davide125 / rpminspect Goto Github PK

==========
rpminspect
==========

RPM build deviation analysis tools.  rpminspect inspects the output of an
RPM build (e.g., the output of a Koji build) and looks at the contents of
the build artifacts to report:

    * Policy compliance
    * Changes from a previous build to the current build
    * General correctness and best practices

rpminspect is the frontend tool and librpminspect provides the inspection
engine and individual inspections.  The program is configured through the
rpminspect.conf file and runtime data is provided by a vendor specific
rpminspect-data package.  The rpminspect-data-generic package in this source
tree provides a template for constructing the vendor specific data package.


Intended Audience
-----------------

Developers, QE, release engineers, and system administrators who regularly
build RPMs for use in some environment or product.

From an individual user standpoint, rpminspect is intended to be a command
line tool you can use as a linter of sorts.  rpminspect reports and that's
it.  rpminspect can output information in JSON format which is intended to
make it easier to integrate in to automated workflows or web frontends.


Requirements
------------

A typical Linux system with a toolchain for building C software and the
following libraries (make sure the header files are available):

    * json-c
          http://json-c.github.io/json-c/

    * xmlrpc-c
          http://xmlrpc-c.sourceforge.net/

    * libxml-2.0
          http://xmlsoft.org/

    * rpm
          https://github.com/rpm-software-management/rpm

    * libarchive
          https://www.libarchive.org/

    * elfutils
          https://sourceware.org/elfutils/

    * kmod
          https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git

    * zlib
          https://www.zlib.net/

    * mandoc (formerly mdocml)
          https://mandoc.bsd.lv/

    * iniparser
          http://ndevilla.free.fr/iniparser/

Most distributions include the above projects in prebuilt and packaged
form.  If those are available, you should use those packages.


Building
--------

If you got the source from a released tarball, you can probably do this:

    ./configure
    make
    make install

If you have the source cloned from git, you should do this:

    ./autogen.sh
    # then the steps above

Building from git will require autoconf, automake, libtool, and the rest
of the autotools packages.


Contributing
------------

Patches are welcome as are bug reports.  There's a lot to do in this
project.  Some things to keep in mind:

    * Please follow existing coding style in files you modify.  Things like
      variable and function naming, spacing, and indentation.  I want to
      avoid wildly varying code styles throughout the tree.

    * New inspections in librpminspect need to be in the form of an
      inspect_NAME.c file with a driver added to the main struct.  You may
      add static and non-static support functions to your inspect_NAME.c file
      and expose those as part of the librpminspect API.  If the function is
      generic enough, feel free to start a new source file.

    * Test cases or updates to existing test cases need to accompany patches
      and new code submissions.

    * Use the standard C library whenever possible.  Code using glib,
      libbsd, or any other type of generic utility library is going to be
      reviewed and likely rejected until it is modified to use the standard C
      library.

    * That said, inspections are expected to make use of available libraries
      for performing their work.  When given the option between a library
      and forking an execing a program, please use the library.  This is not
      always possible, but in many cases it is.

    * See the TODO file for a current list of things that need work.


Licensing and Copyright
-----------------------

The project is licensed under the GNU General Public License version 3 or,
at your option, any later version.  A number of contributions have been
under the Apache License 2.0 and GPLv3+ allows for that.

Copyright statements are in the boilerplates of each source file.