Bug 2418762 - Review Request: smallstep - private CA with ACME
Summary: Review Request: smallstep - private CA with ACME
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody's working on this, feel free to take it
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-04 04:04 UTC by Stuart D Gathman
Modified: 2026-03-06 19:45 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)
The .spec file difference from Copr build 9864495 to 10178465 (3.85 KB, patch)
2026-02-28 03:53 UTC, Fedora Review Service
no flags Details | Diff
The .spec file difference from Copr build 10178465 to 10191682 (1.70 KB, patch)
2026-03-05 01:11 UTC, Fedora Review Service
no flags Details | Diff
The .spec file difference from Copr build 10191682 to 10198338 (420 bytes, patch)
2026-03-06 19:45 UTC, Fedora Review Service
no flags Details | Diff

Description Stuart D Gathman 2025-12-04 04:04:19 UTC
Spec URL: https://gathman.org/linux/SPECS/smallstep.spec
SRPM URL: https://gathman.org/linux/f44/src/smallstep-0.28.4-9.fc44.src.rpm
Description: A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.  Also supports TLS with private TLDs and DNS.
Fedora Account System Username: sdgathman

Comment 2 Fedora Review Service 2025-12-04 04:14:51 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/9864490
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2418762-smallstep/fedora-rawhide-x86_64/09864490-smallstep/fedora-review/review.txt

Please take a look if any issues were found.


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 3 Fedora Review Service 2025-12-04 04:16:16 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/9864495
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2418762-smallstep/fedora-rawhide-x86_64/09864495-smallstep/fedora-review/review.txt

Please take a look if any issues were found.


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 4 Stuart D Gathman 2025-12-04 17:47:30 UTC
The auto review doesn't like 1.3M in /usr/share - but this is all LICENSE and NOTICE files.  This seems unavoidable with the fragmented golang libraries.

Comment 5 Stuart D Gathman 2026-02-23 12:53:39 UTC
Install on a fresh vm fails because -r on useradd prevents creating home dir.  Need new release.  New vendor version up as well.

Comment 6 Stuart D Gathman 2026-02-28 03:21:13 UTC
Spec URL: https://gathman.org/linux/SPECS/smallstep.spec
SRPM URL: https://gathman.org/linux/SRPMS/smallstep-0.29.0-2.fc44.src.rpm

New upstream release, switch to systemd-sysusers for service uid.

Comment 7 Fedora Review Service 2026-02-28 03:53:34 UTC
Created attachment 2131365 [details]
The .spec file difference from Copr build 9864495 to 10178465

Comment 8 Fedora Review Service 2026-02-28 03:53:37 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10178465
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2418762-smallstep/fedora-rawhide-x86_64/10178465-smallstep/fedora-review/review.txt

Found issues:

- Not a valid SPDX expression 'Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LicenseRef-scancode-proprietary-license AND MIT AND MPL-2.0'.
  Read more: https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 9 Stuart D Gathman 2026-03-05 01:08:53 UTC
Spec URL: https://gathman.org/linux/SPECS/smallstep.spec
SRPM URL: https://gathman.org/linux/SRPMS/smallstep-0.29.0-3.fc44.src.rpm

The vendored module askalono couldn't recognize was github.com/google/go-tpm-tools/LICENSE
The LICENSE files concatenates submodule LICENSES, and the vendored archive does not include the simulator/ms-tpm-20-ref submodule - the submodule with the incompatible license.

I edited License: in the spec to remove the LicenseRef-scancode-proprietary-license (after confirming the only the ms-tpm-20-ref license was flagged as that by askalono).  I added a comment to explain why I changed the output of go_vendor_license.  I'm not sure if that is the correct way to handle this situation.  For one thing, I have to do it for every upgrade - but then licenses have to be re-examined anyway.

Comment 10 Stuart D Gathman 2026-03-05 01:10:30 UTC
If I'm reading the go-tpm-tools LICENSE wrong, let me know.  IANAL

Comment 11 Fedora Review Service 2026-03-05 01:11:27 UTC
Created attachment 2132110 [details]
The .spec file difference from Copr build 10178465 to 10191682

Comment 12 Fedora Review Service 2026-03-05 01:11:29 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10191682
(failed)

Build log:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2418762-smallstep/fedora-rawhide-x86_64/10191682-smallstep/builder-live.log.gz

Please make sure the package builds successfully at least for Fedora Rawhide.

- If the build failed for unrelated reasons (e.g. temporary network
  unavailability), please ignore it.
- If the build failed because of missing BuildRequires, please make sure they
  are listed in the "Depends On" field


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 13 Stuart D Gathman 2026-03-06 19:38:15 UTC
Spec URL: https://gathman.org/linux/SPECS/smallstep.spec
SRPM URL: https://gathman.org/linux/SRPMS/smallstep-0.29.0-3.fc44.src.rpm

Update go-vendor-tools.toml to remove licenses for ms-tpm-20-ref submodule (which is NOT vendored).  I asked on legal mailing list, and while it seems fairly clear that "Microsoft simulator code (in simulator/ms-tpm-20-ref) uses the following licenses" means that *all* of the following licenses apply to ms-tpm-20-ref, I will also ask for additional clarification on github.com/google/go-tpm-tools .

Comment 14 Fedora Review Service 2026-03-06 19:45:18 UTC
Created attachment 2132329 [details]
The .spec file difference from Copr build 10191682 to 10198338

Comment 15 Fedora Review Service 2026-03-06 19:45:21 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/10198338
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2418762-smallstep/fedora-rawhide-x86_64/10198338-smallstep/fedora-review/review.txt

Please take a look if any issues were found.


---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.


Note You need to log in before you can comment on or make changes to this bug.