[Pkg-javascript-devel] Bug#943389: Bug#943389: node-lodash: source package does not contain upstream source

[Jonas Smedegaard]

[ sent again with ASCII-only headers to please Debian mail servers ]

Quoting Jérémy Lal (2019-10-24 19:47:48)
> Le jeu. 24 oct. 2019 à 19:33, Jonas Smedegaard <dr at jones.dk> a écrit :
> 
> > Quoting Pirate Praveen (2019-10-24 19:12:22)
> > >
> > >
> > > On Thu, Oct 24, 2019 at 19:05, Jonas Smedegaard <dr at jones.dk> wrote:
> > > > Quoting Pirate Praveen (2019-10-24 18:42:17)
> > > >>  On Thu, Oct 24, 2019 at 16:19, Jonas Smedegaard <dr at jones.dk
> > > >> <mailto:dr at jones.dk>> wrote:
> > > >>  > Quoting Pirate Praveen (2019-10-24 15:34:15)
> > > >>  >>  All files derived from source have their corresponding 
> > > >>  >>  source code and it is regenerated during build.
> > > >>  >
> > > >>  > It may very well be "source" but not "upstream source".
> > > >>  >
> > > >>
> > > >>  Then I fail to see how this is a serious bug.
> > > >
> > > > I listed Policy § 2.1 as being the reason for severity of this 
> > > > bug.
> > > >
> > > > Let me quote the part I find relevant:
> > > >
> > > >>  The program must include source code, and must allow 
> > > >>  distribution in source code as well as compiled form.
> > > >
> > > > If this package _does_ contain source code but just from a 
> > > > _different_ upstream project than the one currently listed in 
> > > > debian/copyright then the bug is easily fixed by simply 
> > > > correcting what upstream project this package claims to ship 
> > > > source code from.
> > >
> > > Lets ask the team what they think about the issue.
> > >
> > > Hi js-team,
> > >
> > > Do you think this is really an rc bug? Do you think Source field 
> > > in debian/copyright should be changed to 
> > > https://github.com/lodash/lodash/releases ?
> >
> > For the record, I did not say that above URL solves this bug.
> >
> 
> Does the problem Jonas refer to is that embedded component lodash-cli 
> is downloaded (by watch file) from 
> https://registry.npmjs.org/lodash-cli ?

This bugreport is generally about upstream source missing.

If upstream source really is multiple things e.g. due to embedded code, 
then sure embedding comes into the picture _too_ but to simplify the 
conversation here I choose to begin with looking at the _main_ source.

[snipped note relevant for embedding but not directly for this bug]

> Jérémy, trying to help.

Thanks for trying :-)

 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20191024/fa7d9c41/attachment.sig>