Source: popper.js Version: 1.14.6+ds-1 Severity: serious Justification: Policy 2.1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Source package contains several files (seemingly all of them) below <dist/> which does not excist in upstream version tracking and therefore are not in the form preferred upstream, and more importantly may include other code than the actual source below <packages/>. - Jonas -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAlxPP8IACgkQLHwxRsGg ASFK1hAAriXMDCIrGsMdyAicI0pRWZ5nWGeeQa0Sn5WLev+PFE9GcuykxDVQtdv5 0tVfziLSg9l66YNjc0nzxsPMChX0emu2LmJXXJltpX816NkrmwZUBg0xuJleZ3zl 2DTTBmmE3rvS9WJ+qjtcTM8r/YtosWwXXqooTe+MVaKaD9mQWC63iak8NYUc27pW rduq11FOzalZHW4jOcLorYA1PrfaUr67JGNWNPZCkcKm9KPAN0Z9sjhofmkEqKXP A+06IwxVgfK9PiijScSSWKzQSVfCi1RF5nMJciDWMJmUePDu7+9vSyxaJJcsQcBt aWau9Hy/Akb0J/SRdMV6fS8mhTo2xF5SDEDjxxp7X3AZ8vn9EdnQFvdFrbsIoj5d 4TinMiZfgexMy8Asve2tGRUOszDsyVEMziNopI40yslSIq3RYXrlSAu/Mh0mt/l4 fmdZXcqlsnS8XtT5iNHBxjQ+e/wliIxATz7qztBhjoV1uHkUmO8YvzJyFJu38aVv AEu2LXHf2vpGHcwUKaqXnen+PDeCOGg+j5OsAI6g/NfSlaxTid6ZUojZUK+mVCw9 2v1rQyR3BHGatNabaE31tXnRSZO5EOFG4nTs5rQDgxQIpWFgwWgwPFSysPBNE8Fh OwDSFkfX/gfCXebygXRTbQP2MQ+M9WrDxkZ5JJfIybgGhNXu6j8= =Ndgg -----END PGP SIGNATURE-----