On Thu, Feb 14, 2008 at 04:02:41PM -0800, Russ Allbery wrote: > Bas Wijnen <wijnen@debian.org> writes: > > A workaround could be to not regenerate the files. This is how it is > > usually done now. IMO that is incorrect, because the compiler for every > > generated file must be in Debian. The current practise of not rerunning > > autotools makes this rule technically unnecessary, but it can still be > > violated (and that should still be considered a bug, even if it doesn't > > result in a build failure). > > Note that libtool is an unusual case here and isn't the same as Autoconf > or Automake. The files included in the package (libtool.m4 and ltmain.sh) > are not generated files in the same sense. Running libtoolize basically > just copies those files from the installed libtool into the package. Oh, ok. That changes things a bit. In that case, not copying them, but using the included copy instead is similar to using an included version of a library instead of the package containing it. This is bad for security, but not a problem with respect to policy. > I think (but am not at all certain) that ltmain.sh is a generated file in > that I don't think it's maintained in that form by the libtool > maintainers, but if so, whatever generation is done is already done as > part of the installation of libtool. In that case, my proposal would require it to be copied from there, and not used from upstream. That is wise anyway, but if it would just be a copy of the source, it would strictly not be required. Thanks, Bas -- I encourage people to send encrypted e-mail (see http://www.gnupg.org). If you have problems reading my e-mail, use a better reader. Please send the central message of e-mails as plain text in the message body, not as HTML and definitely not as MS Word. Please do not use the MS Word format for attachments either. For more information, see http://pcbcn10.phys.rug.nl/e-mail.html
Attachment:
signature.asc
Description: Digital signature