Taking this review.

To sponsors: Juraj is currently working as an intern at Red Hat in the SELinux team and will have many people around him (including me) who can help him with the packaging-fu, so please don't hesitate to sponsor him :)

I like SELinux stuff, so I'll be happy to sponsor once the review is completed.

Some initial spec review feedback:

> Version: 1.4.0
> Release: 1%{?selint_pre_ver:.%{selint_pre_ver}}%{?dist}

Please use modern pre-release versioning, as it makes automation much easier.

Cf. https://docs.fedoraproject.org/en-US/packaging-guidelines/Versioning/#_handling_non_sorting_versions_with_tilde_dot_and_caret

> License: ASL 2.0

Please use SPDX license identifiers here. In this case, it'd be "Apache-2.0".

Cf. https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/#_valid_license_short_names

> BuildRequires: autoconf autoconf-archive automake bison check check-devel flex gcc help2man libconfuse libconfuse-devel uthash-devel

Please put these one per line, so that future updates make it easy to see changes. You're also missing "make" as a build dependency. You also don't need "check" as a dependency when "check-devel" pulls it in.

> # pkgconfig
> Requires: libconfuse
> %if 0%{?fedora} || 0%{?rhel} >= 8
> Requires: check
> %endif

None of this should be needed, as dependencies are automatically generated. Please drop this.

> %setup -q -n %{name}-%{version}
> %autosetup -p 1

This is very redundant. Drop the "%setup" line.

> %if 0%{?rhel} == 7
> %{configure} --without-check
> %else
> %{configure}
> %endif

You should be able to just use "%configure" here, since you always have check available in the build environment (even in EL7).

Looking at the sources, you probably want to conditionalize the inclusion of "BuildRequires: check-devel" and "BuildRequires: check". That may give you the same effect.

Also, generally as a style choice, we don't usually use curly braces here.

> %{make_build}

Generally as a style choice, we don't usually use curly braces here.

> %{make_install}

Generally as a style choice, we don't usually use curly braces here.

> %check

Your check section is empty. You aren't running tests.

Maybe "%make_build check" would work in this section?

> %{_mandir}/man1/selint.1.gz

This should be "%{_mandir}/man1/selint.1*" as we cannot assume that man pages will remain gzip compressed.

Cf. https://docs.fedoraproject.org/en-US/packaging-guidelines/#_manpages

+1 to Neil's comments, with one note:

(In reply to Neal Gompa from comment #3)
> > %if 0%{?rhel} == 7
> > %{configure} --without-check
> > %else
> > %{configure}
> > %endif
> 
> You should be able to just use "%configure" here, since you always have
> check available in the build environment (even in EL7).
> 
> Looking at the sources, you probably want to conditionalize the inclusion of
> "BuildRequires: check-devel" and "BuildRequires: check". That may give you
> the same effect.

Plain %configure unfortunately fail in an epel-7 chroot. Probably the check in RHEL-7 is too old...

Still, I would suggest to rewrite the conditionals like this (or similar), so that the RHEL-7 check is in one place & it's possible to build --with/--without tests locally for debugging:

diff --git a/selint/selint.spec b/selint/selint.spec
index 9616554f3e0a6cf5aca8104e142b07b3d81a22ea..58334077c80357573305b5ca9577abcb319b0e6b 100644
--- a/selint/selint.spec
+++ b/selint/selint.spec
@@ -1,5 +1,12 @@
 # % global selint_pre_ver rc
 
+# RHEL-7 has too old check
+%if 0%{?rhel} <= 7
+%bcond_with tests
+%else
+%bcond_without tests
+%endif
+
 Summary: Static code analysis tool for SELinux policy source files
 Name: selint
 Version: 1.4.0
@@ -8,11 +15,9 @@ URL: https://github.com/SELinuxProject/selint
 License: ASL 2.0
 Source: https://github.com/SELinuxProject/selint/releases/download/v%{version}%{?selint_pre_ver:-%{selint_pre_ver}}/%{name}-%{version}%{?selint_pre_ver:-%{selint_pre_ver}}.tar.gz
 
-BuildRequires: autoconf autoconf-archive automake bison check check-devel flex gcc help2man libconfuse libconfuse-devel uthash-devel
-# pkgconfig
-Requires: libconfuse
-%if 0%{?fedora} || 0%{?rhel} >= 8
-Requires: check
+BuildRequires: autoconf autoconf-archive automake bison flex gcc help2man libconfuse-devel uthash-devel
+%if %{with tests}
+BuildRequires: check-devel
 %endif
 
 %description
@@ -29,10 +34,10 @@ challenging policy issues.
 %build
 # autogen.sh
 autoreconf -fiv -Wall -Wno-portability
-%if 0%{?rhel} == 7
-%{configure} --without-check
-%else
+%if %{with tests}
 %{configure}
+%else
+%{configure} --without-check
 %endif
 
 %{make_build}
@@ -40,7 +45,10 @@ autoreconf -fiv -Wall -Wno-portability
 %install
 %{make_install}
 
+%if %{with tests}
 %check
+%make_build check
+%endif
 
 %files
 %license LICENSE

Another way to do the configure thing:

%if 0%{?rhel} && 0%{?rhel} < 8
%global configure_opts --without-check
%else
%global configure_opts %{nil}
%endif

[..]

%configure %{?configure_opts}

> +%if 0%{?rhel} <= 7

This will make it get disabled on Fedora too.

You want "%if 0%{?rhel} && 0%{?rhel} <= 7" instead. Alternatively, if you think nobody will build on older stuff, then "%if 0%{?el7}" will work too.

A third way to handle the configure option:


%configure %{!?with_tests:--without-check}

That ties it to the tests bcond.

(In reply to Neal Gompa from comment #6)
> > +%if 0%{?rhel} <= 7
> 
> This will make it get disabled on Fedora too.
> 
> You want "%if 0%{?rhel} && 0%{?rhel} <= 7" instead. Alternatively, if you
> think nobody will build on older stuff, then "%if 0%{?el7}" will work too.

Oh, you're right, the "this is a RHEL that is older than 7" condition can't be implemented in a single comparison. Indeed %rhel < 7 is not a case we care about here, but I find using </>/<=/>= better semantically - "Beyond this line the packages are too old - don't even try to run the tests."

Thank you for your feedback. I have updated the spec file to fix the issues you mentioned. The check package in RHEL-7 is indeed too old, selint requires check>=0.11.0.

New spec file and SRPM can be found here:

Spec URL: https://download.copr.fedorainfracloud.org/results/jmarcin/selint/fedora-rawhide-x86_64/05528894-selint/selint.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/jmarcin/selint/fedora-rawhide-x86_64/05528894-selint/selint-1.4.0-1.fc39.src.rpm

Copr build:
https://copr.fedorainfracloud.org/coprs/build/5529041
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2168255-selint/fedora-rawhide-x86_64/05529041-selint/fedora-review/review.txt

Please take a look if any issues were found.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Just one more thing I noticed... The NOTICE file should probably be added as another "license" file (it contains the copyright notice):

%license LICENSE NOTICE

Otherwise all looks good in the last version.

(In reply to Ondrej Mosnáček from comment #11)
> Just one more thing I noticed... The NOTICE file should probably be added as
> another "license" file (it contains the copyright notice):
> 
> %license LICENSE NOTICE
> 
> Otherwise all looks good in the last version.

Updated the spec file to include the NOTICE file. Thank you for noticing. ;)

Spec URL: https://download.copr.fedorainfracloud.org/results/jmarcin/selint/fedora-rawhide-x86_64/05532407-selint/selint.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/jmarcin/selint/fedora-rawhide-x86_64/05532407-selint/selint-1.4.0-1.fc39.src.rpm

Created attachment 1944497 [details]
The .spec file difference from Copr build 5529041 to 5533162

Copr build:
https://copr.fedorainfracloud.org/coprs/build/5533162
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2168255-selint/fedora-rawhide-x86_64/05533162-selint/fedora-review/review.txt

Please take a look if any issues were found.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

> BuildRequires: check-devel

I'd recommend changing this to a versioned build dependency, so you know what it's supposed to have: "BuildRequires: pkgconfig(check) >= 0.11.0"

Changing from "check-devel" to "pkgconfig(check)" also makes the build dependency match what the build system requests. Since the configure script is looking for it via pkg_check_modules, that means it's using pkgconfig to find it. So expressing the dependency in the form of a pkgconfig() dependency ensures you're tracking the right thing.

There's more detail about this here: https://docs.fedoraproject.org/en-US/packaging-guidelines/PkgConfigBuildRequires/

> Source: https://github.com/SELinuxProject/selint/releases/download/v%{version}/%{name}-%{version}.tar.gz

Since "https://github.com/SELinuxProject/selint" is also the URL, you can actually shorten this to "Source: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz"

Thank you Neal. I have applied your suggestions, updated spec file is available here:

Spec URL: https://download.copr.fedorainfracloud.org/results/jmarcin/selint/fedora-rawhide-x86_64/05536439-selint/selint.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/jmarcin/selint/fedora-rawhide-x86_64/05536439-selint/selint-1.4.0-1.fc39.src.rpm

Created attachment 1944738 [details]
The .spec file difference from Copr build 5533162 to 5536540

Copr build:
https://copr.fedorainfracloud.org/coprs/build/5536540
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2168255-selint/fedora-rawhide-x86_64/05536540-selint/fedora-review/review.txt

Please take a look if any issues were found.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Looks good to me now. :)

Same here :) Approving the package.

Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated


===== MUST items =====

C/C++:
[x]: Package does not contain kernel modules.
[x]: Package contains no static executables.
[x]: If your application is a C or C++ application you must list a
     BuildRequires against gcc, gcc-c++ or clang.
[x]: Header files in -devel subpackage, if present.
[x]: Package does not contain any libtool archives (.la)
[x]: Rpath absent or only used for internal libs.

Generic:
[x]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
     Note: Using prebuilt packages
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.
[x]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "Unknown or generated", "FSF All Permissive License", "*No
     copyright* Apache License 2.0", "Apache License 2.0", "Apache License
     2.0 [generated file]", "FSF Unlimited License (with License Retention)
     [generated file]", "GNU General Public License v2.0 or later
     [generated file]", "FSF Unlimited License [generated file]", "X11
     License [generated file]", "*No copyright* [generated file]", "GNU
     General Public License v3.0 or later". 238 files have unknown license.
     Detailed output of licensecheck in /var/lib/copr-
     rpmbuild/results/selint/licensecheck.txt
[x]: License file installed when any subpackage combination is installed.
[x]: %build honors applicable compiler flags or justifies otherwise.
[x]: Package contains no bundled libraries without FPC exception.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[-]: Package contains desktop file if it is a GUI application.
[-]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
     names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[-]: Package contains systemd file(s) if in need.
[x]: Useful -debuginfo package or justification otherwise.
[x]: Package is not known to require an ExcludeArch tag.
[-]: Large documentation must go in a -doc subpackage. Large could be size
     (~1MB) or number of files.
     Note: Documentation size is 20480 bytes in 2 files.
[x]: Package complies to the Packaging Guidelines
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: No rpmlint messages.
[x]: If (and only if) the source package includes the text of the
     license(s) in its own file, then that file, containing the text of the
     license(s) for the package is included in %license.
[x]: Package requires other packages for directories it uses.
[x]: Package must own all directories that it creates.
[x]: Package does not own files or directories owned by other packages.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: %config files are marked noreplace or the reason is justified.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Dist tag is present.
[x]: Package does not contain duplicates in %files.
[x]: Permissions on files are set properly.
[x]: Package must not depend on deprecated() packages.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: No %config files under /usr.
[x]: Package does not use a name that already exists.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Packages must not store files under /srv, /opt or /usr/local

===== SHOULD items =====

Generic:
[x]: Reviewer should test that the package builds in mock.
[-]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[x]: Package functions as described.
[x]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[-]: Sources are verified with gpgverify first in %prep if upstream
     publishes signatures.
     Note: gpgverify is not used.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[x]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed
     files.
[x]: Buildroot is not present
[x]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Fully versioned dependency in subpackages if applicable.
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: SourceX is a working URL.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

Generic:
[x]: Rpmlint is run on debuginfo package(s).
     Note: No rpmlint messages.
[x]: Rpmlint is run on all installed packages.
     Note: No rpmlint messages.
[x]: Large data in /usr/share should live in a noarch subpackage if package
     is arched.
[x]: Package should not use obsolete m4 macros


Rpmlint
-------
Checking: selint-1.4.0-1.fc39.x86_64.rpm
          selint-debuginfo-1.4.0-1.fc39.x86_64.rpm
          selint-debugsource-1.4.0-1.fc39.x86_64.rpm
          selint-1.4.0-1.fc39.src.rpm
============================ rpmlint session starts ============================
rpmlint: 2.4.0
configuration:
    /usr/lib/python3.11/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora-legacy-licenses.toml
    /etc/xdg/rpmlint/fedora-spdx-licenses.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
rpmlintrc: [PosixPath('/tmp/tmpuj3kijma')]
checks: 31, packages: 4

 4 packages and 0 specfiles checked; 0 errors, 0 warnings, 0 badness; has taken 0.3 s 




Rpmlint (debuginfo)
-------------------
Checking: selint-debuginfo-1.4.0-1.fc39.x86_64.rpm
============================ rpmlint session starts ============================
rpmlint: 2.4.0
configuration:
    /usr/lib/python3.11/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora-legacy-licenses.toml
    /etc/xdg/rpmlint/fedora-spdx-licenses.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
rpmlintrc: [PosixPath('/tmp/tmpwrp2xmh6')]
checks: 31, packages: 1

 1 packages and 0 specfiles checked; 0 errors, 0 warnings, 0 badness; has taken 0.1 s 





Rpmlint (installed packages)
----------------------------
============================ rpmlint session starts ============================
rpmlint: 2.4.0
configuration:
    /usr/lib/python3.11/site-packages/rpmlint/configdefaults.toml
    /etc/xdg/rpmlint/fedora-legacy-licenses.toml
    /etc/xdg/rpmlint/fedora-spdx-licenses.toml
    /etc/xdg/rpmlint/fedora.toml
    /etc/xdg/rpmlint/scoring.toml
    /etc/xdg/rpmlint/users-groups.toml
    /etc/xdg/rpmlint/warn-on-functions.toml
checks: 31, packages: 3

 3 packages and 0 specfiles checked; 0 errors, 0 warnings, 0 badness; has taken 0.3 s 



Source checksums
----------------
https://github.com/SELinuxProject/selint/releases/download/v1.4.0/selint-1.4.0.tar.gz :
  CHECKSUM(SHA256) this package     : 275e5bd44d83e25593a486a5daa381eda2b5b122167b3d506779e54510669040
  CHECKSUM(SHA256) upstream package : 275e5bd44d83e25593a486a5daa381eda2b5b122167b3d506779e54510669040


Requires
--------
selint (rpmlib, GLIBC filtered):
    config(selint)
    libc.so.6()(64bit)
    libconfuse.so.2()(64bit)
    rtld(GNU_HASH)

selint-debuginfo (rpmlib, GLIBC filtered):

selint-debugsource (rpmlib, GLIBC filtered):



Provides
--------
selint:
    config(selint)
    selint
    selint(x86-64)

selint-debuginfo:
    debuginfo(build-id)
    selint-debuginfo
    selint-debuginfo(x86-64)

selint-debugsource:
    selint-debugsource
    selint-debugsource(x86-64)



Generated by fedora-review 0.9.0 (6761b6c) last change: 2022-08-23
Command line :/usr/bin/fedora-review --no-colors --prebuilt --rpm-spec --name selint --mock-config /var/lib/copr-rpmbuild/results/configs/child.cfg
Buildroot used: fedora-rawhide-x86_64
Active plugins: C/C++, Shell-api, Generic
Disabled plugins: PHP, Python, Ocaml, Perl, Haskell, SugarActivity, R, Java, fonts
Disabled flags: EPEL6, EPEL7, DISTTAG, BATCH, EXARCH

You're now sponsored as a packager.

Welcome to Fedora. :)

The Pagure repository was created at https://src.fedoraproject.org/rpms/selint

The package is now in Fedora and this bug can be closed.