Bug 711895 - Review Request: softhsm - Software version of a PKCS#11 Hardware Security Module
Summary: Review Request: softhsm - Software version of a PKCS#11 Hardware Security Module
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Wes Hardaker
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-08 22:05 UTC by Paul Wouters
Modified: 2011-11-25 02:04 UTC (History)
3 users (show)

Fixed In Version: softhsm-1.3.0-3.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-11-25 01:55:53 UTC
Type: ---
wjhns174: fedora-review+
gwync: fedora-cvs+


Attachments (Terms of Use)

Description Paul Wouters 2011-06-08 22:05:00 UTC
Spec URL: ftp://ftp.xelerance.com/opendnssec/softhsm.spec
SRPM URL: ftp://ftp.xelerance.com/opendnssec/softhsm-1.2.1-1.fc14.src.rpm
Description: OpenDNSSEC is providing a software implementation of a generic
cryptographic device with a PKCS#11 interface, the SoftHSM. SoftHSM is
designed to meet the requirements of OpenDNSSEC, but can also work together
with other cryptographic products because of the PKCS#11 interface.

current rpmlint output:
softhsm.x86_64: E: invalid-soname /usr/lib64/libsofthsm.so libsofthsm.so
softhsm.x86_64: E: non-standard-dir-perm /var/softhsm 0700L
softhsm-devel.x86_64: W: spelling-error %description -l en_US libsofthsm -> libertinism, softhearted

The invalid-soname is something I'm talking to upstream about right now. They changed from a shared library to a module but need to change the install location. Will be fixed in a rebuild when upstream has decided on a place (or else I'll pick one in a day or two)

Comment 1 Paul Wouters 2011-10-05 22:04:58 UTC
I've updated to softhsm-1.3.0.

They still did not fix the .so issue, so I"ve changed --libdir to %{_libdir}/softhsm/ to avoid the system from trying to use it as a shared library.

rpmlint output:
softhsm.x86_64: E: non-standard-dir-perm /var/softhsm 0700L
softhsm-devel.x86_64: W: spelling-error %description -l en_US libsofthsm -> libertinism, softhearted
4 packages and 0 specfiles checked; 1 errors, 1 warnings.

Spec URL: ftp://ftp.xelerance.com/opendnssec/softhsm.spec
SRPM URL: ftp://ftp.xelerance.com/opendnssec/softhsm-1.3.0-1.fc14.src.rpm

Comment 2 Wes Hardaker 2011-10-15 15:18:49 UTC
Close...  A few minor things to clean up.

* Notes:
  -devel description:
     Summary: Development package that (does not?) includes header files
     Description: The devel package contains the libsofthsm library and (no?) include files

     + Pick one? (hint, it does)


* MUSTs
  - [X] MUST: rpmlint must be run on the source rpm and all binary rpms the build produces. The output should be posted in the review.
    - spec file:
      0 packages and 1 specfiles checked; 0 errors, 0 warnings.
    - src rpm:
      softhsm.src: W: spelling-error %description -l en_US cryptographic -> cryptography, cryptographer, crystallographic
      1 packages and 0 specfiles checked; 0 errors, 1 warnings.
    - binary RPM:
      0-1.fc15.x86_64.rpm /home/hardaker/rpmbuild/RPMS/x86_64/softhsm-1.3.0-1.fc15.x86_64.rpm
      softhsm-devel.x86_64: W: spelling-error %description -l en_US libsofthsm -> softhearted
      softhsm.x86_64: W: spelling-error %description -l en_US cryptographic -> cryptography, cryptographer, crystallographic
      softhsm.x86_64: W: unstripped-binary-or-object /usr/bin/softhsm
      softhsm.x86_64: W: unstripped-binary-or-object /usr/bin/softhsm-keyconv
      softhsm.x86_64: W: unstripped-binary-or-object /usr/lib64/softhsm/libsofthsm.so
      softhsm.x86_64: E: non-standard-dir-perm /var/softhsm 0700L
      2 packages and 0 specfiles checked; 1 errors, 5 warnings.

      - Reviewer note: the /var/softhsm directory will contain keys
        and locking it down to root-readable makes sense.

  - [X] MUST: The package must be named according to the Package
    Naming Guidelines .
  - [X] MUST: The spec file name must match the base package %{name},
    in the format %{name}.spec unless your package has an exemption.
  - [X] MUST: The package must meet the Packaging Guidelines .
  - [X] MUST: The package must be licensed with a Fedora approved
    license and meet the Licensing Guidelines .
  - [X] MUST: The License field in the package spec file must match
    the actual license.
    - Note: the only copyright statements are in the source code, but
      are BSD licenses.  Work with the upstream to add a top-level file?
  - [X] MUST: If (and only if) the source package includes the text of
    the license(s) in its own file, then that file, containing the
    text of the license(s) for the package must be included in %doc.
  - [X] MUST: The spec file must be written in American English. 
  - [X] MUST: The spec file for the package MUST be legible. 
  - [X] MUST: The sources used to build the package must match the
    upstream source, as provided in the spec URL. Reviewers should use
    md5sum for this task. If no upstream URL can be specified for this
    package, please see the Source URL Guidelines for how to deal with
    this.
  - [X] MUST: The package MUST successfully compile and build into
    binary rpms on at least one primary architecture.
  - [X] MUST: If the package does not successfully compile, build or
    work on an architecture, then those architectures should be listed
    in the spec in ExcludeArch. Each architecture listed in
    ExcludeArch MUST have a bug filed in bugzilla, describing the
    reason that the package does not compile/build/work on that
    architecture. The bug number MUST be placed in a comment, next to
    the corresponding ExcludeArch line.
  - [X] MUST: All build dependencies must be listed in BuildRequires,
    except for any that are listed in the exceptions section of the
    Packaging Guidelines ; inclusion of those as BuildRequires is
    optional. Apply common sense.
    - tested via mock
  - [X] MUST: The spec file MUST handle locales properly. This is done
    by using the %find_lang macro. Using %{_datadir}/locale/* is
    strictly forbidden.
  - [ ] MUST: Every binary RPM package (or subpackage) which stores
    shared library files (not just symlinks) in any of the dynamic
    linker's default paths, must call ldconfig in %post and %postun.
    - Needs to be added
  - [X] MUST: Packages must NOT bundle copies of system libraries.
  - [X] MUST: If the package is designed to be relocatable, the
    packager must state this fact in the request for review, along
    with the rationalization for relocation of that specific
    package. Without this, use of Prefix: /usr is considered a
    blocker.
  - [X] MUST: A package must own all directories that it creates. If
    it does not create a directory that it uses, then it should
    require a package which does create that directory.
  - [X] MUST: A Fedora package must not list a file more than once in
    the spec file's %files listings. (Notable exception: license texts
    in specific situations)
  - [X] MUST: Permissions on files must be set properly. Executables
    should be set with executable permissions, for example.
  - [X] MUST: Each package must consistently use macros. 
  - [X] MUST: The package must contain code, or permissable content. 
  - [X] MUST: Large documentation files must go in a -doc
    subpackage. (The definition of large is left up to the packager's
    best judgement, but is not restricted to size. Large can refer to
    either size or quantity).
  - [X] MUST: If a package includes something as %doc, it must not
    affect the runtime of the application. To summarize: If it is in
    %doc, the program must run properly if it is not present.
  - [X] MUST: Header files must be in a -devel package. 
  - [ ] MUST: Static libraries must be in a -static package.
    - Err... they're in -devel.  That's a new requirement to me as
      well.  It's certainly not consistently enforced yet.
  - [X] MUST: If a package contains library files with a suffix
    (e.g. libfoo.so.1.1), then library files that end in .so (without
    suffix) must go in a -devel package.
  - [X] MUST: In the vast majority of cases, devel packages must
    require the base package using a fully versioned dependency:
    Requires: %{name}%{?_isa} = %{version}-%{release}
  - [X] MUST: Packages must NOT contain any .la libtool archives,
    these must be removed in the spec if they are built.
  - [X] MUST: Packages containing GUI applications must include a
    %{name}.desktop file, and that file must be properly installed
    with desktop-file-install in the %install section. If you feel
    that your packaged GUI application does not need a .desktop file,
    you must put a comment in the spec file with your explanation.
  - [X] MUST: Packages must not own files or directories already owned
    by other packages. The rule of thumb here is that the first
    package to be installed should own the files or directories that
    other packages may rely upon. This means, for example, that no
    package in Fedora should ever share ownership with any of the
    files or directories owned by the filesystem or man package. If
    you feel that you have a good reason to own a file or directory
    that another package owns, then please present that at package
    review time.
  - [X] MUST: All filenames in rpm packages must be valid UTF-8.
* SHOULDs
  - [X] SHOULD: The description and summary sections in the package
    spec file should contain translations for supported Non-English
    languages, if available.
    - Note: not available
  - [X] SHOULD: The reviewer should test that the package builds in
    mock.
  - [X] SHOULD: The package should compile and build into binary rpms
    on all supported architectures.
  - [X] SHOULD: The reviewer should test that the package functions as
    described. A package should not segfault instead of running, for
    example.
    - Didn't do a huge amount, but started to tinker.
  - [X] SHOULD: If scriptlets are used, those scriptlets must be
    sane. This is vague, and left up to the reviewers judgement to
    determine sanity.
  - [X] SHOULD: Usually, subpackages other than devel should require
    the base package using a fully versioned dependency.
  - [X] SHOULD: The placement of pkgconfig(.pc) files depends on their
    usecase, and this is usually for development purposes, so should
    be placed in a -devel pkg. A reasonable exception is that the main
    pkg itself is a devel tool not installed in a user runtime,
    e.g. gcc or gdb.
  - [X] SHOULD: If the package has file dependencies outside of /etc,
    /bin, /sbin, /usr/bin, or /usr/sbin consider requiring the package
    which provides the file instead of the file itself.
  - [X] SHOULD: your package should contain man pages for
    binaries/scripts. If it doesn't, work with upstream to add them
    where they make sense.

Comment 3 Wes Hardaker 2011-10-15 15:21:05 UTC
The important ones:

  -devel description:
     Summary: Development package that (does not?) includes header files
     Description: The devel package contains the libsofthsm library and (no?) include files

     + Pick one? (hint, it does)

  - [ ] MUST: Every binary RPM package (or subpackage) which stores
    shared library files (not just symlinks) in any of the dynamic
    linker's default paths, must call ldconfig in %post and %postun.
    - Needs to be added

  - [ ] MUST: Static libraries must be in a -static package.
    - Err... they're in -devel.  That's a new requirement to me as
      well.  It's certainly not consistently enforced yet.

Also of note is this one (but it's not a blocker, IMHO)

  - [X] MUST: The License field in the package spec file must match
    the actual license.
    - Note: the only copyright statements are in the source code, but
      are BSD licenses.  Work with the upstream to add a top-level file?

I do think having /var/softhsm owned by a softhsm group would be more helpful for mulit-operator environments.

Comment 4 Wes Hardaker 2011-10-17 18:49:09 UTC
Whoops, my bad: the /usr/lib64/softhsm contains the .so file so there is no requirement to run ldconfig.

Comment 5 Paul Wouters 2011-10-26 01:44:42 UTC
So if I understood Wes correctly, the only real mistake left was the text about include files in the descriptions? Those have been fixed. I have not added a separate user as this might complicate things later with HSM as well.

Spec URL: ftp://ftp.xelerance.com/opendnssec/softhsm.spec
SRPM URL: ftp://ftp.xelerance.com/opendnssec/softhsm-1.3.0-2.fc14.src.rpm

Comment 6 Wes Hardaker 2011-10-26 17:26:31 UTC
I'll leave it to your judgment about the user...  It does seem less useful to me "as is", but I don't see a problem with it.

The new spec file does fix the summary/description issues.

But there is still the remaining issue of the static .a library, which now must either be packaged into a -static package (or you could just remove it instead).

Comment 7 Paul Wouters 2011-10-27 18:13:16 UTC
how's this?

Spec URL: ftp://ftp.xelerance.com/opendnssec/softhsm.spec
SRPM URL: ftp://ftp.xelerance.com/opendnssec/softhsm-1.3.0-3.fc14.src.rpm


* Thu Oct 27 2011 Paul Wouters <paul@xelerance.com> - 1.3.0-3
- Do not install the .a file
- Use a separate "opendnssec" user to own /var/sofhsm


[paul@bofh fedora]$ rpmlint /home/paul/SRPMS/softhsm-1.3.0-3.fc14.src.rpm /home/paul/RPMS/x86_64/softhsm-1.3.0-3.fc14.x86_64.rpm /home/paul/RPMS/x86_64/softhsm-devel-1.3.0-3.fc14.x86_64.rpm /home/paul/RPMS/x86_64/softhsm-debuginfo-1.3.0-3.fc14.x86_64.rpm
softhsm.x86_64: W: non-standard-uid /var/softhsm opendnssec
softhsm.x86_64: W: non-standard-gid /var/softhsm opendnssec
softhsm.x86_64: E: non-standard-dir-perm /var/softhsm 0770L
softhsm-devel.x86_64: W: spelling-error %description -l en_US libsofthsm -> libertinism, softhearted
4 packages and 0 specfiles checked; 1 errors, 3 warnings.

Comment 8 Wes Hardaker 2011-10-27 20:02:34 UTC
Looks good to me!  I like the new user/group, as I doubt most operators in critical environments operate by themselves.

Approved.

Comment 9 Wes Hardaker 2011-10-27 20:05:28 UTC
Minor nits that ideally should be cleaned up in the final packaging:

- I think things like %{__rm} are preferred to standard binary calls.  I've never figured out why though.
- Ideally, I think removing *.a would be safer than *a

Comment 10 Paul Wouters 2011-10-28 15:58:25 UTC
I am using *a because there is .a and a .la file there.
On #fedora-devel they also said to just use "rm" and "install" instead of their macros

Comment 11 Paul Wouters 2011-10-28 16:55:57 UTC
New Package SCM Request
=======================
Package Name: softhsm
Short Description: Software version of a PKCS#11 Hardware Security Module
Owners: pwouters
Branches: f15 f16 el5 el6
InitialCC:

Comment 12 Gwyn Ciesla 2011-10-28 17:04:53 UTC
Git done (by process-git-requests).

Comment 13 Fedora Update System 2011-11-01 20:45:07 UTC
softhsm-1.3.0-3.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/softhsm-1.3.0-3.fc16

Comment 14 Fedora Update System 2011-11-01 20:46:28 UTC
softhsm-1.3.0-3.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/softhsm-1.3.0-3.fc15

Comment 15 Fedora Update System 2011-11-01 20:49:18 UTC
softhsm-1.3.0-3.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/softhsm-1.3.0-3.el6

Comment 16 Fedora Update System 2011-11-02 00:06:44 UTC
softhsm-1.3.0-3.el6 has been pushed to the Fedora EPEL 6 testing repository.

Comment 17 Fedora Update System 2011-11-25 01:55:53 UTC
softhsm-1.3.0-3.fc16 has been pushed to the Fedora 16 stable repository.

Comment 18 Fedora Update System 2011-11-25 02:01:13 UTC
softhsm-1.3.0-3.fc15 has been pushed to the Fedora 15 stable repository.

Comment 19 Fedora Update System 2011-11-25 02:04:09 UTC
softhsm-1.3.0-3.el6 has been pushed to the Fedora EPEL 6 stable repository.


Note You need to log in before you can comment on or make changes to this bug.