Bug#775509: Seeking Mentor for Bug#775509: RFS: tz-converter/1.0.0 ITP tz-converter
Hello Paul,
Thank you very much for you in-depth review and comments. Sorry for
delay in the reply, I needed to go back and review the current build
based on these comments. As suggested, I found using the python commands
to be much easier in creating this package. With the revisions
completed, I have updated the result back to the mentors repo:
https://mentors.debian.net/package/tz-converter
If possible, could I get a further review on these changes? If there is
anything else that needs to be fixed, please let me know.
Thanks again for the help!
- Dave
On 月, 2015-03-30 at 14:12 +0800, Paul Wise wrote:
> On Sat, 2015-03-28 at 14:10 +0900, Dave Maiorino wrote:
>
> > For the copyright file, I have gone back and added a source for
> > Saki-NuoveXT-Apps-world-clock.ico. As for the icon "gnome-set-time.png",
> > I have grabbed this from the system, which looks to belong from the
> > package "gnome-desktop" licensed under GNU. As a result, I have added
> > the copyright owners of this package for the file
> > "icons/gnome-set-time.png". Please let me know if this needs to be
> > further reviewed.
>
> Please add this information to the upstream AUTHORS file too.
>
> The License lines in debian/copyright are incorrect, please use the
> right ones from the copyright-format spec:
>
> https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
>
> > Sorry for the PEP errors.
>
> main_widget.py is giving PEP-8 warnings too.
>
> > For the "build" dir and the "changelog.Debian.gz" issues, not quite sure
> > how those got in there ;) Might have been from an older upload that I
> > did not fixed. Corrected these now.
>
> You should use `python setup.py sdist` to create your upstream tarballs
> but if I use that some files are missing so you'll need to fix setup.py.
>
> > I have taken all of these changes, and reposted to mentors.debian.net.
> > Please let me know if there is anything else, or how I can catch a
> > sponsor. I have been using Debian for almost 10 years, and want to be
> > able to contribute back :)
>
> Could you explain what debian/source/options is for?
>
> debian/tz-converter.1.gz is a compressed copy of the upstream manual
> page. I would suggest removing it.
>
> debian/upstream-signing-key.pgp is at a deprecated path, it should be
> converted to an ASCII-armoured key at debian/upstream/signing-key.asc
>
> debian/source/include-binaries can be removed after the above fixes.
>
> debian/patches is empty and can be removed.
>
> Downloading the upstream tarball with uscan fails, missing sigs:
>
> uscan --download-current-version --verbose --destdir .
>
> The upstream tarball from uscan is different to the one on mentors.
>
> The upstream setup.py should install the manual page instead of the
> Debian packaging including debian/tz-converter.manpages.
>
> Same for debian/tz-converter.desktop and debian/install
>
> Same for /usr/bin/tz-converter and debian/links
>
> Same for the icons and debian/install
>
> Are you sure the override_dh_* in debian/rules are needed?
>
> Please wrap and sort the debian meta-data using this (from devscripts):
>
> wrap-and-sort -sa
>
> I'd suggest wrapping debian/watch on the whitespace.
>
> You might want to look at this wiki page:
>
> https://wiki.debian.org/debian/watch
>
> Why is there a copy of debian/changelog in the upstream tarball here?
>
> tz-converter/changelog.gz
>
> Your OpenPGP key is using SHA-1 self-signatures and never expires, you
> might want to update your configuration and set a expiry date using a
> self-signature with a stronger hash algorithm. Please also read through
> the rest of the OpenPGP best practices:
>
> https://help.riseup.net/en/security/message-security/openpgp/best-practices#self-signatures-should-not-use-sha1
> https://help.riseup.net/en/security/message-security/openpgp/best-practices#use-an-expiration-date-less-than-two-years
>
Reply to: