Bug#798900: [Debian-med-packaging] Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
Hi all, I have prepared a package for datatables [1] building directly from the GitHub sources, creating the JS and CSS files and associated images. I have kept the JS policy [2] in mind, storing minified and non-minified versions of the .js files in /usr/share/javascript/datatables, stripping away the package descriptors and examples (also looked at some of the other .js packages in the archive to see how they did it). Embedded copies of JQuery etc. in the upstream source are removed via Files-Excluded during repacking. However, even this package triggers the lintian error we are discussing here as the source input JS file from upstream contains the overly long line [3] that lintian complains about, raising the missing-source error as well. I suppose it is finally OK to write this off as a false positive in this case? I will also look for a sponsor for this package from the Debian Med team to also get it into collab-maint. Cheers, Sascha [1] https://anonscm.debian.org/cgit/users/sascha-guest/datatables.js.git/ [2] https://wiki.debian.org/Javascript/Policy [3] https://github.com/DataTables/DataTablesSrc/blob/master/js/DataTables.js#L25 On 12/10/2015 09:01, Paul Wise wrote: > On Sun, 2015-10-11 at 13:38 +0100, Sascha Steinbiss wrote: > >> It looks like JSHint is not a hard requirement but will just not be used if >> it’s >> not there: >> https://github.com/DataTables/DataTablesSrc/blob/master/build/make.sh#L58 >> Otherwise I wouldn't mind patching the build script to not use it. > > Aha, great! > >> In principle I agree here. > > Good to hear :) > >> Sure. Could you probably give me access to collab-maint then? As a DM I only >> have a >> guest account on Alioth and someone has to approve me. I have sent a request >> via >> the Alioth web interface quite some time ago but received no response. > > I don't have admin access to collab-maint. > > As per the policy, you should have your sponsor or potential sponsor > advocate you in order to get access. Probably someone from debian-med. > > https://lists.debian.org/debian-devel-announce/2012/01/msg6.html > -- The Wellcome Trust Sanger Institute is operated by Genome Research Limited, a charity registered in England with number 1021457 and a company registered in England with number 2742969, whose registered office is 215 Euston Road, London, NW1 2BE.
Bug#798900: [Debian-med-packaging] Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
On Wed, 2015-10-14 at 10:11 +0100, Sascha Steinbiss wrote: > I have prepared a package for datatables [1] building directly from the > GitHub sources, creating the JS and CSS files and associated images. > I have kept the JS policy [2] in mind... All great! Looks good to me. :) > However, even this package triggers the lintian error we are discussing > here as the source input JS file from upstream contains the overly long > line [3] that lintian complains about, raising the missing-source error > as well. I suppose it is finally OK to write this off as a false > positive in this case? Agreed. I'm still curious about the line length though. -- bye, pabs https://wiki.debian.org/PaulWise signature.asc Description: This is a digitally signed message part
Bug#798900: [Debian-med-packaging] Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
On Sun, 2015-10-11 at 13:38 +0100, Sascha Steinbiss wrote: > It looks like JSHint is not a hard requirement but will just not be used if > it’s > not there: > https://github.com/DataTables/DataTablesSrc/blob/master/build/make.sh#L58 > Otherwise I wouldn't mind patching the build script to not use it. Aha, great! > In principle I agree here. Good to hear :) > Sure. Could you probably give me access to collab-maint then? As a DM I only > have a > guest account on Alioth and someone has to approve me. I have sent a request > via > the Alioth web interface quite some time ago but received no response. I don't have admin access to collab-maint. As per the policy, you should have your sponsor or potential sponsor advocate you in order to get access. Probably someone from debian-med. https://lists.debian.org/debian-devel-announce/2012/01/msg6.html -- bye, pabs https://wiki.debian.org/PaulWise signature.asc Description: This is a digitally signed message part
Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
On Sun, 2015-10-11 at 10:41 +0200, Ole Streicher wrote: > The Readme.md states that the files in the DataTables were generated > from the ones in DataTablesSrc, which means that DataTablesSrc contains > the *sources*. That is exactly my point. > Specifically, > https://github.com/DataTables/DataTablesSrc/blob/master/js/DataTables.js > contains a line 25 (> 1024 characters long): > which triggers the lintian error in the case of python-astropy. I don't > see why this is real, since: Yes, I hadn't seen that the line lintian was triggered on in jquery.dataTables.js was also in one of the source files DataTables.js so I had assumed that the build process was creating this line. > --> lintian uses some heuristics here, which does obviously not match > the real life. Until this is improved, I would (again) propose to use > the "experimental" tag here; this is what this tag is for. Agreed that the heuristics need adjusting (some changes are in git) and that the tag should be marked as possible rather than certain. I don't think wild-guess is appropriate though. > I would also propose to consider removing at least the line length test > for comments. That seems reasonable. > They don't; at least not in the case of python-astropy. The do actually, astropy/extern/js/jquery.dataTables.js is an embedded code copy of a build artefact. In other words it is from DataTables instead of from DataTablesSrc. Personally I would repack the tarball to remove it and package DataTablesSrc separately. -- bye, pabs https://wiki.debian.org/PaulWise signature.asc Description: This is a digitally signed message part
Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
On 12.10.2015 09:58, Paul Wise wrote:
>> They don't; at least not in the case of python-astropy.
> The do actually, astropy/extern/js/jquery.dataTables.js is an embedded
> code copy of a build artefact.
How do you see this? It is well formatted, including comments etc. In
the packages I maintain I have source files which are much worse to
maintain. Again my question: for what kind of editing you would prefer a
different ("original") source? What do you miss here?
And, again: would you consider any automatically inserted line, like CVS
tags as non-source, and reject these files from Debian? What is the
difference here?
> In other words it is from DataTables instead of from DataTablesSrc.
> Personally I would repack the tarball to remove it and package DataTablesSrc
> separately.
How do you come to that?
$ wget
https://raw.githubusercontent.com/DataTables/DataTablesSrc/1_9/media/js/jquery.dataTables.js
\
-Ogit-jquery.dataTables.js
$ wget
https://sources.debian.net/data/main/p/python-astropy/1.0.4-1/astropy/extern/js/jquery.dataTables.js
\
-Oastropy-git-jquery.dataTables.js
$ diff -c git-jquery.dataTables.js astropy-git-jquery.dataTables.js
Files git-jquery.dataTables.js and astropy-git-jquery.dataTables.js are
identical
Don't you have the feeling that you hunt some ghosts here? Please
explain me what this error is about; I feel a bit upset now that you put
some "rules" what is a source and what not, which are nowhere defined
(the only definition I have is the one from GPL, which means "preferred
to edit"), and them randomly trigger some files without a reason, and
without any explanation.
There is no definition (at least, as I know), that requires source files
to be (completely) manually generated,
There is no proof that the file in question is manually generated.
There is nothing that I could discuss with upstream to change the file
-- actually the file was put there by upstream after I asked them to
include the source [1].
But I get a lintian complaint, and then answers like "remove this file",
or "this is a borderline case" or similar. I *am* aware of having the
sources included; however it would be really nice if you were a bit
careful here as well, and at least explain why do you think that this
file is not a source, and by which definition.
Best regards
Ole
[1] https://github.com/astropy/astropy/issues/1992
Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
Sorry, I don't understand this: Am 10.10.2015 um 22:35 schrieb Paul Wise: > On Sun, 13 Sep 2015 21:46:37 + Sascha Steinbiss wrote: > >> Looks like the JQuery DataTables libraries included are flagged as minified >> without source on the basis that they have lines longer than 1024 >> characters: >> P: aegean source: source-contains-prebuilt-javascript-object >> data/share/vendor/jquery.dataTables.js line length is 1397 characters (>1024) >> E: aegean source: source-is-missing data/share/vendor/jquery.dataTables.js >> [...] > lintian is absolutely correct to flag this file, it is generated from a > bunch of other JavaScript files using Bash, PHP 5.4+, JSHint 2.1+ and > the Closure compiler, at least according to the upstream git repos: > > https://github.com/DataTables/DataTablesSrc/ > https://github.com/DataTables/DataTables/ The Readme.md states that the files in the DataTables were generated from the ones in DataTablesSrc, which means that DataTablesSrc contains the *sources*. Specifically, https://github.com/DataTables/DataTablesSrc/blob/master/js/DataTables.js contains a line 25 (> 1024 characters long): /*globals $,require,jQuery,define,_selector_run, [...] */ which triggers the lintian error in the case of python-astropy. I don't see why this is real, since: 1. There is no indication that this line was not inserted manually, or maybe automatically by the editor (emacs f.e. could probably do that during the edit -- this would not make the file automatically generated), 2. Even if it was inserted by some script, it does not make the file sourceless, since the source of this line is clearly the file content itself, 3. there is no use case that you want to not edit this file, its "source" (whatever this is). The line is a just comment, without any influence on the semantics of the file. If you disagree here, you should seriously consider flagging all CVS and SVN tags in source files as "sourceless", since they are not to be edited manually as well. --> lintian uses some heuristics here, which does obviously not match the real life. Until this is improved, I would (again) propose to use the "experimental" tag here; this is what this tag is for. I would also propose to consider removing at least the line length test for comments. > I'm not sure what the correct heuristics to use are but in the > jquery.dataTables.js case the existing ones produced the right result. > They don't; at least not in the case of python-astropy. Best regards Ole
Bug#798900: [Debian-med-packaging] Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
Hi, >> For the time being, would it be enough to add the DataTablesSrc repo >> content (and a README) to aegean’s debian/missing-sources to comply >> with DFSG until a DataTables package gets into the archive? > > Better than nothing but I think it still violates ftpmaster policy > since it might not be possible to build DataTablesSrc because JSHint > isn't in Debian yet. It looks like JSHint is not a hard requirement but will just not be used if it’s not there: https://github.com/DataTables/DataTablesSrc/blob/master/build/make.sh#L58 Otherwise I wouldn't mind patching the build script to not use it. > Their policy is that things must be buildable from > source but not that the source package has to build from source. > Personally I think the only way to prove that you can build from source > is to actually build from source, every time you build. In principle I agree here. >> I’m asking because the existing but apparently never uploaded draft >> DataTables package [1] does not build DataTables from ‘source’ either >> but just gets and repacks the built distribution from >> https://github.com/DataTables/DataTables/. So I guess I would need to >> start from scratch... > > I see, yeah. If you do work on it, please replace the existing repo > instead of starting a new repo. Sure. Could you probably give me access to collab-maint then? As a DM I only have a guest account on Alioth and someone has to approve me. I have sent a request via the Alioth web interface quite some time ago but received no response. Thanks, Sascha signature.asc Description: Message signed with OpenPGP using GPGMail
Bug#798900: [Debian-med-packaging] Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
Hi all, >>> Looks like the JQuery DataTables libraries included are flagged as minified >>> without source on the basis that they have lines longer than 1024 >>> characters: >>> P: aegean source: source-contains-prebuilt-javascript-object >>> data/share/vendor/jquery.dataTables.js line length is 1397 characters >>> (>1024) >>> E: aegean source: source-is-missing data/share/vendor/jquery.dataTables.js >>> [...] >> >> lintian is absolutely correct to flag this file, it is generated from a >> bunch of other JavaScript files using Bash, PHP 5.4+, JSHint 2.1+ and >> the Closure compiler, at least according to the upstream git repos: >> >> https://github.com/DataTables/DataTablesSrc/ >> https://github.com/DataTables/DataTables/ > > Wow, I see (and can’t help but feel a slight WTF about this building setup). > Thanks for pointing this out. I guess the cleanest way to proceed here would > be to properly package DataTables built from source as a dependency for > aegean. Then it wouldn't need to be included with the aegean source anymore, > as it is already the case with its other JS dependencies. I’ll put this on my > agenda. For the time being, would it be enough to add the DataTablesSrc repo content (and a README) to aegean’s debian/missing-sources to comply with DFSG until a DataTables package gets into the archive? I’m asking because the existing but apparently never uploaded draft DataTables package [1] does not build DataTables from ‘source’ either but just gets and repacks the built distribution from https://github.com/DataTables/DataTables/. So I guess I would need to start from scratch... Thanks Sascha [1] http://anonscm.debian.org/cgit/collab-maint/jquery-datatables.git/ signature.asc Description: Message signed with OpenPGP using GPGMail
Bug#798900: [Debian-med-packaging] Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
On Sat, 2015-10-10 at 23:57 +0100, Sascha Steinbiss wrote: > For the time being, would it be enough to add the DataTablesSrc repo > content (and a README) to aegean’s debian/missing-sources to comply > with DFSG until a DataTables package gets into the archive? Better than nothing but I think it still violates ftpmaster policy since it might not be possible to build DataTablesSrc because JSHint isn't in Debian yet. Their policy is that things must be buildable from source but not that the source package has to build from source. Personally I think the only way to prove that you can build from source is to actually build from source, every time you build. > I’m asking because the existing but apparently never uploaded draft > DataTables package [1] does not build DataTables from ‘source’ either > but just gets and repacks the built distribution from > https://github.com/DataTables/DataTables/. So I guess I would need to > start from scratch... I see, yeah. If you do work on it, please replace the existing repo instead of starting a new repo. -- bye, pabs https://wiki.debian.org/PaulWise signature.asc Description: This is a digitally signed message part
Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
On Sat, 2015-10-10 at 23:28 +0100, Sascha Steinbiss wrote: > can’t help but feel a slight WTF about this building setup Welcome to the world of JavaScript :) > I guess the cleanest way to proceed here would be to properly package > DataTables built from source as a dependency for aegean. Then it > wouldn't need to be included with the aegean source anymore, as it is > already the case with its other JS dependencies. I’ll put this on my > agenda. Agreed, thanks for considering this. > OK. Still, I feel that line length probably is a bit weak as > evidence. Agreed, in your case it would also flag the source from DataTablesSrc so clearly something needs to be different. There is some work in lintian git to try to improve this situation. OTOH probably some false positives in these checks are acceptable in order to get the situation with JavaScript in Debian a bit closer to sanity. -- bye, pabs https://wiki.debian.org/PaulWise signature.asc Description: This is a digitally signed message part
Bug#798900: lintian: false positive: source-is-missing for non-minified JS files
Hi Paul, >> Looks like the JQuery DataTables libraries included are flagged as minified >> without source on the basis that they have lines longer than 1024 characters: >> P: aegean source: source-contains-prebuilt-javascript-object >> data/share/vendor/jquery.dataTables.js line length is 1397 characters (>1024) >> E: aegean source: source-is-missing data/share/vendor/jquery.dataTables.js >> [...] > > lintian is absolutely correct to flag this file, it is generated from a > bunch of other JavaScript files using Bash, PHP 5.4+, JSHint 2.1+ and > the Closure compiler, at least according to the upstream git repos: > > https://github.com/DataTables/DataTablesSrc/ > https://github.com/DataTables/DataTables/ Wow, I see (and can’t help but feel a slight WTF about this building setup). Thanks for pointing this out. I guess the cleanest way to proceed here would be to properly package DataTables built from source as a dependency for aegean. Then it wouldn't need to be included with the aegean source anymore, as it is already the case with its other JS dependencies. I’ll put this on my agenda. > I'm not sure what the correct heuristics to use are but in the > jquery.dataTables.js case the existing ones produced the right result. OK. Still, I feel that line length probably is a bit weak as evidence. Cheers, Sascha signature.asc Description: Message signed with OpenPGP using GPGMail
