Review Council Findings (Imperative)

Five issues that need to be fixed before merge — build failures, factual errors, or Fedora packaging guideline violations.

1. complytime-providers.spec line 39: HealthCheck RPC does not exist

The provider interface defines Describe, Generate, and Scan. There is no HealthCheck RPC. The Describe RPC returns a DescribeResponse that includes a Healthy field, but the RPC itself is Describe.

-Communicates via gRPC (Generate, Scan, HealthCheck RPCs)
+Communicates via gRPC (Describe, Generate, Scan RPCs)

2. complytime-providers.spec lines 66-67: Add -mod=vendor to %build

%check (line 77) uses -mod=vendor but %build does not. In network-isolated Koji/mock builds, if vendor auto-detection fails the build breaks — or worse, build and test phases resolve different dependency versions silently.

-go build -buildmode=pie -o ${GO_BUILD_BINDIR}/complyctl-provider-openscap ./cmd/openscap-provider
-go build -buildmode=pie -o ${GO_BUILD_BINDIR}/complyctl-provider-ampel ./cmd/ampel-provider
+go build -mod=vendor -buildmode=pie -o ${GO_BUILD_BINDIR}/complyctl-provider-openscap ./cmd/openscap-provider
+go build -mod=vendor -buildmode=pie -o ${GO_BUILD_BINDIR}/complyctl-provider-ampel ./cmd/ampel-provider

3. complytime-providers.spec: Missing ExclusiveArch: %{go_arches}

Without this, Koji will attempt builds on all Fedora architectures (s390x, ppc64le, etc.) once propose_downstream lands the spec in dist-git. This is required by Fedora Go packaging guidelines.

Add after the BuildRequires lines:

ExclusiveArch:  %{go_arches}

4. complytime-providers.spec line 16: Missing minimum Go version

go.mod declares go 1.25.0 but BuildRequires: golang has no version floor. On targets shipping older Go (e.g., CentOS Stream 9), the build will fail with cryptic compilation errors instead of a clear dependency resolution failure.

-BuildRequires:  golang
+BuildRequires:  golang >= 1.25.0

5. complytime-providers.spec lines 83, 88: vendor/modules.txt under %license

vendor/modules.txt is a Go module manifest, not a license file. The %license macro is reserved for files containing license text per Fedora packaging guidelines. This will be flagged by license auditing tools.

-%license LICENSE vendor/modules.txt
-%doc README.md
+%license LICENSE
+%doc README.md vendor/modules.txt

(Apply to both the openscap and ampel %files sections.)

This review supersedes the previous "Review Council Findings (Imperative)" review above.

Code Review

Issues

Bug: Missing runtime dependency openscap-scanner

The openscap sub-package requires scap-security-guide but not openscap-scanner. The provider binary invokes oscap via exec.Command at runtime — without openscap-scanner installed, every scan will fail with "command not found".

Worth discussing: Missing runtime dependencies for Ampel provider

The ampel sub-package has no Requires for snappy and ampel, both called via exec.Command at runtime. If these aren't packaged in Fedora, the dependency can't be expressed as an RPM requirement, but it should be documented in the sub-package %description.

Minor: vendor/modules.txt listed as %license

This file is a Go module manifest, not a license. Per Fedora Go packaging guidelines, it should be consumed by %golist to generate Provides: bundled(golang(...)) entries. Without that, the RPMs will lack bundled() provides metadata — a Fedora packaging review blocker.

Minor: Build flags not fully applied

%set_build_flags sets CFLAGS/LDFLAGS, but the go build commands don't forward $LDFLAGS via -ldflags. Security hardening is partially ineffective. Using %gobuild or passing -ldflags "${LDFLAGS}" would address this.

Trivial: .fmf/version missing trailing newline

Observations

• Tests in %check may require external tools not available in mock/koji build environments. Verify tests have proper skip conditions.
• CentOS Stream 9 ships Go 1.21 by default, but go.mod specifies go 1.25.0 — likely build failures on that target.
• The test plan only checks binary existence. A smoke test (e.g., --help) would catch dynamic linking issues earlier.