Red Hat Bugzilla – Bug 821776
libvirt: Gnulib bundled but no bundled(gnulib) provides
Last modified: 2012-06-30 18:05:05 EDT
A bundled copy of Gnulib - The GNU Portability Library  was found in
libvirt. No Bundled Libraries section  of Packaging guidelines
gives more information on bundled libraries and how they should be handled.
Affected libvirt version: libvirt-0.9.11.3-1.fc18
As a kind of copylib, Gnulib has been granted an exception. However, to comply
with Packaging guidelines, packages bundling Gnulib must note that the library
has been granted an exception in the spec file comment with a link to the FPC
ticket where the exception was granted and add a virtual provide to the spec
file to note that Gnulib is bundled. Refer to  for more details.
No comment about bundling Gnulib and no virtual provide were found in the
libvirt.spec file. To comply with the packaging guideliness please
add an appropriate comment to the spec file as well as a virtual provide.
Source tarball where bundled Gnulib was found:
At least the following files look like Gnulib files:
There are most likely more Gnulib files bundled in the SRPM. I didn't bother
to list them all as it shouldn't be necessary.
As per the very URL you quote, any package containing gnulib automatically has an exception without needing an explicit grant.
True, but it doesn't exempt packagers from adding "Provides: bundled(gnulib) = version", does it?
If for example a critical bug is found in Gnulib, one could easily check where it's bundled and what version:
repoquery --whatprovides bundled\(gnulib\)
and fix the bug in all packages. Otherwise
Gnulib is used in many core packages and identifying them is important to fix bugs quickly to prevent zero-day exploits after bugs in Gnulib are disclosed.
I'm unclear what the 'version' should be. Obviously the
libvirt patch above doesn't include a version, and
gnulib isn't versioned afaik.
I omitted version because there are no version numbers associated with gnulib & simply checking a version number is a really bad way of assessing whether code is vulnerable to a security issue.
Some other packages use checkout date as version, eg:
$ repoquery --repoid rawhide --provides gdb | grep gnulib
bundled(gnulib) = 20120120
$ repoquery --repoid rawhide --provides liblouis | grep gnulib
bundled(gnulib) = 20091111
bundled(gnulib) = 20091111
$ repoquery --repoid rawhide --provides insight | grep gnulib
bundled(gnulib) = 20120403
At least in the GDB case that date is meaningless since it is the checkout date of the GDB tar.gz which is little relation to the version of gnulib. In addition just the date does not uniquely identify the gnulib changeset. I think using a date here does more harm than good
I have to agree with Dan here. I'd go further and say that
since we have a tool that identifies copied code, we shouldn't
need to mark bundled libraries at all: we could automatically
detect non-whitelisted ones (which presumably you're doing
already), and automatically determine cases of insecure code.
libvirt-0.9.11.4-2.fc17 has been submitted as an update for Fedora 17.
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libvirt-0.9.11.4-2.fc17'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
libvirt-0.9.11.4-3.fc17 has been submitted as an update for Fedora 17.
libvirt-0.9.11.4-3.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.