Bug#923220: Bug#922965: Bug#923220: DFSG compliance concerns

[Russ Allbery]

Philipp Meisberger  writes:

> What about the java-package and DFSG? It is very similar to my package
> and also does not build a .deb from source but is contained in Debian.

java-package is not in Debian.  It's in the contrib distribution, which is
a set of packages provided alongside Debian for working with non-free
software.

This sort of upstream repackager, if it itself is released under a free
software license, is in general acceptable for contrib if someone is
willing to sponsor it.  (I haven't looked at the details of this specific
package.)

-- 
Russ Allbery (r...@debian.org)   

Bug#923220: DFSG compliance concerns

[Carsten Schoenert]

Hello Philipp,

Am 03.03.19 um 16:55 schrieb Philipp Meisberger:
> Hi,
> 
> it is correct that the package just builds a .deb file which contains
> full functional Arduino IDE. Simple and clean.

maybe simple, but definitely not clean from a point of view of the DFSG!
And that's what Rock Storm has mentioned. All packages that are not
fulfilling the DFSG aren't Debian or can't be Debian and need to go to
non-free. But as it's possible to package the arduino IDE for main it
would be confusing for user to also find a arduino package in the
non-free sections.

> What about the java-package and DFSG? It is very similar to my package
> and also does not build a .deb from source but is contained in Debian.

Please have a look at the existing package arduino!
One of the most important files within the Debian packaging is the
copyright file.

https://salsa.debian.org/electronics-team/arduino/arduino/blob/master/debian/copyright

Please note the Files-Excluded field here, it is listing all the files
that are excluded so the package is DFSG clean.

Next there is a file README.source.

https://salsa.debian.org/electronics-team/arduino/arduino/blob/master/debian/README.source

It mostly describes what steps are needed to import a new source tarball
and how to handle the packaging if needed.

Packaging the arduino IDE isn't a nice package where new contributors
should start with (because of this massive DFSG stuff). Geert (CCd) was
one of the latest people who have worked on arduino so he could probably
say something about the current state of the arduino package. I'm not
familiar enough to give more advises regarding updating the arduino
package, I guess Geert can jump in. But I hardly won't see a non-free
arduino IDE package in Debian or a helper package in contrib.

-- 
Regards
Carsten Schoenert

Bug#923220: DFSG compliance concerns

[Philipp Meisberger]

Hi,

it is correct that the package just builds a .deb file which contains
full functional Arduino IDE. Simple and clean.

What about the java-package and DFSG? It is very similar to my package
and also does not build a .deb from source but is contained in Debian.

Regards,
Philipp

Am 03.03.19 um 13:07 schrieb Rock Storm:
> Hi all,
> 
> @Carsten, as was pointed out `arduino-builder` and this package are
> completely different, though the name of course might be misleading.
> 
> @Philipp, I looked at your script. It effectively builds a '.deb' file
> which can be installed. However you are not building the Arduino IDE,
> your package simply contains the very binaries provided by upstream.
> That is not the way Debian works. The binaries shipped in a Debian
> package must be built from source. We must make sure the building is
> reproducible and achievable on all supported architectures.
> 
> Therefore this software somehow promotes practices that I'd say are
> against the DFSG.
> 
> Regards,  
> 



signature.asc
Description: OpenPGP digital signature

Bug#923220: DFSG compliance concerns

[Rock Storm]

Hi all,

@Carsten, as was pointed out `arduino-builder` and this package are
completely different, though the name of course might be misleading.

@Philipp, I looked at your script. It effectively builds a '.deb' file
which can be installed. However you are not building the Arduino IDE,
your package simply contains the very binaries provided by upstream.
That is not the way Debian works. The binaries shipped in a Debian
package must be built from source. We must make sure the building is
reproducible and achievable on all supported architectures.

Therefore this software somehow promotes practices that I'd say are
against the DFSG.

Regards,  

-- 
Rock Storm
GPG KeyID: 4096R/C96832FD
GPG Fingerprint:
 C304 34B3 632C 464C 2FAF  C741 0439 CF52 C968 32FD


signature.asc
Description: PGP signature