-64)

zeek-zkg (rpmlib, GLIBC filtered):
    /usr/bin/python3
    python3
    zeek-btest(x86-64)
    zeek-core(x86-64)
    zeekctl(x86-64)

zeek-btest (rpmlib, GLIBC filtered):
    /usr/bin/bash
    /usr/bin/python3
    python3
    zeek-btest-data

zeek-btest-data (rpmlib, GLIBC filtered):

zeek-debuginfo (rpmlib, GLIBC filtered):

zeek-debugsource (rpmlib, GLIBC filtered):



Provides
--------
zeek-core:
    config(zeek-core)
    group(zeek)
    zeek-core
    zeek-core(x86-64)

zeek-devel:
    zeek-devel
    zeek-devel(x86-64)

zeek-libcaf:
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcaf_openssl.so.0.18.5()(64bit)
    zeek-libcaf
    zeek-libcaf(x86-64)

zeek-libcaf-devel:
    cmake(CAF)
    cmake(caf)
    zeek-libcaf-devel
    zeek-libcaf-devel(x86-64)

libbroker:
    libbroker
    libbroker(x86-64)
    libbroker.so.4()(64bit)

libbroker-devel:
    libbroker-devel
    libbroker-devel(x86-64)

libbinpac:
    libbinpac
    libbinpac(x86-64)
    libbinpac.so.0()(64bit)

zeekctl:
    config(zeekctl)
    zeekctl
    zeekctl(x86-64)

zeek-zkg:
    zeek-zkg
    zeek-zkg(x86-64)

zeek-btest:
    zeek-btest
    zeek-btest(x86-64)

zeek-btest-data:
    zeek-btest-data

zeek-debuginfo:
    zeek-debuginfo
    zeek-debuginfo(x86-64)

zeek-debugsource:
    zeek-debugsource
    zeek-debugsource(x86-64)



Generated by fedora-review 0.8.0 (e988316) last change: 2022-04-07
Command line :/usr/bin/fedora-review -b 2075850
Buildroot used: fedora-rawhide-x86_64
Active plugins: Shell-api, C/C++, Generic
Disabled plugins: Python, fonts, Haskell, Perl, Ocaml, PHP, R, Java, SugarActivity
Disabled flags: EPEL6, EPEL7, DISTTAG, BATCH, EXARCH

Comment 6 Davide Cavalca 2022-04-17 17:11:52 UTC
There's a few things to sort out:

- No %config files under /usr.
  Note: %config /usr/share/zeek/site/local.zeek
[!]: %config files are marked noreplace or the reason is justified.
     Note: No (noreplace) in %config /usr/share/zeek/site/local.zeek

Is this actually a config file, meaning something the user is supposed/expected to edit? If it is, we should figure out if we can move it under /etc (and mark it as %config(noreplace)); if it isn't, it shouldn't be marked as %confg

- Large documentation must go in a -doc subpackage.

I think this is a false positive? The only actual documentation I see is three text files, that doesn't warrant a dedicated package IMO.

[!]: License field in the package spec file matches the actual license.
[!]: Package contains no bundled libraries without FPC exception.

These two are related; basically this thing is bundling a bunch of external libraries like rapidjson, which is generally frowned upon. Long term, we should figure out if we can unbundle these, but for now please add bundled() provides for them per https://docs.fedoraproject.org/en-US/packaging-guidelines/#bundling and updated the License: field accordingly.

[!]: Package requires other packages for directories it uses.
     Note: No known owner of /usr/lib64/zeek, /var/log/zeek
[!]: Package must own all directories that it creates.
     Note: Directories without known owners: /usr/lib/sysusers.d,
     /var/log/zeek, /usr/lib64/zeek

Add %dir entries for /var/log/zeek and /usr/lib64/zeek and add a Requires: systemd for /usr/lib/sysusers.d

[!]: Patches link to upstream bugs/comments/lists or are otherwise
     justified.

Add a comment before the patch with the URL it comes from

[-]: %check is present and all tests pass.

Not a blocker, but if this package has tests it can run at build time, it'd be good to add a %check section to the spec (for cmake-based projects, usually it's enough to call %ctest if they're rigged up properly).

[!]: Large data in /usr/share should live in a noarch subpackage if package
     is arched.

Consider making a zeek-data noarch subpackage for the stuff under /usr/share/zeek

Comment 7 Davide Cavalca 2022-04-17 17:12:18 UTC
For the license stuff, you can see the licensecheck result at https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-rawhide-x86_64/04223111-zeek/fedora-review/licensecheck.txt

Comment 8 Davide Cavalca 2022-04-17 17:48:53 UTC
One more nit I just noticed: in zeek-devel, you're repeating the description, which isn't needed as you're already using the macro; you can delete the first paragraph there.

Comment 9 Marco Rizzi 2022-05-05 02:03:56 UTC
Sorry Davide for the long delay, 
I made some changes, let's give fedora-review another run to see what's still pending. 


Spec URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-rawhide-x86_64/04366466-zeek/zeek.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-rawhide-x86_64/04366466-zeek/zeek-4.2.0-1.fc37.src.rpm


Here are my comments: 

> - No %config files under /usr.
>  Note: %config /usr/share/zeek/site/local.zeek
> [!]: %config files are marked noreplace or the reason is justified.
>     Note: No (noreplace) in %config /usr/share/zeek/site/local.zeek

>Is this actually a config file, meaning something the user is supposed/expected to edit? If it is, we should figure out if we can move it under /etc (and mark it as %config(noreplace)); if it isn't, it shouldn't be marked as %confg

Looking at the zeek documentation, this is classified as a script file, so I have removed the %config

reference: https://docs.zeek.org/en/master/quickstart.html#filesystem-walkthrough


>- Large documentation must go in a -doc subpackage.
>
>I think this is a false positive? The only actual documentation I see is three text files, that doesn't warrant a dedicated package IMO.

I have removed the "CHANGES" text file from the %doc statement, that file alone is more than 1MB. 


>[!]: License field in the package spec file matches the actual license.
>[!]: Package contains no bundled libraries without FPC exception.

>These two are related; basically this thing is bundling a bunch of external libraries like rapidjson, which is generally frowned upon. Long term, we should figure out if we can unbundle these, but for now please add bundled() provides for them per https://docs.fedoraproject.org/en-US/packaging-guidelines/#bundling and updated the License: field accordingly.

I have added "bundled()" for the short term


>[!]: Package requires other packages for directories it uses.
>     Note: No known owner of /usr/lib64/zeek, /var/log/zeek
>[!]: Package must own all directories that it creates.
>     Note: Directories without known owners: /usr/lib/sysusers.d,
>     /var/log/zeek, /usr/lib64/zeek
>
>Add %dir entries for /var/log/zeek and /usr/lib64/zeek and add a Requires: systemd for /usr/lib/sysusers.d

done that


>[!]: Patches link to upstream bugs/comments/lists or are otherwise
>     justified.
>
>Add a comment before the patch with the URL it comes from

done

>[-]: %check is present and all tests pass.
>
>Not a blocker, but if this package has tests it can run at build time, it'd be good to add a %check section to the spec (for cmake-based projects, usually it's enough to call %ctest if they're rigged up properly).

I don't think I see tests that can run at build time. 


>[!]: Large data in /usr/share should live in a noarch subpackage if package
>     is arched.
>
>Consider making a zeek-data noarch subpackage for the stuff under /usr/share/zeek

I'm not sure if that's going to be possible, different packages write to /usr/share/zeek/

Comment 11 Davide Cavalca 2022-05-17 22:10:40 UTC
Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated
[ ] = Manual review needed



===== MUST items =====

C/C++:
[x]: Package does not contain kernel modules.
[x]: Package contains no static executables.
[x]: Development (unversioned) .so files in -devel subpackage, if present.
     Note: Unversioned so-files in private %_libdir subdirectory (see
     attachment). Verify they are not in ld path.
[x]: If your application is a C or C++ application you must list a
     BuildRequires against gcc, gcc-c++ or clang.
[x]: Header files in -devel subpackage, if present.
[x]: ldconfig not called in %post and %postun for Fedora 28 and later.
[x]: Package does not contain any libtool archives (.la)
[x]: Rpath absent or only used for internal libs.

Generic:
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.
[!]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "Unknown or generated", "ISC License BSD 2-Clause License",
     "BSD 3-Clause License", "*No copyright* Creative Commons Attribution
     4.0", "*No copyright* [generated file]", "*No copyright* NTP License",
     "University of Illinois/NCSA Open Source License", "*No copyright*
     Apache License 2.0", "ISC License", "*No copyright* University of
     Illinois/NCSA Open Source License", "MIT License JSON License BSD
     3-Clause License", "*No copyright* ISC License", "ISC License BSD
     4-Clause License BSD 2-clause NetBSD License", "MIT License [generated
     file]", "BSD 4-Clause License", "BSD-4-Clause (University of
     California-Specific)", "*No copyright* Mozilla Public License 2.0
     [generated file]", "Apache License 2.0", "BSD 2-Clause License", "BSD
     1-Clause License", "BSD 3-Clause License Boost Software License 1.0",
     "GNU Lesser General Public License v3.0 or later", "MIT License",
     "Mozilla Public License 2.0 [generated file]", "*No copyright* Apache
     License", "BSD 3-Clause License [generated file]". 10306 files have
     unknown license. Detailed output of licensecheck in
     /tmp/2075850-zeek/licensecheck.txt
[x]: License file installed when any subpackage combination is installed.
[!]: Package must own all directories that it creates.
     Note: Directories without known owners: /usr/lib64/zeek
[x]: %build honors applicable compiler flags or justifies otherwise.
[x]: Package contains no bundled libraries without FPC exception.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[x]: Each %files section contains %defattr if rpm < 4.4
     Note: %defattr present but not needed
[-]: Package contains desktop file if it is a GUI application.
[x]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
     names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[x]: Package contains systemd file(s) if in need.
[x]: Useful -debuginfo package or justification otherwise.
[x]: Package is not known to require an ExcludeArch tag.
[!]: Large documentation must go in a -doc subpackage. Large could be size
     (~1MB) or number of files.
     Note: Documentation size is 194560 bytes in 2 files.
[x]: Package complies to the Packaging Guidelines
[x]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: If (and only if) the source package includes the text of the
     license(s) in its own file, then that file, containing the text of the
     license(s) for the package is included in %license.
[x]: Package requires other packages for directories it uses.
[x]: Package does not own files or directories owned by other packages.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: %config files are marked noreplace or the reason is justified.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Dist tag is present.
[x]: Package does not contain duplicates in %files.
[x]: Permissions on files are set properly.
[x]: Package must not depend on deprecated() packages.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: No %config files under /usr.
[x]: Package does not use a name that already exists.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Packages must not store files under /srv, /opt or /usr/local

===== SHOULD items =====

Generic:
[x]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[x]: Fully versioned dependency in subpackages if applicable.
     Note: No Requires: %{name}%{?_isa} = %{version}-%{release} in zeek-
     core , zeek-devel , zeek-libcaf , zeek-libcaf-devel , libbroker ,
     libbroker-devel , libbinpac , zeekctl , zeek-zkg , zeek-btest , zeek-
     btest-data
[x]: Package functions as described.
[x]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[x]: Patches link to upstream bugs/comments/lists or are otherwise
     justified.
[x]: Scriptlets must be sane, if used.
[x]: Sources are verified with gpgverify first in %prep if upstream
     publishes signatures.
     Note: gpgverify is not used.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[-]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed
     files.
[x]: Reviewer should test that the package builds in mock.
[x]: Buildroot is not present
[x]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: SourceX is a working URL.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

Generic:
[!]: Large data in /usr/share should live in a noarch subpackage if package
     is arched.
     Note: Arch-ed rpms have a total of 4679680 bytes in /usr/share
[x]: Rpmlint is run on debuginfo package(s).
     Note: There are rpmlint messages (see attachment).
[x]: Rpmlint is run on all installed packages.
     Note: There are rpmlint messages (see attachment).
[x]: Spec file according to URL is the same as in SRPM.


Rpmlint
-------
Cannot parse rpmlint output:


Rpmlint (debuginfo)
-------------------
Cannot parse rpmlint output:



Rpmlint (installed packages)
----------------------------
Cannot parse rpmlint output:


Unversioned so-files
--------------------
zeekctl: /usr/lib64/zeek/python/_SubnetTree.so
zeekctl: /usr/lib64/zeek/python/broker/_broker.so

Source checksums
----------------
https://download.zeek.org/zeek-4.2.0.tar.gz :
  CHECKSUM(SHA256) this package     : 8d9a028ca9fec7ad4a9e48a763e296052384cf402ea4cd371577bff183c27451
  CHECKSUM(SHA256) upstream package : 8d9a028ca9fec7ad4a9e48a763e296052384cf402ea4cd371577bff183c27451


Requires
--------
zeek-core (rpmlib, GLIBC filtered):
    /bin/sh
    /usr/bin/bash
    /usr/bin/python3
    /usr/bin/sh
    ld-linux-x86-64.so.2()(64bit)
    libbinpac.so.0()(64bit)
    libbroker.so.4()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libcrypto.so.3()(64bit)
    libcrypto.so.3(OPENSSL_3.0.0)(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libkrb5.so.3()(64bit)
    libkrb5.so.3(krb5_3_MIT)(64bit)
    libm.so.6()(64bit)
    libmaxminddb.so.0()(64bit)
    libpcap.so.1()(64bit)
    libresolv.so.2()(64bit)
    libssl.so.3()(64bit)
    libssl.so.3(OPENSSL_3.0.0)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.1)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.7)(64bit)
    libstdc++.so.6(CXXABI_1.3.8)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    libz.so.1()(64bit)
    rtld(GNU_HASH)
    systemd

zeek-devel (rpmlib, GLIBC filtered):
    /usr/bin/sh
    libbinpac.so.0()(64bit)
    libbroker-devel(x86-64)
    libc.so.6()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libpcap-devel
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    openssl-devel
    rtld(GNU_HASH)
    zeek-libcaf-devel(x86-64)
    zlib-devel

zeek-libcaf (rpmlib, GLIBC filtered):
    ld-linux-x86-64.so.2()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcrypto.so.3()(64bit)
    libcrypto.so.3(OPENSSL_3.0.0)(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libm.so.6()(64bit)
    libssl.so.3()(64bit)
    libssl.so.3(OPENSSL_3.0.0)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.13)(64bit)
    libstdc++.so.6(CXXABI_1.3.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.7)(64bit)
    libstdc++.so.6(CXXABI_1.3.8)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    rtld(GNU_HASH)

zeek-libcaf-devel (rpmlib, GLIBC filtered):
    cmake-filesystem(x86-64)
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcaf_openssl.so.0.18.5()(64bit)

libbroker (rpmlib, GLIBC filtered):
    ld-linux-x86-64.so.2()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcaf_openssl.so.0.18.5()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.8)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    rtld(GNU_HASH)

libbroker-devel (rpmlib, GLIBC filtered):
    libbroker.so.4()(64bit)

libbinpac (rpmlib, GLIBC filtered):
    libc.so.6()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    rtld(GNU_HASH)

zeekctl (rpmlib, GLIBC filtered):
    /usr/bin/bash
    /usr/bin/python3
    config(zeekctl)
    libbroker.so.4()(64bit)
    libc.so.6()(64bit)
    libcaf_core.so.0.18.5()(64bit)
    libgcc_s.so.1()(64bit)
    libgcc_s.so.1(GCC_3.0)(64bit)
    libgcc_s.so.1(GCC_3.3.1)(64bit)
    libpcap.so.1()(64bit)
    libpython3.10.so.1.0()(64bit)
    libstdc++.so.6()(64bit)
    libstdc++.so.6(CXXABI_1.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.11)(64bit)
    libstdc++.so.6(CXXABI_1.3.13)(64bit)
    libstdc++.so.6(CXXABI_1.3.2)(64bit)
    libstdc++.so.6(CXXABI_1.3.3)(64bit)
    libstdc++.so.6(CXXABI_1.3.5)(64bit)
    libstdc++.so.6(CXXABI_1.3.9)(64bit)
    python3
    rtld(GNU_HASH)
    zeek-core(x86-64)

zeek-zkg (rpmlib, GLIBC filtered):
    /usr/bin/python3
    python3
    zeek-btest(x86-64)
    zeek-core(x86-64)
    zeekctl(x86-64)

zeek-btest (rpmlib, GLIBC filtered):
    /usr/bin/bash
    /usr/bin/python3
    python3
    zeek-btest-data

zeek-btest-data (rpmlib, GLIBC filtered):

zeek-debuginfo (rpmlib, GLIBC filtered):

zeek-debugsource (rpmlib, GLIBC filtered):



Provides
--------
zeek-core:
    group(zeek)
    zeek-core
    zeek-core(x86-64)

zeek-devel:
    zeek-devel
    zeek-devel(x86-64)

zeek-libcaf:
    bundled(libcaf)
    libcaf_core.so.0.18.5()(64bit)
    libcaf_io.so.0.18.5()(64bit)
    libcaf_openssl.so.0.18.5()(64bit)
    zeek-libcaf
    zeek-libcaf(x86-64)

zeek-libcaf-devel:
    bundled(libcaf-devel)
    cmake(CAF)
    cmake(caf)
    zeek-libcaf-devel
    zeek-libcaf-devel(x86-64)

libbroker:
    libbroker
    libbroker(x86-64)
    libbroker.so.4()(64bit)

libbroker-devel:
    libbroker-devel
    libbroker-devel(x86-64)

libbinpac:
    libbinpac
    libbinpac(x86-64)
    libbinpac.so.0()(64bit)

zeekctl:
    config(zeekctl)
    zeekctl
    zeekctl(x86-64)

zeek-zkg:
    zeek-zkg
    zeek-zkg(x86-64)

zeek-btest:
    zeek-btest
    zeek-btest(x86-64)

zeek-btest-data:
    zeek-btest-data

zeek-debuginfo:
    zeek-debuginfo
    zeek-debuginfo(x86-64)

zeek-debugsource:
    zeek-debugsource
    zeek-debugsource(x86-64)



Generated by fedora-review 0.8.0 (e988316) last change: 2022-04-07
Command line :/usr/bin/fedora-review -b 2075850
Buildroot used: fedora-rawhide-x86_64
Active plugins: C/C++, Shell-api, Generic
Disabled plugins: Perl, Ocaml, Python, R, PHP, fonts, Haskell, SugarActivity, Java
Disabled flags: EPEL6, EPEL7, DISTTAG, BATCH, EXARCH

Comment 13 Davide Cavalca 2022-07-06 18:21:23 UTC
For the automation to work properly please keep the wording around the links the same.

Spec URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/fedora-rawhide-x86_64/04366466-zeek/zeek.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/marcor/zeek/epel-8-x86_64/04598641-zeek/zeek-4.2.0-1.el8.src.rpm

The License entry

> License:        BSD, Apache License 2.0, BSD 1-Clause License, BSD 2-Clause License, BSD 3-Clause License, BSD 3-Clause License Boost Software License 1.0, BSD 4-Clause License, BSD-4-Clause (University of California-Specific), GNU Lesser General Public License v3.0 or later, ISC License, ISC License BSD 2-Clause License, ISC License BSD 4-Clause License BSD 2-clause NetBSD License, MIT License, MIT License JSON License BSD 3-Clause License, University of Illinois/NCSA Open Source License

isn't using the correct tags. Change it to:

> License:        ASL 2.0 and Boost and BSD and ISC and LGPLv3+ and MIT and NCSA

which should be equivalent if I'm not mistaken. Also, after the BuildRequires you need to add Provides for all the bundled libraries:

Provides: bundled(bifcl)
Provides: bundled(btest)
Provides: bundled(netcontrol-connectors)
Provides: bundled(rapidjson)
Provides: bundled(zeek-client)
Provides: bundled(binpac)
Provides: bundled(highwayhash)
Provides: bundled(package-manager)
Provides: bundled(zeek-archiver)
Provides: bundled(zeekctl)
Provides: bundled(broker)
Provides: bundled(libkqueue)
Provides: bundled(paraglob)
Provides: bundled(zeek-aux)

Comment 14 Davide Cavalca 2022-07-06 18:26:39 UTC
After discussing with marcor and salimma out of band, we're going to limit this package to EPEL8 and EPEL9 initially. zeek currently fails to build in Rawhide due to a Python 3.11 compatibility issue (see https://github.com/zeek/broker/issues/251). Once that is resolved upstream, we will build it for Fedora releases as well.

Comment 16 Davide Cavalca 2022-07-06 22:21:42 UTC
I think this is good to go now. The licensing matches, and while the large amount of bundled dependencies is unfortunate, it doesn't look like they can be reasonably unbundled for the time being.

PACKAGE APPROVED

Marco, I have sponsored you into the packager group, welcome! You should now be able to request a repository for this package, which you can do by by running:

fedpkg request-repo zeek 2075850
fedpkg request-branch --repo zeek epel8
fedpkg request-branch --repo zeek epel9

Once the repo has been created you'll be able to import and build zeek.

Comment 17 Gwyn Ciesla 2022-07-07 16:53:36 UTC
(fedscm-admin):  The Pagure repository was created at https://src.fedoraproject.org/rpms/zeek

Comment 18 Fedora Update System 2022-07-07 21:20:46 UTC
FEDORA-EPEL-2022-cdcffd2257 has been submitted as an update to Fedora EPEL 8. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2022-cdcffd2257

Comment 19 Fedora Update System 2022-07-07 22:33:57 UTC
FEDORA-EPEL-2022-bd5fa7dd34 has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2022-bd5fa7dd34

Comment 20 Fedora Update System 2022-07-08 02:19:49 UTC
FEDORA-EPEL-2022-cdcffd2257 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2022-cdcffd2257

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 21 Fedora Update System 2022-07-08 02:25:54 UTC
FEDORA-EPEL-2022-bd5fa7dd34 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2022-bd5fa7dd34

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 22 Fedora Update System 2022-07-12 03:03:36 UTC
FEDORA-EPEL-2022-bd5fa7dd34 has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 23 Fedora Update System 2022-07-12 03:06:03 UTC
FEDORA-EPEL-2022-cdcffd2257 has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.