Bug#710989: RFS: plover/2.2.0-4 ITP
* Paul Wise <pabs@debian.org>, 2013-06-04, 09:48:
I am looking for a sponsor for my package "plover".
As promised, here is a review...
Hey, I wrote a review, too! (But I don't intend to sponsor this
package.)
There is a security issue (DoS attack); on multi-user systems, any user
can prevent other users from running the program. I'm not sure but
there may also be a symlink attack.
I had a look how the lockfile module is implemented: indeed symlinks
attacks are possible.
The license info is in debian/copyright.
Strangely, the copyright file, unlike the package description, doesn't
currently say anything about GPL version.
I would suggest that 'python' is not the correct section. Either 'misc'
or 'utils' would be appropriate.
Maybe "x11"?
Bug #654659 has not much to do with the desktop-is-not-a-script patch,
so don't mention it in the patch header.
Why is Debian revision "4"? It should be normally "1" for initial
releases...
README lists a number of Python modules required to run plover, but they
are not in Depends.
"This manual page needs a lot of work." - yeah, it does! I think it
would be useful if you incorporated parts of README into the manpage.
Are Python modules included by this package supposed to be used by other
software? If yes, then the package name should be python-plover.
Otherwise the modules should be moved to a private directory (say
/usr/share/plover/).
application/plover has this:
| try:
| print "If Plover is quit using Ctrl-c, the /tmp/plover.lock file must \
| be removed before Plover can be run again."
| gui = plover.gui.main.PloverGUI()
| gui.MainLoop()
| finally:
| lock.release()
I don't get it. Why would I have to remove the lock file manually? Isn't
that what the finally clause is for?
plover/config.py has this:
| CONFIG_DIR = os.path.expanduser('~/.config/plover')
It would be great if upstream could support XDG Base Directory
specification[0] instead of hardcoding ~/.config/.
Typos:
a the default -> the default
copmose -> compose
trasnlations -> translations
[0] http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html
--
Jakub Wilk
Reply to: