[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: RFS/package review





Am 09.06.21 um 10:29 schrieb Nilesh Patra:
On 09/06/21 06:28 AM, Peymaneh Nejad wrote:
I have pushed another package to salsa I believe would be ready for review
and upload:
https://salsa.debian.org/go-team/packages/golang-github-caddyserver-certmagic

Regarding the copyright file I am not certain. There is two files in the
source code (dnsutil.go and dnsutil_test.go) that contain the following
text:

// Code in this file adapted from go-acme/lego, July 2020:
// https://github.com/go-acme/lego
// by Ludovic Fernandez and Dominik Menke

The adapted code is licensed MIT. As of my understanding, because the code
was modified since, the original authors do not need to be included in
debian/copyright

That is the case if it is a complete re-write or the code is a fork for
instance, and is re-licensable.
In this case, I see some functions being verbatim copies of source code,
for example see this[1] and see here in go-acme/lego[2]
Similar for test file, see this[3] and this[4]

In such a state, I think it has to be mentioned in d/copyright with a "Comment:"
field stating that some code is verbatim copy

What I am uncertain of is what license applies for the files. MIT says:
"The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software."
           ^^^^^^^^^^^^^^^^^^^^
Sounds to me as if MIT still applies for those two files, even though the
rest of the source code is licensed Apache 2.

No, both the licenses apply to this file, I think. Some code is entirely
different, and some of it is copies. It makes sense to include all
licenses.
You need to specify
"License:" as "MIT and Apache-2"
As an example, see here[5]

I see, that makes sense.


It has some unsatisfied dependencies:

If you are using sbuild, you can build locally with a --extra-package
option

It depends on a newer version of golang-github-klauspost-cpuid-dev than is
in the repos. I did a fork of the package
(https://salsa.debian.org/peymaneh/golang-github-klauspost-cpuid) for
testing until the issue is resolved
(https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989624)
Changelogs have set distribution=experimental.

Consider doing similar changes for this one (with d/experimental branch along with a mail to
maintainer) as I suggested to do it for
golang-github-masterminds-semver-dev in my other mail

Okay.

It also depends on github.com/mholt/acmez, which has been packaged but is in
new queue[3] still:
https://ftp-master.debian.org/new/golang-github-mholt-acmez_0.1.3-1.html

Again, you can build this locally and pass --extra-package option with
sbuild to get your target building. The source of this package is on
salsa itself[6]

Ah, I wasn't clear in my mail. I already built the packages locally with sbuild --extra-package (works just fine). But thought it might be of interest because I understand it would not yet be possible to build the package on a build server?

Thanks a lot for your detailed mail!


Reply to: