Bug 876317 - Review Request: ec2-metadata - EC2 instance metadata query tool
Summary: Review Request: ec2-metadata - EC2 instance metadata query tool
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Haïkel Guémar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-11-13 19:40 UTC by Matthew Miller
Modified: 2013-10-12 04:25 UTC (History)
5 users (show)

Fixed In Version: ec2-metadata-0.1.1-1.fc20
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-10-11 02:30:25 UTC
Type: ---
Embargoed:
karlthered: fedora-review+
gwync: fedora-cvs+


Attachments (Terms of Use)

Description Matthew Miller 2012-11-13 19:40:36 UTC
Spec URL: http://mattdm.fedorapeople.org/ec2-metadata.spec
SRPM URL: http://mattdm.fedorapeople.org/ec2-metadata-2012.08.30-1.fc18.mattdm.src.rpm
Description: A simple bash script that uses curl to query the EC2 instance metadata from within an instance running in Amazon EC2 or another cloud provider with a compatible metadata service.
Fedora Account System Username: mattdm

Comment 1 Matthew Miller 2012-11-13 19:51:15 UTC
Note that the automatic fedora-review blows up, I think because there's no source tarball -- it's just a single file. We _could_ generate a tar.xz or something, but the script is so small that I'm inclined to not.

Comment 2 Eduardo Echeverria 2012-11-13 22:51:58 UTC
Actually I think it would be better for you do a tarball, also have to provide the license text in a single file :)
Please remove the macro %defattr from %files, can give the appropriate permissions in %prep
Regards

Comment 3 Eduardo Echeverria 2012-11-13 22:56:23 UTC
And remove rm -rf $RPM_BUILD_ROOT from %install, is obsolete, and is only used if the package is for EPEL5

Comment 4 Matthew Miller 2012-11-14 05:28:18 UTC
(In reply to comment #2)
> Actually I think it would be better for you do a tarball, also have to
> provide the license text in a single file :)

I guess I can. But there is no upstream tarball -- this _is_ the source distribution. Hmmm; there's also a license ambiguity, as the web site clearly says Apache 2.0 but the code itself is an MIT-style license.

> Please remove the macro %defattr from %files, can give the appropriate
> permissions in %prep

Yep. Old habits die hard. :)

Comment 5 Matthew Miller 2012-11-14 05:28:49 UTC
(In reply to comment #3)
> And remove rm -rf $RPM_BUILD_ROOT from %install, is obsolete, and is only
> used if the package is for EPEL5

That I think I'll keep, because I see no reason this wouldn't be useful in EPEL5.

Comment 6 Eduardo Echeverria 2012-11-14 07:38:56 UTC
(In reply to comment #4)
> (In reply to comment #2)
> > Actually I think it would be better for you do a tarball, also have to
> > provide the license text in a single file :)
> 
> I guess I can. But there is no upstream tarball -- this _is_ the source
> distribution. Hmmm; there's also a license ambiguity, as the web site
> clearly says Apache 2.0 but the code itself is an MIT-style license.
> 
> > Please remove the macro %defattr from %files, can give the appropriate
> > permissions in %prep
> 
> Yep. Old habits die hard. :)

Hi Mathew
You should contact upstream to include the license, 
https://fedoraproject.org/wiki/Packaging:LicensingGuidelines#License_Text

In this case, you must document how to generate the tarball in the spec
https://fedoraproject.org/wiki/Packaging:SourceURL?rd=Packaging/SourceURL


(In reply to comment #5)
> (In reply to comment #3)
> > And remove rm -rf $RPM_BUILD_ROOT from %install, is obsolete, and is only
> > used if the package is for EPEL5
> 
> That I think I'll keep, because I see no reason this wouldn't be useful in
> EPEL5.

In this case should follow the guidelines for EPEL5

https://fedoraproject.org/wiki/EPEL/GuidelinesAndPolicies#Distribution_specific_guidelines

Comment 7 Matthew Miller 2012-11-14 13:34:50 UTC
(In reply to comment #6)
> Hi Mathew
> You should contact upstream to include the license, 
> https://fedoraproject.org/wiki/Packaging:LicensingGuidelines#License_Text

I've changed the license tag to MIT to reflect the actual license in the source file. Since this file contains its own license in text form, I don't think there's a particular need to include a separate copy.

> In this case, you must document how to generate the tarball in the spec
> https://fedoraproject.org/wiki/Packaging:SourceURL?rd=Packaging/SourceURL

Since there is a single small file, I don't think that gains anything. This source is smaller than most patches. If there were multiple sources, I would do that.

> In this case should follow the guidelines for EPEL5

Added Buildroot tag to match.


Updated:

Spec URL: http://mattdm.fedorapeople.org/ec2-metadata.spec
SRPM URL: http://mattdm.fedorapeople.org/ec2-metadata-2012.08.30-2.fc18.mattdm.src.rpm

Comment 8 Matthew Miller 2013-10-10 12:59:43 UTC

Updated with version number from in the file rather than just the date as on the web page.

Spec URL: http://mattdm.fedorapeople.org/ec2-metadata.spec
SRPM URL: http://fedorapeople.org/~mattdm/ec2-metadata-0.1.1-1.fc19.src.rpm

Comment 9 Haïkel Guémar 2013-10-10 13:43:43 UTC
1. version change => agreed, i was fine with using timestamp since usually AWS is not always consistent with script versionning
2. license => agreed on MIT, you asked Amazon and they didn't answer. Both APSLv2.0 and MIT are accepted by fp.o and as a command-line tool, it has a low-incidence compared to a library. Since this review is pending for quite a time, and it could be easily fixed later, i won't block the review for that issue.
3. Since you're planning to put this in EPEL5+, i have nothing to complain about the packaging.


So, i hereby approve this package into Fedora Packages Collection, you'll find the formal review below (generated with the help of fedora-review)

Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated
[ ] = Manual review needed



===== MUST items =====

Generic:
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.

Website says Apache License v2.0, the script header looks like MIT. 
On IRC, you confirmed that Amazon didn't answer you.
Both license are compliant with Fedora guidelines, and as it's a command-line tool,
so i agree with you to consider this piece of work as MIT.


[-]: If (and only if) the source package includes the text of the license(s)
     in its own file, then that file, containing the text of the license(s)
     for the package is included in %doc.
[x]: License field in the package spec file matches the actual license.
     Note: There is no build directory. Running licensecheck on vanilla
     upstream sources. No licenses found. Please check the source files for
     licenses manually.
[-]: Package contains no bundled libraries without FPC exception.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[x]: Each %files section contains %defattr if rpm < 4.4
     Note: %defattr present but not needed
[-]: Package contains desktop file if it is a GUI application.
[-]: Development files must be in a -devel package
[-]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[x]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[-]: Package contains systemd file(s) if in need.
[-]: Package is not known to require an ExcludeArch tag.
[x]: Package complies to the Packaging Guidelines
[x]: Package successfully compiles and builds into binary rpms on at least one
     supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: Package requires other packages for directories it uses.
[x]: Package must own all directories that it creates.
[x]: Package does not own files or directories owned by other packages.
[x]: All build dependencies are listed in BuildRequires, except for any that
     are listed in the exceptions section of Packaging Guidelines.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Package does not contain duplicates in %files.
[x]: Permissions on files are set properly.
[x]: Package use %makeinstall only when make install' ' DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: Package do not use a name that already exist
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as provided
     in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Large documentation must go in a -doc subpackage. Large could be size
     (~1MB) or number of files.
     Note: Documentation size is 0 bytes in 0 files.
[x]: Packages must not store files under /srv, /opt or /usr/local

===== SHOULD items =====

Generic:
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[-]: Buildroot is not present
     Note: Buildroot: present but not needed
[-]: If the source package does not include license text(s) as a separate file
     from upstream, the packager SHOULD query upstream to include it.

Standalone shell script, since it has a license header, it would be overkill to request upstream.

[x]: Final provides and requires are sane (see attachments).
[x]: Package functions as described.

Tested on a AWS instance right now

[x]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[-]: Description and summary sections in the package spec file contains
     translations for supported Non-English languages, if available.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[-]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed files.
[x]: Sources can be downloaded from URI in Source: tag
[x]: Reviewer should test that the package builds in mock.
[x]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
[x]: Dist tag is present (not strictly required in GL).
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Fully versioned dependency in subpackages if applicable.
[x]: SourceX tarball generation or download is documented.
[x]: SourceX is a working URL.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

Generic:
[x]: Rpmlint is run on all installed packages.
     Note: There are rpmlint messages (see attachment).
[x]: Large data in /usr/share should live in a noarch subpackage if package is
     arched.
[x]: Spec file according to URL is the same as in SRPM.


Rpmlint
-------
Checking: ec2-metadata-0.1.1-1.fc18.noarch.rpm
          ec2-metadata-0.1.1-1.fc18.src.rpm
ec2-metadata.noarch: W: invalid-url URL: http://aws.amazon.com/code/1825 HTTP Error 405: MethodNotAllowed
ec2-metadata.noarch: W: no-documentation
ec2-metadata.noarch: W: no-manual-page-for-binary ec2-metadata
ec2-metadata.src: W: invalid-url URL: http://aws.amazon.com/code/1825 HTTP Error 405: MethodNotAllowed
2 packages and 0 specfiles checked; 0 errors, 4 warnings.




Rpmlint (installed packages)
----------------------------
# rpmlint ec2-metadata
ec2-metadata.noarch: W: invalid-url URL: http://aws.amazon.com/code/1825 HTTP Error 405: MethodNotAllowed
ec2-metadata.noarch: W: no-documentation
ec2-metadata.noarch: W: no-manual-page-for-binary ec2-metadata
1 packages and 0 specfiles checked; 0 errors, 3 warnings.
# echo 'rpmlint-done:'



Requires
--------
ec2-metadata (rpmlib, GLIBC filtered):
    /bin/bash
    bash
    curl



Provides
--------
ec2-metadata:
    ec2-metadata



Source checksums
----------------
http://s3.amazonaws.com/ec2metadata/ec2-metadata :
  CHECKSUM(SHA256) this package     : e320585b2455a879f201c6a0cc381a5b645ce1bd851c7946e12dc6513c07769d
  CHECKSUM(SHA256) upstream package : e320585b2455a879f201c6a0cc381a5b645ce1bd851c7946e12dc6513c07769d

Comment 10 Matthew Miller 2013-10-10 14:08:55 UTC
New Package SCM Request
=======================
Package Name: ec2-metadata
Short Description: EC2 instance metadata query tool
Owners: mattdm
Branches: f19 f20
InitialCC: mattdm

Comment 11 Gwyn Ciesla 2013-10-10 14:12:51 UTC
Git done (by process-git-requests).

Comment 12 Fedora Update System 2013-10-10 15:47:27 UTC
ec2-metadata-0.1.1-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/ec2-metadata-0.1.1-1.fc20

Comment 13 Fedora Update System 2013-10-10 15:48:29 UTC
ec2-metadata-0.1.1-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/ec2-metadata-0.1.1-1.fc19

Comment 14 Fedora Update System 2013-10-11 02:30:25 UTC
ec2-metadata-0.1.1-1.fc19 has been pushed to the Fedora 19 stable repository.

Comment 15 Fedora Update System 2013-10-12 04:25:40 UTC
ec2-metadata-0.1.1-1.fc20 has been pushed to the Fedora 20 stable repository.


Note You need to log in before you can comment on or make changes to this bug.