Fedora Account System
Red Hat Associate
Red Hat Customer
Spec URL: http://people.redhat.com/sgrubb/files/prelude-correlator.spec SRPM URL: http://people.redhat.com/sgrubb/files/prelude-correlator-0.9.0-1.fc9.src.rpm Description: Prelude-Correlator serves to correlate, in real time, the multiple events received by Prelude Manager. Several isolated alerts, generated from different probes, can thus trigger a single correlation alert should the events be related. This correlation alert then appears within the Prewikka interface and indicates the potential target information via the set of correlation rules.
Instructions for registering prelude-correlator have been added to the prelude HOWTO at http://people.redhat.com/sgrubb/audit/prelude.txt
This fails to build for me: + install -m 755 /builddir/build/SOURCES/prelude-correlator.init /var/tmp/prelude-correlator-0.9.0-1.fc10-root-mockbuild/etc/rc.d/init.d/prelude-correlator install: cannot stat `/builddir/build/SOURCES/prelude-correlator.init': No such file or directory
Doh! Added Source1 which holds the init script. New srpm and spec file uploaded.
First comments: Please add some meaningful text to the Summary of the main package. Something like "Real time correlator of events received by Prelude Manager" The version/release must match the upstream and comply with the Fedora NamingGuidelines (the beta1b should be added to the release). version should be: 0.9.0 and release: 0.1.beta1b (0.2.beta1b, ....) rpmlint -v prelude-correlator-0.9.0-1.fc9.x86_64.rpm prelude-correlator.x86_64: I: checking prelude-correlator.x86_64: E: non-standard-dir-perm /etc/prelude-correlator/lua-rules 0700 prelude-correlator.x86_64: E: non-standard-dir-perm /etc/prelude-correlator 0700 Do these directories have to be unreadable to group/other? prelude-correlator.x86_64: E: zero-length /usr/share/doc/prelude-correlator-0.9.0/AUTHORS Please drop AUTHORS from docs if it is empty. prelude-correlator.x86_64: W: incoherent-version-in-changelog 0.9.0.beta1b 0.9.0-1.fc9 See above. prelude-correlator.x86_64: W: incoherent-subsys /etc/rc.d/init.d/prelude-correlator $prog This is OK. rpmlint -v prelude-correlator-devel-0.9.0-1.fc9.x86_64.rpm prelude-correlator-devel.x86_64: I: checking prelude-correlator-devel.x86_64: W: no-documentation rpmlint -v prelude-correlator-debuginfo-0.9.0-1.fc9.x86_64.rpm prelude-correlator-debuginfo.x86_64: I: checking rpmlint -v prelude-correlator-0.9.0-1.fc9.src.rpm prelude-correlator.src: I: checking prelude-correlator.src: W: mixed-use-of-spaces-and-tabs (spaces: line 20, tab: line 74) I think this is purely cosmetic and OK. prelude-correlator.src: W: strange-permission prelude-correlator.init 0755 This is OK.
New package is at: http://people.redhat.com/sgrubb/files/prelude-correlator-0.9.0-0.1.beta1b.fc9.src.rpm This addresses items 1, 2, & 5 above. Item 3, I would expect that the perms be 0700 for the correlator directory. I don't think you want users able to see example what the admin is watching for. I could open it to group root without any concern, but then again it doesn't really buy anything. Item 4, I expect the AUTHORS file to contain something before the beta phase ends.
You use $RPM_BUILD_ROOT in %clean and %{buildroot} in %install. It should be unified. I think there is a missing Requires: libprelude-devel in the devel subpackage. The include file there includes libprelude include file. Perhaps there should be some kind of README.Fedora which would describe just in few words the steps which are necessary to get the correlator running - such as the registration to the prelude manager. Should the prelude-manager be required for the correlator package? But as I understand it could be theoretically running on another machine so perhaps not.
New files were uploaded to address items 1 & 2 from comment#6. As for item 3, I expect a man page to be added by upstream during the beta process that explains this.
And yes in large deployments, it would be a dedicated machine hence the separation.
rpmlint -v prelude-correlator-0.9.0-0.1.beta1b.fc9.src.rpm prelude-correlator.src: I: checking prelude-correlator.src: W: mixed-use-of-spaces-and-tabs (spaces: line 21, tab: line 76) prelude-correlator.src: W: strange-permission prelude-correlator.init 0755 1 packages and 0 specfiles checked; 0 errors, 2 warnings. OK rpmlint -v prelude-correlator-0.9.0-0.1.beta1b.fc9.x86_64.rpm prelude-correlator.x86_64: I: checking prelude-correlator.x86_64: E: non-standard-dir-perm /etc/prelude-correlator/lua-rules 0700 prelude-correlator.x86_64: E: non-standard-dir-perm /etc/prelude-correlator 0700 prelude-correlator.x86_64: E: zero-length /usr/share/doc/prelude-correlator-0.9.0/AUTHORS prelude-correlator.x86_64: W: incoherent-subsys /etc/rc.d/init.d/prelude-correlator $prog prelude-correlator.x86_64: W: incoherent-subsys /etc/rc.d/init.d/prelude-correlator $prog 1 packages and 0 specfiles checked; 3 errors, 2 warnings. OK (with comments above) rpmlint -v prelude-correlator-devel-0.9.0-0.1.beta1b.fc9.x86_64.rpm prelude-correlator-devel.x86_64: I: checking prelude-correlator-devel.x86_64: W: no-documentation 1 packages and 0 specfiles checked; 0 errors, 1 warnings. OK rpmlint -v prelude-correlator-debuginfo-0.9.0-0.1.beta1b.fc9.x86_64.rpm prelude-correlator-debuginfo.x86_64: I: checking 1 packages and 0 specfiles checked; 0 errors, 0 warnings. OK I've noticed one more thing - please remove the calls to /sbin/ldconfig from %post and %postun, the package doesn't contain any libraries (the lua.so bindings are not a regular library and are placed correctly in a subdirectory). So given you fix the above APPROVED.
Fixed ldconfig in spec file. New files uploaded if you wanted to check. Thanks for looking over the package.
New Package CVS Request ======================= Package Name: prelude-correlator Short Description: Prelude Correlator Daemon Owners: sgrubb Branches: F-9 InitialCC: sgrubb Cvsextras Commits: no. This is a security package and I will add some other committers to the package after its created.
CVS Done.
Package is shipped in rawhide...closing.