[Bug 915864] Review Request: oat - Attestation Service & Host Agent based on OpenAttestation SDK

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=915864

--- Comment #1 from Steven Dake <sdake@xxxxxxxxxx> ---
This package includes 74 bundled libraries:
[sdake@freedom JAR_SOURCE]$ ls *jar | wc -l
74

Please note bundling is not allowed in Fedora unless a Fedora exception is
granted.  It appears this has already been addressed by the packaging policy:

https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#Exceptions

Search for "Copylibs"
In particular, the programming practice that is common in some java, mono, and
scripting language circles of copying external libraries that are otherwise
from a separate upstream into the program's source and distributing them
together is not allowed.

The rpm spec file should be designed specifically for Fedora, not RPM based
distributions.  In particular:
1) 
The oat-1.6.0-fedora-build.patch is disturbing.  That logic should be part of
the spec file.

Further these files should be broken out as separate source files.

2)
There are init scripts in the patch.  These should be broken out as separate
source files, and further, systemd unit files are required for new fedora
packages rather then init scripts.

3)
There are macros for fedora vs suse - remove the suse-isms

Other problems:
1)
The description with the trademark "Intel" violates the trademark rules of
packaging:

2)
I recommend placing Requires and BuildRequires on separate lines, ie:
Requires: httpd
Requires: tomcat6
Requires: mysql

See:
https://fedoraproject.org/wiki/Packaging:Guidelines?rd=Packaging/Guidelines#summary

3)
scriplets are modifying sql databases.  This is not allowed.  See:

See:
https://fedoraproject.org/wiki/Packaging:Guidelines?rd=Packaging/Guidelines#Scriptlets

specifically:
Scriplets are only allowed to write in certain directories

One could argue that mysql is writing outside these directories.

I would suggest instead installing a oat-db-drop script which drops the oat
database for users to run if they choose.  Same for db setup - recommend an
oat-db-setup script.

I'll do a formal review once the 74 bundled libraries are packaged, or an
exception is granted by the Fedora Packaging Committee.  The committe that
grants exceptions can be contacted here:

http://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries
Search for "Exceptions"

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=C1hjTJb2S8&a=cc_unsubscribe
_______________________________________________
package-review mailing list
package-review@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/package-review



[Index of Archives]     [Fedora Legacy]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]     [Fedora Tools]