Include %changelog when packaging rpm, so we know why a package update is occurring
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
It would be useful to know why package updates are occurring, by tying changes to the release. The %changelog directive in rpm would give us this. Without it, the rpm changelog is blank.
To reproduce:
# rpm -q --changelog keybase
#
Expected behavior for a security-related tool being updated by the packaging system, something like:
# rpm -q --changelog openssl
* Mon Dec 21 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51.2
- fix CVE-2015-7575 - disallow use of MD5 in TLS1.2
* Fri Dec 04 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51.1
- fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
- fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
- fix CVE-2015-3196 - race condition when handling PSK identity hint
* Tue Jun 23 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51
- fix the CVE-2015-1791 fix (broken server side renegotiation)
#
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the RPM packaging configuration for the client and run rpm -q --changelog keybase to confirm the current blank output. Trace how package releases are represented there, then verify that the packaged RPM exposes release-related entries through the same command, including security changes.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system, release
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100