Package: siso Version: 1.5.15+ds-1 Severity: minor Tags: upstream siso embeds a web UI via go:embed using pre-built JavaScript from npm (Material Web Components, lit-html, lit-element). Most files are readable ES module source, but lit-html 3.1.0 ships its default export as a minified single-line bundle (lit-html.js).
The lit-html npm package provides BOTH minified (default) and unminified (development/) builds. Upstream's reproduce.sh explicitly excludes the development/ directory via rsync_exclude.txt, keeping only the minified defaults for smaller binary size. Proposed fix: add a debian/patches/ that removes the development/ exclusion from rsync_exclude.txt and adjusts the import paths to use the unminified development/ versions. This eliminates the DFSG concern (embedded files become readable source) with no functional change to the web UI. Note: the .pb.go files (protobuf generated) cannot be regenerated at build time because Debian ships protoc 3.21.12 while upstream uses protoc 7.35.0 (incompatible output). This is standard Go practice and will become fixable when protobuf 7.x enters Debian.
