[Pkg-utopia-maintainers] Bug#884302: avahi-ui-utils: recommends virtual package (non-deterministic, potentially pulling in non-free package)

[Jonas Smedegaard]

Package: avahi-ui-utils
Version: 0.7-3
Severity: serious
Justification: Policy 2.2.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

avahi-ui-utils recommends vnc-viewer.

vnc-viewer is a virtual package, which means it is not deterministic
which package will satisfy the recommendation.

Moreover, vnc-viewer is provided by nonfree packages tightvnc-java and
vnc-java, which means those of our users enabling the _ability_ to
install nonfree packages (by including the nonfree suite) may
accidentally install nonfree packages they did not explicitly choose.

Debian Policy includes the following requirement in §2.2.1:

> must not require or recommend a package outside of main for
> compilation or execution (thus, the package must not declare a
> Pre-Depends, Depends, Recommends, Build-Depends, Build-Depends-Indep,
> or Build-Depends-Arch relationship on a non-main package unless that
> package is only listed as a non-default alternative for a package in
> main),

Listing a virtual package as first choice of a Recommends violates
Policy §2.2.1, because that is not "a non-default alternative".

Please prioritize free VNC alternatives over the virtual vnc-viewer.


 - Jonas

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAloxQPwACgkQLHwxRsGg
ASHlJw/+LWtToVa02OLr672PrDBl7Lamr278abtMvy2dOmprf3BLuxwlhG5FRs/4
JM8BsUWjCHld99aZzmC5jC0/DUQK6ICoRuLJHMqhF2jwqr6NjY8EEvm/s0DDpSdb
ifURLaADNPtSxk3ZujkdV+fAS4eKBOtXIpwarbOQyTwBxSuLo316TqhgCc4ByWGT
Xfy+8y5r060aVvnDq9UEwgxy2jsWRIeIhflLkBdpI9/xgiHsyFcaK/3UrF+eRn9J
CfdodEJ9ypiU+Fn421IhaaT6eJoWWke/ofmaRut/f/cVuA8EJY5/D2eEtRsDUMLv
8aoRP/usBmFdesIVSPlcades5VmrtrL1wsYBgV4X12fUKA8y+/N8Fd4IJp8Zmx08
u4IW//It+GVwI5m8mJuzpbif+F9cJJ5Qry1z7ORPHVO8euzS44I9MJFFKLOXKyvm
3gI5ZAgv+WyheMcqCJhNnvkLxSKc+gasPHizDJS4FEf2ueIFtdtAJW7R7uIyZPrQ
bSuM/FXMBl35gYueK63YAIKyc4HpbV9hncEsPJs3kaYc4wfr5Q6C+PvcAu7JZO4Y
CIDqWy0SJh5wtWSh7Mst4rJamg0RLmA1RHI8dy7Oich3WW0IVfrL/+Him+dQ0H1r
VaNhDHQ35ntxyTavk5EclA5XdSUvMU/d7T+jHWpNLZIuJuGik78=
=ggb1
-----END PGP SIGNATURE-----