rpmlint/fedora.toml

# Fedora's configuration for the rpmlint utility.

# When checking that various files that should be compressed are
# indeed compressed, look for this filename extension
CompressExtension = "gz"

# simple error is enough; warnings are fine
BadnessThreshold = -1

# Whether to allow packaging kernel modules in non-kernel packages.
KernelModuleRPMsOK = false

# Maximum allowed line length for Summary and Description tags
MaxLineLength = 80

# Assumed default version of Python if one cannot be determined from files
# FIXME this should be sys.version[:3] but I have no idea how to implement it
# here without changing it every other release
PythonDefaultVersion = ""

# Regexp string with expected suffix in Release tags.
ReleaseExtension = '\.(fc|rhe?l|el)\d+(?=\.|$)'

# Whether to want default start/stop runlevels specified in init scripts
UseDefaultRunlevels = false

ValidSrcPerms = [
    "0o644",
    "0o664",
]

# List of directories considered to be system default library search paths.
SystemLibPaths = [
    "/lib",
    "/usr/lib",
    "/lib64",
    "/usr/lib64",
]

# Enabled checks for the rpmlint to be run (besides the default set)
Checks = [
    "BashismsCheck",
    "PAMModulesCheck",
    "TmpFilesCheck",
    "SysVInitOnSystemdCheck",
    "SharedLibraryPolicyCheck",
]

# Interpreters whose scriptlets are allowed to be empty
ValidEmptyShells = [
    "/usr/sbin/ldconfig",
]

# Package scriptlet interpreters
ValidShells = [
    "<lua>",
    "/usr/bin/sh",
    "/usr/bin/bash",
    "/usr/sbin/ldconfig",
    "/usr/bin/perl",
    "/usr/bin/python",
    "/usr/bin/python3",
]

Filters = [
# FIXME - the commented lines are from openSUSE config
#         Are they relevant for Fedora too?
#         PR which enables them or remove them is welcome
## Stuff autobuild takes care about
#    '.*invalid-version.*',
#    '.*invalid-packager.*',
    '.*not-standard-release-extension.*',
#    '.*invalid-buildhost.*',
    '.*executable-in-library-package.*',
    '.*non-versioned-file-in-library-package.*',
    '.*shlib-policy-name-error.*',
#    '.*hardcoded-path-in-buildroot-tag.*',
    '.*no-buildroot-tag.*',
#    '.*cross-directory-hard-link.*',

# Do not validate package rpm groups
    '.*devel-package-with-non-devel-group.*',
    '.*no-group-tag.*',
    '.*non-standard-group.*',

# Output filters
#    '.*spurious-bracket-in-.*',
#    '.*one-line-command-in-.*',
#    ' dir-or-file-in-opt ',  # handled by CheckFilelist.py
#    ' dir-or-file-in-usr-local ',  # handled by CheckFilelist.py
    ' non-standard-dir-in-usr ',  # handled by CheckFilelist.py
    ' no-signature',
#    ' symlink-crontab-file',  #bnc591431
#    ' without-chkconfig',
#    'unstripped-binary-or-object.*\.ko',
#    ' no-chkconfig',
#    ' subsys-not-used',
#    ' dangerous-command.*',
#    ' setuid-binary.*',
#    'subdir-in-bin /sbin/conf.d/',
#    '.* nss_db non-standard-dir-in-var db',
#    'non-standard-dir-in-usr openwin',
#    'ibcs2 non-standard-dir-in-usr i486-sysv4',
#    'shlibs5 non-standard-dir-in-usr i486-linux-libc5',
#    'explicit-lib-dependency libtool',
#
## Filesystem package needs special exceptions
#    '^filesystem\..*: dir-or-file-in-var-run',
#    '^filesystem\..*: dir-or-file-in-var-lock',
#    '^filesystem\..*: dir-or-file-in-var-tmp',
#    '^filesystem\..*: dir-or-file-in-var-run',
#    '^filesystem\..*: dir-or-file-in-var-lock',
#    '^filesystem\..*: dir-or-file-in-usr-tmp',
#    '^filesystem\..*: dir-or-file-in-tmp',
#    '^filesystem\..*: dir-or-file-in-mnt',
#    '^filesystem\..*: dir-or-file-in-home',
#    '^filesystem\..*: hidden-file-or-dir /root/.gnupg',
#    '^filesystem\..*: hidden-file-or-dir /root/.gnupg',
#    '^filesystem\..*: hidden-file-or-dir /etc/skel/.config',
#    '^filesystem\..*: hidden-file-or-dir /etc/skel/.local',
#    '^filesystem\..*: hidden-file-or-dir /tmp/.X11-unix',
#    '^filesystem\..*: hidden-file-or-dir /tmp/.ICE-unix',
#    '^filesystem\..*: hidden-file-or-dir /etc/skel/.fonts',
#    '^filesystem\..*: filelist-forbidden-fhs23',
#    '^filesystem\..*: filelist-forbidden-opt',
#    '^filesystem\..*: non-standard-uid /var/lib/nobody nobody',
#    '^filesystem\..*: missing-dependency-to-cron',
## has arch specific dirs in /usr
#    '^filesystem\..*: no-binary',
#
## Suppress any errors about internal packages
#    '^qa\S+: [EWI]:',
#    '^\S*(?:INTERNAL|internal)\.\S+: [EWI]:',
#
## Exceptions for devel-files
#    'devel-file-in-non-devel-package.*/boot/vmlinuz-.*autoconf.h',
#    'devel-file-in-non-devel-package.*/usr/src/linux-',
#    'devel-file-in-non-devel-package.*/usr/share/systemtap',
#    '-(?:examples|doc)\.\S+: \w: devel-file-in-non-devel-package',
#    'java\S+-demo\.\S+: \w: devel-file-in-non-devel-package',
#    'avr-libc\.\S+: \w: devel-file-in-non-devel-package',
#    'cross-.*devel-file-in-non-devel-package',
#    'cmake.*devel-file-in-non-devel-package',
#    'gcc\d\d.*devel-file-in-non-devel-package',
#    'OpenOffice_org-sdk\.\S+: \w: devel-file-in-non-devel-package',
#    'wnn-sdk\.\S+: \w: devel-file-in-non-devel-package',
#    'ocaml\.\S+: \w: devel-file-in-non-devel-package',
#    'xorg-x11-server-sdk\.\S+: \w: devel-file-in-non-devel-package',
#    'linux-kernel-headers\.\S+: \w: devel-file-in-non-devel-package',
#    ' devel-file-in-non-devel-package.*-config',
#    'libtool\.\S+: \w: devel-file-in-non-devel-package',
#    'sdb.* dangling-relative-symlink /usr/share/doc/sdb/.*/gifs ../gifs',
#    'kernel-modules-not-in-kernel-packages',
#
## SUSE kmp's don't need manual depmod (bnc#456048)
#    'module-without-depmod-postin',
#    'postin-with-wrong-depmod',
#    'module-without-depmod-postun',
#    'postun-with-wrong-depmod',
#    'configure-without-libdir-spec',
#    'conffile-without-noreplace-flag /etc/init.d',
#    'use-of-RPM_SOURCE_DIR',
#    'use-tmp-in-',
#    'symlink-contains-up-and-down-segments /var/lib/named',
#    'no-ldconfig-symlink',
#    'aaa_base\.\S+: \w: use-of-home-in-%post',
#    'description-line-too-long',
    'hardcoded-library-path',
#
## Doesn't seem to make sense
#    'invalid-ldconfig-symlink',
#    'invalid-soname',
#    'library-not-linked-against-libc',
#    'only-non-binary-in-usr-lib',
    'outside-libdir-files',
#
## We want these files
#    ' perl-temp-file ',
#    ' hidden-file-or-dir .*/\.packlist',
#    ' hidden-file-or-dir .*/\.directory',
#    'perl-.*no-binary',
    ' no-major-in-name ',
#
## We check for that already
#    'dangling-relative-symlink',
    ' lib-package-without-%mklibname',
    ' requires-on-release',
#    ' non-executable-script /etc/profile.d/',
#    ' non-executable-script /var/adm/fillup-templates/',
#    ' init-script-name-with-dot ',
#    '.* statically-linked-binary /sbin/ldconfig',
#    '.* statically-linked-binary /sbin/init',
#    'valgrind.* statically-linked-binary',
#    'ldconfig-post.*/ddiwrapper/wine/',
#    'glibc\.\S+: \w: statically-linked-binary /usr/sbin/glibc_post_upgrade',
    ' symlink-should-be-relative ',
#    ' binary-or-shlib-defines-rpath .*ORIGIN',
#    'libzypp.*shlib-policy-name-error.*libzypp',
#    'libtool.*shlib-policy.*',
#
## Stuff that is currently too noisy, but might become relevant in the future
#    ' prereq-use',
#    ' file-not-utf8',
#    ' tag-not-utf8',
#    ' setup-not-quiet',
#    ' mixed-use-of-spaces-and-tabs ',
#    ' prereq-use ',
#
## An issue with OBS, works with autobuild
    ' no-packager-tag',
#    ' unversioned-explicit-provides ',
#    ' unversioned-explicit-obsoletes ',
#    ' service-default-enabled ',
#    ' non-standard-dir-perm ',
#    ' conffile-without-noreplace-flag ',
#    ' non-standard-executable-perm ',
    ' jar-not-indexed ',
#    ' uncompressed-zip ',
#    ' %ifarch-applied-patch ',
#    ' read-error ',
#    ' init-script-without-chkconfig-postin ',
#    ' init-script-without-chkconfig-preun ',
#    ' postin-without-chkconfig ',
#    ' preun-without-chkconfig ',
    ' no-dependency-on locales',
    ' no-dependency-on perl-base',
    ' no-dependency-on python-base',
    ' python-naming-policy-not-applied',
    # FIXME does this really exists?
    ' perl-naming-policy-not-applied',
#    ' shlib-policy-name-error',
#    ' binary-or-shlib-defines-rpath',
#    ' executable-marked-as-config-file',
#    ' log-files-without-logrotate',
#    ' hardcoded-prefix-tag',
    '-debug(info|source).* no-documentation',
    '-debugsource.* no-binary',
#    ' multiple-specfiles',
#    ' no-default-runlevel ',
#    ' setgid-binary ',
#    ' non-readable ',
    ' postin-without-ghost-file-creation ',
#
## Exceptions for filelist checks
#    'nfs-client\.\S+: \w: filelist-forbidden-backup-file /var/lib/nfs/sm.bak',
#    'perl\.\S+: \w: filelist-forbidden-perl-dir ',
#    'info\.\S+: \w: info-dir-file .*/usr/share/info/dir',
#
## These packages are used for CD creation and are not supposed to be
## installed. It's still a dirty hack to make an exception. The
## packages should either be built in a separate project with
## different config or file be put somewhere below /opt/suse/*
#    '(?:dosutils|skelcd|installation-images|yast2-slide-show|instlux|skelcd-.*|patterns-.*)\.\S+: \w: filelist-forbidden-fhs23 /CD1',
#
## Too noisy, and usually not something downstream packagers can fix
#    ' incorrect-fsf-address ',
#    ' no-manual-page-for-binary ',
#    ' static-library-without-debuginfo /usr/lib(?:64)?/ghc-[\d\.]+/',
#
## Many places have shorter paths
#    ' non-coherent-filename ',

# Mandriva specific stuff that Fedora do not want either
    ' invalid-build-requires ',

# Fedora specific stuff that we don't want
    ' ghost-files-without-postin',
    ' no-provides ',
    '-debuginfo.* /usr/lib/debug/',
    '-debugsource.* /usr/src/debug/',
    '-devel.* no-binary',
    '^gpg-pubkey:',
    ' doc-file-dependency .* /bin/sh$',
    'explicit-lib-dependency (liberation-fonts|libertas-.*-firmware|libvirt$|.*-(java|python|utils)$)',
    'explicit-lib-dependency (python-.*lib.*|python2-.*lib.*|python3-.*lib.*)$',
    'explicit-lib-dependency libreoffice.*$',
    'dangling-\S*symlink /usr/share/doc/HTML/\S+/common .+/common$',
    'hidden-file-or-dir .*/man5/\.k5login\.5[^/]+$',
    'blender.+ (wrong-script-interpreter|non-executable-script) .+/blender/.+\.py.*BPY.*',
    # Don't bother with the non-ghost-in-run checks, /var/lock and /var/run are
    # symlinks to /run/lock and /run respectively, and /run is a tmpfs
    'non-ghost-in-run',
    # Someone thought it was a good idea to make .desktop files executable. They were wrong.
    # Nevertheless, I do not yet control the universe, so we squelch the error here.
    'script-without-shebang .*\.desktop$',
    # Some files in /etc/ are not meant to be modified by the sysadmin
    'non-conffile-in-etc /etc/rpm/.*$',
    # Files that are intentionally not supposed to be readable
    # Contains passwords
    'non-readable /etc/ovirt-engine/isouploader.conf',
    ## Ignore webservers which are just broken.
    'invalid-url .*\.googlecode\.com/.*HTTP Error 404',
    'invalid-url .*\.jboss\.org/.*HTTP Error 403',
    'invalid-url .*bitbucket\.org/.*HTTP Error 403',
    'invalid-url .*github\.com/.*HTTP Error 403',
    # Don't care about long descriptions on debuginfo packages
    # They automatically include the package name and are always
    # quite long.
    '-debuginfo.* description-line-too-long',
    # ignore "common" jargon words
    # https://bugzilla.redhat.com/show_bug.cgi?id=1424684#c9
    'spelling-error.* \b(runtime|Runtime|metadata|cryptographic|multi|linux|filesystem|filesystems|backend|backends|userspace|addon|wayland|Wayland|util|utils|lossless|virtualization|toolkits|libvirtd|crypto|glyphs|GStreamer|http|extensibility|codec|codecs|truetype|scalable|pluggable|pixbuf|Kerberos|customizable|bitstream|tcp|libXss|libs|libc|encodings|GLib|udev|posix|libpng|glapi|gbm|freedesktop|spi|realtime|preprocessor|libaudit|hypervisor|embeddable|distributable|devel|config|cairo|bootloader|adaptors|pragma|passphrase|malloc|libvirt|libmagic|io|datetime|boolean|argparse|py|pinentry|namespace|middleware|lowlevel|libxcb|libudev|libsoup|libgcrypt|libcom|iSCSI|initramfs|GObject|executables|dialogs|checkpolicy|bitmapped|assistive|btrfs|crypttab|defrag|dracut|hostname|luks|mountpoints|netdev|rpmnew|rpmsave|storaged|tss|unlocker)\b',
    # Fedora no longer uses explicit ldconfig %post/%postun as of Fedora 28
    'postin-without-ldconfig',
    'postun-without-ldconfig',
    'library-without-ldconfig-postin',
    'library-without-ldconfig-postun',
    # Ignore 700 dir perms here
    'non-standard-dir-perm /etc/.* 700',
    'non-standard-dir-perm /var/lib/.* 700',
    # pip 20.2 generates PEP 376 "REQUESTED" marker (empty)
    'zero-length .+/site-packages/.+\.dist-info/REQUESTED\b',
    # py.typed files are empty
    'zero-length .+/site-packages/.+/py\.typed\b',
    # https://bugzilla.redhat.com/496737, https://bugzilla.redhat.com/646455
    'coreutils.* (setuid-binary|non-standard-executable-perm) /bin/su (root )?04',
    'krb5-workstation.* (setuid-binary|non-standard-executable-perm) /usr/kerberos/bin/ksu (root )?04',
    'passwd.* (setuid-binary|non-standard-executable-perm) /usr/bin/passwd (root )?04',
    'sudo.* (setuid-binary|non-standard-executable-perm) /usr/bin/sudo(edit)? (root )?04',
    'upstart.* (setuid-binary|non-standard-executable-perm) /sbin/initctl (root )?04',
    'usermode.* (setuid-binary|non-standard-executable-perm) /usr/sbin/userhelper (root )?04',
    # Only works properly with SUSE packages. See
    # https://github.com/rpm-software-management/rpmlint/issues/781
    'no-library-dependency-for',
    'no-library-dependency-on',

## Bash completion files are not scripts, do not require them marked as %config
#    'W: non-conffile-in-etc /etc/bash_completion.d/',
#

# Info uses file triggers now (boo#1152169)
    ' info-files-without-install-info-postin',
    ' info-files-without-install-info-postun ',
    ' postin-without-install-info ',
]

[DanglingSymlinkExceptions."/usr/share/doc/licenses/"]
path = "/usr/share/doc/licenses/"
name = "licenses"
[DanglingSymlinkExceptions."consolehelper$"]
path = "consolehelper$"
name = "usermode"
[DanglingSymlinkExceptions."consolehelper-gtk$"]
path = "consolehelper-gtk$"
name = "usermode-gtk"

[Descriptions]
non-standard-uid = '''A file in this package is owned by an unregistered user id.
To register the user, please make a pull request to the rpmlint config file
configs/Fedora/fedora.toml in the rpmlint repository.
'''
non-standard-gid = '''A file in this package is owned by an unregistered group id.
To register the group, please make a pull request to the rpmlint config file
configs/Fedora/fedora.toml in the rpmlint repository.
'''
no-changelogname-tag = '''There is no changelog. Please insert a '%changelog' section heading in your
spec file and prepare your changelog entry using e.g. the 'rpmdev-bumpspec' command.'''