[Pkg-javascript-devel] node packages in NEW

[Xavier]

Le 10/09/2018 à 17:09, Xavier a écrit :
> Le 10/09/2018 à 07:59, Bastien ROUCARIES a écrit :
>> On Mon, Sep 10, 2018 at 7:33 AM Xavier <yadd at debian.org> wrote:
>>>
>>> Le 09/09/2018 à 23:36, Bastien ROUCARIES a écrit :
>>>> On Sat, Sep 8, 2018 at 6:17 PM Xavier <yadd at debian.org> wrote:
>>>>>
>>>>> Le 07/09/2018 à 16:36, Xavier a écrit :
>>>>>> Le 07/09/2018 à 13:38, Bastien ROUCARIES a écrit :
>>>>>>> On Thu, Sep 6, 2018 at 9:45 PM Thorsten Alteholz <debian at alteholz.de> wrote:
>>>>>>>>
>>>>>>>> Hi Bastien,
>>>>>>>>
>>>>>>>> On Wed, 5 Sep 2018, Bastien ROUCARIES wrote:
>>>>>>>>>>   - put together packages that belong together; I am not sure here, but
>>>>>>>>>>     wouldn't it be fine to have just one package node-d3 or node-babel
>>>>>>>>>>     that contains all corresponding modules (though their different versions
>>>>>>>>>>     might create problems in keeping track of them)?
>>>>>>>>>
>>>>>>>>> I strongly oppose to keep different version.#
>>>>>>>>
>>>>>>>> I don't meant to have different versions of one package here, but
>>>>>>>> bundling several packages with different versions, so that it might not be
>>>>>>>> clear what version the resulting package might get.
>>>>>>>
>>>>>>> I agree with this maybe we could get something like:
>>>>>>> mainpackage+embded-nameembded1-version+embded-namembdedversion2-version+version
>>>>>>> ?
>>>>>>>
>>>>>>> Bastien
>>>>>>
>>>>>> Hello,
>>>>>>
>>>>>> I've written a little draft:
>>>>>> https://wiki.debian.org/Javascript/GroupedSourcePackageProxy
>>>>>
>>>>> I've updated draft to build a stateless proxy: DB was a bad idea since
>>>>> it can be modified at each request.
>>>>> I started to build groupedsources.cgi. The function to build grouped
>>>>> upstream sources works. Now I'm going to write the download part. When
>>>>> ready, you will be able to test with node-tap, simply by changing
>>>>> debian/watch.
>>>>
>>>> No I will not use as is. Actually node-tap use upstream tar ball
>>>> renamed as per dpkg spec [1].
>>>>
>>>> You solution use a repack...
>>>>
>>>>
>>>> uscan support multiple tar (in V4) but only with one version. Your
>>>> redirector could help by fixing the version problem.
>>>
>>> OK, my redirector is ready. It provides all component with the same
>>> version. Example of debian/watch:
>>>
>>> # Main
>>> https://qa.debian.org/cgi-bin/groupedsources.cgi?upstream=npmjs/nodedbi+nmpjs/own-or
>>> \
>>>   .*=mainUpstream-(\d.*)\.(?:tgz|tar\.(?:gz|bz2|xz))
>>> # Component own-or
>>> opts=component=own-or \
>>> https://qa.debian.org/cgi-bin/groupedsources.cgi?upstream=npmjs/nodedbi+nmpjs/own-or&component=own-or&
>>> \
>>>   .*=mainUpstream-(\d.*)\.(?:tgz|tar\.(?:gz|bz2|xz))
>>> ...
>>>
>>> Downloads are redirected to npmjs and not built by groupedsources.cgi
>>>
>>>> A minor point about version, it should be + instead of ~. Embded
>>>> version are after normal version. I think the best will be to use +~
>>>> to separate embed version. It is unlikey someone will use +~ and it is
>>>> a perfectly legal string.
>>>>
>>>> so I will recommend as version
>>>> mainversion+dsembded+~version1+~version2+~version3
>>>
>>> OK, to simplify version, the second part is a cumulative version (sum of
>>> digits of each component). Example: 1.2.3+~6.2.4
>>> There is a "over" parameter in CGI to increase first digit (in case it
>>> was decreased due to the removal of 1 component)
>> I prefer the previous version of version string. Sorry no sum please. Be stupid.
>>
>>>>> If this proposition is acceptable, I'll propose a policy patch to
>>>>> authorize JS grouped sources and a JS policy patch for details.
>>>>
>>>> [1] https://raphaelhertzog.com/2010/09/07/how-to-use-multiple-upstream-tarballs-in-debian-source-packages/
> 
> OK, it works now. I've rebuild node-mongodb including its 2 dependencies
> not yet available. If you want to test:
>  * install groupedsources.cgi in your local /usr/lib/cgi-bin:
>  https://salsa.debian.org/yadd/qa/blob/master/cgi-bin/groupedsources.cgi
>  * clone https://salsa.debian.org/js-team/node-mongodb
>  * `git checkout groupedsources`
> 
> This works:
>  * `uscan -dd` installs the 3 sources
>  * sbuild or `gbp buildpackage` installs the 3 node modules
> 
> Note:
>  * since mongodb build doesn't need dependencies, they are not installed
>    in node_modules directory during build. A simple mkdir+ln-s would be
>    enough if this was needed
>  * debian/copyright not yet updated (=> lintian warnings)
>  * a suffix may be required here
> 
> Any advice or contribution are welcome!

I've updated gbp.conf so components are installed using
`gbp import-orig --uscan --pristine-tar`

So using groupedsources.cgi, it's easy to build multiple sources packages:
 * build gbp.conf and debian/watch following example
 * import source files (`gbp import-orig --pristine-tar --uscan`)
 * manage build order in debian/rules and link component directory in
   node_modules if needed
 * update debian/install to install component files
 * update debian/control to provide virtual packages
 * update debian/copyright

See `git diff debian/3.1.1-1 groupedsources debian` in node-mongodb repo
to see differences (NB: there is also upstream updates, so d/copy has
many changes, 3 components have the same author).

@ftpmasters: *if this proposition gets your agreement* (and JS-team
agreement of course), please reject node-bson and node-mongodb-core: I
will upload a new node-mongodb when groupedsources.cgi will be installed
(in qa.debian.org?)

Cheers,
Xavier

Note for QA: groupedsources.cgi has been written to be installed
separately, but can easily be merged into fakeupstream.cgi

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20180910/639aed7d/attachment.sig>