Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
Summary: Review Request: nikto - Web server scanner Product: Fedora Extras Version: devel Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: Package Review AssignedTo: nobody@fedoraproject.org ReportedBy: foolish@guezz.net QAContact: fedora-package-review@redhat.com
Spec URL: http://folk.ntnu.no/sindrb/packages/green_nyc/nikto.spec SRPM URL: http://folk.ntnu.no/sindrb/packages/green_nyc/nikto-1.36-1.fc7.src.rpm
Description:
Nikto is a web server scanner which performs comprehensive tests against web servers for multiple items, including over 3300 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
foolish@guezz.net changed:
What |Removed |Added ---------------------------------------------------------------------------- BugsThisDependsOn| |239096
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
rayvd@bludgeon.org changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |rayvd@bludgeon.org
------- Additional Comments From rayvd@bludgeon.org 2007-05-22 15:45 EST ------- This is a pre-review:
Encountered the following under MUST:
MUST: Packaging Guidelines * I get the following when trying to install the RPM:
error: Failed dependencies: perl(LW) is needed by nikto-1.36-1.noarch
I notice Nikto itself provides an LW.pm -- should this be installed and a Provides line created?
I can only find perl-libwhisker2 (which provides LW2.pm) in Fedora.
Output of rpmlint:
% rpmlint -i -v nikto-1.36-1.fc6.noarch.rpm I: nikto checking % echo $? 0
Under SHOULD:
No issues. I was able to successfully build the package under mock.
Everything else appears to check out.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From rayvd@bludgeon.org 2007-05-22 15:48 EST ------- Note that the rpmlint output does not indicate any issues, I was merely including it in the review as suggested by the Review Guidelines.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From foolish@guezz.net 2007-05-22 20:08 EST ------- LW.pm is provided by the libwhisker2 package via a compability bridge. LW is discontinued and LW2 is recommended by upstream. Nikto will work just fine with the LW2 LW1 compability bridge. How to solve this package wise I don't know though. Suggestions welcome.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From rayvd@bludgeon.org 2007-05-22 20:21 EST ------- Options I see:
* Modify perl-libwhisker2 to include the LW1 compatability bridge. Perhaps as a -compat sub-package -- perl-libwhisker2-compat * Patch nikto to use LW2 calls (might be too much work) * See if nikto upstream would release a version for LW2 specifically * Create a perl-libwhisker package using the last stable version of LW.pl
I like option #3 best, but probably not realistic. :-) Option 1 would be my choice. You'd have to work with the maintainer of that package however.
Option #4 might be doable as well, but if LW1 is retired, do we really want to bring it into Fedora?
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From foolish@guezz.net 2007-05-22 20:59 EST ------- I'm the maintainer of perl-libwhisker2. It already contains the compability bridge in the base package. See #239096 and let's continue discussion about changes to the perl-libwhisker2 there.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
Bug 239097 depends on bug 239096, which changed state.
Bug 239096 Summary: Review Request: perl-libwhisker2 - Perl module geared specificly for HTTP testing https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239096
What |Old Value |New Value ---------------------------------------------------------------------------- Resolution| |NEXTRELEASE Status|ASSIGNED |CLOSED
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
Bug 239097 depends on bug 239096, which changed state.
Bug 239096 Summary: Review Request: perl-libwhisker2 - Perl module geared specificly for HTTP testing https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239096
What |Old Value |New Value ---------------------------------------------------------------------------- Resolution|NEXTRELEASE | Status|CLOSED |ASSIGNED
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
Bug 239097 depends on bug 239096, which changed state.
Bug 239096 Summary: Review Request: perl-libwhisker2 - Perl module geared specificly for HTTP testing https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239096
What |Old Value |New Value ---------------------------------------------------------------------------- Resolution| |NEXTRELEASE Status|ASSIGNED |CLOSED
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From faucamp@csir.co.za 2007-05-28 08:00 EST ------- (In reply to comment #3)
LW.pm is provided by the libwhisker2 package via a compability bridge. LW is discontinued and LW2 is recommended by upstream. Nikto will work just fine with the LW2 LW1 compability bridge. How to solve this package wise I don't know though. Suggestions welcome.
You don't have to do anything, it's fine; yum is smart enough to figure out which package provides perl(LW) (...which would be "perl-libwhisker2").
Ray: If you try to install the package with yum localinstall <packagename>, you'll see what I mean. :-)
From a (very) quick look-over I can only spot one error in the spec:
You do not need "Requires: perl-libwhisker" - again, RPM and yum does this automatically.
If Ray doesn't grab this one, I'll give it a full review in a few hours.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
faucamp@csir.co.za changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Flag| |fedora-review?
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
faucamp@csir.co.za changed:
What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|nobody@fedoraproject.org |faucamp@csir.co.za
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From faucamp@csir.co.za 2007-05-28 11:39 EST ------- Ok, doing review:
MUST items: * rpmlint is silent * package and spec file are named well * package meets Packaging Guidelines * package contains code licensed under the GPL, license file included * package contains code NOT licensed under the GPL. The following is the license contained in the *.db files:
# This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2001-2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes.
IMO this is acceptable, since the content (the plugin db's) are freely distributable along with (and for use with) the nikto package (however, IANAL), but it does impact the license of RPM as a whole (see next point)
X* "License" field in spec is MOSTLY correct (applies to code, not the content) !* license file is included in %doc (might want to add a second one, see NOTES below) * spec file is written in American English and legible * package source md5sum matches upstream source:
d70107deb225489ecf20e2b46684674e nikto-1.36.tar.bz2
* package is noarch, builds successfully * BuildRequires are good X* Unnecessary "Requires" entry (see comment #6) * package handles locales properly (no locales) * package has no need for %post and %postun sections * package is not relocatable * package owns directories it creates * no duplicate entries in %files * file permissions are good * proper %clean section * spec file macros are used consistently !* package contains GPL'ed code a content under a different license * no -doc, -devel subpackages necessary X- some docs are missing (see NOTES below) * contents in %doc not required for runtime functionality of application
SHOULD items: * package builds in mock (fc6/i386) * package functions properly
NOTES:
Patches: Do note that the "nikto-1.36-config.patch" patch hardcodes the package's config file location. There at least needs to be a comment about this in the spec; if someone moved %{_sysconfdir} they would want to know why the package won't work anymore... What I would recommend, however, is removing the patch, and replacing it with sed scripts in %prep, making use of RPM's macros. For example, the following line (if used in %prep) would do what the first entry in the patch does, except that the package just needs to be rebuilt (without modification) if any dir locations ever change:
sed -i "s:$CFG{configfile}="config.txt":$CFG{configfile}="%{_sysconfdir}/nikto/config":" nikto.pl
Docs: Maybe include the READE_plugins.txt file? It might be outdated, but its the only plug-in documentation in the package...
License: As the content is licensed under a GPL-incompatible license, and CIRT only allows for the distribution of the necessary plugin content along with the FULL nikto package, you will have to change the "License" field of the RPM to something like "Custom, see LICENSE.txt" (or whatever file is appropriate). Also, I would recommend adding a "database-license.txt" (or something similar) file containing the license information to %doc (the license is in the header of each .db file). rpmlint is going to moan about such a "custom" License field entry, but it's unavoidable here.
Other than these points, the package looks good. Fix the mentioned issues (or argue against them ;-) ), and I'll approve the package.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From foolish@guezz.net 2007-05-28 13:55 EST ------- Updated:
- Remove libwhisker Requires - Replace configfile patch with sed magic - Update License - Add database-license.txt and README_plugins.txt to %doc
Spec URL: http://folk.ntnu.no/sindrb/packages/green_nyc/nikto.spec SRPM URL: http://folk.ntnu.no/sindrb/packages/green_nyc/nikto-1.36-2.fc7.src.rpm
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From faucamp@csir.co.za 2007-05-28 15:12 EST ------- Created an attachment (id=155554) --> (https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=155554&action=vie...) Example sed inline script to fixup paths in nikto's default config file
Ok, almost there... However, the sed one-liner in comment #7 was just an example - you'll need to call sed on "config.txt" as well in order to "re-create" the effects of the "nikto-1.36-config.patch" patch. Because config.txt is a user-editable configuration file, this isn't a big issue, although we probably want to enable nikto to use nmap by default (esp. considering it's listed in Requires, and the -2 release isn't using it by default).
I have attached a text file with a 2-liner sed script that adds the "missing" changes from nikto-1.36-config.patch. Please add it, and then I'll do a final review.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
------- Additional Comments From foolish@guezz.net 2007-05-30 18:09 EST ------- Is %prep the right place for this sed magic?
Updated:
- Add sed magic to really replace nikto-1.36-config.patch
Spec URL: http://folk.ntnu.no/sindrb/packages/green_nyc/nikto.spec SRPM URL: http://folk.ntnu.no/sindrb/packages/green_nyc/nikto-1.36-3.fc7.src.rpm
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
faucamp@csir.co.za changed:
What |Removed |Added ---------------------------------------------------------------------------- Flag|fedora-review? |fedora-review+
------- Additional Comments From faucamp@csir.co.za 2007-05-31 03:28 EST ------- (In reply to comment #10)
Is %prep the right place for this sed magic?
Yes, because we are essentially just applying an "in-line" patch :-).
The sed magic modifies (i.e. patches or "prepares") the package content for compilation (it is not actually being built yet) and installation (obviously it's not being installed yet either). In this case, "compilation" is not applicable, so %build is empty, but patching a file using sed is not equivalent to "building" it.
Anyhow, on with the review:
+ Good points from comment #7 still apply, except: + rpmlint output isn't silent, but OK:
W: nikto invalid-license Custom, see LICENSE.txt
-- This is expected, due to the fact that the code is GPL, but the .db content isn't. (see comment #7)
+ Requires are good + License is good (code under GPL and content freely distributable with this program) + License field gives appropriate license information + %docs are good + program installs and runs fine
Everything looks fine.
------------------------- This package is APPROVED. -------------------------
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
foolish@guezz.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Flag| |fedora-cvs?
------- Additional Comments From foolish@guezz.net 2007-06-06 12:04 EST ------- New Package CVS Request ======================= Package Name: nikto Short Description: Web server scanner Owners: foolish@guezz.net Branches: F-7 FC-6 EL-4 EL-5
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
tibbs@math.uh.edu changed:
What |Removed |Added ---------------------------------------------------------------------------- Flag|fedora-cvs? |fedora-cvs+
------- Additional Comments From tibbs@math.uh.edu 2007-06-06 12:18 EST ------- CVS done.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: Review Request: nikto - Web server scanner
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239097
foolish@guezz.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution| |NEXTRELEASE
package-review@lists.fedoraproject.org