Bug 2359878 - Review Request: gpgverify - signature verifier for easy and safe scripting
Summary: Review Request: gpgverify - signature verifier for easy and safe scripting
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Neal Gompa
QA Contact: Fedora Extras Quality Assurance
URL: https://src.fedoraproject.org/rpms/gp...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-15 20:42 UTC by Björn Persson
Modified: 2025-05-09 09:11 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-05-09 09:11:23 UTC
Type: ---
Embargoed:
ngompa13: fedora-review+


Attachments (Terms of Use)
The .spec file difference from Copr build 8907820 to 9006683 (921 bytes, patch)
2025-05-07 07:47 UTC, Fedora Review Service
no flags Details | Diff

Description Björn Persson 2025-04-15 20:42:22 UTC
Spec URL: https://www.Rombobjörn.se/packages/gpgverify-2.1-1/gpgverify.spec
SRPM URL: https://www.Rombobjörn.se/packages/gpgverify-2.1-1/gpgverify-2.1-1.fc43.src.rpm

Description:
GPGverify is a wrapper around GnuPG's gpgv. It verifies a file against an OpenPGP signature and one or more keyrings. Rather than assuming manual use by a knowledgeable user, GPGverify is designed to be easy to use safely in a script. It avoids various unsafe ways of using gpgv that could make a script vulnerable.

Fedora Account System Username: rombobeorn

The package above is for Fedora 43 and later. In Fedora 41 and 42 I'll use this spec file:
https://www.Rombobjörn.se/packages/gpgverify-1-1/gpgverify.spec
This one is a metapackage that pulls in gnupg2. It will allow spec files to require "gpgverify" in Fedora 41 and 42 too, so the Packaging Guidelines can be updated without waiting a year.

Comment 1 Fedora Review Service 2025-04-15 20:46:28 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/8907820
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2359878-gpgverify/fedora-rawhide-x86_64/08907820-gpgverify/fedora-review/review.txt

Please take a look if any issues were found.


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 2 Björn Persson 2025-04-15 20:49:25 UTC
Neal Gompa asked to be pinged.

Comment 3 Neal Gompa 2025-04-16 00:05:44 UTC
Taking this for review.

Comment 4 Neal Gompa 2025-05-04 00:16:49 UTC
Spec review:

> License:        Boehm-GC

This is missing a license file in the sources that is installed along with the package. Can you please add one?

Comment 5 Björn Persson 2025-05-05 15:58:08 UTC
I thought it would be enough to have the license header in both files. If I make a separate license file, what do I write for a copyright notice in that file? SPDX requires the exact words "the above copyright notice", so the license file needs to contain some copyright notice for that phrase to refer to. Should I sort of merge the copyright notices of the script and the macro?

Comment 6 Neal Gompa 2025-05-05 17:18:13 UTC
Basically a file with a copy of the notice you have in the header is sufficient.

Comment 8 Fedora Review Service 2025-05-07 07:47:15 UTC
Created attachment 2088748 [details]
The .spec file difference from Copr build 8907820 to 9006683

Comment 9 Fedora Review Service 2025-05-07 07:47:18 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/9006683
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2359878-gpgverify/fedora-rawhide-x86_64/09006683-gpgverify/fedora-review/review.txt

Please take a look if any issues were found.


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 10 Neal Gompa 2025-05-08 00:18:41 UTC
Review notes:

* Package follows Fedora packaging guidelines
* Package licensing is correct and license data is installed
* Package builds and installs
* No serious issues from rpmlint

PACKAGE APPROVED.

Comment 11 Fedora Admin user for bugzilla script actions 2025-05-08 06:05:01 UTC
The Pagure repository was created at https://src.fedoraproject.org/rpms/gpgverify

Comment 12 Björn Persson 2025-05-09 09:11:23 UTC
Built, tested and submitted for Rawhide. Thanks for the review.


Note You need to log in before you can comment on or make changes to this bug.