Spec URL: https://download.copr.fedorainfracloud.org/results/soumik/topo-review/srpm-builds/11161958/topo.spec
SRPM URL: https://download.copr.fedorainfracloud.org/results/soumik/topo-review/srpm-builds/11161958/topo-0.4.7-0.1.20261016git3adbdb3.fc46.src.rpm
Fedora Account System Username: soumik
Maintainer: Soumik Sarkar <soumiks>
Upstream: https://github.com/Nischoy-ai/topo
Source snapshot: 3adbdb36ad886396ad6267cd706c84bea6d35b99
License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CC-BY-2.5 AND CC0-1.0 AND ISC AND LicenseRef-Fedora-Public-Domain AND Linux-man-pages-copyleft AND MIT AND SunPro AND bcrypt-Solar-Designer

Topo discovers infrastructure through locally approved operations and emits
destination-neutral observations. Its optional outbound worker supports
ServiceNow-managed Linux SSH and restricted Windows HTTPS computer/interface
inventory. Credentials, verified trust files and separate administrator
preparation are required before discovery. Installing this package does not
start discovery. It builds independently from public source.

This review uses an unreleased source snapshot because the worker setup
assistant is not part of the published 0.4.7 worker. Existing upstream tags,
released assets and Nischoy repository packages remain unchanged.

The vendor archive is generated with Fedora Go Vendor Tools from unchanged
upstream go.mod/go.sum. All required composite-license, musl-header and artwork
notices are retained. No license files or directories are excluded.
The spec uses Fedora compiler macros, sysusers and standard systemd lifecycle
macros. Both packaged services are disabled until explicitly configured.

Build/test evidence: https://github.com/Nischoy-ai/topo/actions/runs/38943167448 (all eight jobs passed); exact source 3adbdb36ad886396ad6267cd706c84bea6d35b99.
Copr Rawhide build: https://copr.fedorainfracloud.org/coprs/soumik/topo-review/build/11161958/ (all four targets succeeded).
Architecture scope: Fedora 44 and Rawhide, both x86_64 and aarch64.
Known limitations: synthetic loopback service tests do not establish real
ServiceNow/IRE, target compatibility, reboot, production readiness or default
repository publication.

Automated review notes: all four Copr Fedora Review reports are available from
the build page. Binary/source rpmlint has zero errors and one documented
generated vendor-archive URL warning per target; debuginfo lint is clean.
Prebuilt review retains a CheckBuildInMock marker and manual checks. Its
separate prep environment has unexpanded %goprep, leaving source license scan
incomplete; installed-package lint finds no installed RPMs. These checks are
not claimed passed. Actual native package builds/%check and independent clean
mock/systemd CI passed; complete license inventory is supplied for review.

License audit and vendor-regeneration guidance:
https://github.com/Nischoy-ai/topo/blob/3adbdb36ad886396ad6267cd706c84bea6d35b99/packaging/distro/fedora-license-review.md
https://github.com/Nischoy-ai/topo/blob/3adbdb36ad886396ad6267cd706c84bea6d35b99/packaging/distro/README.md

Packager sponsorship requested:
I maintain the upstream Topo project and intend to maintain its Fedora package.
I am requesting packager sponsorship and guidance through Fedora review and
ongoing package maintenance. I would welcome mentorship from a sponsor familiar
with Go packaging and go-vendor-tools.