Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[Paul Wise]

On Mon, 2016-10-10 at 13:25 +, SOUBEYRAND Yann - externe wrote:

> Indeed, I did a mistake… Should I have included it manually or is there
> a way for debhelper to auto-detect it as for shared libraries?

I think there is a way for pybuild but I'm not sure.

https://wiki.debian.org/Python/Pybuild

> So, if python-gnomekeyring is about to be removed from the archive, is
> it a good idea to include gkeyring in the archive? Not sure about this.
> What's your opinion?

Maybe it should be kept out until upstream migrates to using the
introspection stuff. The new method of importing the gk module:

from gi.repository import GnomeKeyring

Could you contact the ftp-masters to ask for a reject?

https://ftp-master.debian.org/#contact

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


signature.asc
Description: This is a digitally signed message part

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[SOUBEYRAND Yann - externe]

Le lundi 10 octobre 2016 à 21:17 +0800, p...@debian.org a écrit :
> On Mon, 2016-10-10 at 13:03 +, SOUBEYRAND Yann - externe wrote:
> 
> > Unless I did a mistake, it seems that this dependency isn't missing:
> > 
> > https://github.com/yann-soubeyrand/gkeyring/blob/debian/sid/debian/control#L10
> 
> I was referring to the binary package, not the source package:
> 
> https://ftp-master.debian.org/new/gkeyring_0.4-1-gf4ce4c7-1.html#binary-gkeyring-control
> 

Indeed, I did a mistake… Should I have included it manually or is there
a way for debhelper to auto-detect it as for shared libraries?

So, if python-gnomekeyring is about to be removed from the archive, is
it a good idea to include gkeyring in the archive? Not sure about this.
What's your opinion?



Ce message et toutes les pièces jointes (ci-après le 'Message') sont établis à 
l'intention exclusive des destinataires et les informations qui y figurent sont 
strictement confidentielles. Toute utilisation de ce Message non conforme à sa 
destination, toute diffusion ou toute publication totale ou partielle, est 
interdite sauf autorisation expresse.

Si vous n'êtes pas le destinataire de ce Message, il vous est interdit de le 
copier, de le faire suivre, de le divulguer ou d'en utiliser tout ou partie. Si 
vous avez reçu ce Message par erreur, merci de le supprimer de votre système, 
ainsi que toutes ses copies, et de n'en garder aucune trace sur quelque support 
que ce soit. Nous vous remercions également d'en avertir immédiatement 
l'expéditeur par retour du message.

Il est impossible de garantir que les communications par messagerie 
électronique arrivent en temps utile, sont sécurisées ou dénuées de toute 
erreur ou virus.


This message and any attachments (the 'Message') are intended solely for the 
addressees. The information contained in this Message is confidential. Any use 
of information contained in this Message not in accord with its purpose, any 
dissemination or disclosure, either whole or partial, is prohibited except 
formal approval.

If you are not the addressee, you may not copy, forward, disclose or use any 
part of it. If you have received this message in error, please delete it and 
all copies from your system and notify the sender immediately by return message.

E-mail communication cannot be guaranteed to be timely secure, error or 
virus-free.

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[Paul Wise]

On Mon, 2016-10-10 at 13:03 +, SOUBEYRAND Yann - externe wrote:

> Unless I did a mistake, it seems that this dependency isn't missing:
> 
> https://github.com/yann-soubeyrand/gkeyring/blob/debian/sid/debian/control#L10

I was referring to the binary package, not the source package:

https://ftp-master.debian.org/new/gkeyring_0.4-1-gf4ce4c7-1.html#binary-gkeyring-control

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


signature.asc
Description: This is a digitally signed message part

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[SOUBEYRAND Yann - externe]

Le lundi 10 octobre 2016 à 20:50 +0800, un expéditeur inconnu a écrit :
> On Mon, Oct 10, 2016 at 8:19 PM, Yann Soubeyrand wrote:
> 
> > Thanks!
> 
> FYI, it was pointed out to me on the Debian GNOME IRC channel some things:
> 
> The Depends in the binary package is broken as it is missing
> python-gnomekeyring.

Unless I did a mistake, it seems that this dependency isn't missing:

https://github.com/yann-soubeyrand/gkeyring/blob/debian/sid/debian/control#L10

> python-gnomekeyring is deprecated and the Debian GNOME team want to remove it.

OK, I wasn't aware of this fact.

> secret-tool exists (but IMO isn't as good as gkeyring).

I'll give it a try ;-)



Ce message et toutes les pièces jointes (ci-après le 'Message') sont établis à 
l'intention exclusive des destinataires et les informations qui y figurent sont 
strictement confidentielles. Toute utilisation de ce Message non conforme à sa 
destination, toute diffusion ou toute publication totale ou partielle, est 
interdite sauf autorisation expresse.

Si vous n'êtes pas le destinataire de ce Message, il vous est interdit de le 
copier, de le faire suivre, de le divulguer ou d'en utiliser tout ou partie. Si 
vous avez reçu ce Message par erreur, merci de le supprimer de votre système, 
ainsi que toutes ses copies, et de n'en garder aucune trace sur quelque support 
que ce soit. Nous vous remercions également d'en avertir immédiatement 
l'expéditeur par retour du message.

Il est impossible de garantir que les communications par messagerie 
électronique arrivent en temps utile, sont sécurisées ou dénuées de toute 
erreur ou virus.


This message and any attachments (the 'Message') are intended solely for the 
addressees. The information contained in this Message is confidential. Any use 
of information contained in this Message not in accord with its purpose, any 
dissemination or disclosure, either whole or partial, is prohibited except 
formal approval.

If you are not the addressee, you may not copy, forward, disclose or use any 
part of it. If you have received this message in error, please delete it and 
all copies from your system and notify the sender immediately by return message.

E-mail communication cannot be guaranteed to be timely secure, error or 
virus-free.

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[Paul Wise]

On Mon, Oct 10, 2016 at 8:19 PM, Yann Soubeyrand wrote:

> Thanks!

FYI, it was pointed out to me on the Debian GNOME IRC channel some things:

The Depends in the binary package is broken as it is missing
python-gnomekeyring.

python-gnomekeyring is deprecated and the Debian GNOME team want to remove it.

secret-tool exists (but IMO isn't as good as gkeyring).

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[Yann Soubeyrand]

Le samedi 08 octobre 2016 à 11:26 +0800, un expéditeur inconnu a écrit :
> On Fri, Oct 7, 2016 at 5:14 PM, SOUBEYRAND Yann - externe wrote:
> 
> > Thank you for your interest in sponsoring this package ;-)
> 
> No, thank you for being willing to package and maintain it!
> 
> > I uploaded a new version which should address the most important
> > concerns you raised
> 
> Great, built, signed and uploaded it to NEW:
> 
> http://ftp-master.debian.org/new.html

Thanks!

> Once the package reaches Debian, please add debtags and screenshots:
> 
> https://debtags.debian.org/
> https://screenshots.debian.net/
> 
> For future updates, please file an RFS bug as usual.
> 
> > Vcs-Git: https://github.com/yann-soubeyrand/gkeyring.git
> 
> Please upload your Debian packaging to this repository.

Done ;-)

Regards

Yann

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[SOUBEYRAND Yann - externe]

Hi!

Thank you for your interest in sponsoring this package ;-)

I uploaded a new version which should address the most important
concerns you raised

https://mentors.debian.net/debian/pool/main/g/gkeyring/gkeyring_0.4-1-gf4ce4c7-1.dsc

Regards

Yann

Le jeudi 06 octobre 2016 à 12:49 +0800, un expéditeur inconnu a écrit :
> Control: owner -1 !
> Control: tags -1 + moreinfo
> 
> On Wed, Oct 5, 2016 at 10:46 PM, Yann Soubeyrand wrote:
> 
> >   dget -x 
> > https://mentors.debian.net/debian/pool/main/g/gkeyring/gkeyring_0.4-1.dsc
> 
> I intend to sponsor this.
> 
> These issues block the upload of this package:
> 
> Neither the upstream tarball nor debian/ contain a copy of the AGPLv3.
> I see upstream has one in their repository, so they just need to tag a
> new release and you need to update to it, or you could package the
> commit that adds it. The debian/copyright file should also contain a
> full copy of the AGPLv3.
> 
> These issues would be nice to fix:
> 
> The watch file is broken (see below).
> 
> I think you probably only need python rather than python-all?
> 
> The Vcs-Browser field points at the upstream repository instead of the
> Debian one, please remove it or replace it.
> 
> The Vcs-Git field should be present when Vcs-Browser is pointing at a
> git repository browser.
> 
> The Homepage field should point at github because of this on the launchpad 
> page:
> 
> The project is now hosted here:
> https://github.com/kparal/gkeyring
> This Launchpad site is used for its Answers discussion forum only.
> 
> Remove the word Python from the description, the implementation
> language isn't relevant to end users.
> 
> This command will make diffs of debian/ easier to read:
> 
> wrap-and-sort --short-indent --wrap-always --sort-binary-packages
> --trailing-comma
> 
> The debian/ directory is usually licensed under the same license as upstream.
> 
> Please add some upstream metadata:
> 
> https://wiki.debian.org/UpstreamMetadata
> 
> Please get the manual page included upstream, or get documentation
> included in gkeyring.py and have the manual page generated from it
> using sphinx and sphinxcontrib-autoprogram/sphinx-argparse.
> 
> Please ask upstream about switching to or supporting Python 3 and then
> switching to it in Debian.
> 
> Upstream is using an image for flattr, I'd suggest they drop it and
> only use the existing link, otherwise HTML versions of the README.rst
> will violate the privacy of people who load those HTML files. github
> is mitigating that by serving all external images from github.com but
> it could still occur if someone were to render the document to HTML.
> 
> Upstream may want to use signed commits tags and releases:
> 
> https://mikegerwitz.com/papers/git-horror-story
> https://wiki.debian.org/Creating%20signed%20GitHub%20releases
> https://wiki.debian.org/debian/watch#Cryptographic_signature_verification
> 
> Upstream may want to read our guide for upstreams:
> 
> https://wiki.debian.org/UpstreamGuide
> 
> Once the package reaches Debian, add debtags and screenshots:
> 
> https://debtags.debian.org/
> https://screenshots.debian.net/
> 
> Automated checks:
> 
> lintian:
> 
> P: gkeyring source: debian-watch-may-check-gpg-signature
> 
> check-all-the-things:
> 
> $ env PERL5OPT=-m-lib=. cme check dpkg
> ...
> Warning in 'control source Build-Depends:0' value 'debhelper (>= 9~)':
> should be (>= 9) not (>= 9~) because compat is 9
> ...
> you can try 'cme fix dpkg' to fix the warnings shown above
> 
> # check if these can be switched to https://
> $ grep -rF http: .
> ./gkeyring.py:# http://www.gnu.org/licenses/agpl-3.0.html
> ./gkeyring.py:#
> http://blogs.codecommunity.org/mindbending/bending-gnome-keyring-with-python-part-2/
> ./README.rst:You can install this tool from `PyPI
> `_ (using `pip
> `_, `setuptools
> `_ or `distutils
> `_)::
> ./README.rst:This program is a free software, licensed under `GNU AGPL
> 3+ `_.
> ./README.rst:.. image:: http://api.flattr.com/button/flattr-badge-large.png
> ./debian/copyright: along with this program. If not, see
> .
> ./debian/copyright: along with this program. If not, see
> .
> 
> # Note the missing / at the end of the URL
> $ env PERL5OPT=-m-lib=. license-reconcile
> FormatSpec: Cannot recognize format: Format:
> https://www.debian.org/doc/packaging-manuals/copyright-format/1.0 at
> /usr/share/perl5/Debian/LicenseReconcile/App.pm line 222,  line
> 3.
> 
> # This command checks style. While a consistent style
> # is a good idea, people who have different style
> # preferences will want to ignore some of the output.
> # Do not bother adding non-upstreamable patches for this.
> $ find -type f -iname '*.py' -exec pep8 --ignore W191 {} +
> 
> 
> $ find -type f 

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[Paul Wise]

Control: owner -1 !
Control: tags -1 + moreinfo

On Wed, Oct 5, 2016 at 10:46 PM, Yann Soubeyrand wrote:

>   dget -x 
> https://mentors.debian.net/debian/pool/main/g/gkeyring/gkeyring_0.4-1.dsc

I intend to sponsor this.

These issues block the upload of this package:

Neither the upstream tarball nor debian/ contain a copy of the AGPLv3.
I see upstream has one in their repository, so they just need to tag a
new release and you need to update to it, or you could package the
commit that adds it. The debian/copyright file should also contain a
full copy of the AGPLv3.

These issues would be nice to fix:

The watch file is broken (see below).

I think you probably only need python rather than python-all?

The Vcs-Browser field points at the upstream repository instead of the
Debian one, please remove it or replace it.

The Vcs-Git field should be present when Vcs-Browser is pointing at a
git repository browser.

The Homepage field should point at github because of this on the launchpad page:

The project is now hosted here:
https://github.com/kparal/gkeyring
This Launchpad site is used for its Answers discussion forum only.

Remove the word Python from the description, the implementation
language isn't relevant to end users.

This command will make diffs of debian/ easier to read:

wrap-and-sort --short-indent --wrap-always --sort-binary-packages
--trailing-comma

The debian/ directory is usually licensed under the same license as upstream.

Please add some upstream metadata:

https://wiki.debian.org/UpstreamMetadata

Please get the manual page included upstream, or get documentation
included in gkeyring.py and have the manual page generated from it
using sphinx and sphinxcontrib-autoprogram/sphinx-argparse.

Please ask upstream about switching to or supporting Python 3 and then
switching to it in Debian.

Upstream is using an image for flattr, I'd suggest they drop it and
only use the existing link, otherwise HTML versions of the README.rst
will violate the privacy of people who load those HTML files. github
is mitigating that by serving all external images from github.com but
it could still occur if someone were to render the document to HTML.

Upstream may want to use signed commits tags and releases:

https://mikegerwitz.com/papers/git-horror-story
https://wiki.debian.org/Creating%20signed%20GitHub%20releases
https://wiki.debian.org/debian/watch#Cryptographic_signature_verification

Upstream may want to read our guide for upstreams:

https://wiki.debian.org/UpstreamGuide

Once the package reaches Debian, add debtags and screenshots:

https://debtags.debian.org/
https://screenshots.debian.net/

Automated checks:

lintian:

P: gkeyring source: debian-watch-may-check-gpg-signature

check-all-the-things:

$ env PERL5OPT=-m-lib=. cme check dpkg
...
Warning in 'control source Build-Depends:0' value 'debhelper (>= 9~)':
should be (>= 9) not (>= 9~) because compat is 9
...
you can try 'cme fix dpkg' to fix the warnings shown above

# check if these can be switched to https://
$ grep -rF http: .
./gkeyring.py:# http://www.gnu.org/licenses/agpl-3.0.html
./gkeyring.py:#
http://blogs.codecommunity.org/mindbending/bending-gnome-keyring-with-python-part-2/
./README.rst:You can install this tool from `PyPI
`_ (using `pip
`_, `setuptools
`_ or `distutils
`_)::
./README.rst:This program is a free software, licensed under `GNU AGPL
3+ `_.
./README.rst:.. image:: http://api.flattr.com/button/flattr-badge-large.png
./debian/copyright: along with this program. If not, see
.
./debian/copyright: along with this program. If not, see
.

# Note the missing / at the end of the URL
$ env PERL5OPT=-m-lib=. license-reconcile
FormatSpec: Cannot recognize format: Format:
https://www.debian.org/doc/packaging-manuals/copyright-format/1.0 at
/usr/share/perl5/Debian/LicenseReconcile/App.pm line 222,  line
3.

# This command checks style. While a consistent style
# is a good idea, people who have different style
# preferences will want to ignore some of the output.
# Do not bother adding non-upstreamable patches for this.
$ find -type f -iname '*.py' -exec pep8 --ignore W191 {} +


$ find -type f -iname '*.py' -exec pyflakes {} +
./gkeyring.py:158: 'gtk' imported but unused

$ find -type f -iname '*.py' -exec pyflakes3 {} +
./gkeyring.py:189:26: invalid syntax
except ValueError, e:

$ find -type f -iname '*.py' -exec pylint --rcfile=/dev/null
--msg-template='{path}:{line}:{column}: [{category}:{symbol}] {obj}:
{msg}' --reports=n {} +


$ env PERL5OPT=-m-lib=. uscan --report-status --no-verbose
uscan warn: In watchfile debian/watch, reading webpage
  https://github.com/kparal/gkeyring/archive/ failed: 404 Not Found

-- 
bye,
pabs

Bug#839833: RFS: gkeyring/0.4-1 [ITP]

[Yann Soubeyrand]

Package: sponsorship-requests
Severity: wishlist

Dear mentors,

I am looking for a sponsor for my package "gkeyring"

* Package name: gkeyring
  Version : 0.4-1
  Upstream Author : Kamil Páral
* URL : https://github.com/kparal/gkeyring
* License : AGPL-3.0+
  Section : gnome

It builds those binary packages:

  gkeyring   - Tool for shell access to GNOME keyring

To access further information about this package, please visit the following 
URL:

  https://mentors.debian.net/package/gkeyring

Alternatively, one can download the package with dget using this command:

  dget -x 
https://mentors.debian.net/debian/pool/main/g/gkeyring/gkeyring_0.4-1.dsc

Changes since the last upload:

  * Initial release. (Closes: #711344)

Regards,

Yann Soubeyrand