Bundled Provides Libraries and Versioning

[Adam Miller]

Hello all,
    In today's FESCo meeting we discussed the fact that there are many
RPMs currently in Fedora (a reported 244 in Rawhide currently) that
are defining a `Provides: bundled(<lib>) = <version>` but excluding
the version completely[0][1]. This removes that ability to properly
perform source code auditing and security vulnerability tracking.

My question to the Fedora Contributor Community is, how should we
handle this? Is this something that should just simply be fixed by the
packages currently violating the Guidelines, should the Guidelines be
altered in a way that makes this easier to deal with for Packagers but
also provides what is needed for auditing and vulnerability tracking,
or is there simply clarification needed by what is required in the
<version> field?

I look forward to the discussion.

Thank you,
-AdamM


[0] - https://pagure.io/fesco/issue/1734
[1] - https://pagure.io/packaging-committee/issue/696

[Jason L Tibbitts III]

> >>>> "AM" == Adam Miller
> <maxamillion(a)fedoraproject.org&gt; writes: 
[...]
AM> RPMs currently in Fedora (a reported 244 in Rawhide currently) that
AM> are defining a `Provides: bundled(<lib>) = <version>` but excluding
AM> the version completely[0][1]. This removes that ability to properly
AM> perform source code auditing and security vulnerability tracking.

I would argue that it doesn't remove the ability, but that it does make
it more difficult to do in an automated fashion.  Basically you can see
that something has a bundled library but then you need to do manual
inspection to go further.

AM> My question to the Fedora Contributor Community is, how should we
AM> handle this?

Identify and mail lists of the problematic packages to devel (using
find-package-maintainers from
https://pagure.io/fedora-misc-package-utilities if possible).  Figure
out if there are any cases which aren't easy to fix for some reason.

If there are any, then see if a change is needed to accommodate.

If I had to hazard a guess, I would say that there are at least some
cases where it's not really obvious what version to use.  This would
make sense in the case of a fork that's undergone significant rewriting.
Though I wonder if any bundled(X) tag is even warranted in that case.

Alternatively, say that you don't have to specify a version, but if you
don't then you will get every related security bug filed against your
package instead of having those filtered by version.

 - J<

[Vít Ondruch]

Dne 7.7.2017 v 19:43 Jason L Tibbitts III napsal(a):
> >>>>> "AM" == Adam Miller
> <maxamillion(a)fedoraproject.org&gt; writes:
>  [...]
>  AM> RPMs currently in Fedora (a reported 244 in Rawhide currently) that
>  AM> are defining a `Provides: bundled(<lib>) = <version>` but excluding
>  AM> the version completely[0][1]. This removes that ability to properly
>  AM> perform source code auditing and security vulnerability tracking.
>
>  I would argue that it doesn't remove the ability, but that it does make
>  it more difficult to do in an automated fashion.  Basically you can see
>  that something has a bundled library but then you need to do manual
>  inspection to go further.
>
>  AM> My question to the Fedora Contributor Community is, how should we
>  AM> handle this?
>
>  Identify and mail lists of the problematic packages to devel (using
>  find-package-maintainers from
>  https://pagure.io/fedora-misc-package-utilities if possible).  Figure
>  out if there are any cases which aren't easy to fix for some reason.
>
>  If there are any, then see if a change is needed to accommodate.
>
>  If I had to hazard a guess, I would say that there are at least some
>  cases where it's not really obvious what version to use. 
I can support this guess. For example, ruby.spec has following provides:

~~~
# Virtual provides for CCAN copylibs.
# https://fedorahosted.org/fpc/ticket/364
Provides: bundled(ccan-build_assert)
Provides: bundled(ccan-check_type)
Provides: bundled(ccan-container_of)
Provides: bundled(ccan-list)
~~~

If you can tell me what version it should specify, I'll happily add the
versions.

And I also remember lengthy discussions with OkJson upstream (this is
original bundling exception [1]) about versions.

BTW is it enough to used git hash as a version? This does not seems
right ....


Vít



[1] https://fedorahosted.org/fpc/ticket/113