Secure testing team - Dec 2009 - RFS: System protoaculous library

Hi,

I have put together a protoaculous package for the packages currently
embedding it (which of course leads to difficulty when it comes to
security updates).  I am looking for a sponsor that would be willing
to upload the package.  Note that I also had to package yui-compressor
(which already had an ITP #519938 that appeared to have stalled) in
order to satisfy the build dependencies for protoaculous.

The protoaculous packages are available at:
- URL: http://mentors.debian.net/debian/pool/main/p/protoaculous
- Source repository: deb-src http://mentors.debian.net/debian unstable main
contrib non-free
- dget
http://mentors.debian.net/debian/pool/main/p/protoaculous/protoaculous_1.dsc

The yui-compressor packages are available at:
- URL: http://mentors.debian.net/debian/pool/main/y/yui-compressor
- Source repository: deb-src http://mentors.debian.net/debian unstable main
contrib non-free
- dget
http://mentors.debian.net/debian/pool/main/y/yui-compressor/yui-compressor_2.4.2-1.dsc

I am new to building my own packages for inclusion in the archive, and
I may have done some non-standard things, so any and all feedback is
very welcome.

Best wishes,
Mike

Le mardi 29 d?cembre 2009 21:10:41, Michael Gilbert a ?crit
:
> Hi,
Hi,

[context: I''m the owner of yuicompressor ITP #519938]
> I have put together a protoaculous package for the packages currently
> embedding it (which of course leads to difficulty when it comes to
> security updates).  I am looking for a sponsor that would be willing
> to upload the package.  Note that I also had to package yui-compressor
> (which already had an ITP #519938 that appeared to have stalled).
I haven''t seen any ping from you regarding #519938. As a general
guideline, if
an ITP is assigned to someone you should try to contact him before working 
alone on your side :)

For example, I would have said to you that there is already a preview package 
in pkg-java SVN repository :
svn://svn.debian.org/svn/pkg-java/trunk/yuicompressor/

This preview package contains :
- a debian/watch file
- a reviewed debian/copyright

but it''s missing some interesting bits from your package :
- a manpage
- a launcher shell script

I think your first step will be to commit this work to pkg-java SVN repository 
(you can request access on [1]).


Secondly, to explain the "stalled" status of this ITP :
yuicompressor used a modified and embeded version of rhino Javascript library. 
YUI Compressor won''t work with genuine rhino debian package [2].

I''ve seen in your debian/rules that you are trying to "apt-get
source rhino"
during build : it seems wrong from my point of view. You cannot rely on deb-
src lines in /etc/apt/sources.list to build your package and you cannot 
download source code during build (even when using apt-get).

One possible short term solution will be to create a new rhino-source package 
(like we have cacao-source package) to cleanly Build-Depends from but I 
haven''t had time to work on it (patches welcome :).

Other mid-term solution, will be to fix yuicompressor to use clean AST 
(Abstract Syntax Tree) processor [3].


[1] https://alioth.debian.org/projects/pkg-java/
[2] http://yuilibrary.com/projects/yuicompressor/ticket/1859529
[3] Expected to be released in next rhino.

-- 
Damien Raude-Morvan - http://damien.raude-morvan.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20091229/648f5c35/attachment.pgp>