OK, I feel bad about this as half of it is my fault, but after I looked harder at the packaging guidelines in re bundling today, I think it's fair to say owncloud is clearly violating the hell out of them.

I and before me Gregor had been proceeding, I think, on the belief that unpackaged things could be bundled, but that really doesn't seem to be the case:

https://fedoraproject.org/wiki/Packaging:Treatment_Of_Bundled_Libraries , "bundled libraries being defined as libraries which exist and are mantained independently, whether or not they are packaged separately for Fedora" and https://fedoraproject.org/wiki/Packaging:Guidelines#Duplication_of_system_libraries , "In this RPM packaging context, the definition of the term 'library' includes: compiled third party source code resulting in shared or static linkable files, interpreted third party source code such as Python, PHP and others."

It really wasn't compliant all the way back to review, in my opinion. The originally imported spec:

http://pkgs.fedoraproject.org/cgit/owncloud.git/tree/owncloud.spec?id=9ee05fbe8604bcba580b82acc6704d3c281fd8fe

has a 'bundling notes' section:

# bundling notes:
## smb4php - forked php class from http://www.phpclasses.org/package/4129-PHP-Stream-wrapper-to-access-Windows-shared-files.html
## openid/phpMyID - forked from http://siege.org/projects/phpMyID and adjusted to oC needs
## openid/SimpleOpenID - adjusted class from http://roosenmaallen.com/2008/03/20/simpleopenid-for-php/
## Google - copy of a google playground project https://code.google.com/p/gdata-samples/source/browse/trunk/oauth_playground/
# containing random OAuth.php lib from http://oauth.googlecode.com/svn/code/php/ - I don't know what to say
## mediawiki contains two files picked from the mediawiki distribution
# Fedora packages mediawiki but not in a way that it's files would be reusable
# (i.e. the package doesn't contain the files itself but the tarball + deployment
# script)

you could argue that some or all of those might have been worth an FPC exception, but according to the policy they clearly *needed* an FPC exception, not just packager and reviewer judgement calls, which seems to have been what was used.

Since then, well, the details have changed, but things have overall gotten worse. Here are the current 'bundling notes' for 8.0.7:

## 3rdparty/patchwork - https://github.com/nicolas-grekas/Patchwork-UTF8
# "patchwork/utf8": "~1.1"
#
# Used to set a UTF-8 locale (function isSetLocaleWorking does not
# just test whether setlocale works, it actually asks Patchwork to
# set a locale) and for its pure PHP implementation of the Normalizer
# class otherwise found in php-intl. See lib/private/util.php
# Patch from adamw to use php-intl's if available:
# https://github.com/owncloud/core/pull/6620
# We'd also have to set a UTF-8 locale some other way to entirely
# replace OC's use of Patchwork.

## 3rdparty/mcnetic/phpzipstreamer - https://github.com/McNetic/PHPZipStreamer
# "mcnetic/phpzipstreamer": "dev-master"
#
# OC's copy is somewhat behind upstream, and slightly forked: they imported
# it on 2014-02-20, and added a downstream patch to make it work with
# PHP 5.3 on 2014-03-17:
# https://github.com/owncloud/3rdparty/commit/da3c9f651a26cf076249ebf25c477e3791e69ca3
# Upstream implemented a different fix against PHP 5.3 on 2014-03-14:
# https://github.com/McNetic/PHPZipStreamer/commit/0af57cc0d113b27e44455be4be690908c4909d78
# but OC has never synced with that fix. See:
# https://github.com/owncloud/core/pull/3439

## apps/files_external/3rdparty/smb4php - forked php class from
# http://www.phpclasses.org/package/4129-PHP-Stream-wrapper-to-access-Windows-shared-files.html
# Replaced by https://github.com/icewind1991/SMB post-8.0

## 3rdparty/punic - https://github.com/punic/punic
# "punic/punic": "1.1.0"
#
# Used in date localization: lib/private/l10n.php
# Should be straightforward to unbundle

If someone wants to take the trouble to make OC compliant, I'd suggest they need to package and unbundle punic and patchwork, and probably request an exception for the phpzipstreamer fork (that whole situation is kind of a mess) and the smb4php fork.

8.1 gets rid of the smb4php fork (though the replacements need to be packaged - I believe Remi is on that), but adds a major wrinkle in that OC now needs sabredav 2.1, but we also have Horde depending on sabredav, and that still needs 1.8. So we'd need to split that package up somehow. This has already been discussed between me and Remi and Shawn to some extent. There are various other new unpackaged deps in 8.1 too.