Hi,
Your upload of node-lingui 5.4.1-1 to the NEW queue has had an automated
review: an LLM-based check of its licensing and packaging, run by the DFSG team
using the Debian Inference service. It is not a decision on the package, and -
like other LLM-based work - it can be wrong.
It found 2 blocker, 3 important, 3 minor issues:
- [blocker] [licensing] Source ships prebuilt minified Yarn 3.4.1 bundles
with no source, and debian/copyright mislicenses them as Expat and ISC
- [blocker] [licensing]
packages/babel-plugin-lingui-macro/.../cleanJSXElementLiteralChild.ts is copied
from Babel but debian/copyright names no Babel copyright holder
- [important] [packaging] tsc build emits ESM dist/*.js but the installed
package.json files name dist/*.cjs, dist/*.mjs and dist/*.d.ts, which are never
produced
- [important] [packaging] debian/nodejs/build replaces real dependencies with
no-op stubs, silently breaking message IDs, PO support, config loading and ICU
compilation
- [important] [packaging] Depends lists only nodejs:any although the
installed modules require many unpackaged Node modules at runtime
- [minor] [packaging] The only test is `jest || true`, so dh_auto_test can
never fail
- [minor] [packaging] No autopkgtest: debian/tests/control is absent and the
source package declares no Testsuite
- [minor] [packaging] The advertised `lingui` command is not installed: no
/usr/bin link is created
You can read the full review here:
https://dfsg-new-queue.debian.org/reviews/node-lingui#assistant-report
Please look at it, and respond by visiting the link below (you'll be asked to
authenticate with Salsa first):
https://dfsg-new-queue.debian.org/llm-review/FyGMlHEVjEtWcHsrIjNcnEVWZw8nYRBZ
There you may choose to reject the upload yourself, while you fix issues and
re-upload, or add comments to clarify or dispute the review.
Your comments are for the DFSG team member who reviews the package, not for the
LLM: it will not read them or reply. Tell the reviewer where you think the
automated review is right or wrong, and why. Comments are public and shown with
the review; you may use markdown, e.g. to link to clarifying information.
If you have any questions, please reply to this e-mail and someone from the
team will respond.
If you would rather not be e-mailed about these reviews, log in at
https://dfsg-new-queue.debian.org
and say so on your profile page.
Thanks!
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
