Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[foss.freedom]

Hi Gianfranco,

  as requested I've revisited the package.

Since 10.2.6 of budgie-desktop has just been released I've taken the
opportunity to upload this instead of the 10.2.5 you have examined
previously.

I've had a look through and tested the revised packaging.

Changes to the packaging - resolve the folder permissions issue that FTP
masters failed the previous package on.

I've had help from Jeremy Bicha to fix missing dependencies in the -dev
package

Other linitian issues addressed:

1. budgie-desktop: package-contains-no-arch-dependent-files
2. budgie-desktop-doc: capitalization-error-in-description GTK GTK+ and
other similar lintian information issues in the other built packages
3. W: budgie-desktop-doc: non-standard-file-perm
usr/share/gtk-doc/html/budgie-desk
top-10.2.4/BudgieApplet.html 0664 != 0644 and other similar lintian
warnings in other built packages
4. W: libbudgietheme0: maintscript-calls-ldconfig postinst - I've replaced
the postinst with .triggers as recommended by linitian

The puritan issue you pointed me at - I've incorporated the gtk-link patch
that the upstream maintainer (Ikey) recommended.

The remaining linitian issues:
1. no upstream change log - upstream does its change log via git tags
2. hardening linitian recommendations - as discussed with Paul Wise - if I
attempt to apply any of the hardening flags this results in budgie-desktop
not running at all.  I strongly suspect once upstream completes the
conversion to pure C in the future (data unknown), these hardening issues
will be resolved (I believe this is a Vala issue).

David



On 12 July 2016 at 13:06, Gianfranco Costamagna 
wrote:

> Hi
>
> >Ok - TL;DR; from stuff I was discussing with Paul Wise.  Budgie-Desktop
> is definitely not Debian deb-helper friendly.  With a standard v9 debhelper
> - even with a >override_autoreconf, override_autoreconfigure etc, it
> appears from first glance that the compilation works.  However on
> installation the budgie-session fails to >launch.  I discussed this
> upstream but could not find a resolution.
>
> ok
>
>
> >The recipe you see is basically the older deb packaging style - but more
> importantly works in Debian Stretch 32bit & 64bit (tested regularly over
> the last 6 >months), developed from Ubuntu 15.10 and reused for 16.04 and
> 16.10 (again 32bit and 64bit).
> ok
>
> >Sorry - I cannot find a new style debhelper recipe that works against all
> target platforms
>
>
> ok
>
> thanks for fixing my concerns
>
>
> I admit I'm impressed by it, I built, installed and *I like it*.
> It might be candidate to become my new Desktop Manager!
>
> I'm uploading it shortly, thanks
> for your contribution to Debian!
>
> G.
>

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[Gianfranco Costamagna]

Hi

>Ok - TL;DR; from stuff I was discussing with Paul Wise.  Budgie-Desktop is 
>definitely not Debian deb-helper friendly.  With a standard v9 debhelper - 
>even with a >override_autoreconf, override_autoreconfigure etc, it appears 
>from first glance that the compilation works.  However on installation the 
>budgie-session fails to >launch.  I discussed this upstream but could not find 
>a resolution.

ok


>The recipe you see is basically the older deb packaging style - but more 
>importantly works in Debian Stretch 32bit & 64bit (tested regularly over the 
>last 6 >months), developed from Ubuntu 15.10 and reused for 16.04 and 16.10 
>(again 32bit and 64bit).
ok

>Sorry - I cannot find a new style debhelper recipe that works against all 
>target platforms


ok

thanks for fixing my concerns


I admit I'm impressed by it, I built, installed and *I like it*.
It might be candidate to become my new Desktop Manager!

I'm uploading it shortly, thanks
for your contribution to Debian!

G.

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[foss.freedom]

Hi Gianfranco,

  good to hear from you!  Many thanks for your feedback.

control:

> description should be extended a lot

Have made the descriptions more meaningful

> some build-dependencies might be useless, did you check that? e.g.
dh-buildinfo
> intltool (note: I'm not checking the above)

> "python2.7" <-- what?

>  don't see any Python script here, and I see only
> ./panel/manager.vala:engine.enable_loader("python3");

Good spot - this was a left-over from 6 months ago when git compiling was
done.  This has been tidied.

rules:
> please use the new dh sequencer.

Ok - TL;DR; from stuff I was discussing with Paul Wise.  Budgie-Desktop is
definitely not Debian deb-helper friendly.  With a standard v9 debhelper -
even with a override_autoreconf, override_autoreconfigure etc, it appears
from first glance that the compilation works.  However on installation the
budgie-session fails to launch.  I discussed this upstream but could not
find a resolution.

The recipe you see is basically the older deb packaging style - but more
importantly works in Debian Stretch 32bit & 64bit (tested regularly over
the last 6 months), developed from Ubuntu 15.10 and reused for 16.04 and
16.10 (again 32bit and 64bit).

Sorry - I cannot find a new style debhelper recipe that works against all
target platforms

install files:
> usr/lib/libbudgietheme*.0

> this might be something like:
> usr/lib/libbudgietheme*.so.*

Agreed - fixed.

> maybe?

> lintian overrides? please remove and fix bugs, or comment about why

> you think lintian is wrong
>this is all for a first review.

budgie-core binary: desktop-entry-contains-unknown-key * --> This is
because budgie-desktop introduced its own unique key "Budgie" - the desktop
autostart for network manager and each of the budgie executables use this
key to ensure the executables  only launch for budgie-desktop and therefore
have no impact on people using multiple desktop environments.


happy to remove the override if required.



On 29 June 2016 at 10:57, Gianfranco Costamagna 
wrote:

> control: owner -1 !
> control: tags-1 moreinfo
>
> Hi,
>
> control:
>
> description should be extended a lot
> some build-dependencies might be useless, did you check that? e.g.
> dh-buildinfo
> intltool (note: I'm not checking the above)
>
> "python2.7" <-- what?
>
> I don't see any Python script here, and I see only
> ./panel/manager.vala:engine.enable_loader("python3");
>
>
>
> rules:
> please use the new dh sequencer.
>
> install files:
> usr/lib/libbudgietheme*.0
>
> this might be something like:
> usr/lib/libbudgietheme*.so.*
>
> maybe?
>
> lintian overrides? please remove and fix bugs, or comment about why
>
> you think lintian is wrong
>
> this is all for a first review.
>
> G.
>

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[Gianfranco Costamagna]

control: owner -1 !
control: tags-1 moreinfo

Hi,

control:

description should be extended a lot
some build-dependencies might be useless, did you check that? e.g. dh-buildinfo
intltool (note: I'm not checking the above)

"python2.7" <-- what?

I don't see any Python script here, and I see only
./panel/manager.vala:engine.enable_loader("python3");



rules:
please use the new dh sequencer.

install files:
usr/lib/libbudgietheme*.0

this might be something like:
usr/lib/libbudgietheme*.so.*

maybe?

lintian overrides? please remove and fix bugs, or comment about why

you think lintian is wrong

this is all for a first review.

G.

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[foss.freedom]

Hi all,

  I've updated a new version today of my package budgie-desktop - this
tidies the vcs-browser and git fields in the control file.

Does anyone have anytime to have a look-see and maybe sponsor the package
please?

thanks

David

On 31 May 2016 at 20:14, foss.freedom  wrote:

> Many thanks Paul for the additional review comments.  I've included the
> changes below in a revised package.
>
> Important Note.  I've contacted the maintainer of the budgie-desktop
> package on a couple of issues that was raised.
>
> He has decided to consolidate all the issues raised under one umbrella
> issue:
>
>  - https://github.com/solus-project/budgie-desktop/issues/465
>
> He has graciously (albeit time-limited) offered Debian a minor point
> release that can address any packaging issue or issues.  Two caveats - the
> issue or issues must not be distro specific and he is expecting a
> consolidated list of points to consider - "let's get a complete action plan
> here so I can get my development time back. i.e. kick things into gear."
>
> Whilst I know you do not wish to sponsor this package - do you know of
> someone who can?  I'm keen to get one list together to to keep the
> maintainer positively engaged.  I cannot go back now to the maintainer with
> individual points over a period of time.
>
> On Fri, 2016-05-27 at 20:17 +0100, foss.freedom wrote:
>
> > > Looking on the mentors / mypackages webpage it says that the watch
> > > file I've included does not work.  This is very strange because I ran
> > > a uscan and it correctly downloaded the upstream release file:
>
> > The version we use on mentors is older so that might be the issue.
> > I expect if you use version=3 in the watch file it will work there.
>
> version=3 has been used now and you are quite correct - mentors website no
> longer complains :)
>
> > > In summary - users are requested to upgrade.  Moving forward, the
> > > maintainer intends to branch the project at the next major release
> > > and will backport stuff where necessary (e.g. critical issues).  This
> > > will be very useful for Debian to identify issues to include in
> > > updates.
>
> > Sounds good, please refer to the dev ref for security/stable uploads:
>
> >
> https://www.debian.org/doc/manuals/developers-reference/pkgs.html#upload-stable
> 
> >
> https://www.debian.org/doc/manuals/developers-reference/pkgs.html#bug-security
> 
>
> Thanks for this - I'll use this info for maintenance of the package moving
> forward in the future.
>
> > I suggest dropping the version number from the Upstream-Name field,
> > since version numbers are usually not in the name of upstream projects.
>
> This has now been corrected.
>
> > > I asked this upstream:
> https://github.com/solus-project/budgie-desktop/issues/448
>
> > Nice response :(
>
> > It doesn't sound like they understood what I was trying to say.
>
> > Perhaps the first paragraph of our upstream guide is more clear:
>
> > https://wiki.debian.org/UpstreamGuide#Pristine_Upstream_Source
> 
>
>
> > > In the debian/clean I've removed the build artifacts that upstream
> > > have recommended here https://github.com/solus-project/budgie-
> > > desktop/issues/446#issuecomment-221378660
>
> > There was no need to remove those because autoreconf will automatically
> > overwrite them. The other generated files need to be removed though.
>
> I've removed the clean part of the debian/rules as requested.  With
> regards to the build artifacts and other possible package changes, the
> maintainer has pointed us to this:
> https://github.com/solus-project/budgie-desktop/blob/master/README.md#reporting-issues--project-integration
>
> Basically, if we change the upstream release package in anyway without the
> explicit consent of the maintainer and a problem that is reported that is
> found to be because of that change we will lose support.  "Don't make other
> users suffer because you failed to follow our established build and release
> processes. Use standard methods, and we all benefit."
>
>
> > Thanks for the info. I suggest this course of action in parallel to
> > finding a sponsor for budgie-desktop:
>
> > For each of natray and gvc:
>
> > First, get the embedded code copies documented according to this:
>
> > https://wiki.debian.org/EmbeddedCodeCopies
> 
>
> I looked at that link  - are you asking me to file bug reports to debian
> with the following body text?
>
> "Source: natray
> Severity: normal
> Usertags: embed"
>
> or
>
> "Source: gvc
> Severity: normal
> Usertags: embed"
>
>
> > Second, find out where they are developed and talk with upstream about
> > making these stable projects that are released and can be used as
> > shared libraries by each of the 

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[foss.freedom]

Many thanks Paul for the additional review comments.  I've included the
changes below in a revised package.

Important Note.  I've contacted the maintainer of the budgie-desktop
package on a couple of issues that was raised.

He has decided to consolidate all the issues raised under one umbrella
issue:

 - https://github.com/solus-project/budgie-desktop/issues/465

He has graciously (albeit time-limited) offered Debian a minor point
release that can address any packaging issue or issues.  Two caveats - the
issue or issues must not be distro specific and he is expecting a
consolidated list of points to consider - "let's get a complete action plan
here so I can get my development time back. i.e. kick things into gear."

Whilst I know you do not wish to sponsor this package - do you know of
someone who can?  I'm keen to get one list together to to keep the
maintainer positively engaged.  I cannot go back now to the maintainer with
individual points over a period of time.

On Fri, 2016-05-27 at 20:17 +0100, foss.freedom wrote:

> > Looking on the mentors / mypackages webpage it says that the watch
> > file I've included does not work.  This is very strange because I ran
> > a uscan and it correctly downloaded the upstream release file:

> The version we use on mentors is older so that might be the issue.
> I expect if you use version=3 in the watch file it will work there.

version=3 has been used now and you are quite correct - mentors website no
longer complains :)

> > In summary - users are requested to upgrade.  Moving forward, the
> > maintainer intends to branch the project at the next major release
> > and will backport stuff where necessary (e.g. critical issues).  This
> > will be very useful for Debian to identify issues to include in
> > updates.

> Sounds good, please refer to the dev ref for security/stable uploads:

>
https://www.debian.org/doc/manuals/developers-reference/pkgs.html#upload-stable

>
https://www.debian.org/doc/manuals/developers-reference/pkgs.html#bug-security


Thanks for this - I'll use this info for maintenance of the package moving
forward in the future.

> I suggest dropping the version number from the Upstream-Name field,
> since version numbers are usually not in the name of upstream projects.

This has now been corrected.

> > I asked this upstream:
https://github.com/solus-project/budgie-desktop/issues/448

> Nice response :(

> It doesn't sound like they understood what I was trying to say.

> Perhaps the first paragraph of our upstream guide is more clear:

> https://wiki.debian.org/UpstreamGuide#Pristine_Upstream_Source



> > In the debian/clean I've removed the build artifacts that upstream
> > have recommended here https://github.com/solus-project/budgie-
> > desktop/issues/446#issuecomment-221378660

> There was no need to remove those because autoreconf will automatically
> overwrite them. The other generated files need to be removed though.

I've removed the clean part of the debian/rules as requested.  With regards
to the build artifacts and other possible package changes, the maintainer
has pointed us to this:
https://github.com/solus-project/budgie-desktop/blob/master/README.md#reporting-issues--project-integration

Basically, if we change the upstream release package in anyway without the
explicit consent of the maintainer and a problem that is reported that is
found to be because of that change we will lose support.  "Don't make other
users suffer because you failed to follow our established build and release
processes. Use standard methods, and we all benefit."


> Thanks for the info. I suggest this course of action in parallel to
> finding a sponsor for budgie-desktop:

> For each of natray and gvc:

> First, get the embedded code copies documented according to this:

> https://wiki.debian.org/EmbeddedCodeCopies


I looked at that link  - are you asking me to file bug reports to debian
with the following body text?

"Source: natray
Severity: normal
Usertags: embed"

or

"Source: gvc
Severity: normal
Usertags: embed"


> Second, find out where they are developed and talk with upstream about
> making these stable projects that are released and can be used as
> shared libraries by each of the projects using them.

The links show that upstream (Red Hat/GNOME) are fully aware of the issue
and have been for two years.  There was mention of producing a standalone
binary but despite comments over the last two years, no explicit commitment
has been given.  There is very little that myself or Debian can do other
than monitor those links for movement and if/when a standalone library is
produced to advise the budgie-desktop maintainer to use the standalone
libraries.


> Probably not a good idea to 

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[Paul Wise]

On Fri, 2016-05-27 at 20:17 +0100, foss.freedom wrote:

> Looking on the mentors / mypackages webpage it says that the watch
> file I've included does not work.  This is very strange because I ran
> a uscan and it correctly downloaded the upstream release file:

The version we use on mentors is older so that might be the issue.
I expect if you use version=3 in the watch file it will work there.

> In summary - users are requested to upgrade.  Moving forward, the
> maintainer intends to branch the project at the next major release
> and will backport stuff where necessary (e.g. critical issues).  This
> will be very useful for Debian to identify issues to include in
> updates.

Sounds good, please refer to the dev ref for security/stable uploads:

https://www.debian.org/doc/manuals/developers-reference/pkgs.html#upload-stable
https://www.debian.org/doc/manuals/developers-reference/pkgs.html#bug-security

> This did not reveal any specific build issues.

Hmm.

> > The package fails to build because gtk+3.0 3.20.5-1 is not yet built in 
> > Debian:
> 
> I presume this is a transition issue for Sid as it moves to GTK+3.20

It turned out to be a bug, it is now in sid for most arches:

https://buildd.debian.org/status/package.php?p=gtk%2b3.0

> The dependencies are been cleaned up.  No libraries are included. 
> The minimal necessary dependencies have been left - these are
> required for the desktop system to start successfully

Looks good.

> This has been substantially revised

I suggest dropping the version number from the Upstream-Name field,
since version numbers are usually not in the name of upstream projects.

> The copyright now identifies LGPL vs GPL.

I didn't audit it fully, but it looks good at a glance.

> I asked this upstream: 
> https://github.com/solus-project/budgie-desktop/issues/448

Nice response :(

It doesn't sound like they understood what I was trying to say.

Perhaps the first paragraph of our upstream guide is more clear:

https://wiki.debian.org/UpstreamGuide#Pristine_Upstream_Source

> In the debian/clean I've removed the build artifacts that upstream
> have recommended here https://github.com/solus-project/budgie-
> desktop/issues/446#issuecomment-221378660

There was no need to remove those because autoreconf will automatically
overwrite them. The other generated files need to be removed though.


> https://bugzilla.redhat.com/show_bug.cgi?id=1170875
> https://mail.gnome.org/archives/commits-list/2012-November/msg06793.html
> https://bugzilla.gnome.org/show_bug.cgi?id=686488
> [1] https://mail.gnome.org/archives/gnomecc-list/2012-October/msg3.html

Thanks for the info. I suggest this course of action in parallel to
finding a sponsor for budgie-desktop:

For each of natray and gvc:

First, get the embedded code copies documented according to this:

https://wiki.debian.org/EmbeddedCodeCopies

Second, find out where they are developed and talk with upstream about
making these stable projects that are released and can be used as
shared libraries by each of the projects using them.

Third, get those packaged for Debian.

> > Please add DEP-3 headers to the patches, particularly the
> > Origin/Forwarded headers should point at URLs.
> 
> This has been done.

Probably not a good idea to remove authorship info from patches.

> Upstream are already signing their commits.  Tags/releases are not going to 
> be signed.

Is there a particular reason why they sign commits but not sign
tags/releases? That seems strange to me.

> This has been tidied - only one vital override exists - this is
> needed to display the GNOME appmenu correctly in the window
> decoration.

Hmm, ok. I wonder if this will affect people using both GNOME and
Budgie under different users on the same machine.

> I've moved to misc since I didnt see any other obvious Sid section
> available.  Please advise if there is a better more appropriate
> section for GNOME/GTK+3 based desktop systems such as budgie-desktop

Cinnamon is in Section: x11, that would be appropriate.

> Apparently yes - according to the maintainer as linked above.

Seems weird.

> This is not installed - source only issue.

True, you could send upstream a PR though.

> Maintainer has indicated otherwise  - see link above

Please ask them to read the upstream guide section I quoted above.

> > $ codespell --quiet-level=3
> > 
> 
> Vala to C compiler issues - not an upstream matter.

Not entirely true, there are some in non-generated files:

$ codespell --quiet-level=3
./raven/sound.vala:384: dont  ==> don't
./raven/sound.vala:395: dont  ==> don't
./raven/Makefile.am:44: calender  ==> calendar
./gvc/gvc-mixer-control.c:514: successfull  ==> successful
./gvc/gvc-mixer-control.c:1503: everytime  ==> every time

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


signature.asc
Description: This is a digitally signed message part

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[foss.freedom]

Many thanks Paul for your review - even though you do not wish to sponsor
this, your review has been very valuable.

I've addressed your comments as discussed below.

Looking on the mentors / mypackages webpage it says that the watch file
I've included does not work.  This is very strange because I ran a uscan
and it correctly downloaded the upstream release file:

uscan --force-download --verbose
uscan info: uscan (version 2.16.2ubuntu3) See uscan(1) for help
uscan info: Scan watch files in .
uscan info: Check debian/watch and debian/changelog in .
uscan info: package="budgie-desktop" version="10.2.5-1" (as seen in
debian/changelog)
uscan info: package="budgie-desktop" version="10.2.5" (no epoch/revision)
uscan info: ./debian/changelog sets package="budgie-desktop"
version="10.2.5"
uscan info: Process ./debian/watch (package=budgie-desktop version=10.2.5)
uscan info: Last orig.tar.* tarball version (from debian/changelog): 10.2.5
uscan info: Last orig.tar.* tarball version (dversionmangled): 10.2.5
uscan info: Requesting URL:
   https://github.com/solus-project/budgie-desktop/releases
uscan info: Matching pattern:
   (?:(?:https://github.com
)?\/solus\-project\/budgie\-desktop\/releases)?.*/?(\d{2}\.\d.\d)\.tar\.xz
uscan info: Found the following matching hrefs on the web page (newest
first):

/solus-project/budgie-desktop/releases/download/v10.2.5/budgie-desktop-10.2.5.tar.xz
(10.2.5) index=10.2.5-4

/solus-project/budgie-desktop/releases/download/v10.2.4/budgie-desktop-10.2.4.tar.xz
(10.2.4) index=10.2.4-4

/solus-project/budgie-desktop/releases/download/v10.2.3/budgie-desktop-10.2.3.tar.xz
(10.2.3) index=10.2.3-4

/solus-project/budgie-desktop/releases/download/v10.2.2/budgie-desktop-10.2.2.tar.xz
(10.2.2) index=10.2.2-4

/solus-project/budgie-desktop/releases/download/v10.2.1/budgie-desktop-10.2.1.tar.xz
(10.2.1) index=10.2.1-4
uscan info: Matching target for downloadurlmangle:
https://github.com/solus-project/budgie-desktop/releases/download/v10.2.5/budgie-desktop-10.2.5.tar.xz
uscan info: Upstream URL (downloadurlmangled):

https://github.com/solus-project/budgie-desktop/releases/download/v10.2.5/budgie-desktop-10.2.5.tar.xz
uscan info: Newest upstream tarball version selected for download
(uversionmangled): 10.2.5
uscan info: Download filename (filenamemangled):
budgie-desktop-10.2.5.tar.xz
uscan: Newest version of budgie-desktop on remote site is 10.2.5, local
version is 10.2.5
uscan info:=> Package is up to date for from

https://github.com/solus-project/budgie-desktop/releases/download/v10.2.5/budgie-desktop-10.2.5.tar.xz
uscan info:=> Forcing download as requested
uscan info: Downloading upstream package: budgie-desktop-10.2.5.tar.xz
uscan info: Requesting URL:

https://github.com/solus-project/budgie-desktop/releases/download/v10.2.5/budgie-desktop-10.2.5.tar.xz
uscan info: Successfully downloaded package: budgie-desktop-10.2.5.tar.xz
uscan info: Start checking for common possible upstream OpenPGP signature
files
uscan info: End checking for common possible upstream OpenPGP signature
files
uscan info: Missing OpenPGP signature.
uscan info: New orig.tar.* tarball version (oversionmangled): 10.2.5
uscan info: Executing internal command:
   mk-origtargz --package budgie-desktop --version 10.2.5 --compression
gzip --directory .. --copyright-file debian/copyright
../budgie-desktop-10.2.5.tar.xz
uscan info: New orig.tar.* tarball version (after mk-origtargz): 10.2.5
uscan info: Successfully symlinked ../budgie-desktop-10.2.5.tar.xz to
../budgie-desktop_10.2.5.orig.tar.xz.
uscan info: Scan finished


The remaining review comments and how I addressed them now follows:

> Does upstream have an opinion on having older versions of Budgie in
> Debian stable, which gets supported for 5 years now that we have LTS.

I've asked this question upstream:
https://github.com/solus-project/budgie-desktop/issues/446

In summary - users are requested to upgrade.  Moving forward, the
maintainer intends to branch the project at the next major release and will
backport stuff where necessary (e.g. critical issues).  This will be very
useful for Debian to identify issues to include in updates.

> I would suggest using diffoscope to compare the broken build with the
> working one, you might discover the reason for this brokenness.

This did not reveal any specific build issues.


> The package fails to build because gtk+3.0 3.20.5-1 is not yet built in
Debian:

I presume this is a transition issue for Sid as it moves to GTK+3.20


> There are many hardcoded library dependencies, they shouldn't be
> needed as ${shlibs:Depends} will take care of them, unless these
> libraries are loaded using dlopen instead of linking. If they are
> loaded with dlopen, a ${dlopen:Depends} substvar and a script to
> generate it would be better than hardcoding them.

The dependencies are been cleaned up.  No libraries are included.  The
minimal necessary dependencies 

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[Paul Wise]

On Sun, May 22, 2016 at 6:38 AM, foss.freedom wrote:

> https://mentors.debian.net/debian/pool/main/b/budgie-desktop/budgie-desktop_10.2.5-1.dsc

I've included a review below.

> budgie-desktop is the flagship desktop system for Solus.  Solus is an tier 1
> distro using its own packaging mechanism eopkg.  Solus supports only its own
> distro (naturally) in a 64bit intel based system only.  The maintainer does
> accept bug-reports for other distro's as long as it is reproducible in Solus
> and/or the maintainer considers that the wider use of its desktop
> environment would be enhanced.

Does upstream have an opinion on having older versions of Budgie in
Debian stable, which gets supported for 5 years now that we have LTS.

>   To produce a debian package that works in debian and ubuntu I have used a
> more traditional rules based package rather than a simpler debhelper
> auto-build mechanism.  I have had to do it this way because debhelper does
> not produce binaries that actually work on a Ubuntu based platform - the
> desktop system fails to launch at logon.  The failure is silent - there is
> no obvious reason why debhelper autobuild fails to produce a working
> solution.

I would suggest using diffoscope to compare the broken build with the
working one, you might discover the reason for this brokenness.

> The patches incorporated are required for specifically Debian and Ubuntu and
> are used in budgie-remix itself.

I don't intend to sponsor this but here is a review:

Things that I personally think should be fixed before this package can
be uploaded:

The package fails to build because gtk+3.0 3.20.5-1 is not yet built in Debian:

 libgtk-3-0 : Depends: libgtk-3-common (>= 3.20.5-1) which is a
virtual package and is not provided by any available package
https://buildd.debian.org/status/package.php?p=gtk+3.0=unstable

There are many hardcoded library dependencies, they shouldn't be
needed as ${shlibs:Depends} will take care of them, unless these
libraries are loaded using dlopen instead of linking. If they are
loaded with dlopen, a ${dlopen:Depends} substvar and a script to
generate it would be better than hardcoding them.

debian/copyright is missing some copyright holders.

I think the ftp-masters will want debian/copyright to be more specific
about which files are LGPL and which are GPL.

I note that the upstream tarball contains generated files (*.c *.vapi
*.css *.png *.html). I personally think these need to be removed from
the upstream tarball and VCS if present in either of those and always
created at build time. If upstream doesn't want to do that an
acceptable workaround would be to remove these files in `debian/rules
clean` and in `debian/rules build` before autoreconf/configure are
run. Alternatively you could use the gitub-generated tarballs which
only contain what is in git. Looks like you will need to package some
more build-deps here though, like gulp-sass.

The imports/natray/ and gvc/ directories appear to be embedded code
copies from one of GNOME/cinnamon/MATE/cairo-dock-plug-ins/something.
They should be removed from all of these including budgie and packaged
separately. Until that happens the security team need to be notified
about the embedded code copy, which they track.

$ apt-file search -iIdsc na-tray
https://wiki.debian.org/EmbeddedCodeCopies

Things that I think would be nice to fix:

Please add DEP-3 headers to the patches, particularly the
Origin/Forwarded headers should point at URLs.

http://dep.debian.net/deps/dep3/

The first line of nm-applet.diff looks a bit strange.

The debian-watch-file-is-missing lintian tag should not be overridden
since upstream has a git repo with tags and tarballs that can be used
with uscan and debian/watch.

https://github.com/solus-project/budgie-desktop/releases
https://wiki.debian.org/debian/watch#GitHub

Please file bugs on lintian about the
dep5-copyright-license-name-not-unique and postinst-must-call-ldconfig
false positives.

The binary-without-manpage lintian tag should not be overridden since
it is true. Just ignore it until a manual page exists.

It would be great if upstream could sign their commits, tags and
releases with OpenPGP:

https://wiki.debian.org/Creating%20signed%20GitHub%20releases
https://wiki.debian.org/debian/watch#Cryptographic_signature_verification
https://help.riseup.net/en/security/message-security/openpgp/best-practices

I wonder what happens when you have both budgie and GNOME installed,
will the GNOME change?

Why do you disable the ibus systray icon?

I'm not sure the gnome-settings overrides are appropriate.

I wonder if the gsettings overrides should be renamed to
budgie-desktop.gsettings-override so it is only installed for one
package?

Usually in debian/control the version numbers in dependency relations
have a space before them:

- libgnome-bluetooth-dev (>=3.16),
+ libgnome-bluetooth-dev (>= 3.16),

I like to wrap-and-sort the debian/ directory using this command:

wrap-and-sort --short-indent 

Bug#824967: RFS: budgie-desktop/10.2.5-1 [ITP]

[foss.freedom]

Package: sponsorship-requests
Severity: wishlist

Dear Mentors,

I am looking for a sponsor for my package "budgie-desktop"

Package name: budgie-desktop
Version : 10.2.5
Upstream Author : i...@solus-project.com
URL : https://github.com/solus-project/budgie-desktop
License : LGPL-2.1/GPL2.0
Programming Lang: Vala
Description : The Budgie Desktop is the flagship desktop of the Solus
Operating System.

 Section : gnome

It builds the following binary packages:
Package: budgie-desktop
Description: Desktop package for budgie-desktop
 Budgie is the flagship desktop of the Solus Linux Distribution,
 a Solus project. Designed with the modern user in mind, it focuses on
 simplicity and elegance. A huge advantage for the Budgie desktop is
 that it is not a fork of another project, but rather one written from
 scratch with integration in mind.

Package: budgie-core
Description: Core package for budgie-desktop
 This is the base package for budgie-desktop

Package: libbudgie-plugin0
Section: libs
Description: plugin library for budgie-desktop
 This adds the plugin library to budgie-desktop

Package: libbudgietheme0
Section: libs
Description: theme library for budgie-desktop
 This adds the theme controls for budgie-desktop

Package: libraven0
Section: libs
Description: raven library for budgie-desktop
 This provides the budgie-desktop user-defined settings called raven.

Package: budgie-core-dev
Section: libdevel
Description: development package for budgie-desktop
 Development library allowing compiling against the budgie-desktop API

Package: gir1.2-budgie-desktop-1.0
Section: introspection
Description: GNOME introspection library for budgie-desktop
 This is the introspection library against the budgie-desktop API
 and allows creating plugins in python and Vala

Package: budgie-desktop-doc
Section: doc
Description: documentation files for the budgie-desktop
 This package contains the API documentation in HTML format

  To access further information about this package, please visit the
following URL:

  https://mentors.debian.net/package/budgie-desktop


  Alternatively, one can download the package with dget using this command:

dget -x
https://mentors.debian.net/debian/pool/main/b/budgie-desktop/budgie-desktop_10.2.5-1.dsc

Further Information:

budgie-desktop is the flagship desktop system for Solus.  Solus is an tier
1 distro using its own packaging mechanism eopkg.  Solus supports only its
own distro (naturally) in a 64bit intel based system only.  The maintainer
does accept bug-reports for other distro's as long as it is reproducible in
Solus and/or the maintainer considers that the wider use of its desktop
environment would be enhanced.

The maintainer does produce OBS packages for a number of distros - but not
Debian.

For myself, I am the project leader of a Ubuntu based distro called
budgie-remix that uses budgie-desktop as its choice of desktop.

Thus, my direct interest is ensuring that Debian and its derivative
eco-system is enhanced by the incorporation of this exciting new desktop
system.

Packaging Notes:
  To produce a debian package that works in debian and ubuntu I have used a
more traditional rules based package rather than a simpler debhelper
auto-build mechanism.  I have had to do it this way because debhelper does
not produce binaries that actually work on a Ubuntu based platform - the
desktop system fails to launch at logon.  The failure is silent - there is
no obvious reason why debhelper autobuild fails to produce a working
solution.

I've tested this traditional package mechanism on Debian Stretch 64bit
(up-to-date today), Debian Stretch 32bit (up-to-date today), Ubuntu (64bit)
16.04 and Ubuntu (32bit) 16.04.

This build package has been used for two upstream releases now for
budgie-remix and thus I have confidence that this mechanism will be
sustainable in the long-term.

The patches incorporated are required for specifically Debian and Ubuntu
and are used in budgie-remix itself.

Changes since the last upload:

  * initial Debian package

Regards,
David Mohammed (fossfreedom)