Hi Thomas, Thanks a lot for the review on #debian-python. Here are my answers. All changes are pushed to https://salsa.debian.org/python-team/packages/python-opentelemetry-contrib
> Most of your build-depends could be made build-depends-indep. Not a > blocker, mostly nit-picking... Done. All 14 binaries are Architecture: all, so in practice nothing changes for the buildds, but it is the correct split. Build-Depends now only has what clean and the build itself need (debhelper-compat, dh-sequence-python3, pybuild-plugin-pyproject, python3-all, python3-hatchling, python3-setuptools). All <!nocheck> test deps moved to Build-Depends-Indep. I did the same for python-logfire, pydantic-handlebars and python-mcp, which are also arch:all only. > I can see > sdk-extension/opentelemetry-sdk-extension-aws/src/opentelemetry/sdk/extension/aws/trace/sampler/_sampling_statistics_document.py: > # Copyright Amazon.com, inc > Not mentioned in d/copyright. (and many others) > FYI, this will be rejected by the DFSG team. Thanks, you're right: d/copyright has to cover the whole tarball, not only what we ship in the binaries. Fixed. It now lists: - the 26 Amazon.com files (sdk-extension-aws sampler and its tests, botocore's bedrock.py), which also carry The OpenTelemetry Authors - the two Google LLC files in exporter-credential-provider-gcp - the gRPC authors' test_server.proto in instrumentation-grpc - LICENSE.BSD3 (Datadog, BSD-3-clause), which licenserecon found and I had missed The main holder now reads "The OpenTelemetry Authors", as upstream writes it. licenserecon reports no differences anymore. > Also, see [the glance d/copyright] how to write the copyright notice > for a package under the Apache license. [...] > Oh, debian/source/lintian-overrides is overriding what I said: you > don't have a copyright notice for the Apache license. Fix it and > remove the override. Referring to /usr/share/common-licenses/Apache-2.0 is what Policy 12.5 allows, but I've added the standard Apache notice to the License paragraph as in your glance example, since it costs nothing. The override is something else, though: it's missing-notice-file-for-apache-license, which is about Apache-2.0 section 4(d) NOTICE files. The only NOTICE in the tarball belongs to the langchain instrumentation, which we don't build or ship, so there is nothing that requires it to be installed. The comment above the override says so. We should drop the override once langchain gets packaged and its NOTICE is installed. Do you agree? > We don't need your debian/gbp.conf > With ignore-branch = True in ~/.gbp.conf that's useless. I'd prefer to keep it. gbp's defaults are master, upstream and pristine-tar = False. Anyone who doesn't set ignore-branch and pristine-tar = True locally would get the wrong branches or a regenerated orig tarball. The file just records the DEP-14 layout the team policy asks for. Your remark made me check the branch names: I renamed upstream/latest to upstream, as the policy says. Okay for you to keep it? > I don't think your py3dist-overrides is useful, someone else may > advise ? This is a bit deep for me. Claude believes it is needed, and I think I understand its reasoning: - the sibling dists (instrumentation, util-http, wsgi, asgi, propagator-aws-xray) are built from this same source, so they are neither installed in the build chroot nor in dh-python's fallback list. - Without the overrides, dh_python3 silently drops the Depends between these binaries. - This is what caused #1151142 in python-opentelemetry. The overrides can go once a dh-python release lists these packages, i.e. once everything is accepted and uploaded. What do you think? > Not sure why your salsa-ci.yml contains: > SALSA_CI_DISABLE_BLHC: 1 > SALSA_CI_DISABLE_BUILD_PACKAGE_ALL: 1 > SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: 1 > SALSA_CI_ENABLE_BUILD_PACKAGE_PROFILES: 1 I took them from other packages. They are deliberate for an arch:all-only Python package: - SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: test-build-any runs sbuild --arch-any --no-arch-all. With only Architecture: all binaries there is nothing to build. - SALSA_CI_DISABLE_BUILD_PACKAGE_ALL: test-build-all runs sbuild --arch-all --no-arch-any, which for an all-only package is the same as the main build job, so it only duplicates CI time. - SALSA_CI_DISABLE_BLHC: blhc checks for hardening flags in compiler calls. This is pure Python, so there is nothing to check. - SALSA_CI_ENABLE_BUILD_PACKAGE_PROFILES: enables the test-build-profiles matrix, which checks that the <!nocheck> annotations are right. That's the useful check here. (dh copies nocheck from DEB_BUILD_PROFILES into DEB_BUILD_OPTIONS by itself, so the profile job really skips the tests.) I'm pretty sure we want to keep these. Thanks again, Pieter
signature.asc
Description: PGP signature
