Package: sponsorship-requests Severity: normal Dear mentors,
I am looking for a sponsor for my package "cunit": * Package name : cunit Version : 2.1-3-dfsg-3 Upstream contact : Jerry St.Clair <[email protected]> Anil Kumar <[email protected]> * URL : https://cunit.sourceforge.net/ * License : LGPL-2.0+, GFDL-NIV-1.2+ (documentation), GPL-2.0+ (debian/*) * Vcs : https://salsa.debian.org/ejjl/cunit Section : libs The source builds the following binary packages: libcunit1 - Unit Testing Library for C libcunit1-dev - Unit Testing Library for C -- development files libcunit1-ncurses - Unit Testing Library for C (ncurses) libcunit1-ncurses-dev - Unit Testing Library for C (ncurses) -- development files libcunit1-doc - Unit Testing Library for C -- documentation To access further information about this package, please visit the following URL: https://mentors.debian.net/package/cunit/ Alternatively, one can download the package with dget using this command: dget -x https://mentors.debian.net/debian/pool/main/c/cunit/cunit_2.1-3-dfsg-3.dsc The package needed quite a bit of polishing up after updating the debhelper-compat to 14, which is all reported here below. Changes for the just uploaded package: cunit (2.1-3-dfsg-3) unstable; urgency=medium . * New maintainer (Closes: #1136394) * debian/control: - Maintainer set to myself; Uploaders and debian/compat dropped - debhelper-compat: 9 -> 14; Build-Depends: dh-autoreconf dropped - Standards-Version: 3.9.6 -> 4.7.4 - Priority and Rules-Requires-Root dropped: both are the default since dpkg 1.22.13 and are now flagged as redundant - Homepage: switched to https - Vcs-Git and Vcs-Browser: point at the repository where the package is actually maintained * debian/rules: - drop --with autoreconf (implicit since compat 10) - drop DH_VERBOSE and the legacy DPKG_EXPORT_BUILDFLAGS - set DEB_BUILD_MAINT_OPTIONS = hardening=+all; the ncurses build had lost every hardening flag because -lncurses was passed as a configure LDFLAGS assignment, overriding dpkg-buildflags. Pass it via LIBS - split the dh_install, dh_installman and dh_installexamples overrides into -arch and -indep variants. "dpkg-buildpackage -A" installed both build trees but built only libcunit1-doc, so dh_missing, which is fatal since compat 13, aborted the arch:all-only build - keep the examples in /usr/share/doc/libcunit1-doc; since compat 11 debhelper would auto-detect libcunit1 as the main package and relocate them, and libcunit1-doc does not depend on libcunit1 * debian/watch: rewritten in the version 5 format, https URL, fixed mangles * debian/patches: DEP-3 headers on all patches; new patches renaming configure.in to configure.ac and fixing a manpage typo * debian/not-installed: added (dh_missing is fatal since compat 13) * debian/upstream/metadata: added * debian/salsa-ci.yml: added, with the arm64 and riscv64 build jobs enabled in addition to the default amd64 and i386 * debian/tests: replaced the stale test.sh, which referenced build directories that do not exist at test time, with two tests compiling against the installed packages via pkg-config * debian/source/lintian-overrides: document the unavoidable hyphen-in-upstream-part tag * debian/copyright: https URLs; added myself to debian/* This is my first package as a maintainer; I filed the ITA as #1136394 after the package was orphaned. The changes are packaging-only: there is no new upstream release (upstream last released 2.1-3 in April 2014) and no security component. The upload targets unstable/forky. Verification performed: * builds cleanly with sbuild against unstable (amd64), both the full build and the arch:all-only build (dpkg-buildpackage -A) * autopkgtest passes both tests (basic and ncurses variants), compiling against the installed packages via pkg-config * lintian from unstable is clean apart from the tags discussed below * Salsa CI is green: builds on amd64, i386, and arm64, plus source build, lintian, piuparts, autopkgtest, blhc, reprotest/debrebuild, uscan, test-build-any and test-build-all * debdiff against 2.1-3-dfsg-2.7 shows no unintended change to the shipped files Three packaging bugs were found and fixed in the process: * The arch:all-only build (dpkg-buildpackage -A) failed. debian/rules installed both build trees unconditionally, but a binary-indep build only builds libcunit1-doc, leaving the libraries, headers, pkg-config file and manpage unclaimed; dh_missing, fatal since compat 13, then aborted the build. This was introduced by the compat 9 -> 14 upgrade in this very upload - at compat 9 dh_missing did not run at all - and would have meant libcunit1-doc never building on the archive's arch:all buildd. Caught by Salsa CI's test-build-all job. Fixed by splitting the dh_install, dh_installman and dh_installexamples overrides into -arch and -indep variants, and by having dh_missing only list (not fail on) the arch:any files during an arch:all-only build. * debian/rules passed LDFLAGS="-lncurses" as a configure command-line assignment for the ncurses build. That overrides the environment set by dpkg-buildflags, so the ncurses library was built without any hardening flags (no bindnow, no relro) and without -Wl,-z,defs. Fixed by passing -lncurses via LIBS, which is where libraries belong; the hardening flags are now present in both libraries. * debian/tests/test.sh referenced debian/tmp and debian/tmp-ncurses, which do not exist when autopkgtest runs. The test passed only because gcc fell back to the installed headers and library. One further consequence of the compat upgrade was caught by debdiff: since compat 11, debhelper auto-detects libcunit1 as the "main package" for libcunit1-doc and would have relocated the examples from /usr/share/doc/libcunit1-doc/examples to /usr/share/doc/libcunit1/examples, even though libcunit1-doc does not depend on libcunit1. debian/rules now passes --doc-main-package=libcunit1-doc so the files stay where the archive has always had them. Remaining lintian tags, all deliberate: * no-symbols-control-file (I, both libraries): upstream has been frozen since 2014, so per-symbol versioning would produce dependencies identical to the existing shlibs. Happy to add symbols files if you prefer. * patch-not-forwarded-upstream (I, two patches): both patches are from previous NMUs. Upstream is dormant - no release since 2014 and the SourceForge bug tracker is inactive. * hyphen-in-upstream-part-of-debian-changelog-version (P): overridden with an explanatory comment. The upstream version genuinely is "2.1-3". Switching to +dfsg is not possible without breaking version ordering: dpkg --compare-versions "2.1-3+dfsg-3" gt "2.1-3-dfsg-2.7" is false. I intend to switch to +dfsg if upstream ever releases above 2.1-3. * package-uses-experimental-debhelper-compat-version: no longer emitted by lintian in unstable; compat 14 is a deliberate choice, as this targets unstable/forky only. * debian-watch-does-not-check-openpgp-signature (X): upstream publishes no OpenPGP signatures - the 2.1-3 release directory contains only the tarball. Note on debian/watch: it uses the version 5 (rfc822-style) format. This is parsed correctly by devscripts 2.26 in unstable and accepted by lintian there, but uscan in trixie cannot read it. I am happy to revert to version=4 if you consider that premature. Many thanks also to all on IRC and the mentors mailing list who helped with this! Kind regards, Edmund Lodewijks -- Edmund Lodewijks <[email protected]> TZ: UTC+2 / GMT+2
