How to install rpmlint on Fedora?

On Fedora, use 'dnf install rpmlint' as it's part of the distribution. The README notes this simplifies installation, but ensure all dependencies like Python and rpm bindings are present for full functionality.

rpmlint vs lintian: which is better for RPM packages?

rpmlint is specifically designed for RPM packages, while lintian is for DEB packages. rpmlint is inspired by lintian but tailored to the RPM ecosystem, so use rpmlint for RPM-based distributions to ensure policy compliance.

How to ignore a specific warning in rpmlint?

Add filters in a configuration file using 'addFilter' in rpmlintrc or TOML. For example, create a .rpmlintrc file with regex patterns to suppress warnings, as detailed in the configuration flexibility section.

Can rpmlint automatically fix errors in my specfile?

No, rpmlint is a static analysis tool that only reports errors and warnings. It doesn't provide automated fixes; you must manually correct issues based on its feedback, which is a limitation for quick fixes.

How to write a custom check for rpmlint?

Create a Python module in the 'rpmlint/checks' folder, following the modular structure. The README provides an example workflow with pytest tests, and contributions are encouraged via GitHub.

Why does rpmlint require so many dependencies for testing?

The test suite needs additional tools like devscripts and dash to validate checks comprehensively, as listed in the optional dependencies. This adds overhead but ensures robustness through pytest-based testing.

Open-Awesome

rpmlint

GPL-2.0Python2.9.0

A linting tool for checking common errors and policy violations in RPM packages.

GitHub

162 stars134 forks0 contributors

What is rpmlint?

rpmlint is a linting tool that checks RPM packages for common errors, policy violations, and potential issues. It helps package maintainers and developers ensure their RPMs are correctly built and compliant with distribution standards before distribution or upload.

Target Audience

RPM package maintainers, Linux distribution developers, and system administrators who build or audit RPM packages for quality and compliance.

Value Proposition

Developers choose rpmlint for its comprehensive, extensible checks and deep integration with the RPM ecosystem, providing automated quality assurance that prevents common packaging errors and ensures consistency across distributions.

Overview

Tool for checking common errors in rpm packages

Use Cases

Best For

Validating RPM packages before uploading to repositories
Checking specfiles for syntax and policy compliance
Automating quality checks in CI/CD pipelines for package builds
Auditing entire Linux distributions for packaging consistency
Learning RPM packaging best practices through error detection
Extending with custom checks for organization-specific packaging rules

Not Ideal For

Teams packaging for non-RPM-based distributions like Debian or Arch Linux
Projects needing automated error correction; rpmlint only reports issues, doesn't fix them
Developers looking for a GUI-based linting tool; rpmlint is command-line only and requires manual configuration
Casual users wanting quick, one-off checks without installing multiple dependencies and setting up configurations

Pros & Cons

Pros

Comprehensive Package Validation

Checks binary RPMs, source RPMs, and specfiles for a wide range of errors, with the README recommending source RPMs for best coverage, ensuring thorough static analysis.

Extensible Check System

All checks are modular and reside in a dedicated folder, allowing community contributions and custom checks, as highlighted in the extensible architecture.

Flexible Configuration Options

Supports TOML configuration files and legacy rpmlintrc files, enabling customization of checks and filters, with detailed merging rules explained in the configuration section.

Deep Distribution Integration

Part of most Linux distributions and integrates with build systems like OBS, facilitating automated testing in CI/CD pipelines, as noted in the distribution integration feature.

Cons

Complex Installation Setup

Requires multiple mandatory and optional dependencies, including Python bindings and utilities like binutils, making installation non-trivial for new users, as listed in the Install section.

Configuration Overhead

TOML configuration values are merged rather than overridden, and legacy rpmlintrc files add layers of complexity, which can lead to confusion and misconfigurations.

RPM-Exclusive Focus

Only validates RPM packages, with no support for other formats like DEB or Snap, limiting its utility in mixed packaging environments or for cross-distribution projects.

Frequently Asked Questions

Related Projects

Gitleaks

Find secrets with Gitleaks 🔑

Stars28,284

Forks2,158

Last commit2 days ago

Grype

A vulnerability scanner for container images and filesystems

Stars12,629

Forks836

Last commit1 day ago

Haskell Dockerfile Linter

Dockerfile linter, validate inline bash, written in Haskell

Stars12,319

Forks498

Last commit3 days ago

clair

Vulnerability Static Analysis for Containers

Stars11,030

Forks1,216