Fedora Account System
Red Hat Associate
Red Hat Customer
Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm Description: A pure Unix shell script implementing ACME client protocol. - An ACME protocol client written purely in Shell (Unix shell) language. - Full ACME protocol implementation. - Support ECDSA certs - Support SAN and wildcard certs - Simple, powerful and very easy to use. You only need 3 minutes to learn it. - Bash, dash and sh compatible. - Purely written in Shell with no dependencies on python. - Just one script to issue, renew and install your certificates automatically. - DOES NOT require root/sudoer access. - Docker ready - IPv6 ready - Cron job notifications for renewal or error etc. Fedora Account System Username: mikelo2
Hi! I'm new to Fedora Packaging and reviewing some packages as part of working towards sponsorship into the packager group. I use `acme.sh` quite a bit myself, so it seemed fitting to review this one. I can't perform binding reviews yet, but hopefully this helps. I'll post some things I spotted this comment and then I can post the full fedora-review checklist in the future. 1. The License field isn't a valid SPDX expression because of the use of `GPL-3.0` based on https://spdx.org/licenses/ this needs to be either `GPL-3.0-only` or `GPL-3.0-or-later`. 2. From what I understand, the systemd_post scriptlet needs activating in the %post section too, even if the timer isn't being started by default. Other than that, this is looking pretty good to me so far.
Thanks Alex for your review! Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm - Changed license to GPL-3.0-or-later - Added systemd_post scriplet
Copr build: https://copr.fedorainfracloud.org/coprs/build/9150225 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2370890-acme.sh/fedora-rawhide-x86_64/09150225-acme.sh/fedora-review/review.txt Found issues: - Systemd service file(s) in acme.sh Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_scriptlets Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm Another try to check if the systemd issue is gone
Created attachment 2093565 [details] The .spec file difference from Copr build 9150225 to 9150712
Copr build: https://copr.fedorainfracloud.org/coprs/build/9150712 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2370890-acme.sh/fedora-rawhide-x86_64/09150712-acme.sh/fedora-review/review.txt Found issues: - Systemd service file(s) in acme.sh Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_scriptlets Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
Just a few comments: ``` %post %systemd_post acmesh-renew.timer # Remind users to start acmesh-renew.timer if they need acme.sh to automatically renew certs if [ "$1" -eq 1 ] ; then echo "" echo "acme.sh auto renewal timer is not started by default." echo "Run 'systemctl start acmesh-renew.timer' to enable automatic renewals." fi %preun %systemd_preun acmesh-renew.timer %postun %systemd_postun_with_restart acmesh-renew.timer ``` I'm pretty sure this not what you want here. I don't think restarting a timer doesn't do anything ... and printing output in RPM scriptlets is very frowned upon. I would just do what's documented in the Packaging Guidelines for systemd services: ``` %post %systemd_post acmesh-renew.service %preun %systemd_preun acmesh-renew.service %postun %systemd_postun_with_restart acmesh-renew.service ```
Spec URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh.spec SRPM URL: https://mikel.olasagasti.info/tmp/fedora/acme.sh-3.1.1-1.fc42.src.rpm I copied the way certbot package is doing: https://src.fedoraproject.org/rpms/certbot/blob/rawhide/f/certbot.spec#_273-293 But agree that it might not be the best option, so new spec changes that.
Hello, just bumping this review. It would be great to have acme.sh included in Fedora. Would anyone available for package review be able to take another look? Is there anything that needs to be done? The latest version is 3.1.2.
Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated ======= Summary ====== I haven't check whether the program works correctly. Some questions: [?]: Package is named according to the Package Naming Guidelines. kanru: "The maintainer MUST NOT use an underscore _, a plus +, kanru: or a period . as a delimiter." We can probably stretch this kanru: exception "packages where the upstream name naturally contains kanru: an underscore are excluded from this." to also apply to dot '.' kanru: It would be good to confirm with devel@ [!]: Requires correct, justified where necessary. kanru: If I understand correctly acme.sh requires the openssl binary kanru: The spec should add Requires: openssl and Recommends: socat Additional: What do you think about creating a selinux policy subpackage for it? I feel a shell script that have network access and writes to cert directory would be a good target to be confined with selinux, to ensure it can't write to other directories. ===== MUST items ===== Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [x]: License field in the package spec file matches the actual license. [x]: If the package is under multiple licenses, the licensing breakdown must be documented in the spec. [x]: Package contains no bundled libraries or specifies bundled libraries with Provides: bundled(<libname>) if unbundling is not possible. [x]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [?]: Package is named according to the Package Naming Guidelines. kanru: "The maintainer MUST NOT use an underscore _, a plus +, kanru: or a period . as a delimiter." We can probably stretch this kanru: exception "packages where the upstream name naturally contains kanru: an underscore are excluded from this." to also apply to dot '.' [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [!]: Requires correct, justified where necessary. kanru: If I understand correctly acme.sh requires the openssl binary kanru: The spec should add Requires: openssl and Recommends: socat [x]: Spec file is legible and written in American English. [x]: Package contains systemd file(s) if in need. [x]: Package is not known to require an ExcludeArch tag. [x]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 22650 bytes in 3 files. [x]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: The License field must be a valid SPDX expression. [x]: Package requires other packages for directories it uses. [x]: Package must own all directories that it creates. [x]: Package does not own files or directories owned by other packages. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package must not depend on deprecated() packages. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: systemd_post is invoked in %post, systemd_preun in %preun, and systemd_postun in %postun for Systemd service files. Note: Systemd service file(s) in acme.sh [x]: File names are valid UTF-8. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [-]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [x]: Final provides and requires are sane (see attachments). [?]: Package functions as described. [!]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [?]: Sources are verified with gpgverify first in %prep if upstream publishes signatures. Note: gpgverify is not used. [x]: Package should compile and build into binary rpms on all supported architectures. [?]: %check is present and all tests pass. [x]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on all installed packages. [x]: Spec file according to URL is the same as in SRPM.