Package maintenance guide

From FedoraProject

Jump to: navigation, search

This page provides some basic instructions for day-to-day usage of the git-based package maintenance system for Fedora. It is intended primarily for new and current Fedora package maintainers, but does briefly cover anonymous read-only use of the system. It is not a guide to RPM packaging per se. Some pre-existing knowledge of git may be useful, but is not a pre-requisite (in fact, Fedora packaging can be a relatively painless introduction to it).

You may have been looking for, or also be interested in:


Installing fedpkg and doing initial setup

Start by installing Package-x-generic-16.pngfedora-packager with dnf install fedora-packager. This will also install the Package-x-generic-16.pngfedpkg tool, which will be your primary interface to the packaging system. Run fedora-packager-setup to configure your machine for package maintenance. If you have run fedora-packager-setup before, but wish to set up a new machine, copy the files ~/.fedora*.cert to the new system.

You also must have an ssh key configured in the Fedora Accounts System to be able to make changes to any package (including your own). fedpkg will expect the correct ssh key to be available in your keyring.

Before uploading sources with new-sources and upload and building packages in Koji, with build for example, you have to get your Kerberos credential first with kinit, e.g.


(Keep FEDORAPROJECT.ORG in capital case)

Common fedpkg commands

This section lists typical fedpkg commands in a normal workflow, with short descriptions. Longer explanations for each can be seen by clicking the 'Show' links. In this workflow, we will be operating on the Rawhide branch of the package.

  • Check out a package:
fedpkg co <source_package_name>
cd <source_package_name>
  • Update your checked-out copy from the Fedora server:
fedpkg pull
  • Retrieve the package sources:
fedpkg sources
  • Make your changes to the package
  • Run the 'prep' stage (extract source, apply patches etc) within the checkout directory:
fedpkg prep
  • Do a local build of the current state:
fedpkg local
  • Do a mock build of the current state:
fedpkg mockbuild
  • Generate a .src.rpm from the current state:
fedpkg srpm
fedpkg diff
  • Run some checks (rpmlint) on your package:
fedpkg lint
  • Stage any small patches or new source files for commit:
git add (somefile)
  • Upload new source files to the lookaside cache:
fedpkg new-sources
This will replace the current list of source files, not add to it. See Details for more details on the lookaside cache system.
fedpkg upload
  • Switch to a different release branch:
fedpkg switch-branch <f25, el6, master>
  • Generate git changelog from package changelog:
fedpkg clog
  • Commit changes:
fedpkg commit (-F clog) (-p) (-c)
Difference from git
This behaves by default like git commit -a - it stages modified files and commits all at once, though it does not add files which git is not yet tracking.
  • Push changes:
fedpkg push
  • Do an 'official' build of the latest pushed changes:
fedpkg build
fedpkg container-build
Going into production
This is the first point at which you might possibly cause real mess for a real user, so use it with caution. If you are following the example and operating on Rawhide, your build would go live for Rawhide users some few hours after you ran this command.
Uses pushed state
Unlike most of the above commands, this operates on the state you have pushed to git, not the local state. If you have issues make sure you have pushed and committed all patches and handled the sources correctly.
  • Submit a package update for the latest build:
fedpkg update

Typical fedpkg session

A typical session may look like this:

fedpkg clone foo
cd foo
fedpkg sources
fedpkg new-sources foo-0.0.2.tar.bz2
gedit foo.spec       # change the required things in the specfile.
                     # rpmdev-bumpspec is useful for simple version updates
fedpkg mockbuild     # check that the changes you made are correct
fedpkg diff
fedpkg lint
fedpkg commit -p -c  # commit and push in one go

Working with branches

Each Fedora release is represented by a branch in the git repository. You can switch between them like this:

fedpkg switch-branch f25
fedpkg switch-branch f24
fedpkg switch-branch master

The master branch is for Rawhide. You can maintain each branch entirely separately, if you like, laboriously copying changes between them (so long as you always stay within the Updates Policy requirements). However, git provides us with several handy tools for working with branches. Here's an example:

fedpkg clone bzrtools
# Make some changes in the master branch
fedpkg new-sources bzrtools-2.2.tar.gz
gedit bzrtools.spec
fedpkg commit
fedpkg switch-branch f25
git merge master
# for push into repo
fedpkg push

This will 'merge' the changes from the master (Rawhide) branch to the f25 branch. git aficionados may note this is a somewhat unusual workflow, but it is appropriate to the context of package management. Remember, after pushing to and building for a stable release or a Branched release after Bodhi has been enabled, you will have to submit an update before any other Fedora users will see your build.

Note that merges will only be sure to work cleanly so long as the branches have not previously diverged. That is, if you do this:

fedpkg clone bzrtools
# Make some changes in the master branch
fedpkg commit
fedpkg switch-branch f25
# Make some changes in the f25 branch
fedpkg commit
fedpkg switch-branch master
# Make some more changes in the master branch
fedpkg commit
fedpkg switch-branch f25
git merge master

you may encounter a merge conflict.

Remember that git is a collaborative system, and used as such in Fedora package management. It is often the case that you must consider changes made by others in working on a package, and consider how your changes will affect others.

Resolving merge conflicts

This is a large topic and somewhat beyond the scope of this guide, but we can give basic pointers. There are other good references in the git book and at github.

When you git merge and a conflict occurs you can edit the files that have conflicts. Remove the conflict markers in the files and merge the changes manually. Use git diff or fedpkg diff to inspect the changes against the pre-conflict state and verify you are happy with the resolution. Then you can commit the files with fedpkg commit or git commit -a. git will know if you have resolved the conflict by checking that all the conflict markers have been removed.

Using git mergetool to resolve conflicts

Git provides a graphical diff program to help resolve conflicts. This can be handy for visualizing what changes have occurred and dealing with them as a set.

git config --global merge.tool meld
fedpkg switch-branch f25
git merge master
# Conflicts occurred
git mergetool            # Opens up a meld showing a three way diff of 
                         # the merge, working tree, and the last commit
# Resolved all the conflicts in the GUI
git commit

Requesting special dist tags

When a change to a package affects a large number of dependencies (e.g. all perl, python, ruby or ghc packages), requiring them to be rebuilt, it may be better to initially do the builds in a special repository, so that there is less disruption in Rawhide.

If you think you have an update that falls under this case you can request a special dist tag by filing a release engineering ticket. Someone from release engineering will likely want to discuss your needs to make sure this is really an appropriate case (it's OK ask if you aren't sure) and that you get what you need.

Tips and tricks

Using fedpkg anonymously

You can use fedpkg like this:

fedpkg clone --anonymous <somepackage>

to check out a package without requiring identification. Obviously, you will not be able to push any changes to this repository, but it is useful for non-packagers who simply want to examine a package, make changes for their own use, and perhaps submit changes to a Fedora developer.

As of 2017-01-13, fedpkg uses git://, which does not integrity-protect your download from MITM attackers. This should be fixed soon in bug 1188634. Until then, you can run the following to get integrity protection:
# Remove the previous version of this workaround.
git config --global --unset url.
git config --global --unset http.

git config --global url. git://
Now when you use fedpkg clone --anonymous, your git remote definition will still refer to git://, but git will actually use

Local branch names

If you use git commands to branch and checkout directly, you can define whatever local branch names you want. If you use fedpkg switch-branch, it will default to creating the names used in the examples above.

Current branch and state in shell prompt

It is often helpful to know what branch you are working on at a glance. You can add this information to your bash prompt with the information here.

Importing a .src.rpm to update

The fedpkg import command usually used to initially populate a git package repository from a .src.rpm that has been through the Package Review Process can also be used to update a normal working copy, if you have an old-school packaging process to which you are particularly attached. Just run fedpkg import file.src.rpm and it will upload new tarballs into lookaside cache, update a working copy of the last version found in git, and commit all changes. fedpkg import --help documents some other parameters it can accept.

This approach makes it harder to verify that your changes are safe and do not overwrite changes made to the package by others. For this reason, its use is not recommended.

Making changes on an older branch without breaking the upgrade path

Here is the scenario: you've built your package successfully on the 25 branch, but there is a problem keeping your package from building on last.

Solution: make your changes in the branch and then add a digit to the very right of the release tag. There is no need to change the release in the other branches. This allows upgrades to work smoothly if the user upgrades to a newer release of Fedora.

Name:    foo
Version: 1.0
Release: 1%{?dist}

Name:    foo
Version: 1.0
Release: 1%{?dist}.1

Then tag and build as usual. This approach was initially discussed in this mailing list thread.

Removing a package build pending for Rawhide or Branched

From time to time you may want to remove a package build you submitted to Rawhide or to Branched prior to the Alpha freeze (both cases where the build would usually go out to the main repository without further gating). This could happen in a situation where a bug or issue is found in your package that will be resolved upstream in the next release, or you realize you made a significant mistake in the build that cannot easily be corrected.

Stop (medium size).png
Use this carefully!
This should only be done on the same day of the build, before it is included in a compose. If your build was already included in a compose you must not untag it! Check the Release Engineering Dashboard to get the starting time of the last compose.

You can remove the package by using Koji: koji untag-pkg f26 foo-1.1.3-1.fc26

where foo-1.1.3-1.fc26 is replaced with the name of your package build. See koji help or using Koji for more information.

ssh fingerprint

The recommended option is to include "VerifyHostKeyDNS yes" in your ~/.ssh/config file. This will result in using DNS to check that the key is correct.

But you can also manually check against the list of keys at . The strings there are what ends up in your ~/.ssh/known_hosts file. So you can accept the fingerprint when prompted and then check that the correct string for ended up in your ~/.ssh/known_hosts file.

Problems connecting to the repository

The fedpkg tool clones repositories using the ssh:// protocol, so this should not be a problem normally (as long as you have your ssh key). If you cloned using the git utility itself, check the .git/config file to ensure the remote repository is being accessed via an ssh:// protocol, and not git://.

Expired certificates (Error 255 or OpenSSL.SSL.Error)

This error usually means that your client certificate (~/.fedora.cert) has expired, so you need to run fedora-cert to get a new one. If you have trouble with this, you may try removing ~/.fedora*.cert and re-running fedora-packager-setup.

It builds here, why doesn't it build there?

Is your package building locally - even with Mock, even as a scratch build! - but not when you run fedpkg build? Before you get too frustrated, remember fedpkg build runs on the package as it exists in the upstream repository, not your local working copy. Make sure you have committed and pushed all changes and source files, and handled the lookaside cache correctly. Other issues that have been reported, are issues because of build/make check parallelization and failures because of test suites that depend on operations finish on precise timing (and a busy build system may not be able to perform operations on time).