Bug 2130734 - Review Request: Chezmoi - Manage your dotfiles across multiple diverse machines, securely.
Summary: Review Request: Chezmoi - Manage your dotfiles across multiple diverse machin...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody's working on this, feel free to take it
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 2045475 2056006 2119976 2120419 2120452 2120454 2120459 2120461 2120462 2120464 2130733 2131402 2131497 2132377 2142022
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-09-29 02:42 UTC by Anthony Rabbito
Modified: 2023-06-30 13:52 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Anthony Rabbito 2022-09-29 02:42:20 UTC
Spec URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi.spec
SRPM URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi-2.21.1-1.fc37.src.rpm
Description: Chezmoi provides many features beyond symlinking dotfiles or using a bare git repo including: dotfile templates (to handle small differences between machines), password manager support (to store your secrets securely), importing files from archives (great for shell and editor plugins), full file encryption (using gpg or age), and running scripts (to handle everything else).
Fedora Account System Username: anthr76

Comment 1 Tom Payne 2022-10-05 10:20:48 UTC
Since chezmoi v2.24.0, the dependency on github.com/google/gops has been removed (https://github.com/twpayne/chezmoi/pull/2389) so the dependency of this bug on https://bugzilla.redhat.com/show_bug.cgi?id=2120460 can be removed.

If it helps, I can move the code from github.com/twpayne/go-shell into chezmoi to remove the dependency on https://bugzilla.redhat.com/show_bug.cgi?id=2120462.

Comment 2 Anthony Rabbito 2022-10-05 12:16:07 UTC
Hi Tom, thanks for the update.

I have updated the spec to v2.24.0 which indeed removes the gops dependency. As for integrating go-shell into Chezmoi.. I will let that up to you. It would avoid one more package review here, but in the grand scheme I don't think it will change the time significantly as far as getting Chezmoi into the repos.

Thanks again for giving an update!

Spec URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi.spec
SRPM URL: https://anthr76.fedorapeople.org/chezmoi/chezmoi-2.24.0-1.fc37.src.rpm

Comment 3 Elliott Sales de Andrade 2022-12-18 03:54:29 UTC
golang-github-google-go-github is updated now, so I guess you should be able to bump this to the latest version?

Comment 4 Mikel Olasagasti Uranga 2023-04-22 19:46:12 UTC
Hi Anthony,

I found that some of the deps that were already reviewed and added to Fedora were retired because they had no dependencies. For example github.com/twpayne/go-xdg/v6 or howett.net/plist.

If you plan to continue working for adding Chezmoi to Fedora we can make a last effort and review whatever is missing. If not I can continue over your work.

Comment 5 Tom Payne 2023-06-19 10:46:46 UTC
Author of chezmoi here.

As I understand it, the Fedora packaging policy is to package each dependency separately and have a single version of each dependency installed on each machine.

If this is the case, then it will likely be hard or impossible to package chezmoi for Fedora for the following reasons:
1. chezmoi has many dependencies: about 50 direct dependencies, and about 70 indirect dependencies. Packaging all of these will be a huge amount of work.
2. chezmoi regularly updates its dependencies to the latest version for security fixes, bug fixes, and features. chezmoi's set of dependencies changes on each patch release of chezmoi, which is roughly every two weeks.
3. chezmoi blacklists specific versions of certain dependencies due to critical bugs in specif versions of those dependencies or removed features.

chezmoi's go.mod file lists all of chezmoi's dependencies, and the exclude section at the end lists the blacklisted versions:
  https://github.com/twpayne/chezmoi/blob/master/go.mod


Note You need to log in before you can comment on or make changes to this bug.