Re: Browserified copy and DFSG

2018-09-10 Thread Bastien ROUCARIES
On Mon, Sep 10, 2018 at 1:27 AM Sean Whitton wrote: > > Hello, > > On Mon 10 Sep 2018 at 11:00AM +1200, Michael Hudson-Doyle wrote: > > > I actually implemented something like this for Go in Ubuntu when we were > > looking at building Go shared libraries but we gave up on that whole > > approach

Re: Browserified copy and DFSG

2018-09-09 Thread Sean Whitton
Hello, On Mon 10 Sep 2018 at 11:00AM +1200, Michael Hudson-Doyle wrote: > I actually implemented something like this for Go in Ubuntu when we were > looking at building Go shared libraries but we gave up on that whole > approach (because even minor releases of Go upstream tend to break ABI and >

Re: Browserified copy and DFSG

2018-09-09 Thread Michael Hudson-Doyle
On Sun, 9 Sep 2018 at 04:52, Sean Whitton wrote: > Hello, > > On Sat 08 Sep 2018 at 10:02AM +0800, Paul Wise wrote: > > > On Fri, Sep 7, 2018 at 7:22 PM, Bastien ROUCARIES wrote: > > > >> Ok adding cc @security > >> > >> How will you handle security problem in static > >>

Re: Browserified copy and DFSG

2018-09-08 Thread Shengjing Zhu
(drop pkg-javascript-devel) On Sun, Sep 9, 2018 at 12:52 AM Sean Whitton wrote: > > Hello, > > On Sat 08 Sep 2018 at 10:02AM +0800, Paul Wise wrote: > > > On Fri, Sep 7, 2018 at 7:22 PM, Bastien ROUCARIES wrote: > > > >> Ok adding cc @security > >> > >> How will you handle security problem in

Re: Browserified copy and DFSG

2018-09-08 Thread Sean Whitton
Hello, On Sat 08 Sep 2018 at 10:02AM +0800, Paul Wise wrote: > On Fri, Sep 7, 2018 at 7:22 PM, Bastien ROUCARIES wrote: > >> Ok adding cc @security >> >> How will you handle security problem in static >> (browserified/webpacked) javascript library ? > > Same goes for the other languages that do

Re: Browserified copy and DFSG

2018-09-07 Thread Paul Wise
On Fri, Sep 7, 2018 at 7:22 PM, Bastien ROUCARIES wrote: > Ok adding cc @security > > How will you handle security problem in static > (browserified/webpacked) javascript library ? Same goes for the other languages that do static linking. It would be great to have this wiki page updated with

Re: Browserified copy and DFSG

2018-09-07 Thread Bastien ROUCARIES
On Thu, Sep 6, 2018 at 10:41 PM Sean Whitton wrote: > > Hello, > > On Wed 05 Sep 2018 at 04:38PM +0200, Bastien ROUCARIES wrote: > > >> AFAIUI, Built-Using is solely to be used for compliance with licenses > >> (GPL or GPL-like licenses). Are these node modules under GPL or a > >> GPL-like

Re: Browserified copy and DFSG

2018-09-06 Thread Sean Whitton
Hello, On Wed 05 Sep 2018 at 04:38PM +0200, Bastien ROUCARIES wrote: >> AFAIUI, Built-Using is solely to be used for compliance with licenses >> (GPL or GPL-like licenses). Are these node modules under GPL or a >> GPL-like license? If not, there should be no need for Built-Using. > > They are

Re: Browserified copy and DFSG

2018-09-06 Thread Julien Cristau
On 09/05/2018 04:38 PM, Bastien ROUCARIES wrote: >>> Browserify (or webpack) is a static compiler for javascript. I believe >>> that we must use built-using field in order to be policy compliant. >>> [...] > But I was thinking Built-Using may be used by security team in order > to trigger

Re: Browserified copy and DFSG

2018-09-05 Thread Bastien ROUCARIES
On Tue, Aug 7, 2018 at 12:43 AM Niels Thykier wrote: > > Bastien ROUCARIES: > > Hi, > > > > They are a few package that FTBFS due to lack of browserify under debian [1] > > > > The most significant point is to render javadoc FTBFS due to lack of > > browserified version of pako a port of zlib to

Re: Browserified copy and DFSG

2018-08-07 Thread Andreas Henriksson
On Tue, Aug 07, 2018 at 12:14:05AM +0200, Bastien ROUCARIES wrote: > Hi, [...] > I can output a list of javascript module (or file installed in the > tree) but I lack the > debhelper skill needed to output automatically built-using. > > Can somebody help me ? You might find it useful to look at

Re: Browserified copy and DFSG

2018-08-06 Thread Niels Thykier
Bastien ROUCARIES: > Hi, > > They are a few package that FTBFS due to lack of browserify under debian [1] > > The most significant point is to render javadoc FTBFS due to lack of > browserified version of pako a port of zlib to javascript. > > I plan to upload browserify soon but browserify is

Browserified copy and DFSG

2018-08-06 Thread Bastien ROUCARIES
Hi, They are a few package that FTBFS due to lack of browserify under debian [1] The most significant point is to render javadoc FTBFS due to lack of browserified version of pako a port of zlib to javascript. I plan to upload browserify soon but browserify is blocked by: *