On 12-08-19 at 08:10pm, Simon Josefsson wrote: > Vincent Bernat <bernat@debian.org> writes: > > > ❦ 19 août 2012 15:11 CEST, "Bernhard R. Link" <brlink@debian.org> : > > > >>> The difference is that we need to bug upstream about a file that we > >>> won't even use. There is no real bug (not even a licensing issue). > >> > >> They are distributing files without source, so everyone else can either > >> not just easily modify it or verify if it really does what it is > >> supposed to do. This is definitely a shortcoming in what upstream ships > >> and really something you should bug upstream about. > > > > The source is one link away. People wanting the source just have to > > click on the link in the header of the minified version. As for > > verification, having the source next to the minified version does not > > guarantee anything about the minified version, all the more that we > > don't have currently in Debian Wheezy a reliable minifier. > > That seems problematic -- so even if the source is shipped, there is no > way to re-build the minified file? In Wheezy we have the minifier yui-compressor which probably(!) doesn't produce broken code but is not the most efficient at its job. I say probably, because regression testing is uncommon, and the environment for which is must work is often alien (e.g. compile on Debian but run the code in Internet Explorer in Windows), so broken JavaScript may go unnoticed for some time. Because yui-compressor is not the most efficient at minifying, it receives less testing, which also leads to potential bugs going unnoticed for longer time. For status of uglifyjs - the minifier used upstream for e.g. jQuery, see http://bugs.debian.org/684044 Regards, - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private
Attachment:
signature.asc
Description: Digital signature