On Thu, 2006-06-29 at 20:11 -0700, Jens Petersen wrote:
Author: petersen
Update of /cvs/extras/rpms/haddock/devel In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv16242
Modified Files: haddock.spec Log Message:
- set selinux unconfined_execmem_exec_t context to allow running under targeted policy (#195821)
Index: haddock.spec
RCS file: /cvs/extras/rpms/haddock/devel/haddock.spec,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- haddock.spec 29 Jun 2006 12:23:45 -0000 1.2 +++ haddock.spec 30 Jun 2006 03:11:26 -0000 1.3
@@ -10,6 +10,8 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: ghc libxslt docbook-style-xsl +# need chcon +PreReq: coreutils
%description Haddock is a tool for automatically generating hyperlinked documentation from @@ -53,6 +55,11 @@ %clean rm -rf ${RPM_BUILD_ROOT}
+%post +/usr/bin/chcon -t unconfined_execmem_exec_t %{_libexecdir}/haddock.bin >/dev/null 2>&1 || :
I think, we should implement a policy to make
* Requires(pre|post) mandatory instead of PreReq
* To make file deps on tools being used in %pre|post scripts mandatory.
Ralf
Ralf Corsepius wrote:
I think, we should implement a policy to make
- Requires(pre|post)
mandatory instead of PreReq
I'd say recommended or strongly encouraged. There are still a few valid uses for PreReq. I use Prereq: foo occasionally as short-hand for Requires: foo Requires(pre): foo Requires(post): foo
- To make file deps on tools being used in %pre|post scripts mandatory.
+1
-- Rex
On Fri, 2006-06-30 at 14:31 +0200, Ralf Corsepius wrote:
I think, we should implement a policy to make
- Requires(pre|post)
mandatory instead of PreReq
-1 for that wording, they are not the same thing. http://rpm.org/max-rpm-snapshot/s1-rpm-depend-manual-dependencies.html#S3-RP...
On the other hand, +1 if you mean just that relying on PreReq to cover scriptlet dependencies is a no-no.
- To make file deps on tools being used in %pre|post scripts mandatory.
+1 when the tools are really required. An example when they are not is eg. the GTK+ icon cache entry at http://fedoraproject.org/wiki/ScriptletSnippets
On Fri, 2006-06-30 at 15:58 +0300, Ville Skyttä wrote:
On Fri, 2006-06-30 at 14:31 +0200, Ralf Corsepius wrote:
I think, we should implement a policy to make
- Requires(pre|post)
mandatory instead of PreReq
-1 for that wording, they are not the same thing. http://rpm.org/max-rpm-snapshot/s1-rpm-depend-manual-dependencies.html#S3-RP...
On the other hand, +1 if you mean just that relying on PreReq to cover scriptlet dependencies is a no-no.
Originially, I was referring to PreReq in the context of Jens' spec file: He is running /usr/bin/chcon in a %post scriptlet.
I.e. he actually wants Requires(post) and doesn't want PreReq.
And ... given the difference between older "PreReq" and newer "PreReq" (==Require), described in the link above, I am even stronger in favor of "disallowing PreReq", to avoid problems related to the behavioral changes.
- To make file deps on tools being used in %pre|post scripts mandatory.
+1 when the tools are really required. An example when they are not is eg. the GTK+ icon cache entry at http://fedoraproject.org/wiki/ScriptletSnippets
C.f. Jens spec file: He is using /usr/bin/chcon in a %post scriptlet and "PreReq: coreutils".
This will break should /usr/bin/chcon be moved or removed.
Ralf
On Fri, 2006-06-30 at 15:58 +0300, Ville Skyttä wrote:
On Fri, 2006-06-30 at 14:31 +0200, Ralf Corsepius wrote:
I think, we should implement a policy to make
- Requires(pre|post)
mandatory instead of PreReq
-1 for that wording, they are not the same thing. http://rpm.org/max-rpm-snapshot/s1-rpm-depend-manual-dependencies.html#S3-RP...
On the other hand, +1 if you mean just that relying on PreReq to cover scriptlet dependencies is a no-no.
+1 Maybe wording like:
The use of PreReq to install a package prior to installing this one has been deprecated within rpm. Inside of spec files the Prereq tag should be replaced with a plain Requires line or the [http://rpm.org/max-rpm-snapshot/s1-rpm-depend-manual-dependencies.html#S3-RP... context marked Requires] that expresses when the requirement needs to be met.
- To make file deps on tools being used in %pre|post scripts mandatory.
+1 when the tools are really required. An example when they are not is eg. the GTK+ icon cache entry at http://fedoraproject.org/wiki/ScriptletSnippets
What is the reason to use file dependencies? Clarity when comparing Requires to scriptlets? To protect against programs moving to a different package?
-Toshio
On Fri, 2006-06-30 at 09:31 -0700, Toshio Kuratomi wrote:
On Fri, 2006-06-30 at 15:58 +0300, Ville Skyttä wrote:
On Fri, 2006-06-30 at 14:31 +0200, Ralf Corsepius wrote:
- To make file deps on tools being used in %pre|post scripts mandatory.
+1 when the tools are really required. An example when they are not is eg. the GTK+ icon cache entry at http://fedoraproject.org/wiki/ScriptletSnippets
What is the reason to use file dependencies? Clarity when comparing Requires to scriptlets? To protect against programs moving to a different package?
My motivation is to protect package maintainers and installers against * tools moving to different packages. * tools moving to different places.
Actually, I would like to see a policy of this kind implemented: * All tools being used in rpm-scriptlets must be using an absolute path. * Each tool being used in rpm-scriptlets must be accompanied by a corresponding Requires(post|pre|preun|postun|..).
IMO, this would help avoiding such changes breaking upgrade/update paths and would help avoid users to break their systems.
Ralf
packaging@lists.fedoraproject.org