[Pkg-javascript-devel] Bug#995722: Bug#995722: Bug#995722: loash: Vendoring should be removed

[Jonas Smedegaard]

Quoting Yadd (2021-10-06 11:43:40)
> On Lu, 04 oct 21, 16:40:48, Bastien Roucari�s wrote:
> > Source: src:node-lodash
> > Version: 4.17.21+dfsg+~cs8.31.173-1
> > Severity: serious
> > Justification: do not compile from source
> >
> > Dear Maintainer,
> >
> > The vendor directory should be emptied
> >
> > The debug version is compiled without source (lintian warn) and moreover the
> > rest of file are already packaged
> >
> > grep -R vendor * gives only a few hit that could be cured by symlinking
> >
> > Bastien
> Hi,
> 
> this files are used for test only, maybe severity could be decreased.

I find the severity accurate: Relying on non-source code is a severe 
violation of Debian Policy, not matter the purpose of relying on it.


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20211006/fb7cb2fe/attachment.sig>