[Pkg-roundcube-maintainers] DFSG suffix and SWF files

[Guilhem Moulin]

Hi there,

A new upstream release (1.1.3) has been available for a little while,
and I thought I would try to package it this week-end ;-)  I've got one
blocker and two questions though:

  1/  I thought the ‘dfsg’ suffix was added due to upstream shipping
     .swf files with TinyMCE.  However ‘moxieplayer.swf’ is still
     included in the roundcube-core package [0].  And even stranger,
     upstream changelog for 0.7 says “TinyMCE security issue: removed
     moxieplayer (embedding flv and mp4 is not supported anymore)”.
     Could anyone enlighten me here?  Should we get rid of
     moxieplayer.swf as well?  Is there anything else justifying the
     presence of the ‘dfsg’ suffix?

  2/ Has anyone tried to convince upstream to cryptographically sign
     their release?  (If not I'll drop them a line.)

  3/ Is there a policy for inclusion in roundcube-plugins-extra (which I
     forgot to backport — oops :-/)?  I'm thinking of adding
     kolab/calendar [1] (AGPLv3).

Cheers,
-- 
Guilhem.

[0] https://packages.debian.org/sid/all/roundcube-core/filelist
[1] https://plugins.roundcube.net/packages/kolab/calendar
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-roundcube-maintainers/attachments/20151017/6a333102/attachment.sig>