Bug#824520: Just don't
Hello,
I was maintaining subsurface in Debian for a while.
In subsurface, they keep forking libraries. In Debian, it's not
allowed to have source packages containing forked libraries. This is
due to the fact that the security team doesn't want to have to find
multiple copies of the same bug in libraries which might have slight
differencies, and apply fixes in all of the copies. In my opinion it's
a very sensible approach.
I don't know what the policies in other distributions are, about
duplicated source code.
Unfortunately in subsurface, they don't care about any of this, and
keep forking libraries.
While libdivecomputer isn't problematic, because it is the only
project using it, libmarble and libgit2 pose a problem, and they are
internet facing, so could have security vulnerabilities.
Upstream is not willing to help in using the original libraries rather
than the forks, so a huge amount of patches is necessary to keep this
package in Debian.
The alternative is to delete all parts of code that use those
libraries, and lose many functionalities.
I am not closing this bug, but if anyone is reading this, my advice is
to move on and don't try to package it.
Best
Reply to: