On 10/7/21 11:35 AM, Russ Allbery wrote:
Richard Laager <rlaager@debian.org> writes:I haven't looked into the specifics of this situation, but in general, tests should be run against the same versions of dependencies that the actual code will use, for what should be obvious reasons. If Debian has the dependencies with different API versions, then it's all the more important that the tests run against the Debian versions of the dependencies.I believe the dependencies in question are test dependencies. In other words, they're dependencies required to drive the test suite machinery, not dependencies of the code under test.
Thanks for the clarification of the specifics!In that case, I personally don't see a big problem with them being vendored as opposed to using system copies.
But AFAIK, they do still need to be DFSG-free to be in main if they are in the source tarball. And I personally would not consider minified JS (if that is indeed at issue here) to be "source code".
-- Richard
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature