>Spec URL: http://labs.linuxnetz.de/bugzilla/libmtp11.spec
>SRPM URL: http://labs.linuxnetz.de/bugzilla/libmtp11-1.1.10-1.src.rpm

Why your src package does not contain a %{?dist} tag?

Review:

- COPYING is not tagged with %license

You can use %license and %doc to package all documentation files
instead to make $RPM_BUILD_ROOT%{_pkgdocdir}.

- BuildRoot and cleaning commands are not required on EPEL6 and above.
http://fedoraproject.org/wiki/EPEL:Packaging#BuildRoot_tag

- %defattr present but not needed

- All examples binary files are not PIE, not full RELRO. 
  libmtp.so.9.3.0 is not full RELRO.
http://fedoraproject.org/wiki/Packaging:Guidelines#PIE
https://fedoraproject.org/wiki/Changes/Harden_All_Packages

- HTML documentation can be installed ina -doc sub-package.


Package Review
==============

Legend:
[x] = Pass, [!] = Fail, [-] = Not applicable, [?] = Not evaluated
[ ] = Manual review needed


Issues:
=======
- If (and only if) the source package includes the text of the license(s)
  in its own file, then that file, containing the text of the license(s)
  for the package is included in %license.
  Note: License file COPYING is marked as %doc instead of %license
  See:
  http://fedoraproject.org/wiki/Packaging/LicensingGuidelines#License_Text
- Large documentation must go in a -doc subpackage. Large could be size
  (~1MB) or number of files.
  Note: Documentation size is 2662400 bytes in 149 files.
  See:
  http://fedoraproject.org/wiki/Packaging/Guidelines#PackageDocumentation


===== MUST items =====

C/C++:
[x]: Package does not contain kernel modules.
[x]: Package contains no static executables.
[x]: Header files in -devel subpackage, if present.
[x]: ldconfig called in %post and %postun if required.
[x]: Package does not contain any libtool archives (.la)
[x]: Rpath absent or only used for internal libs.
[x]: Development (unversioned) .so files in -devel subpackage, if present.

Generic:
[x]: Package is licensed with an open-source compatible license and meets
     other legal requirements as defined in the legal section of Packaging
     Guidelines.
[x]: License field in the package spec file matches the actual license.
     Note: Checking patched sources after %prep for licenses. Licenses
     found: "MIT/X11 (BSD like)", "GPL", "LGPL (v2 or later)", "LGPL (v2 or
     later) (with incorrect FSF address)", "Unknown or generated". 49 files
     have unknown license. Detailed output of licensecheck in
     /home/sagitter/Downloads/libmtp11/licensecheck.txt
[x]: License file installed when any subpackage combination is installed.
[x]: Package must own all directories that it creates.
     Note: Directories without known owners: /lib/udev, /lib/udev/rules.d
[!]: %build honors applicable compiler flags or justifies otherwise.
[x]: Package contains no bundled libraries without FPC exception.
[x]: Changelog in prescribed format.
[x]: Sources contain only permissible code or content.
[!]: Each %files section contains %defattr if rpm < 4.4
     Note: %defattr present but not needed
[-]: Package contains desktop file if it is a GUI application.
[x]: Development files must be in a -devel package
[x]: Package uses nothing in %doc for runtime.
[x]: Package consistently uses macros (instead of hard-coded directory
     names).
[x]: Package is named according to the Package Naming Guidelines.
[x]: Package does not generate any conflict.
[x]: Package obeys FHS, except libexecdir and /usr/target.
[-]: If the package is a rename of another package, proper Obsoletes and
     Provides are present.
[x]: Requires correct, justified where necessary.
[x]: Spec file is legible and written in American English.
[-]: Package contains systemd file(s) if in need.
[x]: Useful -debuginfo package or justification otherwise.
[x]: Package is not known to require an ExcludeArch tag.
[x]: Package complies to the Packaging Guidelines
[!]: Package successfully compiles and builds into binary rpms on at least
     one supported primary architecture.
[x]: Package installs properly.
[x]: Rpmlint is run on all rpms the build produces.
     Note: There are rpmlint messages (see attachment).
[x]: Package requires other packages for directories it uses.
[x]: Package does not own files or directories owned by other packages.
[x]: All build dependencies are listed in BuildRequires, except for any
     that are listed in the exceptions section of Packaging Guidelines.
[x]: Package uses either %{buildroot} or $RPM_BUILD_ROOT
[x]: Package does not run rm -rf %{buildroot} (or $RPM_BUILD_ROOT) at the
     beginning of %install.
[x]: Macros in Summary, %description expandable at SRPM build time.
[x]: Dist tag is present.
[x]: Package does not contain duplicates in %files.
[x]: Permissions on files are set properly.
[x]: Package use %makeinstall only when make install DESTDIR=... doesn't
     work.
[x]: Package is named using only allowed ASCII characters.
[x]: Package does not use a name that already exists.
[x]: Package is not relocatable.
[x]: Sources used to build the package match the upstream source, as
     provided in the spec URL.
[x]: Spec file name must match the spec package %{name}, in the format
     %{name}.spec.
[x]: File names are valid UTF-8.
[x]: Packages must not store files under /srv, /opt or /usr/local

===== SHOULD items =====

Generic:
[!]: Buildroot is not present
     Note: Buildroot: present but not needed
[!]: Package has no %clean section with rm -rf %{buildroot} (or
     $RPM_BUILD_ROOT)
     Note: %clean present but not required
[-]: If the source package does not include license text(s) as a separate
     file from upstream, the packager SHOULD query upstream to include it.
[x]: Final provides and requires are sane (see attachments).
[x]: Fully versioned dependency in subpackages if applicable.
     Note: No Requires: %{name}%{?_isa} = %{version}-%{release} in
     libmtp11-debuginfo
[ ]: Package functions as described.
[x]: Latest version is packaged.
[x]: Package does not include license text files separate from upstream.
[x]: Scriptlets must be sane, if used.
[-]: Description and summary sections in the package spec file contains
     translations for supported Non-English languages, if available.
[x]: Package should compile and build into binary rpms on all supported
     architectures.
[-]: %check is present and all tests pass.
[x]: Packages should try to preserve timestamps of original installed
     files.
[x]: Packager, Vendor, PreReq, Copyright tags should not be in spec file
[x]: Sources can be downloaded from URI in Source: tag
[x]: Reviewer should test that the package builds in mock.
[x]: No file requires outside of /etc, /bin, /sbin, /usr/bin, /usr/sbin.
[x]: Uses parallel make %{?_smp_mflags} macro.
[x]: The placement of pkgconfig(.pc) files are correct.
[x]: SourceX is a working URL.
[x]: Spec use %global instead of %define unless justified.

===== EXTRA items =====

Generic:
[!]: Large data in /usr/share should live in a noarch subpackage if package
     is arched.
     Note: Arch-ed rpms have a total of 2703360 bytes in /usr/share
[x]: Rpmlint is run on debuginfo package(s).
     Note: No rpmlint messages.
[x]: Rpmlint is run on all installed packages.
     Note: No rpmlint messages.


Rpmlint
-------
Checking: libmtp11-1.1.10-1.el6.i686.rpm
          libmtp11-examples-1.1.10-1.el6.i686.rpm
          libmtp11-devel-1.1.10-1.el6.i686.rpm
          libmtp11-debuginfo-1.1.10-1.el6.i686.rpm
          libmtp11-1.1.10-1.el6.src.rpm
libmtp11.i686: E: incorrect-fsf-address /usr/share/doc/libmtp11-1.1.10/COPYING
libmtp11-examples.i686: W: spelling-error Summary(en_US) libmtp -> Librium
libmtp11-examples.i686: W: no-documentation
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-tracks
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-emptyfolders
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-getfile
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-thumb
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-connect
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-sendtr
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-getplaylist
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-newfolder
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-newplaylist
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-reset
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-hotplug
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-folders
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-detect
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-albums
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-files
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-delfile
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-sendfile
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-format
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-trexist
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-filetree
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-albumart
libmtp11-examples.i686: W: no-manual-page-for-binary mtp11-playlists
libmtp11-devel.i686: W: spelling-error Summary(en_US) libmtp -> Librium
libmtp11-devel.i686: W: spelling-error %description -l en_US libmtp -> Librium
libmtp11-devel.i686: W: install-file-in-docs /usr/share/doc/libmtp11-1.1.10/INSTALL
5 packages and 0 specfiles checked; 1 errors, 27 warnings.




Rpmlint (debuginfo)
-------------------
Checking: libmtp11-debuginfo-1.1.10-1.el6.i686.rpm
1 packages and 0 specfiles checked; 0 errors, 0 warnings.


Rpmlint (installed packages)
----------------------------
rpmdb: /var/lib/rpm/Name: unexpected file type or format
error: cannot open Name index using db3 - Invalid argument (22)
rpmdb: /var/lib/rpm/Name: unexpected file type or format
rpmdb: /var/lib/rpm/Name: unexpected file type or format
rpmdb: /var/lib/rpm/Name: unexpected file type or format
rpmdb: /var/lib/rpm/Name: unexpected file type or format
rpmdb: /var/lib/rpm/Name: unexpected file type or format
(none): E: error while reading libmtp11: 'libmtp11'
rpmdb: /var/lib/rpm/Name: unexpected file type or format
rpmdb: /var/lib/rpm/Name: unexpected file type or format
(none): E: error while reading libmtp11-debuginfo: 'libmtp11-debuginfo'
rpmdb: /var/lib/rpm/Name: unexpected file type or format
rpmdb: /var/lib/rpm/Name: unexpected file type or format
(none): E: error while reading libmtp11-devel: 'libmtp11-devel'
rpmdb: /var/lib/rpm/Name: unexpected file type or format
rpmdb: /var/lib/rpm/Name: unexpected file type or format
(none): E: error while reading libmtp11-examples: 'libmtp11-examples'
0 packages and 0 specfiles checked; 0 errors, 0 warnings.



Requires
--------
libmtp11 (rpmlib, GLIBC filtered):
    /sbin/ldconfig
    libc.so.6
    libgcrypt.so.11
    libgcrypt.so.11(GCRYPT_1.2)
    libmtp.so.9
    libusb-1.0.so.0
    rtld(GNU_HASH)
    udev

libmtp11-debuginfo (rpmlib, GLIBC filtered):

libmtp11-devel (rpmlib, GLIBC filtered):
    /usr/bin/pkg-config
    libgcrypt-devel
    libmtp.so.9
    libmtp11(x86-32)
    libusb1-devel
    pkgconfig
    pkgconfig(libusb-1.0)

libmtp11-examples (rpmlib, GLIBC filtered):
    libc.so.6
    libgcrypt.so.11
    libmtp.so.9
    libmtp11(x86-32)
    libusb-1.0.so.0
    rtld(GNU_HASH)



Provides
--------
libmtp11:
    libmtp.so.9
    libmtp11
    libmtp11(x86-32)

libmtp11-debuginfo:
    libmtp11-debuginfo
    libmtp11-debuginfo(x86-32)

libmtp11-devel:
    libmtp11-devel
    libmtp11-devel(x86-32)
    pkgconfig(libmtp)

libmtp11-examples:
    libmtp11-examples
    libmtp11-examples(x86-32)



Source checksums
----------------
http://download.sourceforge.net/libmtp/libmtp-1.1.10.tar.gz :
  CHECKSUM(SHA256) this package     : 1eee8d4c052fe29e58a408fedc08a532e28626fa3e232157abd8fca063c90305
  CHECKSUM(SHA256) upstream package : 1eee8d4c052fe29e58a408fedc08a532e28626fa3e232157abd8fca063c90305


Generated by fedora-review 0.6.0 (3c5c9d7) last change: 2015-05-20
Command line :/usr/bin/fedora-review -m epel-6-i386 --define EPEL6 -rn libmtp11-1.1.10-1.src.rpm
Buildroot used: epel-6-i386
Active plugins: Generic, Shell-api, C/C++
Disabled plugins: Java, Python, fonts, SugarActivity, Ocaml, Perl, Haskell, R, PHP, Ruby
Disabled flags: EXARCH, DISTTAG, EPEL5, BATCH

(In reply to Antonio Trande from comment #1)
> >Spec URL: http://labs.linuxnetz.de/bugzilla/libmtp11.spec
> >SRPM URL: http://labs.linuxnetz.de/bugzilla/libmtp11-1.1.10-1.src.rpm
> 
> Why your src package does not contain a %{?dist} tag?

Because I did not define %dist when during "rpmbuild -bs" to create this
source RPM for review. This should not matter, because the spec file has
the proper %{?dist} tag inside.

> - COPYING is not tagged with %license
> 
> You can use %license and %doc to package all documentation files
> instead to make $RPM_BUILD_ROOT%{_pkgdocdir}.

As per http://fedoraproject.org/wiki/EPEL:Packaging#The_.25license_tag
%license is not supported on RHEL 5 and 6.

> - BuildRoot and cleaning commands are not required on EPEL6 and above.
> http://fedoraproject.org/wiki/EPEL:Packaging#BuildRoot_tag
> 
> - %defattr present but not needed

Yes, but both do not hurt. Given I am also thinking about RHEL 5, the
BuildRoot tag still seems good to me.

> - All examples binary files are not PIE, not full RELRO. 
>   libmtp.so.9.3.0 is not full RELRO.
> http://fedoraproject.org/wiki/Packaging:Guidelines#PIE
> https://fedoraproject.org/wiki/Changes/Harden_All_Packages

The change you refer to is only mandatory for Fedora >= 22, while this is
EPEL. If you would build this package on Fedora >= 22, full RELRO should be
given (like for libmtp itself). I don't see a reason to enforce a Fedora-
only related guideline on EPEL 5 and 6.

> - HTML documentation can be installed ina -doc sub-package.

I don't treat the documentation as large/important enough to put it into an
own package. Note, that I try to keep the package libmtp11 in sync with the
libmtp one (from Fedora) as much as possible. Additionally:

> [!]: Large data in /usr/share should live in a noarch subpackage if package
>      is arched.

This does not work for EPEL 5 and 6, they do not support noarch subpackages.
What we end up with would be one -doc per architecture, not really any gains.

Please let me know if you disagree with me and my answers - and if so, also
why exactly. Thank you :)

(In reply to Robert Scheck from comment #2)
> (In reply to Antonio Trande from comment #1)
> 
> > - COPYING is not tagged with %license
> > 
> > You can use %license and %doc to package all documentation files
> > instead to make $RPM_BUILD_ROOT%{_pkgdocdir}.
> 
> As per http://fedoraproject.org/wiki/EPEL:Packaging#The_.25license_tag
> %license is not supported on RHEL 5 and 6.

I meant, why create a $RPM_BUILD_ROOT%{_pkgdocdir} when you can use a "bogus" %license and %doc. Of course, it's at your discretion. 

> 
> > - BuildRoot and cleaning commands are not required on EPEL6 and above.
> > http://fedoraproject.org/wiki/EPEL:Packaging#BuildRoot_tag
> > 
> > - %defattr present but not needed
> 
> Yes, but both do not hurt. Given I am also thinking about RHEL 5, the
> BuildRoot tag still seems good to me.

Well, leaving a comment or a note do not hurt. ;)

> 
> > - All examples binary files are not PIE, not full RELRO. 
> >   libmtp.so.9.3.0 is not full RELRO.
> > http://fedoraproject.org/wiki/Packaging:Guidelines#PIE
> > https://fedoraproject.org/wiki/Changes/Harden_All_Packages
> 
> The change you refer to is only mandatory for Fedora >= 22, while this is
> EPEL. If you would build this package on Fedora >= 22, full RELRO should be
> given (like for libmtp itself). I don't see a reason to enforce a Fedora-
> only related guideline on EPEL 5 and 6.

Here I do not totally agree, from http://fedoraproject.org/wiki/EPEL/GuidelinesAndPolicies:

> The packages in EPEL follow the Fedora Packaging and Maintenance Guidelines  
> that includes, but is not limited to the packaging guidelines, the package 
> naming guidelines and the package review guidelines that are designed and 
> maintained by the FESCo and Packaging Committee. EPEL-specific exceptions are > documented here and in the EPEL:Packaging page.

Full RELRO and PIE (http://fedoraproject.org/wiki/Packaging:Guidelines#PIE) issue are part of packaging guidelines, I don't understand why EPEL packagers should choice what they follow or not.
Also, we are talking of security issues important for EPEL too, or not?

(In reply to Antonio Trande from comment #3)
> Full RELRO and PIE (http://fedoraproject.org/wiki/Packaging:Guidelines#PIE)
> issue are part of packaging guidelines, I don't understand why EPEL
> packagers should choice what they follow or not.
> Also, we are talking of security issues important for EPEL too, or not?

RHEL 6 doesn't support the %_hardened_build macro. Additionally, even the
base operating system dependencies of libmtp do not have full relro - why
would it make sense for a single relatively unimportant library on top? I
also looked to other EPEL packages...this is usually not manually done. So
why is this here expected? I get "security", but the impact is relatively
low from my point of view (libmtp is not used by a network daemon AFAIK).

Check for full relro for libmtp dependencies:
readelf -l /usr/lib*/libusb-0.1.so.4 | grep -c GNU_RELRO
readelf -d /usr/lib*/libusb-0.1.so.4 | grep -c BIND_NOW
readelf -l /lib*/libgcrypt.so.11 | grep -c GNU_RELRO
readelf -d /lib*/libgcrypt.so.11 | grep -c BIND_NOW

If you still insist on full relro for EPEL 6 for libmtp11, let me know and I
will add: export LDFLAGS="-Wl,-z,now -Wl,-z,relro %{?__global_ldflags}"

(In reply to Robert Scheck from comment #4)
> (In reply to Antonio Trande from comment #3)
> > Full RELRO and PIE (http://fedoraproject.org/wiki/Packaging:Guidelines#PIE)
> > issue are part of packaging guidelines, I don't understand why EPEL
> > packagers should choice what they follow or not.
> > Also, we are talking of security issues important for EPEL too, or not?
> 
> RHEL 6 doesn't support the %_hardened_build macro. Additionally, even the
> base operating system dependencies of libmtp do not have full relro - why
> would it make sense for a single relatively unimportant library on top? I
> also looked to other EPEL packages...this is usually not manually done. So
> why is this here expected? I get "security", but the impact is relatively
> low from my point of view (libmtp is not used by a network daemon AFAIK).
> 
> Check for full relro for libmtp dependencies:
> readelf -l /usr/lib*/libusb-0.1.so.4 | grep -c GNU_RELRO
> readelf -d /usr/lib*/libusb-0.1.so.4 | grep -c BIND_NOW
> readelf -l /lib*/libgcrypt.so.11 | grep -c GNU_RELRO
> readelf -d /lib*/libgcrypt.so.11 | grep -c BIND_NOW
> 
> If you still insist on full relro for EPEL 6 for libmtp11, let me know and I
> will add: export LDFLAGS="-Wl,-z,now -Wl,-z,relro %{?__global_ldflags}"

You're right and I don't know if it's (or will be) a topic of discussion sooner or later.
I have prefered to set manually hardening flags on all my packages in EPEL in advance; of course I can't force you to do that.
Anyway I drew attention in the package reviews I done.

Package approved.

Antonio, thank you very much for the review!

Package request has been approved: https://admin.fedoraproject.org/pkgdb/package/libmtp11

libmtp11-1.1.10-1.el6 has been submitted as an update to Fedora EPEL 6. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-9e9fcfc8ae

libmtp11-1.1.10-1.el6 has been pushed to the Fedora EPEL 6 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-9e9fcfc8ae

libmtp11-1.1.10-1.el5 has been submitted as an update to Fedora EPEL 5. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-3792c06bf1

libmtp11-1.1.10-1.el5 has been pushed to the Fedora EPEL 5 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-3792c06bf1

libmtp11-1.1.10-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.