[Pkg-javascript-devel] RFS: node-loose-envify 1.3.0

[Jérémy Lal]

2016-12-05 11:15 GMT+01:00 Paolo Greppi <paolo.greppi at libpf.com>:
> On 03/12/2016 01:33, Jérémy Lal wrote:
>> 2016-12-03 1:02 GMT+01:00 Paolo Greppi <paolo.greppi at libpf.com>:
>>> Hi,
>>>
>>> I packaged node-loose-envify as per this ITP:
>>> https://bugs.debian.org/846206, this is the repo:
>>> https://anonscm.debian.org/git/pkg-javascript/node-loose-envify.git
>>>
>>> Two notes
>>> - regarding the source-is-missing error mentioned here
>>> https://lists.alioth.debian.org/pipermail/pkg-javascript-devel/2016-November/015929.html,
>>> I choose to delete the file with a patch
>>
>> I'm not sure it does the trick.
>> A better IMO approach is to use Files-Exclude in debian/copyright, and
>> make a proper debian/watch. Then uscan will automatically dfsg-repack
>> the orig tarball. See how some other dfsg/ds packages do that.
>
> It does the trick because the lintian error is gone.

Be careful here: lintian is a tool supposed to help you. You can do many
wrong things that pass lintian tests.

> I'd rather avoid dfsg rightnow because :
> - the specific file is part of the javascript corpus the test suite runs
> on (which we can't run at the moment anyway since it requires browserify)
> - I don't think that makes the package "non-DFSG clean" as a whole

A single tiny unessential file can make a package non-dfsg clean.
(the stupidest example being copyrighted icc profile in a test picture).

In this specific case, the file in question is protected by NON-DFSG patents.
Removing it from the upstream tarball is mandatory.

Removing it with a quilt patch actually:
- keeps the file in upstream tarball
- adds a copy of the file in the debian tarball
so it's even worse.

> - sheer ignorance: the dfsg_clean workflow being new for me
Append to the first section of debian/copyright

Comment: exclude non-dfsg patented react source code
Files-Excluded: test/react/react-with-addons-with-node_env.js

Add this to debian/watch params:
repacksuffix=~dfsg

Make sure you removed initial tarball and do
uscan --force-download
gbp import-orig ../thedfsgtarball.tar.xz

>>> - I could not get rid of the binary-without-manpage lintian warning, as
>>> the supplied CLI does not support --help I could not use help2man ...
>>
>> Then you need to build a manpage...
>> A very easy way to do so is with marked-man (convert .md to .1).
>> Leave the envify.md file in debian/ dir and build the .1 during build.
>
> Nice tool, I have created a basic manpage.

Great

>> Side note:
>> override_dh_fixperms:
>>   dh_fixperms -X debian/node-loose-envify/usr/lib/nodejs/loose-envify/cli.js
>>
>> isn't right because it makes the build non-reproducible, see
>> https://bugs.debian.org/845745
>> about why.
>
> Done
>
>> Also the description isn't really clear. Maybe a short sentence about
>> what it's about in a more general way. Is it useful for some build tool ?
>
> I gave it a try, let me know if it makes more sense.
>
> It's difficult for me to imagine the use cases of some of the modules we
> are packaging. This one I'm trying to get in because it's a dependency
> of node-invariant - and all this is to get node-yarnpkg into Stretch as
> a new package.

Much better description, thanks.

> I wonder if we can do it < 2017-01-05 ?
>
> There are about 6 dependencies left to go plus babel + gulp as build
> deps. The latter is the same short-term focus as
> https://www.generosity.com/community-fundraising/debian-browserify-2 so
> yes maybe it can be done !

Maybe, i can't really help more but i will try to keep reviewing afaic.

Jérémy