https://bugzilla.redhat.com/show_bug.cgi?id=1830220
--- Comment #3 from Lyes Saadi fedora@lyes.eu --- Hello!
In this section of the guidelines: https://docs.fedoraproject.org/en-US/packaging-guidelines/#bundling
All packages whose upstreams have no mechanism to build against system libraries MAY opt to carry bundled libraries, but if they do, they MUST include an indication of what they bundle. This provides a mechanism for locating libraries with bundled code which can, for example, assist in locating packages which may have particular security vulnerabilities.
To indicate an instance of bundling, first determine the name and version of the bundled library:
- If the bundled package also exists separately in the distribution, use the
name of that package. Otherwise consult the Naming Guidelines to determine an appropriate name for the library as if it were entering the distribution as a separate package.
- Use the Versioning Guidelines to determine an appropriate version for the
library, if possible. If the library has been forked from an upstream, use the upstream version that was most recently merged in or rebased onto, or the version the original library carried at the time of the fork.
Then at an appropriate place in your spec, add Provides: bundled(<libname>) = <version> where <libname> and <version> are the name and version you determined above. If it was not possible to determine a version, use Provides: bundled(<libname>) instead.
In addition to indicating bundling in this manner, packages whose upstreams have no mechanism to build against system libraries must be contacted publicly about a path to supporting system libraries. If upstream refuses, this must be recorded in the spec file, either in comments placed adjacent to the Provides: above, or in an additional file checked into the SCM and referenced by a comment placed adjacent to the Provides: above.
So, a "Provide" for each bundled libraries and the addition of the MIT License (tomboykeybinder.c) with a comment indicating the license of each bundled libraries is enough to get the package approved ;)!