[Bug 1503915] New: Review Request: roca-detect - test RSA public keys for ROCA vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Bug ID: 1503915 Summary: Review Request: roca-detect - test RSA public keys for ROCA vulnerability Product: Fedora Version: rawhide Component: Package Review Severity: medium Priority: medium Assignee: nobody@fedoraproject.org Reporter: stuart@gathman.org QA Contact: extras-qa@fedoraproject.org CC: package-review@lists.fedoraproject.org
Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f26/x86_64/roca-detect-1.0.7-2.fc26.noarch.rpm Description: This tool is related to the [ACM CCS 2017 conference paper #124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli](https://crocs.fi.muni.cz/public/papers/rsa_ccs17).
Example output when run on /etc/pki/rpm-gpg/* on a Fedora 26 system (with rpmfusing and other extra repos):
2017Oct19 00:13:22 ### SUMMARY #################### 2017Oct19 00:13:22 Records tested: 158 2017Oct19 00:13:22 .. PEM certs: . . . 0 2017Oct19 00:13:22 .. DER certs: . . . 0 2017Oct19 00:13:22 .. RSA key files: . 0 2017Oct19 00:13:22 .. PGP master keys: 177 2017Oct19 00:13:22 .. PGP total keys: 272 2017Oct19 00:13:22 .. SSH keys: . . . 0 2017Oct19 00:13:22 .. APK keys: . . . 0 2017Oct19 00:13:22 .. JSON keys: . . . 0 2017Oct19 00:13:22 .. LDIFF certs: . . 0 2017Oct19 00:13:22 .. JKS certs: . . . 0 2017Oct19 00:13:22 .. PKCS7: . . . . . 0 2017Oct19 00:13:22 No fingerprinted keys found (OK) 2017Oct19 00:13:22 ################################
Fedora Account System Username: sdgathman
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #1 from Stuart D Gathman stuart@gathman.org --- Note that the test suite fails when building on F25. I don't plan on debugging this, as F25 will be EOL by the time this gets reviewed.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #2 from Stuart D Gathman stuart@gathman.org --- The package does build and run correctly on CentOS-7 with EPEL.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #3 from Igor Gnatenko ignatenko@redhat.com ---
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-buildroot
drop this
Group: Development/Libraries
not needed
Prefix: %{_prefix}
drop this
Vendor: Dusan Klinec dusan.klinec@gmail.com
drop this
python setup.py build
%py2_build
python setup.py install --single-version-externally-managed -O1 --root=$RPM_BUILD_ROOT --record=INSTALLED_FILES
%py2_install
* all python requires should be python2- prefixed * any reason to make it py2 instead of py3?
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #4 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f26/x86_64/roca-detect-1.0.7-3.fc26.noarch.rpm
Dropped unwanted metadata %py2_build does not work on f26 - added comment
%py2_install does not work on f26 - added comment
python3 does not (yet) have all needed packages for the application in f26. This can be revisited with later releases,
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #5 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f27/x86_64/roca-detect-1.0.7-3.fc26.noarch.rpm
Ran build and self-test on f27.
Changed shebang in /usr/bin/roca-detect to python2.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #6 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.1-1.fc28.src.rpm
Update to new upstream release. Switch to python3 as default.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Neal Gompa ngompa13@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ngompa13@gmail.com
--- Comment #7 from Neal Gompa ngompa13@gmail.com --- If you want to change Python versions easily with the macros, you can do the following:
%global __python %{__python3}
....
%build %py_build ... %install %py_install ... %files %{python_sitelib}/* ...
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Miro Hrončok mhroncok@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED CC| |mhroncok@redhat.com Assignee|nobody@fedoraproject.org |mhroncok@redhat.com
--- Comment #8 from Miro Hrončok mhroncok@redhat.com --- OK. Let me take this. Here are my suggestions:
1. I find the spec file very hard to read. I suggest you give it some air with empty lines on appropriate places and reorder some lines to more common order. See for example https://src.fedoraproject.org/rpms/uflash/blob/master/f/uflash.spec
2. The spec file references Fedora 26 several times, but that is EOL.
3. If you really need to have if RHEL conditionals for python2 / python3, follow what Neal says above.
4. Use the %py3_build and %py3_install (or %py_build and %py_install) macros.
5. Use a publicly accessible website for URL.
6. Don't put # in description.
7. Please no INSTALLED_FILES.
8. Use %{buildroot} instead of $RPM_BUILD_ROOT
9. Is there no /usr/bin/roca-detect created by upstream's setup.py? Why the cat?
10. As %check gets executed after %install I suggest you move it bellow.
11. Give the patch a number, use %autosetup if possible.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #9 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.1-3.fc28.src.rpm
Adjusted as requested, except as noted below:
3. As noted above and in SPEC comments, %py_build and %py_install fail. Also, Neal's definition of __python fails, %{__python} gets substituted with a literal "%{__python3}" - causing all kinds of havoc. I compromised and defined it as /usr/bin/python3 (should have used %{_bindir}, but I've spent too long).
4. See 3.
9. The "EASY" introducer supplied by upstream requires setuptools >= 1.0 (doesn't work in epel), requires setuptools at runtime, and is horribly complex compared to a simple wrapper script. The cat is so that the proper python version is easily substituted in. The upstream /usr/bin name is roca-detect-tls. I took the liberty of shortening it.
11. I gave the patch an explicit 0 (is that *really* important?). It is important to me to give the patch backup files an extension that I can easily feed back into gendiff.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #10 from Miro Hrončok mhroncok@redhat.com --- 3. Add BuildRequires: python3-devel, it will bring the macros in. When not defined, they are evaluated to literal %py_build and % is a job control character for shell. The same for %{__python3} - you get it literal because you don't BR python3-devel. Please read https://fedoraproject.org/wiki/Packaging:Python#Dependencies
4. See 3.
9. Please stay close to upstream. Require setuptools. Feel free to supply changes to the epel branch later. The complexity is there for a reason. The proper python version will be used if you use the proper macros. DO NOT change upstream executable names. Work with upstream if you think it is desired. Create symbolic links for shortcuts if absolutely desired.
11. It's not important. It's juts good manners. I also suggest you use %autosetup with -S git and use git instead of gendiff, but that's juts a suggestion (feel free to ignore it).
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #11 from Miro Hrončok mhroncok@redhat.com --- 12. Be more explicit than %{python_sitelib}/*. https://pagure.io/packaging-committee/issue/782
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #12 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.1-4.fc28.src.rpm
3,4. I was wondering why %py_build worked on my native code python packages, but not on this one. Thanks!
9. Kept upstream wrapper name and added symlink for my shortcut. I stayed with the trivial distro specific wrapper script, however. This is absolutely no purpose served by pulling in setuptools at runtime solely to make a 3 line wrapper script into a government project.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #13 from Stuart D Gathman stuart@gathman.org --- Well, the purpose of the complex wrapper is to have the same script run on a variety of distros and python versions. However, that purpose doesn't apply to a Fedora package.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #14 from Miro Hrončok mhroncok@redhat.com --- 3,4.
%py_build # Fails with "fg: no job control" #{__python} setup.py build
Please just keep the %py_build macro. (Same for install.)
1. This still stands
6. There is more markdown in %description, plese use plaintext.
9. I don't agree, but apparently there is nothing I can do to stop you. At least, please make the script PEP8 compliant and set the shebang line to:
#!%{__python} %{py_shbang_opts}
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #15 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.1-5.fc28.src.rpm
1. Added tabs after tags and double space between sections to SPEC. I aim to please.
3,4. I wasn't going to leave the commented out code in there. Really, I wasn't!
6. Removed square brackets and parens from description.
9. I was eager to see what %{py_shbang_opts} would add. The -s seems quite reasonable. I'll use that for wrappers from now on. Thanks! A trivial wrapper seems the one place where multiple imports on one line would be entirely appropriate - but I split into two lines, and now the trivial wrapper is fully pep8 compliant. I can't complain much since you caved on using a distro specific wrapper.
For reference, here is the EASY script I am replacing. It works on Windows, but not on Fedora without a lot of hacking (and additional runtime dependencies). By far the smallest hack to upstream is to simply replace it with a trivial wrapper. (I won't convince you, but thought I'd try.)
#!/usr/bin/python3 # EASY-INSTALL-ENTRY-SCRIPT: 'roca-detect==1.2.1','console_scripts','roca-detect-tls' __requires__ = 'roca-detect==1.2.1' import re import sys from pkg_resources import load_entry_point
if __name__ == '__main__': sys.argv[0] = re.sub(r'(-script.pyw?|.exe)?$', '', sys.argv[0]) sys.exit( load_entry_point('roca-detect==1.2.1', 'console_scripts', 'roca-detect-tls')() )
The roca-detect EASY script would run roca.detect.py, and roca-detect-tls EASY script (new in upstream version 1.2.1) runs roca.detect_tls.py (but is broken on Fedora). The roca-detect-tls entry works if you symlink to it directly. But they both use the forbidden (for good reason) /usr/bin/env shbang. The detect.py cli scans local files, the detect_tls.py cli makes actual network connections.
The upshot is that roca-detect-tls is actually a different function from roca-detect.
Proposal:
How do you feel about patching both upstream cli scripts to replace the env shbang with %{__python} %{py_shbang_opts} - and making the /usr/bin entries simply symlink to them? I'll go ahead and do that, test, and then come back here for your reaction.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #16 from Stuart D Gathman stuart@gathman.org --- Ok, testing reveals that the roca-detect-tls scripts does not work with python3. Only the roca-detect script works with py3. I can:
1. leave out roca-detect-tls 2. try to patch it to work with python3 3. revert to python2
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #17 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.1-6.fc28.src.rpm
It turned out to be a 1 char fix to make roca-detect-tls work in python3. I'll report upstream. I also patched in additional help for roca-detect-tls since there are no man pages.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #18 from Miro Hrončok mhroncok@redhat.com --- 9. additional runtime dependencies is setuptools? still, I urge you to use entry points instead of handcrafted script
Have you actually updated the specfile?
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #19 from Stuart D Gathman stuart@gathman.org --- Oops, copied spec to wrong server. Fixed now. I got rid of the handcrafted script. Now I just symlink directly to the upstream python CLI - after fixing the "env python" shebang. Another reason why the "EASY" abomination is pointless - trivially replaced with a symlink...
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #20 from Stuart D Gathman stuart@gathman.org --- (In reply to Miro Hrončok from comment #18)
- additional runtime dependencies is setuptools? still, I urge you to use
entry points instead of handcrafted script
It's not just the runtime dependency. The "EASY" scripts also do not run out of the box on Fedora, requiring *far* more extensive patches to fix the problems than a 3 line wrapper. And now even the wrapper is gone - all I've done is patch the 'env python' shebang (which is against Fedora rules), and replace the EASY scripts with symlinks. The only purpose of the EASY scripts is for platforms (like Windows - where the scripts actually work) with no symlink apparently.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #21 from Miro Hrončok mhroncok@redhat.com --- I have hard time understanding what are you talking about. Upstream uses a pretty standard console_scripts entry_point used by hundreds of packages within Fedora and thousand of upstream Python packages. Why do you fight against it so much?
It should work in Fedora out of the box without any patches and the shebang should be set by the %py3_install command.
Please answer the following questions:
do not run out of the box on Fedora
How does this manifest the problem? What is the error message or incorrect behavior?
requiring *far* more extensive patches to fix the problems
What would you need to patch to make it work?
The only purpose of the EASY scripts is for platforms (like Windows - where the scripts actually work) with no symlink apparently.
Where are you getting this information?
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #22 from Stuart D Gathman stuart@gathman.org --- (In reply to Miro Hrončok from comment #21) Look, I really appreciate the nits you've pointed out, and I've learned a lot. But let me turn it around. Upstream provides two directly executable CLI python scripts in %{py_sitelib}. I symlink them to /usr/bin for convenience. Why are you so against that? All my packages have one or more symlinks for convenience, I've never encountered any resistance from reviewers over it before.
My (admittedly snide, sorry) remark about the teleology of EASY scripts was based on my observation that they work on Windows, do not work for me out of the box on Fedora (I know you said installing some additional stuff would let them work), and when I trace through the source to debug, I find they end up doing the equivalent of simply symlinking the actual CLI scripts. Is there a Fedora rule against using symlinks to conveniently access python CLI scripts? Without the symlink, you could also just type "python3 -m roca.detect" as the equivalent of the /usr/bin/roca-detect symlink.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Miro Hrončok mhroncok@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEW Assignee|mhroncok@redhat.com |nobody@fedoraproject.org
--- Comment #23 from Miro Hrončok mhroncok@redhat.com --- My resistence is based on a fact that you are trying to workaround what I see as a no-problem and that you are diverging from upstream.
No, there is no rule that you cannot remove one part of upstream software and replace it with something else because you think it's better. However I always though that this is something that is discouraged in Fedora and all our downstream changes must be highly justifiable, or on it's way to upstream.
https://fedoraproject.org/wiki/Staying_close_to_upstream_projects
If you are unwilling to accept this, I am unwilling to accept the package and am stepping down form the review. I guess there will be others who are not so prudent.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #24 from Stuart D Gathman stuart@gathman.org --- No problem. The need for this package is decaying anyway, as it is being incorporated into key generation software.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #25 from Stuart D Gathman stuart@gathman.org --- For posterity, here is how the "EASY" entry point breaks:
roca-detect-tls Traceback (most recent call last): File "/usr/bin/roca-detect-tls", line 11, in <module> load_entry_point('roca-detect==1.2.1', 'console_scripts', 'roca-detect-tls')() File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 476, in load_entry_point return get_distribution(dist).load_entry_point(group, name) File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 2700, in load_entry_point return ep.load() File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 2318, in load return self.resolve() File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 2324, in resolve module = __import__(self.module_name, fromlist=['__name__'], level=0) File "/usr/lib/python3.6/site-packages/roca/detect_tls.py", line 23, in <module> from detect import RocaFingerprinter, logger, LOG_FORMAT ModuleNotFoundError: No module named 'detect'
The problem is that the actual CLI scripts expect to be run directly, and when loaded as a module by EASY, relative imports break. If I patch the import, then that breaks running the entry script directly. Some sort of conditional logic is needed on the imports for the EASY introducer to work correctly. It is insane to debug and workround the EASY bugs - when a symlink accomplishes the intended result on Fedora systems.
I am making the symlinks a conditional build option for building with and without EASY. Since EASY is broken as is, I am making the symlinks the default.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #26 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.1-7.fc28.src.rpm
Add build option to use broken EASY entry point provided by upstream. Not enabled by default since it doesn't work.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #27 from Miro Hrončok mhroncok@redhat.com --- That is an upstream bug that was fixed in 1.2.6 https://github.com/crocs-muni/roca/issues/43
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #28 from Stuart D Gathman stuart@gathman.org --- 1.2.1 is the latest release. There are more recent tags (not releases). SHould I use the latest tag: 1.2.12 ?
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #29 from Miro Hrončok mhroncok@redhat.com --- "release" is just a github thing built on top of tags. I recommend asking upstream whether they consider the "releases" to be somehow more or of they just sometimes forget to create them.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #30 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.12-1.fc28.src.rpm
Moved to latest upstream tag. Symlink option is no longer default since EASY scripts now work. If I think of it after getting my other work done, I'd like to explore whether replacing EASY scripts with symlinks should be a more accepted packaging option.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #31 from Miro Hrončok mhroncok@redhat.com ---
I'd like to explore whether replacing EASY scripts with symlinks should be a more accepted packaging option.
Try https://pagure.io/packaging-committee/issues but be prepared to have some arguments.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Miro Hrončok mhroncok@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|nobody@fedoraproject.org |mhroncok@redhat.com Flags| |fedora-review?
--- Comment #32 from Miro Hrončok mhroncok@redhat.com --- Package Review ==============
Legend: [x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated [ ] = Manual review needed
Issues: ======= - Packages MUST NOT have dependencies (either build-time or runtime) on packages named with the unversioned python- prefix unless no properly versioned package exists. Dependencies on Python packages instead MUST use names beginning with python2- or python3- as appropriate. Note: Unversionned Python dependency found. See: https://fedoraproject.org/wiki/Packaging:Python#Dependencies Note: "%if 0%{?rhel} <= 7" is true on Fedora.
- Missing requirement on python3dist(six) (upstream says it needs it).
- Incoherent version in changelog, see rpmlint output bellow.
- Wrong (unneeded) shebangs, see rpmlint output bellow.
- Packaged .gitignore, see rpmlint output bellow.
===== MUST items =====
Generic: [x]: Package is licensed with an open-source compatible license and meets other legal requirements as defined in the legal section of Packaging Guidelines. [x]: License field in the package spec file matches the actual license. [x]: Package contains no bundled libraries without FPC exception. [!]: Changelog in prescribed format. [x]: Sources contain only permissible code or content. [-]: Package contains desktop file if it is a GUI application. [-]: Development files must be in a -devel package [x]: Package uses nothing in %doc for runtime. [x]: Package consistently uses macros (instead of hard-coded directory names). [x]: Package is named according to the Package Naming Guidelines. [x]: Package does not generate any conflict. [x]: Package obeys FHS, except libexecdir and /usr/target. [-]: If the package is a rename of another package, proper Obsoletes and Provides are present. [!]: Requires correct, justified where necessary. (python-dateutil, six missing) [x]: Spec file is legible and written in American English. [-]: Package contains systemd file(s) if in need. [x]: Package is not known to require an ExcludeArch tag. [-]: Large documentation must go in a -doc subpackage. Large could be size (~1MB) or number of files. Note: Documentation size is 276480 bytes in 5 files. [?]: Package complies to the Packaging Guidelines [x]: Package successfully compiles and builds into binary rpms on at least one supported primary architecture. [x]: Package installs properly. [x]: Rpmlint is run on all rpms the build produces. Note: There are rpmlint messages (see attachment). [x]: If (and only if) the source package includes the text of the license(s) in its own file, then that file, containing the text of the license(s) for the package is included in %license. [x]: Package requires other packages for directories it uses. [x]: Package must own all directories that it creates. [x]: Package does not own files or directories owned by other packages. [x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT [x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the beginning of %install. [x]: Macros in Summary, %description expandable at SRPM build time. [x]: Dist tag is present. [x]: Package does not contain duplicates in %files. [x]: Permissions on files are set properly. [x]: Package must not depend on deprecated() packages. [x]: Package use %makeinstall only when make install DESTDIR=... doesn't work. [x]: Package is named using only allowed ASCII characters. [x]: Package does not use a name that already exists. [x]: Package is not relocatable. [x]: Sources used to build the package match the upstream source, as provided in the spec URL. [x]: Spec file name must match the spec package %{name}, in the format %{name}.spec. [x]: File names are valid UTF-8. [x]: Packages must not store files under /srv, /opt or /usr/local
Python: [x]: Python eggs must not download any dependencies during the build process. [x]: A package which is used by another package via an egg interface should provide egg info. [?]: Package meets the Packaging Guidelines::Python [x]: Package contains BR: python2-devel or python3-devel [x]: Binary eggs must be removed in %prep
===== SHOULD items =====
Generic: [-]: If the source package does not include license text(s) as a separate file from upstream, the packager SHOULD query upstream to include it. [!]: Final provides and requires are sane (see attachments). [?]: Package functions as described. [?]: Latest version is packaged. [x]: Package does not include license text files separate from upstream. [x]: Patches link to upstream bugs/comments/lists or are otherwise justified. [-]: Description and summary sections in the package spec file contains translations for supported Non-English languages, if available. [?]: Package should compile and build into binary rpms on all supported architectures. [x]: %check is present and all tests pass. [?]: Packages should try to preserve timestamps of original installed files. [x]: Reviewer should test that the package builds in mock. [x]: Buildroot is not present [x]: Package has no %clean section with rm -rf %{buildroot} (or $RPM_BUILD_ROOT) [x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin. [x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file [x]: Sources can be downloaded from URI in Source: tag [x]: SourceX is a working URL. [x]: Spec use %global instead of %define unless justified.
===== EXTRA items =====
Generic: [x]: Rpmlint is run on all installed packages. Note: There are rpmlint messages (see attachment). [x]: Spec file according to URL is the same as in SRPM.
Rpmlint ------- Checking: roca-detect-1.2.12-1.fc30.noarch.rpm roca-detect-1.2.12-1.fc30.src.rpm roca-detect.noarch: W: incoherent-version-in-changelog 1.2.1-8 ['1.2.12-1.fc30', '1.2.12-1'] roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert01.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert02.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert03.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert04.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert05.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert06.pem roca-detect.noarch: E: wrong-script-interpreter /usr/lib/python3.7/site-packages/roca/tests/test_fingerprint.py /usr/bin/env python roca-detect.noarch: E: non-executable-script /usr/lib/python3.7/site-packages/roca/tests/test_fingerprint.py 644 /usr/bin/env python roca-detect.noarch: E: wrong-script-interpreter /usr/lib/python3.7/site-packages/roca/tests/test_tls.py /usr/bin/env python roca-detect.noarch: E: non-executable-script /usr/lib/python3.7/site-packages/roca/tests/test_tls.py 644 /usr/bin/env python roca-detect.noarch: E: version-control-internal-file /usr/share/doc/roca-detect/docs/.gitignore roca-detect.noarch: E: zero-length /usr/share/doc/roca-detect/docs/.gitignore roca-detect.noarch: W: no-manual-page-for-binary roca-detect roca-detect.noarch: W: no-manual-page-for-binary roca-detect-tls 2 packages and 0 specfiles checked; 6 errors, 9 warnings.
Rpmlint (installed packages) ---------------------------- sh: /usr/bin/python: No such file or directory roca-detect.noarch: W: incoherent-version-in-changelog 1.2.1-8 ['1.2.12-1.fc30', '1.2.12-1'] roca-detect.noarch: W: invalid-url URL: https://crocs.fi.muni.cz/public/papers/rsa_ccs17 <urlopen error [Errno -2] Name or service not known> roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert01.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert02.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert03.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert04.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert05.pem roca-detect.noarch: W: pem-certificate /usr/lib/python3.7/site-packages/roca/tests/data/cert06.pem roca-detect.noarch: E: wrong-script-interpreter /usr/lib/python3.7/site-packages/roca/tests/test_fingerprint.py /usr/bin/env python roca-detect.noarch: E: non-executable-script /usr/lib/python3.7/site-packages/roca/tests/test_fingerprint.py 644 /usr/bin/env python roca-detect.noarch: E: wrong-script-interpreter /usr/lib/python3.7/site-packages/roca/tests/test_tls.py /usr/bin/env python roca-detect.noarch: E: non-executable-script /usr/lib/python3.7/site-packages/roca/tests/test_tls.py 644 /usr/bin/env python roca-detect.noarch: E: version-control-internal-file /usr/share/doc/roca-detect/docs/.gitignore roca-detect.noarch: E: zero-length /usr/share/doc/roca-detect/docs/.gitignore roca-detect.noarch: W: no-manual-page-for-binary roca-detect roca-detect.noarch: W: no-manual-page-for-binary roca-detect-tls 1 packages and 0 specfiles checked; 6 errors, 10 warnings.
Requires -------- roca-detect (rpmlib, GLIBC filtered): /usr/bin/python3 python(abi) python-dateutil python3-cryptography python3-future python3-pgpdump
Provides -------- roca-detect: python3.7dist(roca-detect) python3dist(roca-detect) roca-detect
Source checksums ---------------- https://github.com/crocs-muni/roca/archive/v1.2.12.tar.gz#/roca-detect-1.2.1... : CHECKSUM(SHA256) this package : 698987a3a260bf8eabf17767f0db6952bce42dff90ddbc3974e6248957fac3e7 CHECKSUM(SHA256) upstream package : 698987a3a260bf8eabf17767f0db6952bce42dff90ddbc3974e6248957fac3e7
Generated by fedora-review 0.6.1 (3899f24) last change: 2018-09-06 Command line :./try-fedora-review -b 1503915 -m fedora-rawhide-x86_64 Buildroot used: fedora-rawhide-x86_64 Active plugins: Python, Generic, Shell-api Disabled plugins: Java, C/C++, fonts, SugarActivity, Ocaml, Perl, Haskell, R, PHP, Ruby Disabled flags: EXARCH, BATCH, DISTTAG, EPEL5, EPEL7, EPEL6
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #33 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.12-2.fc28.src.rpm
Fix the shebangs and permissions of the CLI test scripts, just in case user want to run individual tests without python3 -m (and to keep rpmlint happy).
Fix bogus changelog version.
Remove version control files left by upstream.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #34 from Miro Hrončok mhroncok@redhat.com --- I really don't get this conditional now:
%if 0%{?rhel} >= 7 Requires: python-dateutil %else Requires: %{python}-dateutil %endif
What is it that you are trying to express? On RHEL7+, require python-dateutil, but on RHEL6, require python3-dateutil? Why?
--------------
Requires: %{python}-future %{python}-cryptography %{python}-pgpdump # Not required in normal usage, but recommended by upstream. Requires: python3dist(six)
This mixes 2 types of specifying Python dependencies. As well as this doesn't work with your python macros specified on top. Also, submit a pull request to upstream if the six dependency is bogus.
I recommend you switch to https://fedoraproject.org/wiki/Packaging:Python#Automatically_generated_depe...
--------------
# fix env shbang in CLI scripts sed -i -e '1,1 s,^#!.*$,#!%{__python} %{py_shbang_opts},' \ `find roca -name "*.py" | xargs grep -l '^#!.*env python'`
You might very well just use pathfix.py as a one-liner. https://fedoraproject.org/wiki/Changes/Make_ambiguous_python_shebangs_error#...
--------------
find . -name .gitignore | xargs rm
Why not just -delete?
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #35 from Stuart D Gathman stuart@gathman.org --- (In reply to Miro Hrončok from comment #34)
I really don't get this conditional now:
%if 0%{?rhel} >= 7 Requires: python-dateutil %else Requires: %{python}-dateutil %endif
What is it that you are trying to express? On RHEL7+, require python-dateutil, but on RHEL6, require python3-dateutil? Why?
python-dateutil.noarch 1.5-7.el7 @base python2-dateutil.noarch 1.5-0.el7 epel python34-dateutil.noarch 1:2.4.2-3.el7 epel
I'll just remove all rhel7 support from the package review, and sneak it in after Fedora is approved. I didn't get el6 to work, and may not spend time on it.
I'll try your other recommendations after I get a day job trouble ticket taken care of. The pathfix.py looks quite handy - I need to do that a lot.
I only put in the python3dist(six) because you thought I needed it. The actual substance is met by Requires: %{python}-future. I put the software through its paces in mock, or in a minimal install where network is needed (roca-detect-tls) to verify dependencies. I will try the autodependency, but I've had mixed results in the past. But it's been a few years, maybe it'll work for this.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #36 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.12-3.fc28.src.rpm
Use pathfix.py and auto dependencies
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #37 from Miro Hrončok mhroncok@redhat.com --- I really don't like the %if 0 part of the spec file. Can you check if python_enable_dependency_generator is defined instead if you really must?
BuildRequires: %{python}-setuptools %{python}-devel BuildRequires: /usr/bin/pathfix.py
Here you mix tabs and spaces. I recommend sticking with spaces, but please pick one.
Otherwise this starts to look good.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #38 from Stuart D Gathman stuart@gathman.org --- The autodependency pulls in python3-six, which isn't needed - but python2-six is needed for python2, and there are going to be lots of dual version packages so I don't mind it. It builds for epel7 for python2, and still works - but the autodependency fails. I'll need the manual dependencies for epel7.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #39 from Stuart D Gathman stuart@gathman.org --- Spec URL: https://gathman.org/linux/SPECS/roca-detect.spec SRPM URL: https://gathman.org/linux/f28/src/roca-detect-1.2.12-4.fc28.src.rpm
Mark manual dependency section as needed for epel7. Builds as is on epel7 with correct dependencies.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #41 from Gwyn Ciesla limburgher@gmail.com --- (fedscm-admin): The Pagure repository was created at https://src.fedoraproject.org/rpms/roca-detect
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Miro Hrončok mhroncok@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|fedora-review? |fedora-review+
--- Comment #40 from Miro Hrončok mhroncok@redhat.com --- OK.
Package APPROVED.
Thank for your patience with me.
Note that your RHEL >= 7 conditional might bite you with next major RHEL release.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |MODIFIED
--- Comment #42 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-a4704b6c52
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #43 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2cce72d1ce
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #44 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-68039ba023
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #45 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1238d3177c
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |ON_QA
--- Comment #46 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-a4704b6c52
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #47 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-68039ba023
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #48 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1238d3177c
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #49 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2cce72d1ce
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #51 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA Last Closed| |2018-09-21 01:33:26
--- Comment #50 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #52 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1503915
--- Comment #53 from Fedora Update System updates@fedoraproject.org --- roca-detect-1.2.12-4.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
package-review@lists.fedoraproject.org
-
bugzilla＠redhat.com