On 2017-09-10 16:06, Pirate Praveen wrote: > On ഞായര് 10 സെപ്റ്റംബര് 2017 07:22 വൈകു, Andreas Beckmann wrote: >> Source: node-acorn-dynamic-import >> Version: 2.0.2-2 >> Severity: serious >> >> sources should be shipped in packages, not downloaded at build time ... > > but this is in contrib not main.
Downloading things at package build time hasn't been seen in the archive until recently when some node-* packages started doing this in contrib. (There are installer packages that download non-distributable stuff at install time, but that is a completely different topic.) Anyway, I hope this is a temporary measure and you (i.e. the javascript maintainers) are working on getting these large dependency trees properly into main. Packages in contrib can usually be built in the buildd network (unless they have Build-Depends in non-free), but your packages will FTBFS there due to requiring network access. So no source-only uploads ... and hopefully everything is arch:all. Andreas PS: You'll probably receive a similar bug report for each source package doing this once someone encounters the FTBFS issue in a build chroot that forbids network access.
