On 11.11.2014 16:26, Vít Ondruch wrote:
> Dne 11.11.2014 v 16:17 Václav Pavlín napsal(a):
>> I also have one more topic...
>>
>> Software written in Go is linked statically and we are not able to
>> figure out which version of Go was used during build. Means that
>> despite we have latest Go with all CVE fixed in Fedora, we still have
>> these CVEs in some packages built from old Go releases.
>>
>> I've heard someone to mention we could use "Bundles" tag in RPM
header
>> to track this.
> You mean bundled virtual provide, e.g. "Provides: bundled(go) = 1.0.0"
> etc. See
>
>
https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#Requirement...
>
>
> for more information.
Thanks!
That's probably it, although I think we need to set this automatically
during the build to make it useful.
Vašek