[Bug 598471] New: Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

Summary: Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

Summary: Review Request: maven-gpg-plugin - sign all of the
                    project's attached artifacts with GnuPG.
           Product: Fedora
           Version: rawhide
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: medium
          Priority: medium
         Component: Package Review
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
         QAContact: [e-mail]
                CC: [e-mail], [e-mail]
   Estimated Hours: 0.0
    Classification: Fedora
    Target Release: ---

Spec URL: http://sochotni.fedorapeople.org/maven-gpg-plugin.spec
SRPM URL: http://sochotni.fedorapeople.org/maven-gpg-plugin-1.1-1.fc14.src.rpm

Description: 
This plugin signs all of the project's attached artifacts with GnuPG. It adds
goals gpg:sign and gpg:sign-and-deploy-file.

Note that this package has dependencies available only in dist-f14-maven221
target. Koji build:
https://koji.fedoraproject.org/koji/taskinfo?taskID=2222334

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

Alexander Kurtakov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |[e-mail]
         AssignedTo|[e-mail]    |[e-mail]
               Flag|                            |fedora-review+

--- Comment #1 from Alexander Kurtakov  2010-06-01 16:06:17 EDT ---
Review:

OK: rpmlint must be run on every package. Output:
aven-gpg-plugin.noarch: W: no-documentation
maven-gpg-plugin.noarch: W: non-conffile-in-etc
/etc/maven/fragments/maven-gpg-plugin

False positives.

OK: The package must be named according to the Package Naming Guidelines .
OK: The spec file name must match the base package %{name}, in the format
%{name}.spec unless your package has an exemption. 
OK: The package must meet the Packaging Guidelines .
OK: The package must be licensed with a Fedora approved license and meet the
Licensing Guidelines .
OK: The License field in the package spec file must match the actual license.
OK: If (and only if) the source package includes the text of the license(s) in
its own file, then that file, containing the text of the license(s) for the
package must be included in %doc.
OK: The spec file must be written in American English. 
OK: The spec file for the package MUST be legible. 
OK: The sources used to build the package must match the upstream source, as
provided in the spec URL. 
OK: The package MUST successfully compile and build into binary rpms on at
least one primary architecture. 
OK: All build dependencies must be listed in BuildRequires, except for any that
are listed in the exceptions section of the Packaging Guidelines ; inclusion of
those as BuildRequires is optional. Apply common sense.
OK: Packages must NOT bundle copies of system libraries.
OK: A package must own all directories that it creates. If it does not create a
directory that it uses, then it should require a package which does create that
directory. 
OK: A Fedora package must not list a file more than once in the spec file's
%files listings. 
OK: Permissions on files must be set properly. Executables should be set
with executable permissions, for example. Every %files section must include a
%defattr(...) line. 
OK: Each package must consistently use macros. 
OK: The package must contain code, or permissable content. 
OK: Large documentation files must go in a -doc subpackage. 
OK: If a package includes something as %doc, it must not affect the runtime of
the application. 
OK: Packages must not own files or directories already owned by other packages. 
OK: All filenames in rpm packages must be valid UTF-8.    
OK: Provides/Obsoletes are good.

FIXIT: Package is missing Requires: gnupg2 . I know it's not obvious but at
runtime this package execs gpg. See
http://svn.apache.org/viewvc/maven/plugins/tags/maven-gpg-plugin-1.0/src/mai...
line 143

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

huwang  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from huwang  2010-06-01 21:46:13 EDT ---
I noticed add_to_maven_depmap maven-antrun-plugin, it should be
maven-gpg-plugin.

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

--- Comment #3 from Alexander Kurtakov  2010-06-02 02:40:24 EDT ---
Thanks huwang.
Stanislav: please fix before importing

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

Alexander Kurtakov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
               Flag|fedora-review+              |fedora-review?

--- Comment #4 from Alexander Kurtakov  2010-06-02 02:41:27 EDT ---
Ideally it should become %{name}

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

--- Comment #5 from Stanislav Ochotnicky  2010-06-02 03:46:16 EDT ---
Thanks huwang for noticing, it's really better to have more pairs of eyes...

I was also wondering about gnupg2 dependency, but it wasn't mentioned on the
plugin web page so I thought that maybe they used some pure java
implementation...Should have checked...

Anyway, those things are fixed:

SRPM URL: http://sochotni.fedorapeople.org/maven-gpg-plugin-1.1-2.fc13.src.rpm
Spec URL: http://sochotni.fedorapeople.org/maven-gpg-plugin.spec

Koji build:
http://koji.fedoraproject.org/koji/taskinfo?taskID=2224276

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

Alexander Kurtakov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
               Flag|fedora-review?              |fedora-review+

--- Comment #6 from Alexander Kurtakov  2010-06-02 03:59:31 EDT ---
Thanks, 
This package is APPROVED.

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

Stanislav Ochotnicky  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
               Flag|                            |fedora-cvs?

--- Comment #7 from Stanislav Ochotnicky  2010-06-02 04:34:19 EDT ---
Thanks for the review. Requesting CVS:

New Package CVS Request
=======================
Package Name: maven-gpg-plugin
Short Description: Plugin to sign all of the project's attached artifacts with
GnuPG.
Owners: sochotni 
Branches: 
InitialCC:

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

--- Comment #8 from Kevin Fenzi  2010-06-03 16:34:20 EDT ---
CVS done (by process-cvs-requests.py).

[Bug 598471] Review Request: maven-gpg-plugin - sign all of the project's attached artifacts with GnuPG.

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=598471

Stanislav Ochotnicky  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |CLOSED
         Resolution|                            |NEXTRELEASE

--- Comment #9 from Stanislav Ochotnicky  2010-06-04 03:20:27 EDT ---
Package built:
https://koji.fedoraproject.org/koji/buildinfo?buildID=176559

Closing.