Fedora Account System
Red Hat Associate
Red Hat Customer
Spec URL: https://pemensik.fedorapeople.org/dns-root-data.spec SRPM URL: https://pemensik.fedorapeople.org/dns-root-data-2025080400-3.fc44.src.rpm Description: This package contains various root zone related data as published by IANA to be used by various DNS software as a common source of DNS root zone data, namely: * Root Hints (root.hints) * Root Trust Anchors (root.key, root.ds) Fedora Account System Username: pemensik
This package built on koji: https://koji.fedoraproject.org/koji/taskinfo?taskID=138285845
The idea for this is to have shared DNSSEC root anchor data and DNS root-servers.net hints provided in separate, shareable files. It is based on Debian scripts, although these data are offered by IANA to everyone, public domain. Candidates for these files are any DNSSEC validating implementations: - bind - bind9-next - unbound - dnsmasq - knot-resolver - pdns-recursor - ldns-utils Maybe others, like systemd-resolved
Copr build: https://copr.fedorainfracloud.org/coprs/build/9704184 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2405013-dns-root-data/fedora-rawhide-x86_64/09704184-dns-root-data/fedora-review/review.txt Please take a look if any issues were found. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
Technical side looks good, but I have two reservations: 1. I would love to see checksums of important pieces we pull from Debian. It is kinda pointless to verify signatures if we pull files and _also_ the signatures from the same source without any verification. I understand it is major PITA, but imagine someone hacks Debian and modifies the Perl script (or CA bundle or ...) to do something nefarious. In that case Fedora gets hosed as well, transitively. 2. License seems incorrect - https://salsa.debian.org/dns-team/dns-root-data/-/blob/debian/master/debian/copyright does not mention MIT anywhere. This might be a detective story and I don't know what to do with it.
They mention Expat license. The wording of it is exactly what other distributions and spdx.org lists as MIT license. Check this and compare it with text they have in debian/copyright. I think I use correct SPDX name for that license: https://spdx.org/licenses/MIT.html The common way in Fedora is to include keys in dist-git repository itself, even when sources and signatures are stored in lookaside cache. You are correct, I should probably include those signatures as Source and use them to verify signatures.
Spec URL: https://github.com/pemensik/dns-root-data/raw/refs/heads/fedora/dns-root-data.spec SRPM URL: https://pemensik.fedorapeople.org/srpm/dns-root-data-2025080400-6.fc44.src.rpm Okay, added mention to IANA licensing of content. Added fetching of icannbundle.pem and registry-admin.key in spec file to fetch them and work as trust anchor for them. Have not found registry-admin.key with a good source, linking it to ubuntu keyserver only.
I'm still nervous we get the Perl script from Debian because it requires inspection on each import (into lookaside cache) to ensure there is nothing bad in it. But I guess that applies to the whole package which is as sensitive as it can possibly be ...
Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated [ ] = Manual review needed ===== MUST items ===== Generic: [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. Note: Using prebuilt packages [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [x]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "Unknown or generated", "MIT License". 20 files have unknown license. Detailed output of licensecheck in /var/lib/copr- rpmbuild/results/dns-root-data/licensecheck.txt [x]: Package contains no bundled libraries without FPC exception. [-]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [-]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [-]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [-]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [-]: Package contains systemd file(s) if in need. [x]: Package is not known to require an ExcludeArch tag. [x]: Package complies to the Packaging Guidelines [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: The License field must be a valid SPDX expression. [x]: Package requires other packages for directories it uses. [x]: Package must own all directories that it creates. [x]: Package does not own files or directories owned by other packages. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package must not depend on deprecated() packages. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 1835 bytes in 1 files. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [x]: Reviewer should test that the package builds in mock. [x]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [x]: Final provides and requires are sane (see attachments). [x]: Package functions as described. [x]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [x]: Sources are verified with gpgverify first in %prep if upstream publishes signatures. Note: gpgverify is not the first command in %prep. Source 0 is not passed to gpgverify. [-]: Package should compile and build into binary rpms on all supported architectures. [-]: %check is present and all tests pass. [-]: Packages should try to preserve timestamps of original installed files. [x]: Spec use %global instead of %define unless justified. Note: %define requiring justification: %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on all installed packages. Note: No rpmlint messages.
Good job with this mess. Approved - thank you!
The Pagure repository was created at https://src.fedoraproject.org/rpms/dns-root-data
Requesting repo requires assigned person to be same as the person setting review+ flag.
FEDORA-2025-ba906832a8 (dns-root-data-2025080400-2.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2025-ba906832a8
FEDORA-2025-7d84c8471d (dns-root-data-2025080400-2.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-7d84c8471d
Thanks for the quick review, Petr!
FEDORA-2025-ba906832a8 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf install --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-ba906832a8 \*` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-ba906832a8 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-7d84c8471d has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf install --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-7d84c8471d \*` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-7d84c8471d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-ba906832a8 (dns-root-data-2025080400-2.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2025-7d84c8471d (dns-root-data-2025080400-2.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.