Re: Security concerns with minified javascript code

[Ben Finney <ben+debian@benfinney.id.au>]

Steve Langasek <vorlon@debian.org> writes:

> […] Nevertheless, for packages that *are* in Debian, we should expect
> that the source package contains the *full* corresponding source code
> for any minified javascript files. If we can't rebuild it then we
> don't actually have the source, and that's a practical as well as
> philosophical problem for Debian and for our users.
>
> Yes, packaging a new and fast-moving ecosystem according to Debian's
> standards is a lot of work. Let's figure out the best way to do that
> work, instead of pretending that Debian's standards don't matter.

Thank you Steve, that's a succinct and clear statement of the position
I've been struggling to express so plainly.

My (small, to date) efforts to package works containing JavaScript make
it clear that this is a problem which continues to increase in scale.
It's one that we need the wider community beyond the Debian project to
engage with; but it does at least require the Debian project to be clear
about what is and isn't acceptable.

-- 
 \         “Nature hath given men one tongue but two ears, that we may |
  `\          hear from others twice as much as we speak.” —Epictetus, |
_o__)                                                      _Fragments_ |
Ben Finney