[Pkg-javascript-devel] Bug#943389: Bug#943389: node-lodash: source package does not contain upstream source

[Jonas Smedegaard]

Quoting Pirate Praveen (2019-10-24 15:34:15)
> On Thu, Oct 24, 2019 at 11:40, Jonas Smedegaard <dr at jones.dk> wrote:
> > The source package src:node-lodash states in its debian/copyright 
> > file that its upstream source is <https://github.com/lodash/lodash>
> > 
> 
> I don't thik that is how DFSG is intrepreted. If that were the case, 
> then we won't able to modify upstream tarball at all.

I am not surprised (but frustrated and sad) that you try to argue that 
what is listed as upstream source need not be upstream source.


> You need to check with the release tarballs.
> https://github.com/lodash/lodash/releases

If upstream source is not https://github.com/lodash/lodash but instead 
it is https://github.com/lodash/lodash then it is a(nother) bug that the 
package points at the wrong place for its upstream source.


> We don't usually specify the releases page in debian/copyright only 
> the project page. You can verify this against any other package in 
> debian.

That's no bug if project page _also_ is upstream source, as is commonly 
the case e.g. at Github.

It is a minor bug when project page clearly and unambiguously references 
upstream source.

It is a severe bug when project page serves code which upstream use as 
their prefered form for editing but the code distributed with Debian as 
"upstream source" is *not* that same code but instead some other code, 
regardless how clearly that other non-source code is referenced from 
project page, and regardless if upstream labels that other code as their 
"releases".

This bug is about the code upstream treats as their source *not* being 
what Debian distributes as upstream *source*.


> All files derived from source have their corresponding source code and 
> it is regenerated during build.

It may very well be "source" but not "upstream source".


> As for lodash-cli, it is included as another source tarball and you 
> can see this in the dsc file.

This bug is *not* about embedded code, it is about the main code.


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20191024/f58d316b/attachment.sig>