Control: tags -1 - moreinfo Control: retitle -1 RFS: vielotus/2.0.1-1 [ITP] -- VieLotusIM (Sen Viet) next-gen Vietnamese input method
Dear Boyuan, Thank you very much for testing 2.0.0-1 on sid/amd64 and for pointing out the DFSG #2 issue together with the FTP Team and debian-legal references. You are completely right: publishing a pre-filtered/obfuscated C++ engine and shipping precomputed 64-bit FNV-1a hex tables without their underlying plaintext wordlists and generator does not meet DFSG #2 (preferred form for modification). I have resolved this upstream in release v2.0.1 and uploaded an updated source package (2.0.1-1) to Debian Mentors: dget -x https://mentors.debian.net/debian/pool/main/v/vielotus/vielotus_2.0.1-1.dsc Upstream v2.0.1 tag: https://github.com/stevedat/VieLotus-IM/tree/v2.0.1/Sources/VieLotusCoreWindows Summary of changes and how the Linux/desktop C++ core is maintained and built: 1. Direct, unobfuscated C++20 maintenance source (MIT / Expat): - `Sources/VieLotusCoreWindows/WindowsNativeEngine.{h,cpp}` is now published and maintained directly in its unobfuscated human-readable form (semantic struct, function, and table names, inline comments, zero pre-publication filtering or identifier mangling). - Relationship to the rest of the project: our macOS/iOS app uses a separate Apple-platform Swift implementation (`InputMethodKit` / `UIKit` / `NaturalLanguage`), whereas the Linux (IBus / Fcitx5) and Windows (TSF) engine in `Sources/VieLotusCoreWindows/` is a standalone zero-dependency C++20 implementation maintained directly in C++20 (there is no Swift-to-C++ transpiler or code generator producing `WindowsNativeEngine.cpp`). - We have permanently retired the old obfuscation policy for the C++20 desktop/Linux engine. 2. Plaintext UTF-8 (Unicode NFC) wordlists, historical provenance & offline generator (all Expat / MIT): - Prior to v2.0.1, `WindowsNativeEngine.cpp` embedded 12 precomputed sorted 64-bit FNV-1a lookup arrays (2,008 entries in total) inline without committing the plaintext wordlists alongside the C++ file. - For v2.0.1, all 12 phonotactic and bilingual collision-escape tables (2,008 / 2,008 entries, verified 100% bit-for-bit with zero hash collisions against the pre-2.0.1 tables) have been consolidated, audited, and committed as human-editable UTF-8 (Unicode NFC) plaintext wordlists at: `Sources/VieLotusCoreWindows/lexicon/00_initial_onsets.txt` .. `Sources/VieLotusCoreWindows/lexicon/11_extended_english_escapes.txt` Starting with v2.0.1, these `.txt` files are the sole canonical upstream maintenance source for the C++20 engine's lexical tables. Full per-table provenance, reconstitution notes, and format invariants are documented in `Sources/VieLotusCoreWindows/lexicon/README.md` and `debian/copyright`. - Added the deterministic, offline Python 3 generator (standard library only, no external dependencies, no network access): `Sources/VieLotusCoreWindows/scripts/generate_lexicon_hashes.py` which validates UTF-8, strict Unicode NFC normalization, lowercase BMP codepoints, duplicate freedom, and zero 64-bit FNV-1a collisions before emitting sorted lookup arrays. 3. Non-shadowable build-time regeneration & removal of binary fallback in CMake: - `CrossPlatform/capi-native/CMakeLists.txt` (with `python3:any` in `debian/control` `Build-Depends`) regenerates `${CMAKE_CURRENT_BINARY_DIR}/generated/VieLotusLexicon/WindowsNativeLexiconGenerated.inc` directly from `lexicon/*.txt` during every build, and `WindowsNativeEngine.cpp` includes it via `#include <VieLotusLexicon/WindowsNativeLexiconGenerated.inc>`. - No `.inc` file sits alongside `WindowsNativeEngine.cpp` and `prebuilt/` is not added to compiler include paths on Linux/Debian builds, so edits to `lexicon/*.txt` deterministically take effect on rebuild (verified via `-H` include traces and wordlist-mutation rebuild tests). - Removed the legacy prebuilt `.deb` extraction fallback from `CrossPlatform/capi-native/CMakeLists.txt`; CMake now fails immediately with `FATAL_ERROR` if any C++20 source file, wordlist, or generator script is missing. Please let me know if there are any remaining questions or further adjustments needed for DFSG review. Thank you again for your time and guidance. Best regards, Dat Tran (Steve Dat) On Sun, Nov 1, 2026 at 7:45 PM Boyuan Yang <[email protected]> wrote: > X-Debbugs-CC: [email protected] [email protected] > Control: tags -1 + moreinfo > > Hi, > > On Sat, 31 Oct 2026 12:23:32 +0700 Dat Tran <[email protected]> wrote: > > Control: tags -1 - moreinfo > > > > Dear Boyuan, > > > > Thank you very much for your thorough review and testing on Debian sid. > > I have resolved all 8 issues you reported and uploaded an updated source > > package (2.0.0-1) to Debian Mentors: > > > > dget -x > > > https://mentors.debian.net/debian/pool/main/v/vielotus/vielotus_2.0.0-1.dsc > > Thanks for the fixes. The updated package builds successfully in > sid/amd64, and my targeted checks confirm the input and font configuration > fixes. > > One source-code issue remains: your release policy explicitly requires > publishing an obfuscated C++ core: > > https://github.com/stevedat/VieLotus-IM/blob/a45d3b5a83460aa84913237b06b08ab0b7e2210f/docs/RELEASE_STANDARDS.md#L38-L58 > > Debian expects the preferred form for modification. See the FTP Team's > explanation of DFSG #2 (slide 10, PDF page 11), and the discussion > distinguishing actual maintenance source > from code filtered before publication: > > * https://ftp-master.debian.org/talks/ftpmaster-dc11.pdf#page=11 > * https://lists.debian.org/debian-legal/2005/07/msg00379.html > > Please provide the unobfuscated source actually used to maintain the Linux > core, including the original wordlists and any generation scripts, and > explain how the published C++ is > produced. > > Until this is resolved, I cannot sponsor the package. Even if I do, your > version will be rejected during the DFSG review. > > Best, > Boyuan Yang >
