[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Debian package without released upstream source



Jörg Sommer wrote:
> Hallo Goswin,
> 
> Goswin von Brederlow <brederlo@informatik.uni-tuebingen.de> wrote:
> > Just make sure to use a version that sorts lower than a future actual
> > 2.2 release. Optimaly 2.2~beta2 would be used but I think the DAK
> > still doesn't accept those. 2.1.99+2.2-beta might be a good choice.
> 
> Good objection. I've changed this.
> 
> In a PM, someone raised the objection that the source tar.gz might be a
> temporary file. I assume this, too. But I expect when upstream removes
> this file, it places a new one at sourceforge. Does anyone share this
> objection? Should I not use this tar ball?
> 
> BTW: What can I do, if I can't run pbuilder?

Why can't you run pbuilder?  Not enough disk space?

> Exist an open pbuilder network?
<snip>

pbuilder isn't secure against malicious code so it would be foolish
for anyone to allow random uploads.  Sponsors will probably build your
package in pbuilder or sbuild after inspecting, but would prefer you
to test beforehand.

Ben.

-- 
Ben Hutchings -- ben@decadentplace.org.uk shortened to ben@decadent.org.uk
If you've signed my GPG key, please send a signature on and to the new uid.
It is impossible to make anything foolproof because fools are so ingenious.

Attachment: signature.asc
Description: Digital signature


Reply to: