[Pkg-mozext-maintainers] Bug#559971: Bug#559971: itsalltext: Source package does not contain corresponding source for work

[Jan Luebbe]

On Tue, 2009-12-08 at 12:17 +1100, Ben Finney wrote: 
> Package: itsalltext
> Version: 1.3.1-1
> Severity: serious
> Justification: Policy 2.3
> 
> The source package for ‘itsalltext’ is not the corresponding source
> for the work. Instead, it is a bundling of the binary ‘*.jar’
> libraries.

The jar 'libraries' are just zip archives of the source code.

> This violates the license terms of the work (GPLv3 §6) and as such
> means the package is currently illegal to distribute by the Debian
> project.

> The GPLv3 defines the “corresponding source” as:
> 
>     The "Corresponding Source" for a work in object code form means
>     all the source code needed to generate, install, and (for an
>     executable work) run the object code and to modify the work,
>     including scripts to control those activities.

The work is not shipped in 'object code' as i understand it, just
compressed original .js and .xul files. The jar files have been obtained
by extracting upstream's .xpi file.

> So, fixing this bug involves changing the source package to consist of
> the corresponding source for the work plus the Debian packaging, all
> licensed appropriately.

For the next upstream version, i will change it to the recommended
pkg-mozext style where the the jars are extracted. 

> For this package, the source package needs to include all the files
> from the VCS repository (currently a Git repository located at
> ‘git://gerf.org/itsalltext.git’). The Debian packaging then should use
> the ‘Makefile’ to build the binary package from source.

I've had not seen this git repo before and have now compared the source
files in my package to those in git. They seem to be identical.

> The package's build system uses the third-party packages ‘jslint’
> <URL:http://bugs.debian.org/559969> and (for the documentation)
> ‘jsdoc-toolkit’ <URL:http://bugs.debian.org/559963>.

Building without those tools also works, and produces the same as
upstreams .xpi.

What do you think we would gain by using the git repo as upstream?

Best regards,
Jan