severity 851817 normal thanks Hi,
On 18/01/17 22:15, Haruki TSURUMOTO wrote: > Dear maintainers, > Prometheus depends on many libraries, including source codes located > into vendor directory. > Is this a violation for Debian Policy 4.13 ? > "4.13 Convenience copies of code" > https://www.debian.org/doc/debian-policy/ch-source.html#s-embeddedfiles > > Some libraries of vendor/* had already packaged in Debian, > (ex: golang-github-hashicorp-go-cleanhttp-dev, > golang-github-hashicorp-consul-dev) > Can't we use these instead of vendoring method ? When I packaged the prometheus ecosystem, most of the vendored dependencies were not present in Debian. I packaged about 30 different libraries to remove vendoring and left just a couple of them. There were a couple of libs that were just too small and specific to justify separate packages (not used directly by prometheus), and in the case of the consul API because there is an API incompatibility with the package present in Debian. I will review this to see again if the vendoring can be removed. But I disagree with the severity of this bug, the policy only marks this requirement as a "should", so it is not serious. -- Martín Ferrari (Tincho)