Re: jQuery dependency for Trac 0.11 should be < 1.3
On Sat, Dec 26, 2009 at 7:23 PM, anatoly techtonik <techtonik@gmail.com> wrote:
> Upstream Trac is shipped with jQuery it needs while leaving Genshi and
> other libraries as dependencies. Debian specific patch removes jQuery
> from Trac distribution even though it contributes only 2% to package
> size. This dependency injection creates aforementioned problems.
The dependency exists whether or not trac has "Depends: libjs-jquery".
Removing the "Depends: libjs-jquery" sounds like the equivalent of
shipping a copy of GTK+ with gnome-terminal. Or a copy of ncurses with
top. Or a copy of glibc with ls or cp. None of those things are
nessecary, so why should shipping a copy of jQuery with one of the
packages that use it be any different?
In any case I don't think the security team would appreciate reopening
one of the issues from their embedded-code-copies list:
http://svn.debian.org/wsvn/secure-testing/data/embedded-code-copies
It is already huge and scary enough as it is. I have a feeling it is
probably quite incomplete too.
> There was a complex issue with TracDeveloperPlugin, which solution
> involved permissions, aliases and mod_wsgi configuration. The jQuery
> was only a part of a problem and it was not only downgrading that
> fixed it.
>
> There are more than 200 plugins tagged for 0.11 on
> http://trac-hacks.org/ They were developed and debugged with jQuery
> 1.2.x which is not forward compatible with 1.3.x I don't feel like I
> want to check if they are compatible next time I'd like to use one.
> 15kBytes doesn't worth wasted hours.
It sounds like you're installing the trac plugins manually rather from
Debian packages. I'd suggest manually installing jquery 1.2 for the
manually installed plugins that need it and putting the javascript
file at a different URL to the Debian jQuery 1.3 version. If there are
any trac plugins in Debian sid/squeeze that need jQuery 1.2, I'd
suggest filing RC bugs.
--
bye,
pabs
http://wiki.debian.org/PaulWise
Reply to: