Package: elpa-elfeed-web
Version: 3.1.0-1
Severity: serious
Control: block -1 by 902083
Control: found -1 3.3.0-1
elfeed-web uses Foundation [1], AngularJS [2], and URI.js [3], loading
them from various CDN sites in index.html:
<link rel="stylesheet"
href="//cdn.jsdelivr.net/foundation/4.3.1/css/foundation.min.css"/>
<script
src="//ajax.googleapis.com/ajax/libs/angularjs/1.0.7/angular.min.js"></script>
<script
src="//cdnjs.cloudflare.com/ajax/libs/URI.js/1.7.2/URI.min.js"></script>
AngularJS is included in main, but Foundation and URI.js are not. This
is probably a violation of Policy 2.2.1, which states that “None of the
packages in the main archive area requires software outside of that
area to function.”
Ideally, Debian’s elfeed-web should Depend on packages containing
Foundation, AngularJS, and URI.js, and it should be patched to load
those resources from the same origin as index.html. There’s already an
ITP for URI.js, which I’ve marked as a blocker for this bug.
[1] https://foundation.zurb.com/
[2] https://angularjs.org/
[3] https://medialize.github.io/URI.js/
