From Fedora Project Wiki
m (Add subheadings within Git Hosting Services)
m (Delete checksum warning, it isn't applicable to archives extracted by commit or tag)
Line 145: Line 145:
Alternately, if you are using a specific revision that is either a pre-release revision or a post-release revision, you must follow the "snapshot" guidelines. They are documented here: [[Packaging:NamingGuidelines#Snapshot_packages|Snapshot packages]]. You can substitute %{shortcommit0} for %{checkout} in that section.
Alternately, if you are using a specific revision that is either a pre-release revision or a post-release revision, you must follow the "snapshot" guidelines. They are documented here: [[Packaging:NamingGuidelines#Snapshot_packages|Snapshot packages]]. You can substitute %{shortcommit0} for %{checkout} in that section.
Keep in mind that Git tarballs are generated on-demand, so their modification dates will vary and cause checksum tests to fail. Reviewers will need to use diff -r to verify the tarballs.
=== Git Submodules ===
=== Git Submodules ===

Revision as of 06:26, 25 June 2015

Referencing Source

One of the design goals of rpm is to cleanly separate upstream source from vendor modifications. For the Fedora packager, this means that sources used to build a package should be the vanilla sources available from upstream. To help reviewers and QA scripts verify this, the packager needs to indicate where a reviewer can find the source that was used to make the rpm.

The most common case is where upstream distributes source as a tar.gz, tar.bz2 or zip archive that we can download from an upstream website. In these cases you must use a full URL to the package in the SourceX: line. For example:


Smallest Compressed Archive
If the upstream source archive is available in multiple compressed formats that our tools can decompress it's best to use the one that is smallest in size. This ensures the smallest source rpm to save space on the mirrors and downloads of source RPM packages.

There are several cases where upstream is not providing the source to you in an upstream tarball. In these cases you must document how to generate the tarball used in the rpm either through a spec file comment or a script included as a separate SourceX:.

Here are some specific examples:

Using Revision Control

In some cases you may want to pull sources from upstream's revision control system because there have been many changes since the last release and you think that a tarball that you generate from there will more accurately show how the package relates to upstream's development. Here's how you can use a comment to show where the source came from:

# The source for this package was pulled from upstream's vcs.  Use the
# following commands to generate the tarball:
#  svn export -r 250 foo-20070221
#  tar -cJvf foo-20070221.tar.xz foo-20070221
Source0: foo-20070221.tar.xz

When pulling from revision control, please remember to use a Name-version-release compatible with the Version and Release Guidelines. In particular, check the section on Naming Snapshots.

When Upstream uses Prohibited Code

Some upstream packages include patents or trademarks that we are not allowed to ship even as source code. In these cases you have to modify the source tarball to remove this code before you even upload it to the build system. Here's an example of using a script to document how you went from the upstream tarball to the one included in the package:

From the spec:

Source0: libfoo-1.0-nopatents.tar.gz
# libfoo contains patented code that we cannot ship.  Therefore we use
# this script to remove the patented code before shipping it.
# Download the upstream tarball and invoke this script while in the
# tarball's directory:
# ./ 1.0



tar -xzvf libfoo-$VERSION.tar.gz
rm libfoo-$VERSION/src/patentedcodec.c
sed -i -e 's/patentedcodec.c//' libfoo-$VERSION/src/Makefile

tar -czvf libfoo-$VERSION-nopatents.tar.gz libfoo-$VERSION

For packages hosted on sourceforge, use


changing ".tar.gz" to whatever matches the upstream distribution. Note that we are using instead of an arbitrarily chosen mirror. You may use the package name/package version instead of the %{name} and %{version} macros, of course.

Please note that the correct url is, and NOT

Git Hosting Services

As many upstreams use Git web-based hosting services for their source control, it is worth covering how to handle that source in a Fedora Package.

If the upstream does create tarballs you should use them as tarballs provide an easier trail for people auditing the packages.

Git web-based hosting services provide a mechanism to create tarballs on demand, either from a specific commit revision, or from a specific tag.

If the upstream does not create tarballs for releases, you can use this mechanism to produce them.

Git Tags

Git Tags can appear in many different formats. Upstream could use $PROJECT-version, "v"%{version} or other combinations which include the date. Keep this in mind when constructing the download URL which includes Git Tag information. Additionally, there is an opportunity for abuse by upstream in their use of Git Tags; specifically regarding re-tagging which is NOT acceptable. If you believe upstream is engaging in this practice you MUST request upstream to correct this situation. If upstream refuses or not responsive, you can either drop your effort to package the application OR use the commit hash method. If you decide to use the commit hash method, you MUST place a comment in the Spec file documenting the fact that upstream is in violation of Git practices and the commit hash method was used to circumvent the situation.

#  Upstream is known to engage in the practice of Re-tagging
#  and was notified on dd-mm-yyyy that this is not allowed.
#  Full commit hash is being used since they have not 
#  corrected the situation.

Commit Revision

You must use the full 40-character hash when referring to the sources by commit revision. This is for a number of reasons; including immutability, availability and uniqueness.

The full 40-character hash can be obtained by issuing the following git command:

git ls-remote https://$HOSTING-SERVICE/$OWNER/$PROJECT.git

$HOSTING-SERVICE = name of the service, i.e. "", "", etc.
$OWNER = username for the repository owner
$PROJECT = name of the project

You may also obtain the 40-character hash via the web-interface of the $HOSTING-SERVICE or by cloning the repository and issuing the git show-ref command.

Once the commit hash is known, you can define it in your Spec file as follows:

%global commit0 $40-CHARACTER-HASH-VALUE
%global shortcommit0 %(c=%{commit}; echo ${c:0:7})

Note that the numeric identifier after commit and shortcommit matches the associated identifier of the Source macro.

For the source tarball, you should use the following syntax:


%setup -qn %{name}-%{commit0} (GitHub - Unpack tarball)
%setup -qn $OWNER-%{name}-%{commit0} (BitBucket - Unpack tarball)

If the release corresponds to a Git Tag with a sane numeric version, you must use that version to populate the Version field in the spec file. If it does not, look at the source code to see if a version is indicated there, and use that value. If no numeric version is indicated in the code, you may set Version to 0, and treat the package as a "pre-release" package (and make use of the %{shortcommit0} macro). See Pre-Release packages for details.

Alternately, if you are using a specific revision that is either a pre-release revision or a post-release revision, you must follow the "snapshot" guidelines. They are documented here: Snapshot packages. You can substitute %{shortcommit0} for %{checkout} in that section.

Git Submodules

Some projects may use the Git submodule capability. If so, please note that the submodule will not be included in the tarball. Instead, it will appear in the tarball as an empty directory. In this situation, you will need to manually incorporate the submodule into the project.

One method is to rebuild the tarball prior to it's inclusion in the Spec file. This involves cloning the project, issuing the Git commands to incorporate the submodule, then building a tarball of the newly created project directory structure. You will then need to comment as described in the Using Revision Control section. The following is an example specific to Git submodules:

# The source of this package was pulled from upstreams's vcs.
# Use the following command to generate the tar ball:
# git clone http://$HOSTING-SERVICE/$OWNER/$PROJECT.git
# git submodule init
# git submodule update
# cd ..
# tar cvjf $PROJECT-%{version}.tar.gz $PROJECT/

An alternative is to incorporate the submodule within the %prep section of the Spec file. In this instance you will follow the preceding instructions to obtain the tarball for the submodule project. Instead of Source0, commit0 and shortcommit0; you will use Source1, commit1 and shortcommit1. An example %prep section would be:

chmod 644 %{SOURCE0} - (Required if rpmlint reports strange permission)
chmod 644 %{SOURCE1} - (Required if rpmlint reports strange permission)
%setup -qn %{name}-%{commit0} -a 1 - (GitHub - Unpack tarballs)
%setup -qn $OWNER-%{name}-%{commit0} -a 1 (BitBucket - Unpack tarballs)
rm $SUBMODULE --recursive - (Remove empty $SUBMODULE directory)
mv $PROJECT-%{commit1} $SUBMODULE - (Move $SUBMODULE directory into the $PROJECT directory structure)

Keep in mind that the version specified reflects that of the project and NOT the submodule.

Using %{version}

Using %{version} in the SourceX: makes it easier for you to bump the version of a package, because most of the time you do not need to edit SourceX: when editing the specfile for the new package.

Troublesome URLs

When upstream has URLs for the download that do not end with the tarball name rpm will be unable to parse the tarball out of the source URL. One workaround for many cases is to construct a URL where the tarball is listed in a "URL fragment":


rpm will then use %{name}-%{version}.tar.gz as the tarball name. If you use spectool -g foo.spec to download the tarball, it will rename the tarball for you.

Sometimes this does not work because the upstream cgi tries to parse the fragment or because you need to login or fill in a form to access the tarball. In these cases, you have to put just the tarball's filename into the Source: field. To make clear where you got the tarball, you should leave notes in comments above the Source: line to explain the situation to reviewers and future packagers. For example:

 # Mysql has a mirror redirector for its downloads
 # You can get this tarball by following a link from:
 Source0: mysql-5.1.31.tar.gz