releng/tickets
15
3
Fork 2
Code Issues 77 Pull requests Projects Releases Packages Wiki Activity Actions

log4j contains files with unacceptable licenses #11083

New issue
Open
opened 2022-10-13 10:40:20 +00:00 by mkoncek · 4 comments
mkoncek commented 2022-10-13 10:40:20 +00:00
Copy link

See https://gitlab.com/fedora/legal/fedora-license-data/-/issues/78.
I opened PRs fixing this issue:

But the files already present in lookaside cache still contain the zip entry.
Looks like the first version which started using glyphicons.zip is:
https://src.fedoraproject.org/lookaside/pkgs/log4j/apache-log4j-2.13.0-src.tar.gz/sha512/

The zip archive is not required for the package functioning.

See https://gitlab.com/fedora/legal/fedora-license-data/-/issues/78. I opened PRs fixing this issue: * https://src.fedoraproject.org/rpms/log4j/pull-request/16 * https://src.fedoraproject.org/rpms/log4j/pull-request/17 But the files already present in lookaside cache still contain the zip entry. Looks like the first version which started using glyphicons.zip is: https://src.fedoraproject.org/lookaside/pkgs/log4j/apache-log4j-2.13.0-src.tar.gz/sha512/ The zip archive is not required for the package functioning.
phsmoura commented 2022-10-13 18:06:43 +00:00
Copy link

Metadata Update from @phsmoura:

  • Issue tagged with: medium-gain, medium-trouble, ops
**Metadata Update from @phsmoura**: - Issue tagged with: medium-gain, medium-trouble, ops
smilner commented 2025-03-03 16:55:41 +00:00
Copy link

Thank you for that @mkoncek. is the request here is to ensure that glyphicons.zip is removed from the lookaside cache source tarballs for log4j from when the project started including them up until it stopped? Will that cause any issues with the previous built packages, etc?

Thank you for that @mkoncek. is the request here is to ensure that `glyphicons.zip` is removed from the lookaside cache source tarballs for log4j from when the project started including them up until it stopped? Will that cause any issues with the previous built packages, etc?
mkoncek commented 2025-03-04 10:01:46 +00:00
Author
Copy link

Hi, you are correct, it should be done for all the package version from 2.13.0 up until 2.17.2, release 5.
As I said, the zip file is not needed for the package to work.

Hi, you are correct, it should be done for all the package version from 2.13.0 up until 2.17.2, release 5. As I said, the zip file is not needed for the package to work.
smilner commented 2025-03-04 14:58:02 +00:00
Copy link

Thank you @mkoncek. @jnsamyak, @patrikp, @amedvede, let's get this on one of the upcoming releng meetings to double check the gain/effort and for someone to pick up and move it forward.

Thank you @mkoncek. @jnsamyak, @patrikp, @amedvede, let's get this on one of the upcoming releng meetings to double check the gain/effort and for someone to pick up and move it forward.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
twoweek-stable
rawhide-stable
Labels
Clear labels   
after freeze

   
automation

   
backlog
Tasks that will take longer then ~4 hours to do

  
blocked

   
change-ack
Changes that have releng work and are accepted

  
change-nak
Changes that have releng work and have been rejected

  
change-noreleng
Changes that do not have any releng work

  
changes
  
Closed As
Can't Fix
 Closed with the reason of Can't Fix

  
Closed As
Duplicate
 Closed with the reason of Duplicate

  
Closed As
Fixed
 Closed with the reason of Fixed

  
Closed As
Fixed with Explanation
 Closed with the reason of Fixed with Explanation

  
Closed As
Get back later
 Closed with the reason of Get back later

  
Closed As
Grooming
 Closed with the reason of Grooming

  
Closed As
Insufficient data
 Closed with the reason of Insufficient data

  
Closed As
Invalid
 Closed with the reason of Invalid

  
Closed As
It's all good
 Closed with the reason of It's all good

  
Closed As
taiga
 Closed with the reason of taiga

  
Closed As
upstream
 Closed with the reason of upstream

  
day-to-day
These are small, self-contained tasks that are part of normal operations but are async from sprint planning.

  
dev

   
docs

   
easyfix

   
epel

   
f26

   
f27
Fedora 27

  
f28
Fedora 28

  
f29
Fedora 29

  
f30

   
f31

   
f32

   
f33
Fedora 33

  
f34

   
f35
Fedora 35

  
f36

   
f37

   
f38

   
f39
Fedora 39

  
f40

   
f41
Fedora 41

  
f42
Fedora 42

  
f43
Fedora 43

  
f44
Fedora 44

  
f45
Fedora 45

  
fedora

   
groomed

   
high-gain

   
high-trouble

   
in-progress

   
in-review

   
investigation

   
legal

   
low-gain

   
low-trouble

   
mass rebuild

   
medium-gain

   
medium-trouble

   
meeting

   
mini-initiative

   
new_artifact
New artifact for fedora release

  
ops

   
pdc_retirement

   
rawhide

   
RCA
Root cause analysis

  
review

   
script

   
sidetarget

   
sprint-0

   
sprint-1
Releng Sprint 1 Tracker

  
sprint-2
Sprint 2

  
sprint-3
Releng Sprint 3 Tracker

  
sprint-4
RelEng Spring 4 Tracker

  
sprint-5
RelEng Sprint Tracker 5 (Nov 18 - Dec 02)

  
unfrozen
Revisit after freeze

  
waiting on external
  
Backlog Status
Needs Review
 Needs to go through refinement

  
Backlog Status
Ready
 Ready for sprint

  
chore

   
documentation
  
points
01
 A task that is simple, small, and has very little uncertainty. It should be easy enough for any team member to pick up and complete quickly, without a lot of discussion or research.

  
points
02
 This is a task that is slightly more complex or larger than a "1." It might involve two or three simple steps, but the outcome is still very clear and there's little uncertainty.

  
points
03
 Medium-sized task with some noticeable complexity. It might require a bit more thought or collaboration. The steps are well-defined, but it's not a trivial change.

  
points
05
 A significant piece of work. It has more complexity and a higher degree of uncertainty than smaller tasks. It might require some research, a design discussion, or collaboration across multiple teams.

  
points
08
 Complex task with a lot of uncertainty. It's often the largest size that a team will consider for a single sprint. It likely requires a detailed breakdown and multiple team members to complete.

  
points
13
 Any task that feels like it's a "13" or more is considered an Epic. These are too large and uncertain to be worked on in a single sprint and should be broken down.

  
Priority
High
 This is for work that is critical and needs to be addressed in the next sprint. It's often for urgent bugs, important features, or a major piece of technical debt that is blocking other work.

  
Priority
Low
 This is for work that is good to do but not urgent. It's a candidate for being worked on when there's extra time or when it rises in importance. It can stay in the backlog for a longer period.

  
Priority
Medium
 This is for important work that should be done soon, but isn't as urgent as a high-priority item. It will likely be considered for the next 1-2 sprints.

  
release-process
All the tickets that are done in order for release process.

  
Sprint Status
Blocked
 Work items that cannot progress due to external dependencies, blockers, or issues that need resolution.

  
Sprint Status
Done
 Work items that have been completed, reviewed, and integrated. No further work is needed within the current sprint.

  
Sprint Status
In Progress
 Work items currently being worked on by a team member. Active development, research, or implementation is happening.

  
Sprint Status
Review
 Work items that are complete but need review, testing, or approval before being marked as done.

  
Sprint Status
To Do
 Work items that are committed to the sprint but haven't been started yet. These items are ready to be picked up by team members.

  
Technical Debt
Work that addresses shortcuts, workarounds, or suboptimal implementations that were done previously to meet deadlines. These items improve code quality, maintainability, or performance without adding new features.

  
Work Item
Bug
 Issues where the system is not working as intended or designed. Bugs represent deviations from expected behavior.

  
Work Item
Epic
 Large initiatives that are broken down into multiple smaller work items (user stories, tasks, bugs). Epics represent significant features or projects that span multiple sprints.

  
Work Item
Spike
 Time-boxed research, investigation, or proof-of-concept work to reduce uncertainty or explore solutions. Spikes help inform future development decisions.

  
Work Item
Task
 Used to break down larger user stories into smaller, manageable implementation pieces. They focus on the specific technical steps needed to deliver the user story's value.

  
Work Item
User Story
 User-facing features or functionality that can be framed from a user perspective, describing what someone wants to accomplish and why.

No labels
after freeze
automation
backlog
blocked
change-ack
change-nak
change-noreleng
changes
Closed As
Can't Fix
Closed As
Duplicate
Closed As
Fixed
Closed As
Fixed with Explanation
Closed As
Get back later
Closed As
Grooming
Closed As
Insufficient data
Closed As
Invalid
Closed As
It's all good
Closed As
taiga
Closed As
upstream
day-to-day
dev
docs
easyfix
epel
f26
f27
f28
f29
f30
f31
f32
f33
f34
f35
f36
f37
f38
f39
f40
f41
f42
f43
f44
f45
fedora
groomed
high-gain
high-trouble
in-progress
in-review
investigation
legal
low-gain
low-trouble
mass rebuild
medium-gain
medium-trouble
meeting
mini-initiative
new_artifact
ops
pdc_retirement
rawhide
RCA
review
script
sidetarget
sprint-0
sprint-1
sprint-2
sprint-3
sprint-4
sprint-5
unfrozen
waiting on external
Backlog Status
Needs Review
Backlog Status
Ready
chore
documentation
points
01
points
02
points
03
points
05
points
08
points
13
Priority
High
Priority
Low
Priority
Medium
release-process
Sprint Status
Blocked
Sprint Status
Done
Sprint Status
In Progress
Sprint Status
Review
Sprint Status
To Do
Technical Debt
Work Item
Bug
Work Item
Epic
Work Item
Spike
Work Item
Task
Work Item
User Story
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
releng/tickets#11083
No description provided.