Building from source required?

2008-12-03 Thread Florian Weimer
Must packages in main derive the contents of binary packages from the
sources shipped in the source package, or can they simply copy
pre-generated, not directly editable files which have been derived
using some other process (not available in the package sources)?


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]



Re: Building from source required?

2008-12-03 Thread David Paleino
On Wed, 03 Dec 2008 11:27:14 +0100, Florian Weimer wrote:

> Must packages in main derive the contents of binary packages from the
> sources shipped in the source package,

Yes.

> or can they simply copy pre-generated, not directly editable files which have
> been derived using some other process (not available in the package sources)?

From where?

David

-- 
 . ''`.  Debian maintainer | http://wiki.debian.org/DavidPaleino
 : :'  : Linuxer #334216 --|-- http://www.hanskalabs.net/
 `. `'`  GPG: 1392B174 | http://snipr.com/qa_page
   `-   2BAB C625 4E66 E7B8 450A C3E1 E6AA 9017 1392 B174


signature.asc
Description: PGP signature


Re: Building from source required?

2008-12-03 Thread Paul Wise
On Wed, Dec 3, 2008 at 7:27 PM, Florian Weimer <[EMAIL PROTECTED]> wrote:

> Must packages in main derive the contents of binary packages from the
> sources shipped in the source package, or can they simply copy
> pre-generated, not directly editable files which have been derived
> using some other process (not available in the package sources)?

That is quite a vague question, do you have more specific details?

Sounds like a package that has source that is built using something
non-free, which would put it in contrib?

I would personally hope packages in main are built from source, we
often don't fully do that though (for e.g. autotools generated build
systems).

-- 
bye,
pabs

http://wiki.debian.org/PaulWise


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]



Re: Building from source required?

2008-12-03 Thread Florian Weimer
* Paul Wise:

> On Wed, Dec 3, 2008 at 7:27 PM, Florian Weimer <[EMAIL PROTECTED]> wrote:
>
>> Must packages in main derive the contents of binary packages from the
>> sources shipped in the source package, or can they simply copy
>> pre-generated, not directly editable files which have been derived
>> using some other process (not available in the package sources)?
>
> That is quite a vague question, do you have more specific details?

libjs-jquery prompted this question.  The files in dist/ have been
processed and are not source-equivalent, and are directly copied into
the binary package.

> Sounds like a package that has source that is built using something
> non-free, which would put it in contrib?

Hmm, I don't really know which Javascript packer is used there.
Sorry.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]



Re: Building from source required?

2008-12-03 Thread Paul Wise
On Wed, Dec 3, 2008 at 7:42 PM, Florian Weimer <[EMAIL PROTECTED]> wrote:

> libjs-jquery prompted this question.  The files in dist/ have been
> processed and are not source-equivalent, and are directly copied into
> the binary package.

Quite a common occurrence with JavaScript stuff unfortunately.

>> Sounds like a package that has source that is built using something
>> non-free, which would put it in contrib?
>
> Hmm, I don't really know which Javascript packer is used there.

There are free JavaScript packers (the yahoo one comes to mind - BSD licensed).

IMO this is a policy/sanity issue rather than a DFSG one; you have the
source and the pre-packed binary, nothing prevents you from doing that
packing yourself. By directly installing the pre-compiled one into the
binary package, any patches applied to the source files will not
result in changes in the binary package, which could be annoying for
the security team in the case of XSS or CSRF vulnerabilities.

I suggest the following actions;

Lart upstream about including only source in their source tarball and
distributing a pre-compressed one separately instead.

Find out which packer upstream are using and get them to switch to a free one.

Remove the packed javascript from the tarball if upstream doesn't do it.

Build the packed javascript in debian/rules using the yahoo compressor
(or another).

-- 
bye,
pabs

http://wiki.debian.org/PaulWise


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]



Re: Building from source required?

2008-12-03 Thread Paul Wise
On Wed, Dec 3, 2008 at 8:29 PM, Paul Wise <[EMAIL PROTECTED]> wrote:

> Build the packed javascript in debian/rules using the yahoo compressor
> (or another).

Looks like this is planned already:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495178#10

-- 
bye,
pabs

http://wiki.debian.org/PaulWise


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]



Asistance of a Lawyer Needed

2008-12-03 Thread Shanxi Xinfusheng Machinery
Dear Lawyer,

We are a reputable Machinery company in China and we have some debts we will 
like you to collect for us, after some goods were supplied to a company in Usa 
and Russia and an advanced payment was made since then they have not gotten 
back to us with the balance please get back to us on how you think you can 
assist.

Regards
Xian Chin
Shanxi Xinfusheng Machinery
www.sxmachine.com





-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]



Re: Building from source required?

2008-12-03 Thread Raphael Geissert
Paul Wise wrote:
[...]
> 
> Build the packed javascript in debian/rules using the yahoo compressor
> (or another).
> 

That reminds me of a bug in one of the js-related packages which resulted in the
switch from the compressed to the uncompressed .js due to bad compression
causing errors.

That's a very important issue to keep in mind when choosing the compressor.

Cheers,
-- 
Raphael Geissert - Debian Maintainer
www.debian.org - get.debian.net



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]