need help with a package

[Alexander Aristotle Davis]

Hi,

A package called rssh has been marked as duplicate on Bugzilla and I am 
working on a 2.3.3 version and would like to update it to a new 
release.  Could you please inform me why this package have been orphaned.

I am not a packager; I am seeking a sponsor to help me review the file.

Thank you

Alex

[Jon VanAlten]

----- Original Message -----
>  From: "Alexander Aristotle Davis"
> <aadavis1(a)learn.senecac.on.ca&gt;
>  To: devel(a)lists.fedoraproject.org
>  Sent: Monday, November 26, 2012 8:03:17 PM
>  Subject: need help with a package
>  
>  Hi,
>  
>  A package called rssh has been marked as duplicate on Bugzilla and I
>  am
>  working on a 2.3.3 version and would like to update it to a new
>  release.  Could you please inform me why this package have been
>  orphaned. 
Hi Alex,

First, welcome to Fedora-land

A little bit of searching goes a long way!  It seems the prior
maintainer orphaned it because it is dead upstream, contains a
known security flaw, upstream doesn't want to put effort into it,
and the old maintainer has no wish to fix the bug himself or
herself[1][2].  So, there in fact is no new release for this
software; the packages currently in fedora are the most current
version.

If you'd like to keep the package alive, I'd focus first on
fixing the security bug; getting the changes into the Fedora
package will be a simple matter, and you can get help for that
here when the time comes  If you have a fix for the security
bug, you may even be able to convince some existing maintainer
to adopt the package, with some assurance that you'll continue
to support it if other bugs are found.

In order for you to take over package maintenance yourself, you
will need to join the packager group[3].  If you want to get
sponsored by adding a new package to fedora, you'll have to find
a different one than rssh since (as you've found out) this
already exists in Fedora.

One comment about the spec you posted for review[4], even though
package review is not what is needed here I had a look anyways.
It seems like the main difference from existing spec in git is
the change in URL.  I'll just point out that, even though upstream
is not actively developing this software, changing the URL from
the upstream page to an empty wiki page seems not to be the best
idea.

Good luck!

jon

[1] http://lists.fedoraproject.org/pipermail/devel/2012-May/166874.html
[2] https://bugzilla.redhat.com/show_bug.cgi?id=820415
[3] https://fedoraproject.org/wiki/How_to_get_sponsored_into_the_packager_group
[4] https://bugzilla.redhat.com/show_bug.cgi?id=879954

[Matthias Runge]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/27/2012 02:03 AM, Alexander Aristotle Davis wrote:
>  Hi,
>  
>  A package called rssh has been marked as duplicate on Bugzilla and
>  I am working on a 2.3.3 version and would like to update it to a
>  new release.  Could you please inform me why this package have been
>  orphaned.
>  
>  I am not a packager; I am seeking a sponsor to help me review the
>  file.
>  
>  Thank you
>  
>  Alex
>  
>   
during the last week or so, I saw some (about 10?) review requests
with email addresses @learn.senecac...., (nearly) all with the same
issues:
- - they found an outdated package in fedora
- - updated that and requested a review for the updated package

The right way to get an outdated package updated is to file a bug
against that package. You'll get a grade A+, if you also submit a patch.

If your task is, to get a package reviewed, then you should find a
package, which is currently not in fedora. A starting point might be[1]

We have extensive documentation ready covering most issues: [2], [3]



[1] https://fedoraproject.org/wiki/Package_maintainers_wishlist
[2] https://fedoraproject.org/wiki/Package_Review_Process
[3] https://fedoraproject.org/wiki/Packaging:Guidelines
- -- 
Matthias Runge <mrunge(a)matthias-runge.de&gt;
               <mrunge(a)fedoraproject.org&gt;
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with undefined - http://www.enigmail.net/
>
> iQEbBAEBAgAGBQJQtIe5AAoJEOnz8qQwcaIWVY0H90PshH/O8DOt0+yXc5EIhlr/
> e9MDWFfI5qM9QyMojGjZDsJTQzL/rzMFYeNN8cx88PIvJ2+Rm/gYUV9pYW6c7D9X
> V3MQ9KkMLGEHsRzuml0gLQHDRpwkBS7PBHwPZunLJGvV7olNzdemdfsVztQjerrZ
> 7Kfs09P0ECNwiUw3lDjvFLolFZBCQYGaE8QBaL4i9Ax7InVRNUpwJJ9TEaxY/5+8
> +3MNfIDpuMPfy2QT7eUdaYvqqZcqixVeYXMgZ9815y2p8nMk1BWpCbvrTqDw8pKQ
> aXL3iaxTkkSbHu0f+vxb+4AkkoUpuq4ALzamSKH1A7K0b1CoMdNiMxQtPONEGA==
> =h1eh
> -----END PGP SIGNATURE-----

[Michael Scherer]

On Tue, Nov 27, 2012 at 10:28:35AM +0100, Matthias Runge wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 11/27/2012 02:03 AM, Alexander Aristotle Davis wrote:
>  > Hi,
>  > 
>  > A package called rssh has been marked as duplicate on Bugzilla and
>  > I am working on a 2.3.3 version and would like to update it to a
>  > new release.  Could you please inform me why this package have been
>  > orphaned.
>  > 
>  > I am not a packager; I am seeking a sponsor to help me review the
>  > file.
>  > 
>  > Thank you
>  > 
>  > Alex
>  > 
>  > 
>  during the last week or so, I saw some (about 10?) review requests
>  with email addresses @learn.senecac...., (nearly) all with the same
>  issues:
>  - - they found an outdated package in fedora
>  - - updated that and requested a review for the updated package 
I got in touch with chris Tyler and one of the student, who explained they are working
on getting olpc server in fedora. So the task is to push the package in F18, and Chris 
was busy with others students ( since the group in charge of Fedora was self sufficient
and 
didn't ask many questions ), but he will try to guide them a bit.

I am the one who asked to Alex to write here, following the procedure on the wiki,
but since he is not a packager, I do not know exactly how to manage it.
 
-- 
Michael Scherer

[Alexander Aristotle Davis]

hello,

I will like to keep the rssh package alive.


I am already a member of FAS2, I am having trouble adopting the package 
can you guide me on the steps necessary to adopt the package?

Alex