control: tag -1 + patch
Hi,
On 2025-05-29 22:53, Aurelien Jarno wrote:
> Package: sash
> Version: 3.8-5
> Severity: serious
> Justification: Policy 7.8
>
> Dear maintainer,
>
> The sash packages provides /usr/bin/sash which is statically
> linked against glibc
>
> glibc is mostly is mostly licensed under the LGPL, which requires that
> the full source code of the incorporating binary package be made
> available. According to Debian Policy ยง7.8 [1] such a binary package
> MUST list the glibc source package (and possibly others) in the
> Built-Using: field.
It happens that sash already has support for adding glibc to
Built-Using. It doesn't work because it uses grep-status to determine
the name of the glibc dev package from the provide, and this binary is
provide by dctrl-tools which is not in the build-depends. This appears
in the build log:
| make[1]: Entering directory '/<<PKGBUILDDIR>>'
| make[1]: grep-status: No such file or directory
| dh_gencontrol -- -V"built-using=zlib (= 1:1.3.dfsg+really1.3.1-1), "
The easiest solution here is to use libc-dev-bin to lookup the source
version, as anyway libc6-dev strictly depends on it. This is what is
done in the attached patch.
By the way, it seems that the zlib license doesn't require the source
code to be available, so it doesn't qualify to Built-Using according to
Debian Policy 7.8. It should probably be moved to Static-Built-Using
(see #1069256), but anyway that's not relevant for this bug.
Regards
Aurelien
--
Aurelien Jarno GPG: 4096R/1DDD8C9B
[email protected] http://aurel32.net
--- sash-3.8/debian/rules
+++ sash-3.8/debian/rules
@@ -1,7 +1,6 @@
#! /usr/bin/make -f
-LIBC_DEV := $(shell grep-status -F Provides libc-dev -n -sPackage)
-BUILT_USING := $(shell dpkg-query -f '$${source:Package} (=
$${source:Version}), ' -W zlib1g-dev $(LIBC_DEV))
+BUILT_USING := $(shell dpkg-query -f '$${source:Package} (=
$${source:Version}), ' -W zlib1g-dev libc-dev-bin)
%:
dh $@
