11:27 a.m.
https://fedoraproject.org/wiki/Changes/SWID_Tag_Enablement
== Summary ==
Provide tools to allow users and developers to create Software
Identity (SWID) tags for Fedora installs and repositories.
== Owner ==
* Name: [[User:adelton|Jan Pazdziora]]
* Email: jpazdziora(a)redhat.com
== Detailed Description ==
SWID (ISO/IEC 19770:2-2015) is a portable standard for identifying
software installed on a system. We already have SWID tags in
fedora-release to identify the overall release+edition of Fedora. We
will add tools to allow users to
* list installed tags
* create and install individual tags identifying RPMs
* add pre-built tags to repositories
* automatically update local tags as packages are installed, updated and removed
This will involve standalone tools to query and build SWID tags and to
add prebuilt tags to dnf repositories, and plugins for dnf/libdnf to
build and download tags.
== Benefit to Fedora ==
Fedora will be usable to users and developers interested in the SWID
functionality being added to relevant other tools, such as
OpenSCAP-1.3.
== Scope ==
* Proposal owners:
** Add python SWID tools (swidq, rpm2swidtag)
** add SWID metadata awareness to createrepo (but this will not be
used in Fedora, only enabled for user use), agreeing metadata format
with dnf team
** add dnf and libdnf plugins (no core dnf/libdnf changes expected)
* Other developers: N/A (not a System Wide Change)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
N/A (not a System Wide Change)
== How To Test ==
N/A (not a System Wide Change)
== User Experience ==
No change unless users choose to enable SWID tags.
If requested, SWID tags will be either built automatically on demand
for installed RPMs, or downloaded from a repository that the user has
added SWID tags to, at the user’s choice. swidq will allow the user
to see all installed tags and their relationships.
== Contingency Plan ==
* Contingency mechanism: (What to do? Who will do it?) N/A (not a
System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change), No
* Blocks product? No
== Release Notes ==
Inform users of new capabilities and how they can be used with the
existing tags in fedora-release-*
--
Ben Cotton
Fedora Program Manager
TZ=America/Indiana/Indianapolis
3:18 a.m.
On Mon, Jan 28, 2019 at 12:27:06PM -0500, Ben Cotton wrote:
https://fedoraproject.org/wiki/Changes/SWID_Tag_Enablement
== Summary ==
Provide tools to allow users and developers to create Software
Identity (SWID) tags for Fedora installs and repositories.
== Owner ==
* Name: [[User:adelton|Jan Pazdziora]]
* Email: jpazdziora(a)redhat.com
== Detailed Description ==
SWID (ISO/IEC 19770:2-2015) is a portable standard for identifying
software installed on a system. We already have SWID tags in
fedora-release to identify the overall release+edition of Fedora. We
will add tools to allow users to
* list installed tags
* create and install individual tags identifying RPMs
* add pre-built tags to repositories
* automatically update local tags as packages are installed, updated and removed
This will involve standalone tools to query and build SWID tags and to
add prebuilt tags to dnf repositories, and plugins for dnf/libdnf to
build and download tags.
== Benefit to Fedora ==
Fedora will be usable to users and developers interested in the SWID
functionality being added to relevant other tools, such as
OpenSCAP-1.3.
== Scope ==
* Proposal owners:
** Add python SWID tools (swidq, rpm2swidtag)
Does "add" mean "package" here? Or are they to be added to some other
package? Are the review requests / pull requests to be reviewed
somewhere?
** add SWID metadata awareness to createrepo (but this will not be
Do you mean createrepo_c? createrepo is going away.
used in Fedora, only enabled for user use), agreeing metadata format
with dnf team
F30 beta is in exactly 2 weeks. I doubt "agreeing" and implementation
can happen in this timeframe. It should be OK to put in parts of the
implementation, even if things are not complete for this release.
But for "advertising purposes", maybe it's better to bump it to F31,
so that we don't advertise something that is not fully implemented?
** add dnf and libdnf plugins (no core dnf/libdnf changes expected)
A bit more detail here would be useful.
Zbyszek
11:47 a.m.
On Tue, Feb 05, 2019 at 09:18:23AM +0000, Zbigniew Jędrzejewski-Szmek wrote:
>
> == Scope ==
> * Proposal owners:
> ** Add python SWID tools (swidq, rpm2swidtag)
Does "add" mean "package" here? Or are they to be added to some
other
package? Are the review requests / pull requests to be reviewed
somewhere?
New package is what we are thinking about. I don't have review
request yet, the upstream development currently happens at
https://github.com/swidtags/rpm2swidtag
and I have a couple more things to flesh out before being ready for review.
> ** add SWID metadata awareness to createrepo (but this will not
be
Do you mean createrepo_c? createrepo is going away.
Yes. Is it OK to update the change page to fix that?
> used in Fedora, only enabled for user use), agreeing metadata
format
> with dnf team
F30 beta is in exactly 2 weeks. I doubt "agreeing" and implementation
can happen in this timeframe. It should be OK to put in parts of the
implementation, even if things are not complete for this release.
But for "advertising purposes", maybe it's better to bump it to F31,
so that we don't advertise something that is not fully implemented?
> ** add dnf and libdnf plugins (no core dnf/libdnf changes expected)
A bit more detail here would be useful.
The latest improvements to dnf and libdnf plugin API seems to cover
everything that we need to be able to generate SWID tags locally
after every transaction, as well as pull in SWID tags from repository
metadata, if present.
--
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat
12:16 p.m.
On 05. 02. 19 18:47, Jan Pazdziora wrote:
>> ** add SWID metadata awareness to createrepo (but this will
not be
> Do you mean createrepo_c? createrepo is going away.
Yes. Is it OK to update the change page to fix that?
Sure thing, go ahead. That's kinda the point of having a discussion on devel -
spot problems, amend the proposal.
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
4:36 a.m.
On Mon, Jan 28, 2019, 18:32 Ben Cotton <bcotton(a)redhat.com wrote:
https://fedoraproject.org/wiki/Changes/SWID_Tag_Enablement
== Summary ==
Provide tools to allow users and developers to create Software
Identity (SWID) tags for Fedora installs and repositories.
== Owner ==
* Name: [[User:adelton|Jan Pazdziora]]
* Email: jpazdziora(a)redhat.com
== Detailed Description ==
SWID (ISO/IEC 19770:2-2015) is a portable standard for identifying
software installed on a system. We already have SWID tags in
fedora-release to identify the overall release+edition of Fedora. We
will add tools to allow users to
* list installed tags
* create and install individual tags identifying RPMs
* add pre-built tags to repositories
* automatically update local tags as packages are installed, updated and
removed
This will involve standalone tools to query and build SWID tags and to
add prebuilt tags to dnf repositories, and plugins for dnf/libdnf to
build and download tags.
== Benefit to Fedora ==
Fedora will be usable to users and developers interested in the SWID
functionality being added to relevant other tools, such as
OpenSCAP-1.3.
== Scope ==
* Proposal owners:
** Add python SWID tools (swidq, rpm2swidtag)
** add SWID metadata awareness to createrepo (but this will not be
used in Fedora, only enabled for user use), agreeing metadata format
with dnf team
Since this needs to be portable, please start discussion on
rpm-ecosystem(a)lists.rpm.org a.d don't do something what is DNF-specific.
** add dnf and libdnf plugins (no core dnf/libdnf changes expected)
* Other developers: N/A (not a System Wide Change)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
N/A (not a System Wide Change)
== How To Test ==
N/A (not a System Wide Change)
== User Experience ==
No change unless users choose to enable SWID tags.
If requested, SWID tags will be either built automatically on demand
for installed RPMs, or downloaded from a repository that the user has
added SWID tags to, at the user’s choice. swidq will allow the user
to see all installed tags and their relationships.
== Contingency Plan ==
* Contingency mechanism: (What to do? Who will do it?) N/A (not a
System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change), No
* Blocks product? No
== Release Notes ==
Inform users of new capabilities and how they can be used with the
existing tags in fedora-release-*
--
Ben Cotton
Fedora Program Manager
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce(a)lists.fedoraproject.org
To unsubscribe send an email to
devel-announce-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedora...
11:49 a.m.
On Tue, Feb 05, 2019 at 11:36:50AM +0100, Igor Gnatenko wrote:
On Mon, Jan 28, 2019, 18:32 Ben Cotton <bcotton(a)redhat.com wrote:
> ** add SWID metadata awareness to createrepo (but this will not be
> used in Fedora, only enabled for user use), agreeing metadata format
> with dnf team
Since this needs to be portable, please start discussion on
rpm-ecosystem(a)lists.rpm.org a.d don't do something what is DNF-specific.
Thank you for the pointer. Does rpm-ecosystem@ really deal with yum/dnf
repository metadata XML schemas?
--
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat
9:01 p.m.
On Tue, Feb 5, 2019 at 9:52 PM Jan Pazdziora <jpazdziora(a)redhat.com> wrote:
On Tue, Feb 05, 2019 at 11:36:50AM +0100, Igor Gnatenko wrote:
> On Mon, Jan 28, 2019, 18:32 Ben Cotton <bcotton(a)redhat.com wrote:
>
> > ** add SWID metadata awareness to createrepo (but this will not be
> > used in Fedora, only enabled for user use), agreeing metadata format
> > with dnf team
>
> Since this needs to be portable, please start discussion on
> rpm-ecosystem(a)lists.rpm.org a.d don't do something what is DNF-specific.
Thank you for the pointer. Does rpm-ecosystem@ really deal with yum/dnf
repository metadata XML schemas?
Technically, there is the rpm-metadata@ mailing list on
lists.baseurl.org, but I don't think anyone looks there anymore.
rpm-ecosystem@ on lists.rpm.org is the right place these days.
--
真実はいつも一つ！/ Always, there's only one truth!
10:35 a.m.
On Tue, Feb 05, 2019 at 07:16:09PM +0100, Miro Hrončok wrote:
On 05. 02. 19 18:47, Jan Pazdziora wrote:
> > > ** add SWID metadata awareness to createrepo (but this will not be
> > Do you mean createrepo_c? createrepo is going away.
> Yes. Is it OK to update the change page to fix that?
Sure thing, go ahead. That's kinda the point of having a discussion on devel
- spot problems, amend the proposal.
Good. Change page updated.
On Tue, Feb 05, 2019 at 10:01:10PM -0500, Neal Gompa wrote:
Technically, there is the rpm-metadata@ mailing list on
lists.baseurl.org, but I don't think anyone looks there anymore.
rpm-ecosystem@ on lists.rpm.org is the right place these days.
OK, http://lists.rpm.org/pipermail/rpm-ecosystem/2019-February/000711.html
sent.
--
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat
4:01 a.m.
On Thu, Feb 07, 2019 at 05:35:23PM +0100, Jan Pazdziora wrote:
On Tue, Feb 05, 2019 at 07:16:09PM +0100, Miro Hrončok wrote:
> On 05. 02. 19 18:47, Jan Pazdziora wrote:
> > > > ** add SWID metadata awareness to createrepo (but this will not be
> > > Do you mean createrepo_c? createrepo is going away.
> > Yes. Is it OK to update the change page to fix that?
>
> Sure thing, go ahead. That's kinda the point of having a discussion on devel
> - spot problems, amend the proposal.
Good. Change page updated.
On Tue, Feb 05, 2019 at 10:01:10PM -0500, Neal Gompa wrote:
>
> Technically, there is the rpm-metadata@ mailing list on
> lists.baseurl.org, but I don't think anyone looks there anymore.
> rpm-ecosystem@ on lists.rpm.org is the right place these days.
OK, http://lists.rpm.org/pipermail/rpm-ecosystem/2019-February/000711.html
sent.
Hello,
the rpm-ecosystem has been silent so far. Any idea who might be the
right person to talk about possibly using
http://rpm.org/metadata/swidtags
URI?
--
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat
1896
days inactive
1912
days old
8 comments
6 participants
participants (6)
-
Ben Cotton -
Igor Gnatenko -
Jan Pazdziora -
Miro Hrončok -
Neal Gompa -
Zbigniew Jędrzejewski-Szmek