Hi Markus, On 20-04-2023 15:21, Markus Koschany wrote:
In version 3.5.x upstream included all Javascript files in the original source tarball but also shipped some minified files without the unminified sources.
[...]This was a missing piece. At least it explains how you got where you are now.
Since I already followed the Debian Policy and included the missing sources in debian/missing-sources, I felt that shipping the 3rdparty directory in debian/missing-sources/3rdparty would be a good intermediate solution.
But you added a more files than you have in testing (including jquery.js).
If you insist I can repack the tarball, add the 3rdparty directory and remove it from debian/missing-sources but in the end it would not make any difference.
Huh? I wasn't asking you to do that. I was asking you to use packaged binaries as a dependency.
Openrefine is a desktop application which only runs on your own computer.
You know, now I know. Does the security team also know? Should they really?
If you insist I can depend on libjs-jquery and replace the local copy with a symlink but I feel this would be an example of over-engineering without any real value to our users in this specific case.
That argument holds for a lot of things we do. What I try to say is that there's a price we pay in our community too by not doing it. In this case: tracking embedded versions. Because of the popularity of things like jquery they are embedded a lot and we're trying to track them *and* remove them. Just to clear, I wasn't *only* talking about jquery.js, but also about the others that are covered by binaries in our archive. Even if upstream added stuff back, I would still recommend you to link (and depend on) the files shipped in e.g. libjs-jquery. I know what I talking about, my upstream cacti ships a lot of embedded libraries too; I do my best to remove things that we already ship in Debian. My upstream complained once in a while that my versions are wrong; I still believe it's the right thing to do in a distribution like Debian. I think they are starting to see the value of our side too.
Lintian is telling you that too: https://udd.debian.org/lintian/?packages=openrefine Paul
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature