Hi Daniel, Daniel Ring dijo [Sun, May 07, 2017 at 11:01:33AM +0000]: > Hi Gunnar, > > I've finished putting together a preliminary version of the package, but I > have a few concerns about it. > > The largest one is that the build system is NodeJS-based, and requires a > version of npm newer than the one currently in Debian. Bugs #857986 and > #794890 > have some details about npm's issues. Installing nodejs from its official > repository works, as does building on Ubuntu.
Ugh. The whole NodeJS ecosystem makes me shiver :-( Anyway, installing a newer version than what's available in Debian is *not* acceptable for a package to go in Debian. Either it has to be patched to build with older versions, or you have to wait to the newer version to arrive to Debian. > Secondly, the build system has the usual issue with NodeJS packaging; it > downloads dependencies at runtime. Most of the packages don't exist in Debian > or are out of date, and I found several existing packages doing this while > looking for a better solution, so I'm not sure how much of an issue this is. > This only occurs at build-time, and nodejs isn't required to use the software. That is also something that cannot be done; packaging software cannot depend on network connectivity (not even initiate network connections). The dependencies must be somehow build-depended upon; in the (ugliest, worst) case you could patch your sources to include the packages to fulfill this... But I doubt the ftp-masters will approve of it. > Finally, the upstream source contains several embedded libraries. I was able > to > swap a few of them for existing packages in Debian, but there are a few PHP > libraries that don't have existing packages. It is frowned upon, but tolerated; you have to just make sure to keep track of them and properly attribute all of the copyrights in debian/copyright. > The JavaScript libraries are amalgamated into a single file at > build-time, and separating them out would be a non-trivial amount of > work for decreased performance. We have to ship sources for every piece of software. You don't need to separate them as long as you provide all the sources and can *prove* they can be amalgamated to the identical "binary" you are shipping. That's not a trivial thing, sadly :( > Again, I found several existing packages doing this, so I'm not sure > how much of a problem it is. Upstream provided sources for most, I > added the few missing to satisfy lintian. > > I've uploaded the package to mentors: > https://mentors.debian.net/package/rainloop > Please review it when you have a chance, and let me know if there's anything I > need to fix! I'm just talking WRT your text, and have not looked at the packaging itself; I think I can do it on ~thursday... If you find some other sponsor, of course, feel free to follow up with them. I want to at least try and get the work done with you. If you find examples in Debian that have been accpeted in opposition to what I have pointed out here, point me to them.
