[Pkg-mozext-maintainers] #922944: handling symbolic links in webextensions

[Dmitry Smirnov]

On Wed, 21 Aug 2019 19:32:26 +0200 Bruno Kleinert <fuddl at debian.org> wrote:
> I've got an ITP ticket open for keepassxc-browser [1] waiting to be
> processed in the NEW packages queue. It's also affected by the reported
> behavior, because I replaced code copies by symbolic links to files in
> existing debian packages. My intention is to reduce the burden of the
> security team by avoiding code copies.
> 
> [...]
> 
> I searched the web for a solution without success. Guidance for package
> maintainers of web extensions with symbolic links is highly
> appreciated.

I've stumbled upon the issue with symlinks with "form-history-control" 
package. Under new Firefox rule, extensions should bundle everything they 
need without using links to files outside of the extension directory. This 
effectively makes webextentions an equivalent of statically linked binaries.

The way to handle such situation is to Build-Depend on required packages and 
copy their resources into webextension directory. Every dependency that we 
borrow resources from should be noted in "Built-Using" field.

This is how I have implemented this (not entirely satisfying) solution for 
the "form-history-control" package:

  https://salsa.debian.org/webext-team/form-history-control/commit/98b0a3ab

-- 
All the best,
 Dmitry Smirnov

---

For every problem, there is a solution that is simple, neat, and wrong.
        -- H. L. Mencken
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-mozext-maintainers/attachments/20191229/13adee41/attachment.sig>