Many thanks for clarifying the bundling of 3rd party binaries.
On 23 Jan 2024, at 21:18, Stephen Gallagher
<sgallagh(a)redhat.com> wrote:
If you are bundling any software, you need to `Provides:
bundled(software)`. This is so we can easily locate affected packages
when e.g. a security issue necessitates fixing it.
I will make sure to include those. Also CC’ing Dave Dykstra who maintains the apptainer
package I referenced earlier in my original email. As I understand it, he will need to add
the Provides for the binaries currently bundled (without corresponding Provides) in the
apptainer packaging.
Also, since it wasn't clear from your text above: It's
(generally)
alright under these circumstances to bundle the extra packages, but
you need to meet certain requirements:
* The code that you're bundling still has to be built in Fedora. That
probably means compiling it as part of your SingularityCE build. You
may not ship code that was compiled somewhere else (e.g. upstream).
This will be the case. The 3rd party binaries are built from source within the
SingularityCE build.
* If you are shipping executables exclusively for use with your
package, make sure they are properly namespaced in
/usr/libexec/singularityce (or similar). This is to ensure that no
other package accidentally tries to use your bundled version.
This is also the case. The binaries are installed into a specific libexec dir.
Thanks again,
Dave Trudgian