Bundled libraries in first proposed package to Fedora

[Marcin Haba]

Hello,

I am trying to contribute Fedora about Baculum WebGUI (BugZilla
1203018). This WebGUI uses PHP framework (PRADO framework) that is not
available in Fedora packages.

My first question is: if first should I try to contribute Fedora about
PRADO Framework and then try to contribute Fedora about Baculum? I would
not provide bundled framework to Fedora.

Second my issue is that PHP framework itself contains bundled libraries
from which part is available in Fedora packages (for example:
prototype.js,  script.aculo.us, tinymce editor...etc.) and a part that
is not available in Fedora packages.

I can try to contribute Fedora about PRADO Framework but I will need to
solve all dependencies and tune PRADO code to external libraries which
in this case will be using Fedora packages (prototype.js,
script.aculo.us, ...etc.).

Additionally I will need to contribute this part of PRADO dependencies
(3rd party code) that is not in Fedora packages (SafeHtml, FirePHP...
and others.).

I would avoid situation that at the start for provide Baculum I will
become a maintainer 30 other packages :-)

Last information is that Baculum uses raw framework without 3rd party
libraries. For preparing buildroot files in Spec I just not include 3rd
party code from upstream tar.gz archive. Maybe this information can make
something easier?

Thank you in advance for advises and any help.

Best regards.
Marcin Haba

[Ankur Sinha]

On Sat, 2015-07-25 at 16:31 +0200, Marcin Haba wrote:
> Hello,

Hi Marcin,

Welcome to the mailing list!
> I am trying to contribute Fedora about Baculum WebGUI (BugZilla
> 1203018). This WebGUI uses PHP framework (PRADO framework) that is 
> not
> available in Fedora packages.
>
> My first question is: if first should I try to contribute Fedora 
> about
> PRADO Framework and then try to contribute Fedora about Baculum? I 
> would
> not provide bundled framework to Fedora.
>
> Second my issue is that PHP framework itself contains bundled 
> libraries
> from which part is available in Fedora packages (for example:
> prototype.js,  script.aculo.us, tinymce editor...etc.) and a part 
> that
> is not available in Fedora packages.
>
> I can try to contribute Fedora about PRADO Framework but I will need 
> to
> solve all dependencies and tune PRADO code to external libraries 
> which
> in this case will be using Fedora packages (prototype.js,
> script.aculo.us, ...etc.).
>
> Additionally I will need to contribute this part of PRADO 
> dependencies
> (3rd party code) that is not in Fedora packages (SafeHtml, FirePHP...
> and others.).
>
> I would avoid situation that at the start for provide Baculum I will
> become a maintainer 30 other packages :-)
>
> Last information is that Baculum uses raw framework without 3rd party
> libraries. For preparing buildroot files in Spec I just not include 
> 3rd
> party code from upstream tar.gz archive. Maybe this information can 
> make
> something easier?

Well, as per the Fedora packaging guidelines[1], the packages cannot
have bundled libraries at all. There are reasons for this too, which
you can read here[2]. When such a situation arises, you must unbundle
the bundled libraries even package them if they're not present in the
Fedora repositories already.

Often, this leads to quite a bit of work if you're doing it all by
yourself :(

[1] https://fedoraproject.org/wiki/Packaging:Guidelines

[2] https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries

[Marcin Haba]

On 28.07.2015 15:16, Ankur Sinha wrote:
> On Sat, 2015-07-25 at 16:31 +0200, Marcin Haba wrote:
> > I would avoid situation that at the start for provide Baculum I will
> > become a maintainer 30 other packages :-)
> >
> > Last information is that Baculum uses raw framework without 3rd party
> > libraries. For preparing buildroot files in Spec I just not include 
> > 3rd
> > party code from upstream tar.gz archive. Maybe this information can 
> > make
> > something easier?
>
> Well, as per the Fedora packaging guidelines[1], the packages cannot
> have bundled libraries at all. There are reasons for this too, which
> you can read here[2]. When such a situation arises, you must unbundle
> the bundled libraries even package them if they're not present in the
> Fedora repositories already.

Hello Ankur,

Thank you for warm welcome on the mailing list.

Thanks for showing me proper way about bundled libraries either.
> Often, this leads to quite a bit of work if you're doing it all by
> yourself :(

Yes, it looks that there is a lot of work and effort before me,
specially that I am beginner in preparing Fedora packages.

The bright side of this work is that Fedora will be richer about new
packages and I will acquire more experience in packaging while preparing
these packages :-)

Thanks again for your help.

Best regards.
Marcin Haba
> [1] https://fedoraproject.org/wiki/Packaging:Guidelines
>
> [2] https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries
>
> fedora-join mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/fedora-join

[Ankur Sinha]

On Tue, 2015-07-28 at 19:00 +0200, Marcin Haba wrote:
> Hello Ankur,
>
> Thank you for warm welcome on the mailing list.
>
> Thanks for showing me proper way about bundled libraries either.
> > Often, this leads to quite a bit of work if you're doing it all by
> > yourself :(
>
> Yes, it looks that there is a lot of work and effort before me,
> specially that I am beginner in preparing Fedora packages.
>
> The bright side of this work is that Fedora will be richer about new
> packages and I will acquire more experience in packaging while 
> preparing
> these packages :-)

Heh. That's the spirit :D

Please feel free to ask any questions you may have regarding packaging
here or the other channels:

- devel mailing list: 
https://admin.fedoraproject.org/mailman/listinfo/devel
- #fedora-devel irc channel on Freenode
- any of the fedora-join channels.
> Thanks again for your help.

[Marcin Haba]

Hello Ankur,

On 28.07.2015 19:59, Ankur Sinha wrote:
> On Tue, 2015-07-28 at 19:00 +0200, Marcin Haba wrote:
> > The bright side of this work is that Fedora will be richer about new
> > packages and I will acquire more experience in packaging while 
> > preparing
> > these packages :-)
>
> Heh. That's the spirit :D

:-)
> Please feel free to ask any questions you may have regarding packaging
> here or the other channels:
> devel mailing list:
>
> https://admin.fedoraproject.org/mailman/listinfo/devel
> #fedora-devel irc channel on Freenode
> any of the fedora-join channels.

Thanks for these tips.

I have already subscribed devel mailing list.

IRC channel and fedora-join sound interesting too. On #fedora-devel I
was there a few times. I am going to visit the channel more frequently.

Thanks.

Best regards.
Marcin Haba
> > Thanks again for your help.
>
> fedora-join mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/fedora-join

[Christopher Meng]

On Sat, Jul 25, 2015 at 10:31 PM, Marcin Haba  wrote:
> Hello,
>
> I am trying to contribute Fedora about Baculum WebGUI (BugZilla
> 1203018). This WebGUI uses PHP framework (PRADO framework) that is not
> available in Fedora packages.

I've seen your thread on Debian. Now Fedora.
> My first question is: if first should I try to contribute Fedora about
> PRADO Framework and then try to contribute Fedora about Baculum? I would
> not provide bundled framework to Fedora.

Many PHP frameworks contain exploits, you must maintain them
separately. In my memory, PRADO, CI, Zend and even Horde had exploits
in the past. Grab more on exploit-db if you don't know.
> Second my issue is that PHP framework itself contains bundled libraries
> from which part is available in Fedora packages (for example:
> prototype.js,  script.aculo.us, tinymce editor...etc.) and a part that
> is not available in Fedora packages.

Based on policy you must unbundle these js, even build them from
source. But you can try asking for a bundle lib exception at
FPC(though I don't have idea about those guys) of them. Web assets
packaging policy has been around for years.
> I would avoid situation that at the start for provide Baculum I will
> become a maintainer 30 other packages :-)

You jumped into the fire on your own. ;-)
> Last information is that Baculum uses raw framework without 3rd party
> libraries. For preparing buildroot files in Spec I just not include 3rd
> party code from upstream tar.gz archive. Maybe this information can make
> something easier?

You need to make sure it works. And you may lose users because they
may prefer the one with PRADO, they still install on their own and
never use package manager to install a raw framework.

And that's why many people don't package something like what you are
packaging, totally a mess.

[Marcin Haba]

Hello Christopher,

On 29.07.2015 02:27, Christopher Meng wrote:
> On Sat, Jul 25, 2015 at 10:31 PM, Marcin Haba  wrote:
> > Hello,
> >
> > I am trying to contribute Fedora about Baculum WebGUI (BugZilla
> > 1203018). This WebGUI uses PHP framework (PRADO framework) that is not
> > available in Fedora packages.
>
> I've seen your thread on Debian. Now Fedora.

Yes, that is me. I am trying to add Baculum to Debian.
Does it make any problem?
> > My first question is: if first should I try to contribute Fedora about
> > PRADO Framework and then try to contribute Fedora about Baculum? I would
> > not provide bundled framework to Fedora.
>
> Many PHP frameworks contain exploits, you must maintain them
> separately. In my memory, PRADO, CI, Zend and even Horde had exploits
> in the past. Grab more on exploit-db if you don't know.

Yes, one exploit in exploit-db for functional tests in old PRADO
version. It has been fixed long time ago.
> > Second my issue is that PHP framework itself contains bundled libraries
> > from which part is available in Fedora packages (for example:
> > prototype.js,  script.aculo.us, tinymce editor...etc.) and a part that
> > is not available in Fedora packages.
>
> Based on policy you must unbundle these js, even build them from
> source. But you can try asking for a bundle lib exception at
> FPC(though I don't have idea about those guys) of them. Web assets
> packaging policy has been around for years.

Thanks for this advise.

I am going to unbundle all bundled libs in PRADO and report as feature
request every lib not available in Fedora packages yet.

If can I do this work self then I prefer that way. If occur some
troubles with packaging not possible to solve by me, then I try to
consider sending ask to FPC, if the cause will be reasonable.
> > I would avoid situation that at the start for provide Baculum I will
> > become a maintainer 30 other packages :-)
>
> You jumped into the fire on your own. ;-)

Yes, Indeed :-)
> > Last information is that Baculum uses raw framework without 3rd party
> > libraries. For preparing buildroot files in Spec I just not include 3rd
> > party code from upstream tar.gz archive. Maybe this information can make
> > something easier?
>
> You need to make sure it works. And you may lose users because they
> may prefer the one with PRADO, they still install on their own and
> never use package manager to install a raw framework.
>
> And that's why many people don't package something like what you are
> packaging, totally a mess.

I do not know how does it look in case other framework projects. I do
not think that in case PRADO. In my opinion it is reliable project.

We will see during packaging process what type of problems do I meet ;-)

Thanks for your mail.

Best regards.
Marcin Haba

[Christopher Meng]

On Wed, Jul 29, 2015 at 3:30 PM, Marcin Haba  wrote:
> I do not know how does it look in case other framework projects. I do
> not think that in case PRADO. In my opinion it is reliable project.
>
> We will see during packaging process what type of problems do I meet ;-)

Don't worry, if you need review of javascript packages, I'm open to review.

[Marcin Haba]

Hello Christopher,

On 29.07.2015 09:33, Christopher Meng wrote:
> On Wed, Jul 29, 2015 at 3:30 PM, Marcin Haba  wrote:
> > I do not know how does it look in case other framework projects. I do
> > not think that in case PRADO. In my opinion it is reliable project.
> >
> > We will see during packaging process what type of problems do I meet ;-)
>
> Don't worry, if you need review of javascript packages, I'm open to review.

Thanks. That is nice from your side.

I will have it on my mind.

Best regards.
Marcin Haba