Re: Non-source Javascript files in upstream source
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
El 26/04/14, 06:20pm, Peter Samuelson escribió:
>
> [Manuel A. Fernandez Montecelo]
> > If you agree that "source-is-missing" also applies in those cases, do
> > you also think that we should immediately declare all source packages
> > in Debian containing a 'configure' script as somehow non free (unless
> > we can check unambigously that they were generated by the .ac)
>
> There's 2 reasons to care if configure was built from the configure.ac
> in the tarball. The immediately practical reason is to ensure that if
> we or our users need to patch it, we can patch the actual source, and
> still be able to build correctly. (These things do tend to bitrot if
> you don't watch them.) Basically that means always rebuilding from
> source - which is already a best practice in Debian. Not every package
> does it, but IMO every package _should_.
>
> The other reason to care is of course to comply with our free software
> guidelines. For that purpose, I think it's entirely reasonable to
> assume good faith in upstream. If we find out that some upstream
> intentionally tricks us by shipping a mismatching configure, just so
> they can point and laugh at the DFSG violation, the solution is very
> simple: remove the package from Debian, because such upstreams clearly
> can't be trusted not to trick us in more malicious ways.
>
I think is unfair to compare `configure` files with minified JavaScript,
starting by the fact that you can't read the minified JavaScript and
distinguish if is doing something wrong compared with the source of the
same un-minified JavaScript.
I think is fine to ship these minified JS files as long as you have a
reproducible way to show that is the same as the source.
Maybe a dh script should be born for this and my head says the prototype
may look like `dh_js_minify_reproduc --source source.js --output min.js
- --rules-should-apply='--with-license --with-copyright' and throw an
error if it's a mismatch.
Kind regards.
>
> --
> To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> Archive: [🔎] 20140426232014.GD4541@p12n.org">https://lists.debian.org/[🔎] 20140426232014.GD4541@p12n.org
>
- --
Jose Luis Rivas -- GPG: 0xB9AC8C43
http://www.joseluisrivas.net/
- --
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: [🔎] 20140426233149.GC12300@arya.ghostbar.co">https://lists.debian.org/[🔎] 20140426233149.GC12300@arya.ghostbar.co
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlNcVbEACgkQOKCtW8rKsRjmGQCfVPeh/hut08w4cnyIzmsNYi9W
LcoAoIc6H549oQNmsXcMvYXZNAlIauXZ
=Y5kV
-----END PGP SIGNATURE-----
Reply to: