[Pkg-javascript-devel] script to generate debian/watch for embedding nodejs modules

[Xavier]

Le 26/11/2018 à 19:40, Jérémy Lal a écrit :
> 
> 
> Le lun. 26 nov. 2018 à 17:29, Xavier <yadd at debian.org
> <mailto:yadd at debian.org>> a écrit :
> 
>     Xavier wrote:
>     >> ...
>     >> Looks acceptable IMO
>     >
>     > Policy update:
>     >  - components used only during build => not used in version
>     >    (except if they inject some code)
>     >  - components without major risks    => not used in version
>     >  - components that must be followed  => declared as "group" in
>     >    debian/watch
>     >  - components that must be followed and used in many other packages
>     >    => packaged separately
>     >
>     > Note: I wrote this to help js-team and decrease time to wait in NEW
>     > queue. If you feel that "crazy", please simply delete
>     > https://wiki.debian.org/Javascript/GroupSourcesTutorial and the
>     links to
>     > this page.
>     >
>     > I you don't want to do it by yourself, I can remove the page for you.
>     > Just ask me to do it.
> 
> 
> This is certainly not crazy, and while i'm not myself completely
> convinced it's the right approach,
> (mostly because i did not took the time to review and practice), it's
> the closest thing we have
> to a usable solution.
> 
> Please don't stop there, it would be such a waste.
> 
> About the bundled packages and the weird version encoding all the
> bundled versions:
> most upstreams that are serious about their packaging now use a
> package-lock file,
> effectively locking down a released version to the needed versions of
> dependencies.
> When it's the case, it means that any change in versions of dependencies
> will be reflected
> by a new parent package version. In that case, it's useless to encode
> dependencies versions
> in the parent debian package version ?
> 
> Jérémy

You're right, in that case, components must be tagged as "ignore" or
best a version number ("0.0.1" for example) directly in debian/watch.