Spec URL: https://wojnilowicz.fedorapeople.org/nodejs-aw-webui.spec SRPM URL: https://wojnilowicz.fedorapeople.org/nodejs-aw-webui-0^20240518.05c25c9-1.fc39.src.rpm Description: A web-based UI for ActivityWatch, built with Vue.js Fedora Account System Username: wojnilowicz It's in the dependency chain for building https://github.com/ActivityWatch/activitywatch (aw-server-rust specifically) One can see that it's working at https://copr.fedorainfracloud.org/coprs/wojnilowicz/activitywatch/ Reproducible: Always
Copr build: https://copr.fedorainfracloud.org/coprs/build/7407337 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2279057-nodejs-aw-webui/fedora-rawhide-x86_64/07407337-nodejs-aw-webui/fedora-review/review.txt Found issues: - Not a valid SPDX expression '0BSD and Apache-2.0 and (Apache-2.0 OR MIT) and Artistic-2.0 and BSD-2-Clause and BSD-3-Clause and CC-BY-4.0 and ISC and MIT and MPL-2.0 and (MPL-2.0 OR Apache-2.0) and Unlicense and W3C-20150513"'. Read more: https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
[fedora-review-service-build]
Created attachment 2031459 [details] The .spec file difference from Copr build 7407337 to 7412626
Copr build: https://copr.fedorainfracloud.org/coprs/build/7412626 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2279057-nodejs-aw-webui/fedora-rawhide-x86_64/07412626-nodejs-aw-webui/fedora-review/review.txt Found issues: - Not a valid SPDX expression '0BSD AND Apache-2.0 AND (Apache-2.0 OR MIT) AND Artistic-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CC-BY-4.0 AND ISC AND MIT AND MPL-2.0 AND (MPL-2.0 OR Apache-2.0) AND Unlicense AND W3C-20150513'. Read more: https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
Created attachment 2032397 [details] The .spec file difference from Copr build 7412626 to 7429313
Copr build: https://copr.fedorainfracloud.org/coprs/build/7429313 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2279057-nodejs-aw-webui/fedora-rawhide-x86_64/07429313-nodejs-aw-webui/fedora-review/review.txt Please take a look if any issues were found. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated Issues ====== - The License field is incomplete. In addition to MPL-2.0, these files have different licenses: src/visualizations/sunburst-clock.ts: Apache-2.0 media-fonts/varela-round-latin.woff2: OFL-1.1-RFN - Where is the bundled-licenses file produced by nodejs-packaging-bundler? See https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/#_bundled_licenses - I'm a little worried about Source3. The README.md file in that tarball says it contains media assets "included as a git submodule in repos like aw-qt and aw-webui". So if we have other Fedora packages that include this, we'll duplicate these media assets. Wouldn't it be better to make that a separate package that can then be referenced from nodejs-aw-webui, and possibly other packages later? - The varela-round-latin font is not being handled in accordance with the font packaging guidelines: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_avoid_bundling_of_fonts_in_other_packages - Should the spec file include "Requires: nodejs", as in the example spec? https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/#_example_spec - Just a suggestion: rpm now supports a syntax for conditionals that is a little easier to understand: %bcond check 1 ===== MUST items ===== Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [!]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "Unknown or generated", "*No copyright* Mozilla Public License 2.0", "BSD 3-Clause License", "*No copyright* BSD 3-Clause License", "ISC License and/or MIT License", "*No copyright* ISC License", "MIT License", "*No copyright* MIT License", "MIT License [generated file]", "*No copyright* Apache License 2.0", "ISC License", "Apache License 2.0 and/or MIT License", "BSD 2-Clause License", "*No copyright* BSD 2-Clause License", "Apache License 2.0", "*No copyright* Creative Commons Attribution 4.0", "Apache License 2.0 and/or ISC License", "Apache License 2.0 and/or BSD 2-Clause License", "*No copyright* Artistic License 2.0", "*No copyright* The Unlicense", "*No copyright* DON'T BE A DICK PUBLIC LICENSE", "W3C License", "*No copyright* W3C Software and Document Notice and License (2015-05-13)", "Academic Free License v2.1 and/or BSD 3-Clause License", "*No copyright* Academic Free License", "*No copyright* Academic Free License v2.1", "*No copyright* Creative Commons CC0 1.0", "MIT License and/or X11 License", "Do What The Fuck You Want To Public License, Version 2 and/or MIT License", "*No copyright* MIT License and/or X11 License", "Creative Commons CC0 1.0", "BSD 3-Clause License and/or MIT License", "Creative Commons Attribution 3.0", "*No copyright* Creative Commons Attribution 3.0", "*No copyright* BSD 2-Clause License and/or BSD 3-Clause License and/or GNU Lesser General Public License, Version 2.1 and/or MIT License", "*No copyright* BSD 3-Clause Clear License", "BSD 0-Clause License", "*No copyright* BSD 0-Clause License", "BSD 2-Clause with views sentence", "*No copyright* Creative Commons Attribution-ShareAlike 4.0", "Apache License 2.0 and/or BSD 3-Clause License", "GNU Library General Public License v2 or later", "*No copyright* MIT License [generated file]". 42442 files have unknown license. Detailed output of licensecheck in /home/jamesjer/2279057-nodejs-aw-webui/licensecheck.txt [!]: Package contains no bundled libraries without FPC exception. [x]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [x]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [-]: Package contains systemd file(s) if in need. [x]: Package is not known to require an ExcludeArch tag. [x]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: The License field must be a valid SPDX expression. [x]: Package requires other packages for directories it uses. [x]: Package must own all directories that it creates. [x]: Package does not own files or directories owned by other packages. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package must not depend on deprecated() packages. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 4211 bytes in 1 files. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [-]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [x]: Final provides and requires are sane (see attachments). [?]: Package functions as described. [!]: Latest version is packaged. There have been more commits since the commit referenced by this package. [x]: Package does not include license text files separate from upstream. [-]: Sources are verified with gpgverify first in %prep if upstream publishes signatures. Note: gpgverify is not used. [x]: %check is present and all tests pass. [x]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Package should compile and build into binary rpms on all supported architectures. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on all installed packages. Note: No rpmlint messages. [x]: Spec file according to URL is the same as in SRPM. Rpmlint ------- Checking: nodejs-aw-webui-0^20240509.cb83d12-1.fc41.noarch.rpm nodejs-aw-webui-0^20240509.cb83d12-1.fc41.src.rpm ================================================ rpmlint session starts ================================================ rpmlint: 2.5.0 configuration: /usr/lib/python3.12/site-packages/rpmlint/configdefaults.toml /etc/xdg/rpmlint/fedora-legacy-licenses.toml /etc/xdg/rpmlint/fedora-spdx-licenses.toml /etc/xdg/rpmlint/fedora.toml /etc/xdg/rpmlint/scoring.toml /etc/xdg/rpmlint/users-groups.toml /etc/xdg/rpmlint/warn-on-functions.toml rpmlintrc: [PosixPath('/tmp/tmpiwslrd2h')] checks: 32, packages: 2 nodejs-aw-webui.src: W: strange-permission aw-webui-cb83d12-nm-dev.tgz 744 nodejs-aw-webui.src: W: strange-permission aw-webui-cb83d12-nm-prod.tgz 744 nodejs-aw-webui.src: W: strange-permission nodejs-aw-webui.spec 744 nodejs-aw-webui.spec: W: invalid-url Source2: aw-webui-cb83d12-nm-dev.tgz nodejs-aw-webui.spec: W: invalid-url Source1: aw-webui-cb83d12-nm-prod.tgz =========== 2 packages and 0 specfiles checked; 0 errors, 5 warnings, 7 filtered, 0 badness; has taken 1.1 s =========== Rpmlint (installed packages) ---------------------------- ============================ rpmlint session starts ============================ rpmlint: 2.5.0 configuration: /usr/lib/python3.12/site-packages/rpmlint/configdefaults.toml /etc/xdg/rpmlint/fedora-legacy-licenses.toml /etc/xdg/rpmlint/fedora-spdx-licenses.toml /etc/xdg/rpmlint/fedora.toml /etc/xdg/rpmlint/scoring.toml /etc/xdg/rpmlint/users-groups.toml /etc/xdg/rpmlint/warn-on-functions.toml checks: 32, packages: 1 1 packages and 0 specfiles checked; 0 errors, 0 warnings, 3 filtered, 0 badness; has taken 0.1 s Source checksums ---------------- https://github.com/ActivityWatch/media/archive/ae8d3737a4984cc891076dc830ad117b13288a9f/media-ae8d373.tar.gz : CHECKSUM(SHA256) this package : 2e2daddeb61cf3289b2894f3d21e6e8edc997a777c2cb1c995841dc276368872 CHECKSUM(SHA256) upstream package : 2e2daddeb61cf3289b2894f3d21e6e8edc997a777c2cb1c995841dc276368872 https://github.com/ActivityWatch/aw-webui/archive/cb83d124961affe2ae25f488eb14422ee35e66c8/aw-webui-cb83d12.tar.gz : CHECKSUM(SHA256) this package : 22bfdc8b49d65add274e75347804000e81ce0f0d4dc0039d7914635f7b55d55f CHECKSUM(SHA256) upstream package : 22bfdc8b49d65add274e75347804000e81ce0f0d4dc0039d7914635f7b55d55f Requires -------- nodejs-aw-webui (rpmlib, GLIBC filtered): Provides -------- nodejs-aw-webui: nodejs-aw-webui Generated by fedora-review 0.10.0 (e79b66b) last change: 2023-07-24 Command line :/usr/bin/fedora-review -b 2279057 -m fedora-rawhide-x86_64 Buildroot used: fedora-rawhide-x86_64 Active plugins: Shell-api, Generic Disabled plugins: Ocaml, Java, C/C++, Perl, fonts, SugarActivity, R, Ruby, Python, Haskell, PHP Disabled flags: EXARCH, EPEL6, EPEL7, DISTTAG, BATCH
(In reply to Jerry James from comment #8) > Package Review > ============== > > Legend: > [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated > > Issues > ====== > - The License field is incomplete. In addition to MPL-2.0, these files have > different licenses: > src/visualizations/sunburst-clock.ts: Apache-2.0 > media-fonts/varela-round-latin.woff2: OFL-1.1-RFN I've found one more missing license. Could you check if it's OK now? > - Where is the bundled-licenses file produced by nodejs-packaging-bundler? > See > > https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/ > #_bundled_licenses Since I don't bundle any npm package and it's marked as "recommended", I just didn't include it. I've included it now. > - I'm a little worried about Source3. The README.md file in that tarball > says > it contains media assets "included as a git submodule in repos like aw-qt > and aw-webui". So if we have other Fedora packages that include this, > we'll > duplicate these media assets. Wouldn't it be better to make that a > separate > package that can then be referenced from nodejs-aw-webui, and possibly > other > packages later? I investigated it further and here are my findings: 1) aw-qt uses logo.png and logo-128.png from Source3 2) aw-webui uses only logo.png and logo.svg from Source3 I just added linked those two files directly from the GitHub. Please take a look. Should it still ba a separate aw-media package, then I can do it. > - The varela-round-latin font is not being handled in accordance with the > font > packaging guidelines: > > https://docs.fedoraproject.org/en-US/packaging-guidelines/ > #_avoid_bundling_of_fonts_in_other_packages I removed it altogether and it works still. > - Should the spec file include "Requires: nodejs", as in the example spec? > > https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/ > #_example_spec It's only a build dependency for aw-server-rust. aw-server-rust embeds it in its executable file. Do you think this package should require nodejs then? > - Just a suggestion: rpm now supports a syntax for conditionals that is a > little easier to understand: > > %bcond check 1 Yes. I know, but rust packages still use %bcond_without and I want to be consistent with them. Anyway, I removed it altogether. > ===== MUST items ===== > > Generic: > [!]: License field in the package spec file matches the actual license. > Note: Checking patched sources after %prep for licenses. Licenses > found: "Unknown or generated", "*No copyright* Mozilla Public License > 2.0", "BSD 3-Clause License", "*No copyright* BSD 3-Clause License", > "ISC License and/or MIT License", "*No copyright* ISC License", "MIT > License", "*No copyright* MIT License", "MIT License [generated > file]", "*No copyright* Apache License 2.0", "ISC License", "Apache > License 2.0 and/or MIT License", "BSD 2-Clause License", "*No > copyright* BSD 2-Clause License", "Apache License 2.0", "*No > copyright* Creative Commons Attribution 4.0", "Apache License 2.0 > and/or ISC License", "Apache License 2.0 and/or BSD 2-Clause License", > "*No copyright* Artistic License 2.0", "*No copyright* The Unlicense", > "*No copyright* DON'T BE A DICK PUBLIC LICENSE", "W3C License", "*No > copyright* W3C Software and Document Notice and License (2015-05-13)", > "Academic Free License v2.1 and/or BSD 3-Clause License", "*No > copyright* Academic Free License", "*No copyright* Academic Free > License v2.1", "*No copyright* Creative Commons CC0 1.0", "MIT License > and/or X11 License", "Do What The Fuck You Want To Public License, > Version 2 and/or MIT License", "*No copyright* MIT License and/or X11 > License", "Creative Commons CC0 1.0", "BSD 3-Clause License and/or MIT > License", "Creative Commons Attribution 3.0", "*No copyright* Creative > Commons Attribution 3.0", "*No copyright* BSD 2-Clause License and/or > BSD 3-Clause License and/or GNU Lesser General Public License, Version > 2.1 and/or MIT License", "*No copyright* BSD 3-Clause Clear License", > "BSD 0-Clause License", "*No copyright* BSD 0-Clause License", "BSD > 2-Clause with views sentence", "*No copyright* Creative Commons > Attribution-ShareAlike 4.0", "Apache License 2.0 and/or BSD 3-Clause > License", "GNU Library General Public License v2 or later", "*No > copyright* MIT License [generated file]". 42442 files have unknown > license. Detailed output of licensecheck in > /home/jamesjer/2279057-nodejs-aw-webui/licensecheck.txt Is it about all licenses listed above or only about missing Apache-2.0 and OFL-1.1-RFN? > [!]: Package contains no bundled libraries without FPC exception. Was it only about varela-round-latin? > ===== SHOULD items ===== > > Generic: > [!]: Latest version is packaged. > > There have been more commits since the commit referenced by this > package. Since it's provided as a git repository and not as releases it will be like that. I've just updated to the last commit and everything still works. > Rpmlint > ------- > Checking: nodejs-aw-webui-0^20240509.cb83d12-1.fc41.noarch.rpm > nodejs-aw-webui-0^20240509.cb83d12-1.fc41.src.rpm > ================================================ rpmlint session starts > ================================================ > rpmlint: 2.5.0 > configuration: > /usr/lib/python3.12/site-packages/rpmlint/configdefaults.toml > /etc/xdg/rpmlint/fedora-legacy-licenses.toml > /etc/xdg/rpmlint/fedora-spdx-licenses.toml > /etc/xdg/rpmlint/fedora.toml > /etc/xdg/rpmlint/scoring.toml > /etc/xdg/rpmlint/users-groups.toml > /etc/xdg/rpmlint/warn-on-functions.toml > rpmlintrc: [PosixPath('/tmp/tmpiwslrd2h')] > checks: 32, packages: 2 > > nodejs-aw-webui.src: W: strange-permission aw-webui-cb83d12-nm-dev.tgz 744 > nodejs-aw-webui.src: W: strange-permission aw-webui-cb83d12-nm-prod.tgz 744 > nodejs-aw-webui.src: W: strange-permission nodejs-aw-webui.spec 744 I've fixed those permissions. I've updated the spec file in my first comment. I hope that [fedora-review-service-build] will rebuild it.
Created attachment 2033945 [details] The .spec file difference from Copr build 7429313 to 7460304
Copr build: https://copr.fedorainfracloud.org/coprs/build/7460304 (failed) Build log: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2279057-nodejs-aw-webui/fedora-rawhide-x86_64/07460304-nodejs-aw-webui/builder-live.log.gz Please make sure the package builds successfully at least for Fedora Rawhide. - If the build failed for unrelated reasons (e.g. temporary network unavailability), please ignore it. - If the build failed because of missing BuildRequires, please make sure they are listed in the "Depends On" field --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
Created attachment 2034000 [details] The .spec file difference from Copr build 7460304 to 7461864
Copr build: https://copr.fedorainfracloud.org/coprs/build/7461864 (failed) Build log: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2279057-nodejs-aw-webui/fedora-rawhide-x86_64/07461864-nodejs-aw-webui/builder-live.log.gz Please make sure the package builds successfully at least for Fedora Rawhide. - If the build failed for unrelated reasons (e.g. temporary network unavailability), please ignore it. - If the build failed because of missing BuildRequires, please make sure they are listed in the "Depends On" field --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
I want to apologize for the silence. I had a giant pile of work dropped on me, then I went on vacation, then I came home to another giant pile of work. I've been slowly catching up with Fedora tasks and am finally reaching the review requests. I should be more responsive now. Your responses to my concerns all seem quite reasonable. I am happy with the current state of the package. This package is APPROVED. (In reply to wojnilowicz from comment #9) > I've found one more missing license. Could you check if it's OK now? Good catch! Yes, that looks fine. > Since I don't bundle any npm package and it's marked as "recommended", I > just didn't include it. I've included it now. Okay, that makes sense. If you don't think it adds value, then feel free to remove it again. > I investigated it further and here are my findings: > 1) aw-qt uses logo.png and logo-128.png from Source3 > 2) aw-webui uses only logo.png and logo.svg from Source3 > > I just added linked those two files directly from the GitHub. Please take a > look. Should it still ba a separate aw-media package, then I can do it. Okay, I'm fine with that approach for now. If more packages show up that need those files, then an aw-media package would be the way to go. > I removed it altogether and it works still. Okay. I see the CSS file falls back to "sans-serif" if the font is not available, so that should be okay. > It's only a build dependency for aw-server-rust. aw-server-rust embeds it in > its executable file. Do you think this package should require nodejs then? I'm asking these questions because I don't know the answers. :-) If it doesn't really require nodejs, then by all means omit it. > Is it about all licenses listed above or only about missing Apache-2.0 and > OFL-1.1-RFN? The latter. The rest are due to licensecheck looking through the bundled nodejs files. > Was it only about varela-round-latin? That and the media files. I'm satisfied with your answers.
The Pagure repository was created at https://src.fedoraproject.org/rpms/nodejs-aw-webui
(In reply to Jerry James from comment #15) > I want to apologize for the silence. I had a giant pile of work dropped on > me, then I went on vacation, then I came home to another giant pile of work. > I've been slowly catching up with Fedora tasks and am finally reaching the > review requests. I should be more responsive now. No problem. I still have several packages to package before I can use it. I'm glad it moves forward though. Thanks for the review. I committed the package exactly as posted here.
FEDORA-2024-a787601cea (nodejs-aw-webui-0^20240518.05c25c9-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-a787601cea
FEDORA-2024-a787601cea (nodejs-aw-webui-0^20240518.05c25c9-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.