Spec URL: https://jgrulich.fedorapeople.org/xdg-native-messaging-proxy.spec SRPM URL: https://jgrulich.fedorapeople.org/xdg-native-messaging-proxy-0.1.0-1.fc43.src.rpm Description: This is a small service which can be used to find native messaging host manifests, as well as start and stop those native messaging hosts. Applications running inside a sandbox might have a limited view of the host which might prevent them from finding and executing native messaging hosts which exist outside of the sandbox. This proxy is supposed to run outside of any sandbox, which will make the native messaging hosts outside the sandbox available to anyone with access to the dbus service. Fedora Account System Username: jgrulich
Copr build: https://copr.fedorainfracloud.org/coprs/build/10224709 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2447277-xdg-native-messaging-proxy/fedora-rawhide-x86_64/10224709-xdg-native-messaging-proxy/fedora-review/review.txt Found issues: - Systemd user unit service file(s) in xdg-native-messaging-proxy Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_user_units Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
> ... available to anyone with access to the dbus service. A little nitpick, could you use "D-Bus" instead of "dbus" in the text, please? Quotes for clarity only. It may or may not be inherited from the upstream, in any case it'll be better typed as it should be in Fedora. > License: LGPL-2.0-or-later The GitHub repo says "LGPL-2.1 license", which reflects their COPYING file. The source files have: "SPDX-License-Identifier: LGPL-2.1-or-later" in the top comments. I would follow the source files. > Requires: dbus I'm not sure of that. It may get it as a transitive auto-dependency from glib2/gio, maybe? it surely does not use dbus library directly, but through glib2. The rest in the template: Package Review ============== Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated [ ] = Manual review needed Issues: ======= - systemd_user_post is invoked in %post and systemd_user_preun in %preun for Systemd user units service files. Note: Systemd user unit service file(s) in xdg-native-messaging-proxy See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_user_units ===== MUST items ===== C/C++: [x]: Package does not contain kernel modules. [x]: If your application is a C or C++ application you must list a BuildRequires against gcc, gcc-c++ or clang. [x]: Package does not contain any libtool archives (.la) [x]: Package contains no static executables. [x]: Rpath absent or only used for internal libs. Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [!]: License field in the package spec file matches the actual license. Note: Checking patched sources after %prep for licenses. Licenses found: "Unknown or generated", "GNU Lesser General Public License, Version 2.1", "*No copyright* GNU Library General Public License, Version 2.0", "GNU Lesser General Public License, Version 2.1 and/or GNU Library General Public License v2 or later", "GNU Lesser General Public License v2.1 or later", "*No copyright* GNU Lesser General Public License, Version 2.1". 23 files have unknown license. [x]: Package must own all directories that it creates. Note: Directories without known owners: /usr/share/dbus-1, /usr/share/dbus-1/services, /usr/share/dbus-1/interfaces mcrha: I'd expect it being taken care of by the systemd macros [x]: %build honors applicable compiler flags or justifies otherwise. [x]: Package contains no bundled libraries or specifies bundled libraries with Provides: bundled(<libname>) if unbundling is not possible. [-]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [ ]: Requires correct, justified where necessary. [x]: Spec file is legible and written in American English. [x]: Package contains systemd file(s) if in need. [x]: Useful -debuginfo package or justification otherwise. [x]: Package is not known to require an ExcludeArch tag. [x]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: The License field must be a valid SPDX expression. [x]: Package requires other packages for directories it uses. [x]: Package does not own files or directories owned by other packages. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package must not depend on deprecated() packages. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 2072 bytes in 1 files. [x]: Packages must not store files under /srv, /opt or /usr/local ===== SHOULD items ===== Generic: [-]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [x]: Final provides and requires are sane (see attachments). [x]: Package functions as described. [x]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [-]: Sources are verified with gpgverify first in %prep if upstream publishes signatures. Note: gpgverify is not used. [x]: Package should compile and build into binary rpms on all supported architectures. [-]: %check is present and all tests pass. [-]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified. ===== EXTRA items ===== Generic: [x]: Rpmlint is run on debuginfo package(s). Note: No rpmlint messages. [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Large data in /usr/share should live in a noarch subpackage if package is arched. [x]: Spec file according to URL is the same as in SRPM. Rpmlint ------- Checking: xdg-native-messaging-proxy-0.1.0-1.fc45.x86_64.rpm xdg-native-messaging-proxy-0.1.0-1.fc45.src.rpm ============================ rpmlint session starts ============================ rpmlint: 2.8.0 configuration: /usr/lib/python3.14/site-packages/rpmlint/configdefaults.toml /etc/xdg/rpmlint/fedora-spdx-licenses.toml /etc/xdg/rpmlint/fedora.toml /etc/xdg/rpmlint/scoring.toml /etc/xdg/rpmlint/users-groups.toml /etc/xdg/rpmlint/warn-on-functions.toml rpmlintrc: [PosixPath('/tmp/tmpk0y46dtc')] checks: 32, packages: 2 xdg-native-messaging-proxy.src: E: spelling-error ('sandboxed', 'Summary(en_US) sandboxed -> sandboxes, sand boxed, sand-boxed') xdg-native-messaging-proxy.src: E: spelling-error ('dbus', '%description -l en_US dbus -> dubs, bus, buds') xdg-native-messaging-proxy.x86_64: E: spelling-error ('sandboxed', 'Summary(en_US) sandboxed -> sandboxes, sand boxed, sand-boxed') xdg-native-messaging-proxy.x86_64: E: spelling-error ('dbus', '%description -l en_US dbus -> dubs, bus, buds') xdg-native-messaging-proxy.spec: W: no-%check-section xdg-native-messaging-proxy.x86_64: E: incorrect-fsf-address /usr/share/licenses/xdg-native-messaging-proxy/COPYING xdg-native-messaging-proxy.x86_64: W: empty-%postun 2 packages and 0 specfiles checked; 5 errors, 2 warnings, 7 filtered, 5 badness; has taken 0.2 s Rpmlint (debuginfo) ------------------- Checking: xdg-native-messaging-proxy-debuginfo-0.1.0-1.fc45.x86_64.rpm ============================ rpmlint session starts ============================ rpmlint: 2.8.0 configuration: /usr/lib/python3.14/site-packages/rpmlint/configdefaults.toml /etc/xdg/rpmlint/fedora-spdx-licenses.toml /etc/xdg/rpmlint/fedora.toml /etc/xdg/rpmlint/scoring.toml /etc/xdg/rpmlint/users-groups.toml /etc/xdg/rpmlint/warn-on-functions.toml rpmlintrc: [PosixPath('/tmp/tmp41m7zmxv')] checks: 32, packages: 1 1 packages and 0 specfiles checked; 0 errors, 0 warnings, 5 filtered, 0 badness; has taken 0.1 s Rpmlint (installed packages) ---------------------------- /bin/sh: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8): No such file or directory /bin/sh: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8): No such file or directory ============================ rpmlint session starts ============================ rpmlint: 2.8.0 configuration: /usr/lib/python3.14/site-packages/rpmlint/configdefaults.toml /etc/xdg/rpmlint/fedora-spdx-licenses.toml /etc/xdg/rpmlint/fedora.toml /etc/xdg/rpmlint/scoring.toml /etc/xdg/rpmlint/users-groups.toml /etc/xdg/rpmlint/warn-on-functions.toml checks: 32, packages: 2 xdg-native-messaging-proxy.x86_64: E: spelling-error ('sandboxed', 'Summary(en_US) sandboxed -> sandboxes, sand boxed, sand-boxed') xdg-native-messaging-proxy.x86_64: E: spelling-error ('dbus', '%description -l en_US dbus -> dubs, bus, buds') xdg-native-messaging-proxy.x86_64: E: incorrect-fsf-address /usr/share/licenses/xdg-native-messaging-proxy/COPYING xdg-native-messaging-proxy.x86_64: W: empty-%postun 2 packages and 0 specfiles checked; 3 errors, 1 warnings, 9 filtered, 3 badness; has taken 0.2 s Source checksums ---------------- https://github.com/flatpak/xdg-native-messaging-proxy/releases/download/0.1.0/xdg-native-messaging-proxy-0.1.0.tar.xz : CHECKSUM(SHA256) this package : 4167e9408b0b07971e4f6948602cf464e002b2694bb2447e6c06725c273d93cb CHECKSUM(SHA256) upstream package : 4167e9408b0b07971e4f6948602cf464e002b2694bb2447e6c06725c273d93cb Requires -------- xdg-native-messaging-proxy (rpmlib, GLIBC filtered): /bin/sh dbus libc.so.6()(64bit) libdex-1.so.1()(64bit) libgcc_s.so.1()(64bit) libgcc_s.so.1(GCC_3.0)(64bit) libgcc_s.so.1(GCC_3.3.1)(64bit) libgio-2.0.so.0()(64bit) libglib-2.0.so.0()(64bit) libgobject-2.0.so.0()(64bit) libjson-glib-1.0.so.0()(64bit) libjson-glib-1.0.so.0(libjson-glib-1.0.so.0)(64bit) rtld(GNU_HASH) Provides -------- xdg-native-messaging-proxy: xdg-native-messaging-proxy xdg-native-messaging-proxy(x86-64) Generated by fedora-review 0.11.0 (05c5b26) last change: 2025-11-29 Command line :/usr/bin/fedora-review -b 2447277 Buildroot used: fedora-rawhide-x86_64 Active plugins: Shell-api, Generic, C/C++ Disabled plugins: SugarActivity, Perl, R, fonts, Java, PHP, Python, Ocaml, Haskell Disabled flags: EXARCH, EPEL6, EPEL7, DISTTAG, BATCH
(In reply to Milan Crha from comment #2) > > ... available to anyone with access to the dbus service. > > A little nitpick, could you use "D-Bus" instead of "dbus" in the text, > please? Quotes for clarity only. It may or may not be inherited from the > upstream, in any case it'll be better typed as it should be in Fedora. > Fixed. > > License: LGPL-2.0-or-later > > The GitHub repo says "LGPL-2.1 license", which reflects their COPYING file. > The source files have: "SPDX-License-Identifier: LGPL-2.1-or-later" in the > top comments. I would follow the source files. > Fixed. I took it from the meson.build (https://github.com/flatpak/xdg-native-messaging-proxy/blob/main/meson.build#L6) while I was collecting dependencies. > > Requires: dbus > > I'm not sure of that. It may get it as a transitive auto-dependency from > glib2/gio, maybe? it surely does not use dbus library directly, but through > glib2. > I based it on xdg-desktop-portal, I think it's meant in this case that it needs a D-Bus session, but can be removed. > Issues: > ======= > - systemd_user_post is invoked in %post and systemd_user_preun in %preun > for Systemd user units service files. > Note: Systemd user unit service file(s) in xdg-native-messaging-proxy > See: > https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/ > #_user_units > Not sure what is wrong here, all required is there.
Updated: Spec URL: https://jgrulich.fedorapeople.org/xdg-native-messaging-proxy.spec SRPM URL: https://jgrulich.fedorapeople.org/xdg-native-messaging-proxy-0.1.0-1.fc43.src.rpm Description: This is a small service which can be used to find native messaging host manifests, as well as start and stop those native messaging hosts. Applications running inside a sandbox might have a limited view of the host which might prevent them from finding and executing native messaging hosts which exist outside of the sandbox. This proxy is supposed to run outside of any sandbox, which will make the native messaging hosts outside the sandbox available to anyone with access to the dbus service. Fedora Account System Username: jgrulich
Copr build: https://copr.fedorainfracloud.org/coprs/build/10231536 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2447277-xdg-native-messaging-proxy/fedora-rawhide-x86_64/10231536-xdg-native-messaging-proxy/fedora-review/review.txt Found issues: - Systemd user unit service file(s) in xdg-native-messaging-proxy Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_user_units Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
Updated: Spec URL: https://jgrulich.fedorapeople.org/xdg-native-messaging-proxy.spec SRPM URL: https://jgrulich.fedorapeople.org/xdg-native-messaging-proxy-0.1.0-1.fc43.src.rpm Description: This is a small service which can be used to find native messaging host manifests, as well as start and stop those native messaging hosts. Applications running inside a sandbox might have a limited view of the host which might prevent them from finding and executing native messaging hosts which exist outside of the sandbox. This proxy is supposed to run outside of any sandbox, which will make the native messaging hosts outside the sandbox available to anyone with access to the D-Bus service. Fedora Account System Username: jgrulich
Copr build: https://copr.fedorainfracloud.org/coprs/build/10231547 (succeeded) Review template: https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2447277-xdg-native-messaging-proxy/fedora-rawhide-x86_64/10231547-xdg-native-messaging-proxy/fedora-review/review.txt Found issues: - Systemd user unit service file(s) in xdg-native-messaging-proxy Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_user_units Please know that there can be false-positives. --- This comment was created by the fedora-review-service https://github.com/FrostyX/fedora-review-service If you want to trigger a new Copr build, add a comment containing new Spec and SRPM URLs or [fedora-review-service-build] string.
> Fixed. I took it from the meson.build (https://github.com/flatpak/xdg-native-messaging-proxy/blob/main/meson.build#L6) while I was collecting dependencies. They certainly have a mismatch there upstream. It would be good to fix it on their end. The fedora-review found few more licenses, though I did check only the files in the src/. > > Issues: > > ======= > > - systemd_user_post is invoked in %post and systemd_user_preun in %preun > > for Systemd user units service files. > > Note: Systemd user unit service file(s) in xdg-native-messaging-proxy > > See: > > https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/ > > #_user_units > > > > Not sure what is wrong here, all required is there. It's also from the fedora-review and I also do not see any problem there. The project installs user unit systemd files, thus it's there. Maybe it's meant to check the usage of it, not as a real issue (which it does not explain at all in my eyes, why it considers it an issue, because the link only shows how to use it, which you did correctly).
Works for me. Thank you.
The Pagure repository was created at https://src.fedoraproject.org/rpms/xdg-native-messaging-proxy