On 10/04/14 14:51, Gunnar Wolf wrote: > Daniel Pocock dijo [Thu, Apr 10, 2014 at 12:40:27PM +0200]: >> Hi Gunnar, >> >> I just saw your comment on this bug from February 18 >> >> Personally, I don't think it is enough to say that a package is not >> using some artifacts from the source tarball - while it is a technically >> valid argument, it would make it far more difficult for FTP masters to >> inspect source packages and badness could start to creep in as a >> consequence of any generosity they show in this area. >> >> Repackaging upstream tarballs is becoming a common problem with minified >> JavaScript, maybe we need to have some automated way of doing this. For >> upstreams who use git and who release the exact contents of their tags >> (without any autotools bootstrapping, etc), it should be fairly easy to >> create some system on alioth that mirrors all the upstreams and >> pro-actively generates +dfsg versions of their tags ready for >> maintainers to work with. > Right. This bug was opened before the relevant discussion in d-devel, > and I am also convinced the minified js should be removed from the > source tarball. I have not had time to look into this, and any help > you can give will be appreciated; a simple (or as simple as possible, > at least) repack.sh script should do. Automating this sounds > interesting, but I cannot do more than just say it sounds interesting > right now :(
This automated repacking idea has significant overlap with one of the GSoC projects: https://wiki.debian.org/SummerOfCode2014/StudentApplications#Recursively_building_Java_dependencies_from_source Whether the embedded artifacts are called *.jar or *.min.js, the same script could probably help -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
