Dne 11.11.2014 v 16:30 Václav Pavlín napsal(a): > > On 11.11.2014 16:26, Vít Ondruch wrote: >> Dne 11.11.2014 v 16:17 Václav Pavlín napsal(a): >>> I also have one more topic... >>> >>> Software written in Go is linked statically and we are not able to >>> figure out which version of Go was used during build. Means that >>> despite we have latest Go with all CVE fixed in Fedora, we still have >>> these CVEs in some packages built from old Go releases. >>> >>> I've heard someone to mention we could use "Bundles" tag in RPM header >>> to track this. >> You mean bundled virtual provide, e.g. "Provides: bundled(go) = 1.0.0" >> etc. See >> >> https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#Requirement_if_you_bundle >> >> >> for more information. > Thanks! > > That's probably it, although I think we need to set this automatically > during the build to make it useful. > > Vašek Yes, you should write generator for it. Vít -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
