Non-free tarball checked in

[Dennis Gilmore]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 12 Mar 2012 08:19:38 -0400
Stephen Gallagher <sgallagh at redhat.com> wrote:

> On Mon, 2012-03-12 at 13:01 +0100, Brendan Jones wrote:
> > On 03/12/2012 03:46 AM, Bruno Wolff III wrote:
> > > I checked in a tarball for egoboo that turned out to have a
> > > non-free (noncommercial restriction) font file in it. The tarball
> > > has only been used for local builds (no scratch-builds). Do I
> > > need to remove this tarball from the lookaside cache? If so how
> > > do I do it? The hash is e6f3130695d297dcd9fe74e50bd59b68.
> > 
> > Does that mean any source tarballs containing non-free content
> > should be repacked by the maintainer even if the source rpm doesn't
> > install/use any of the non-free content? I've been recently
> > commenting on a review where this might apply.
> 
> Yes, see
> http://fedoraproject.org/wiki/Packaging:SourceURL#When_Upstream_uses_Prohibited_Code

Also you should neverdo a scratch build with prohibited code/items.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iEYEARECAAYFAk9d7QkACgkQkSxm47BaWffvXQCdEKN9d0P8pl+UKPRiTRNUDoPc
Rj8AmQGNcKVwqVkMX4C82RCw1t8qyO0E
=/9AT
-----END PGP SIGNATURE-----