F30 Self-Contained Change proposal: SWID tag enablement

[Ben Cotton]

https://fedoraproject.org/wiki/Changes/SWID_Tag_Enablement

== Summary ==
Provide tools to allow users and developers to create Software
Identity (SWID) tags for Fedora installs and repositories.

== Owner ==
* Name: [[User:adelton|Jan Pazdziora]]
* Email: [e-mail]

== Detailed Description ==
SWID (ISO/IEC 19770:2-2015) is a portable standard for identifying
software installed on a system.  We already have SWID tags in
fedora-release to identify the overall release+edition of Fedora. We
will add tools to allow users to
* list installed tags
* create and install individual tags identifying RPMs
* add pre-built tags to repositories
* automatically update local tags as packages are installed, updated and removed
This will involve standalone tools to query and build SWID tags and to
add prebuilt tags to dnf repositories, and plugins for dnf/libdnf to
build and download tags.

== Benefit to Fedora ==
Fedora will be usable to users and developers interested in the SWID
functionality being added to relevant other tools, such as
OpenSCAP-1.3.

== Scope ==
* Proposal owners:
** Add python SWID tools (swidq, rpm2swidtag)
** add SWID metadata awareness to createrepo (but this will not be
used in Fedora, only enabled for user use), agreeing metadata format
with dnf team
** add dnf and libdnf plugins (no core dnf/libdnf changes expected)

* Other developers: N/A (not a System Wide Change)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)

== Upgrade/compatibility impact ==
N/A (not a System Wide Change)

== How To Test ==
N/A (not a System Wide Change)

== User Experience ==
No change unless users choose to enable SWID tags.
If requested, SWID tags will be either built automatically on demand
for installed RPMs, or downloaded from a repository that the user has
added SWID tags to, at the user’s choice.  swidq will allow the user
to see all installed tags and their relationships.

== Contingency Plan ==
* Contingency mechanism: (What to do?  Who will do it?) N/A (not a
System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change), No
* Blocks product? No

== Release Notes ==
Inform users of new capabilities and how they can be used with the
existing tags in fedora-release-*

[Zbigniew Jędrzejewski-Szmek]

On Mon, Jan 28, 2019 at 12:27:06PM -0500, Ben Cotton wrote:
> https://fedoraproject.org/wiki/Changes/SWID_Tag_Enablement
>
> == Summary ==
> Provide tools to allow users and developers to create Software
> Identity (SWID) tags for Fedora installs and repositories.
>
> == Owner ==
> Name: [[User:adelton|Jan Pazdziora]]
> Email: [e-mail]
>
> == Detailed Description ==
> SWID (ISO/IEC 19770:2-2015) is a portable standard for identifying
> software installed on a system.  We already have SWID tags in
> fedora-release to identify the overall release+edition of Fedora. We
> will add tools to allow users to
> list installed tags
> create and install individual tags identifying RPMs
> add pre-built tags to repositories
> automatically update local tags as packages are installed, updated and removed
>
> This will involve standalone tools to query and build SWID tags and to
> add prebuilt tags to dnf repositories, and plugins for dnf/libdnf to
> build and download tags.
>
> == Benefit to Fedora ==
> Fedora will be usable to users and developers interested in the SWID
> functionality being added to relevant other tools, such as
> OpenSCAP-1.3.
>
> == Scope ==
> Proposal owners:
>
> ** Add python SWID tools (swidq, rpm2swidtag)

Does "add" mean "package" here? Or are they to be added to some other
package? Are the review requests / pull requests to be reviewed
somewhere?
> ** add SWID metadata awareness to createrepo (but this will not be

Do you mean createrepo_c? createrepo is going away.
> used in Fedora, only enabled for user use), agreeing metadata format
> with dnf team

F30 beta is in exactly 2 weeks. I doubt "agreeing" and implementation
can happen in this timeframe. It should be OK to put in parts of the
implementation, even if things are not complete for this release.
But for "advertising purposes", maybe it's better to bump it to F31,
so that we don't advertise something that is not fully implemented?
> ** add dnf and libdnf plugins (no core dnf/libdnf changes expected)

A bit more detail here would be useful.

Zbyszek

[Jan Pazdziora]

On Tue, Feb 05, 2019 at 09:18:23AM +0000, Zbigniew Jędrzejewski-Szmek wrote:
> > == Scope ==
> > Proposal owners:
> >
> > ** Add python SWID tools (swidq, rpm2swidtag)
>
> Does "add" mean "package" here? Or are they to be added to some other
> package? Are the review requests / pull requests to be reviewed
> somewhere?

New package is what we are thinking about. I don't have review
request yet, the upstream development currently happens at

https://github.com/swidtags/rpm2swidtag

and I have a couple more things to flesh out before being ready for review.
> > ** add SWID metadata awareness to createrepo (but this will not be
>
> Do you mean createrepo_c? createrepo is going away.

Yes. Is it OK to update the change page to fix that?
> > used in Fedora, only enabled for user use), agreeing metadata format
> > with dnf team
>
> F30 beta is in exactly 2 weeks. I doubt "agreeing" and implementation
> can happen in this timeframe. It should be OK to put in parts of the
> implementation, even if things are not complete for this release.
> But for "advertising purposes", maybe it's better to bump it to F31,
> so that we don't advertise something that is not fully implemented?
> > ** add dnf and libdnf plugins (no core dnf/libdnf changes expected)
>
> A bit more detail here would be useful.

The latest improvements to dnf and libdnf plugin API seems to cover
everything that we need to be able to generate SWID tags locally
after every transaction, as well as pull in SWID tags from repository
metadata, if present.

[Miro Hrončok]

On 05. 02. 19 18:47, Jan Pazdziora wrote:
> > > ** add SWID metadata awareness to createrepo (but this will not be
> >
> > Do you mean createrepo_c? createrepo is going away.
>
> Yes. Is it OK to update the change page to fix that?

Sure thing, go ahead. That's kinda the point of having a discussion on devel - 
spot problems, amend the proposal.

[Igor Gnatenko]

On Mon, Jan 28, 2019, 18:32 Ben Cotton <[e-mail] wrote:
> https://fedoraproject.org/wiki/Changes/SWID_Tag_Enablement
>
> == Summary ==
> Provide tools to allow users and developers to create Software
> Identity (SWID) tags for Fedora installs and repositories.
>
> == Owner ==
> Name: [[User:adelton|Jan Pazdziora]]
> Email: [e-mail]
>
> == Detailed Description ==
> SWID (ISO/IEC 19770:2-2015) is a portable standard for identifying
> software installed on a system.  We already have SWID tags in
> fedora-release to identify the overall release+edition of Fedora. We
> will add tools to allow users to
> list installed tags
> create and install individual tags identifying RPMs
> add pre-built tags to repositories
> automatically update local tags as packages are installed, updated and
>
> removed
> This will involve standalone tools to query and build SWID tags and to
> add prebuilt tags to dnf repositories, and plugins for dnf/libdnf to
> build and download tags.
>
> == Benefit to Fedora ==
> Fedora will be usable to users and developers interested in the SWID
> functionality being added to relevant other tools, such as
> OpenSCAP-1.3.
>
> == Scope ==
> Proposal owners:
>
> ** Add python SWID tools (swidq, rpm2swidtag)
> ** add SWID metadata awareness to createrepo (but this will not be
> used in Fedora, only enabled for user use), agreeing metadata format
> with dnf team

Since this needs to be portable, please start discussion on
[e-mail] a.d don't do something what is DNF-specific.

** add dnf and libdnf plugins (no core dnf/libdnf changes expected)
> Other developers: N/A (not a System Wide Change)
> Policies and guidelines: N/A (not a System Wide Change)
> Trademark approval: N/A (not needed for this Change)
>
> == Upgrade/compatibility impact ==
> N/A (not a System Wide Change)
>
> == How To Test ==
> N/A (not a System Wide Change)
>
> == User Experience ==
> No change unless users choose to enable SWID tags.
> If requested, SWID tags will be either built automatically on demand
> for installed RPMs, or downloaded from a repository that the user has
> added SWID tags to, at the user’s choice.  swidq will allow the user
> to see all installed tags and their relationships.
>
> == Contingency Plan ==
> Contingency mechanism: (What to do?  Who will do it?) N/A (not a
>
> System Wide Change)
> Contingency deadline: N/A (not a System Wide Change)
> Blocks release? N/A (not a System Wide Change), No
> Blocks product? No
>
> == Release Notes ==
> Inform users of new capabilities and how they can be used with the
> existing tags in fedora-release-*
>
> --
> Ben Cotton
> Fedora Program Manager
> TZ=America/Indiana/Indianapolis
> _______________________________________________
> devel-announce mailing list -- [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]...

[Jan Pazdziora]

On Tue, Feb 05, 2019 at 11:36:50AM +0100, Igor Gnatenko wrote:
> On Mon, Jan 28, 2019, 18:32 Ben Cotton <[e-mail] wrote:
> > ** add SWID metadata awareness to createrepo (but this will not be
> > used in Fedora, only enabled for user use), agreeing metadata format
> > with dnf team
>
> Since this needs to be portable, please start discussion on
> [e-mail] a.d don't do something what is DNF-specific.

Thank you for the pointer. Does rpm-ecosystem@ really deal with yum/dnf
repository metadata XML schemas?

[Neal Gompa]

On Tue, Feb 5, 2019 at 9:52 PM Jan Pazdziora  wrote:
> On Tue, Feb 05, 2019 at 11:36:50AM +0100, Igor Gnatenko wrote:
> > On Mon, Jan 28, 2019, 18:32 Ben Cotton <[e-mail] wrote:
> > > ** add SWID metadata awareness to createrepo (but this will not be
> > > used in Fedora, only enabled for user use), agreeing metadata format
> > > with dnf team
> >
> > Since this needs to be portable, please start discussion on
> > [e-mail] a.d don't do something what is DNF-specific.
>
> Thank you for the pointer. Does rpm-ecosystem@ really deal with yum/dnf
> repository metadata XML schemas?

Technically, there is the rpm-metadata@ mailing list on
lists.baseurl.org, but I don't think anyone looks there anymore.
rpm-ecosystem@ on lists.rpm.org is the right place these days.

[Jan Pazdziora]

On Tue, Feb 05, 2019 at 07:16:09PM +0100, Miro Hrončok wrote:
> On 05. 02. 19 18:47, Jan Pazdziora wrote:
> > > > ** add SWID metadata awareness to createrepo (but this will not be
> > >
> > > Do you mean createrepo_c? createrepo is going away.
> >
> > Yes. Is it OK to update the change page to fix that?
>
> Sure thing, go ahead. That's kinda the point of having a discussion on devel
> spot problems, amend the proposal.

Good. Change page updated.

On Tue, Feb 05, 2019 at 10:01:10PM -0500, Neal Gompa wrote:
> Technically, there is the rpm-metadata@ mailing list on
> lists.baseurl.org, but I don't think anyone looks there anymore.
> rpm-ecosystem@ on lists.rpm.org is the right place these days.

OK, http://lists.rpm.org/pipermail/rpm-ecosystem/2019-February/000711.html
sent.

[Jan Pazdziora]

On Thu, Feb 07, 2019 at 05:35:23PM +0100, Jan Pazdziora wrote:
> On Tue, Feb 05, 2019 at 07:16:09PM +0100, Miro Hrončok wrote:
> > On 05. 02. 19 18:47, Jan Pazdziora wrote:
> > > > > ** add SWID metadata awareness to createrepo (but this will not be
> > > >
> > > > Do you mean createrepo_c? createrepo is going away.
> > >
> > > Yes. Is it OK to update the change page to fix that?
> >
> > Sure thing, go ahead. That's kinda the point of having a discussion on devel
> > spot problems, amend the proposal.
>
> Good. Change page updated.
>
> On Tue, Feb 05, 2019 at 10:01:10PM -0500, Neal Gompa wrote:
> > Technically, there is the rpm-metadata@ mailing list on
> > lists.baseurl.org, but I don't think anyone looks there anymore.
> > rpm-ecosystem@ on lists.rpm.org is the right place these days.
>
> OK, http://lists.rpm.org/pipermail/rpm-ecosystem/2019-February/000711.html
> sent.

Hello,

the rpm-ecosystem has been silent so far. Any idea who might be the
right person to talk about possibly using

http://rpm.org/metadata/swidtags

URI?