Roundup in stretch? [Re: Searching for a roundup sponsor]
On 01/10/15 22:11, Kai Storbeck wrote: > Hi, > > Roundup 1.4.20-1.1 is still the version in stable. Roundup 1.5 was released a > few years back, and I need someone to help me with the final stages in > getting 1.5 in stretch, or getting it removed. > > > Roundup is a python web application with quite some vendored code (javascript > libs and fonts), 5 different licenses, and in 1.5.0 there is an offending > file that has an incompatible licensing, so I had to "dfsg" it. (is there a > verb for that?) > > During this work a security issue came along and this made me realise that > the architecture of roundup isn't exactly compatible with what I would expect > from a proper Debain package. > > We can create security updates for roundup, but that won't help any existing > user as all actual issue trackers are using a copy of the lib at the time of > their birth. > > I'm quite unsure on how to proceed here, but perhaps someone with more > experience can help me with the steps needed. > Hello Python Application Team, I'm still reasonably at the same spot as I was in October 2015. Lets compare Roundup with Trac or Request-tracker4: Roundup is not designed to be customizable in the way Request Tracker (request-tracker4) is. The latter supports local customizations (in /usr/local) and plugins either from source, Debian packaged extensions; without having to rewrite any files from the package in /usr/share. Trac is only customizable through settings or extra plugins. Code is not changed, nor copied, IIUC. Roundup is intended to be copied and heavily customized, although I can see a very small niche where roundup would contain only an instantiated demo tracker in /usr/share (I.e. no customizable config/authorization). My advice: File a removal. I certainly have only partially enjoyed maintaining it. I'm open to filing an RFA instead of a removal, but I need some discussion with some people for a consensus. Kind Regards, Kai Storbeck signature.asc Description: OpenPGP digital signature
Searching for a roundup sponsor
Hi, Roundup 1.4.20-1.1 is still the version in stable. Roundup 1.5 was released a few years back, and I need someone to help me with the final stages in getting 1.5 in stretch, or getting it removed. Roundup is a python web application with quite some vendored code (javascript libs and fonts), 5 different licenses, and in 1.5.0 there is an offending file that has an incompatible licensing, so I had to "dfsg" it. (is there a verb for that?) During this work a security issue came along and this made me realise that the architecture of roundup isn't exactly compatible with what I would expect from a proper Debain package. We can create security updates for roundup, but that won't help any existing user as all actual issue trackers are using a copy of the lib at the time of their birth. I'm quite unsure on how to proceed here, but perhaps someone with more experience can help me with the steps needed. Thanks, -- Kai Storbeck kaisan on (oftc, freenet) irc signature.asc Description: OpenPGP digital signature
Re: Joining the PAPT with roundup
On 15/01/2014 23:47, Piotr Ożarowski wrote: [Kai Storbeck, 2014-01-15] My Alioth username is kaisan-guest, and I would like to request a repository on Alioth for roundup. Welcome on board! Hi Piotr, and the rest, Thanks a lot. I've now uploaded my old version of roundup, being version 1.4.20 from wheezy. What is considered good practice for a package maintained by a non-DM/DD? Should I replay my git commits on subversion, or can I create a huge commit that will show the work done up to now? Would someone be interested in the small intermediate commits? They sound boring to me :) Cheers! Kai signature.asc Description: OpenPGP digital signature
Joining the PAPT with roundup
Hello everyone, I currently maintain roundup for the past 2 years, which has been a bumpy ride, I got 1 release out of the door for wheezy. Recently I found the existence of this team, and I sincerely hope you can help me with the roundup package maintenance in the long run. I have a few outstanding issues for the next 1.5 upload for jessie, which I'm discussing with Sebastian Ramacher, but I'd like to move the sources into Aloith's svn, and get some more exposure to potential sponsors through the PAP team. My Alioth username is kaisan-guest, and I would like to request a repository on Alioth for roundup. Cheers, Kai signature.asc Description: OpenPGP digital signature
