Control: tags -1 - moreinfo

在 2018年2月2日星期五 CST 下午11:25:11,Tobias Frost 写道:
> But two things escaped your eyes:
> - Left-tover "Comments:" on line 69
> - license-reconsile finds that in the libqxt is BSD-licensed (eg.
>   qxt/qxtglobal.cpp)

OK. Fixed now.

> > > - don't install -- it does not have extra information beyond
> > > 
> > >   a package  description and compilation instructions (which are useless
> > >   for the users of the binary package)
> > >   There is also a slight bug in it: The URLs at the bottom seems
> > >   outdated, they will forward to the github project from the watch file.
> > >   Maybe at least report that to upstream.)
> > 
> > Done. The typo was forwarded upstream and got fixed in trunk code.
> Ok. You should reflect this in the dep3 header though.
> Forwarded: no is not what you want, the measning for this field is
> when it is a Debian specific patch (value not-needed) or if you did not
> bother to forward it (yet) -- then it is "no",
> Here You Want(tm) "Applied-Upstream"
> followed by either the commit-id or the URL pointing to it.
> (see the dep3 spec for details))
> (This is also valid for the other patches you mentioned below)

I updated those patches and replaced the Forwarded: field with Applied-
Upstream: field as decribed in dep3.

> > > - The embedded libqxt -- can you use the Debian packaged version?
> > 
> > Sorry but nope -- If we take a look into libqxt in Debian, #875027 says
> > that libqxt is unmaintained upstream and will be removed from Debian
> > archive soon. Upstream git repository also suggested that all projects
> > previously using libqxt should either migrate away from libqxt or embed
> > part of its code to fit their own need. [1] That is exactly what
> > qstardict
> > upstream is doing,
> > see also the GitHub issue [2].
> > 
> > [1]
> > [2]
> Well, this is not exactly how we deal with embedded code copies.
> When a library is gonna be removed from Debian this is not a valid excuse to
> have an embedded code copy of the same in another package. So the right
> thing is (as you've done already) to bring it to upstreams' attention to
> get that fixed before QT4 will be removed within this development cycle.
> In this case the effort is probably not required to patch the buildsystem to
> use the packaged version, as long as available, but when you follow the
> instructions here:
> Keep me CC in the mail you send the notice to the security team.

After some investigation, I found that embedded libqxt is becoming a general 
problem thus here the post is:

> OK, round 2 done :)
> Its almost good, let me know when done!

I've updated the git repository on Salsa as well as its source package on .

Boyuan Yang

Attachment: signature.asc
Description: This is a digitally signed message part.

Reply via email to