[Pkg-javascript-devel] libjs-dropzone 5.5.0+dfsg-1 MIGRATED to testing
FYI: The status of the libjs-dropzone source package in Debian's testing distribution has changed. Previous version: 5.1.1+dfsg2-2 Current version: 5.5.0+dfsg-1 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information. -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] node-tap 12.0.1+ds-1 MIGRATED to testing
FYI: The status of the node-tap source package in Debian's testing distribution has changed. Previous version: 11.1.4+ds-2 Current version: 12.0.1+ds-1 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information. -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] node-boom 7.2.0-1 MIGRATED to testing
FYI: The status of the node-boom source package in Debian's testing distribution has changed. Previous version: 4.3.1-1 Current version: 7.2.0-1 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See https://release.debian.org/testing-watch/ for more information. -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] node-mutate-fs_2.1.1-1~bpo9+1_amd64.changes is NEW
binary:node-mutate-fs is NEW. binary:node-mutate-fs is NEW. source:node-mutate-fs is NEW. Your package has been put into the NEW queue, which requires manual action from the ftpteam to process. The upload was otherwise valid (it had a good OpenPGP signature and file hashes are valid), so please be patient. Packages are routinely processed through to the archive, and do feel free to browse the NEW queue[1]. If there is an issue with the upload, you will receive an email from a member of the ftpteam. If you have any questions, you may reply to this email. [1]: https://ftp-master.debian.org/new.html or https://ftp-master.debian.org/backports-new.html for *-backports -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] Processing of node-mutate-fs_2.1.1-1~bpo9+1_amd64.changes
node-mutate-fs_2.1.1-1~bpo9+1_amd64.changes uploaded successfully to localhost along with the files: node-mutate-fs_2.1.1-1~bpo9+1.dsc node-mutate-fs_2.1.1-1~bpo9+1.debian.tar.xz node-mutate-fs_2.1.1-1~bpo9+1_all.deb node-mutate-fs_2.1.1-1~bpo9+1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org) -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Browserified copy and DFSG
Hello, On Wed 05 Sep 2018 at 04:38PM +0200, Bastien ROUCARIES wrote: >> AFAIUI, Built-Using is solely to be used for compliance with licenses >> (GPL or GPL-like licenses). Are these node modules under GPL or a >> GPL-like license? If not, there should be no need for Built-Using. > > They are some module under GPL like license not yet pacakged. > > But I was thinking Built-Using may be used by security team in order > to trigger rebuild. Yes. Policy was changed to say that Built-Using should be used only for licensing issues. This was the release team's preference, and I believe they took the needs of the security team into account in coming to that preference. -- Sean Whitton signature.asc Description: PGP signature -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Browserified copy and DFSG
Hello, On Sat 08 Sep 2018 at 10:02AM +0800, Paul Wise wrote: > On Fri, Sep 7, 2018 at 7:22 PM, Bastien ROUCARIES wrote: > >> Ok adding cc @security >> >> How will you handle security problem in static >> (browserified/webpacked) javascript library ? > > Same goes for the other languages that do static linking. It would be > great to have this wiki page updated with some realistic strategies: > > https://wiki.debian.org/StaticLinking > > IIRC the security team recently flagged Go packages as being > problematic for security support in the Debian buster release. I guess > the same will apply to Rust now that Firefox switched to it? Hmm, Go looks to be using Built-Using in a way that is not Policy-compliant. The Haskell team uses virtual package names in the Provides: field, where these virtual package names contain a hash. This hash encodes all the versions of the dependencies that this build of the binary package used. The Depends: field of other libraries is populated with these virtual package names. For example: spwhitton@iris:~>apt show libghc-propellor-dev [...] Provides: libghc-propellor-dev-3.2.3-2bad6 Depends: libghc-ifelse-dev-0.85.0.0.1-44d2e, libghc-missingh-dev-1.4.0.1-3e847, libghc-ansi-terminal-dev-0.6.2.3-5aa2a, libghc-async-dev-2.1.0-c8d71, libghc-base-dev-4.9.0.0-5e731, libghc-bytestring-dev-0.10.8.1-58b19, libghc-containers-dev-0.5.7.1-8be09, libghc-directory-dev-1.2.6.2-958b8, libghc-exceptions-dev-0.8.3-5d23e, libghc-filepath-dev-1.4.1.0-6e799, libghc-hslogger-dev-1.2.10-8c36b, libghc-mtl-dev-2.2.1-3d1c9, libghc-network-dev-2.6.3.1-f63b0, libghc-process-dev-1.4.2.0-e39cb, libghc-stm-dev-2.4.4.1-99cba, libghc-text-dev-1.2.2.1-80edf, libghc-time-dev-1.6.0.1-6cdb6, libghc-transformers-dev-0.5.2.0-3446d, libghc-unix-dev-2.7.2.0-220bd, libghc-unix-compat-dev-0.4.2.0-bb71a, libc6 (>= 2.2.5), libgmp10 From this information it is possible to determine what needs rebuilding, and we have a script that does that. I assume this approach could be extended to (e.g.) Go. Unfortunately, all this is only for libraries; noticing that a binary package that installs something into /usr/bin needs rebuilding is manual. I think it could be extended, but it all depends on cdbs, so no-one wants to touch it. -- Sean Whitton signature.asc Description: PGP signature -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] Processing of node-rimraf_2.6.2-1~bpo9+1_amd64.changes
node-rimraf_2.6.2-1~bpo9+1_amd64.changes uploaded successfully to localhost along with the files: node-rimraf_2.6.2-1~bpo9+1.dsc node-rimraf_2.6.2-1~bpo9+1.debian.tar.xz node-rimraf_2.6.2-1~bpo9+1_all.deb node-rimraf_2.6.2-1~bpo9+1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org) -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] Processing of node-safe-buffer_5.1.2-1~bpo9+1_amd64.changes
node-safe-buffer_5.1.2-1~bpo9+1_amd64.changes uploaded successfully to localhost along with the files: node-safe-buffer_5.1.2-1~bpo9+1.dsc node-safe-buffer_5.1.2-1~bpo9+1.debian.tar.xz node-safe-buffer_5.1.2-1~bpo9+1_all.deb node-safe-buffer_5.1.2-1~bpo9+1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org) -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] node-chart.js_1.0.2-1_amd64.changes is NEW
binary:libjs-chart.js is NEW. binary:node-chart.js is NEW. binary:node-chart.js is NEW. binary:libjs-chart.js is NEW. source:node-chart.js is NEW. Your package has been put into the NEW queue, which requires manual action from the ftpteam to process. The upload was otherwise valid (it had a good OpenPGP signature and file hashes are valid), so please be patient. Packages are routinely processed through to the archive, and do feel free to browse the NEW queue[1]. If there is an issue with the upload, you will receive an email from a member of the ftpteam. If you have any questions, you may reply to this email. [1]: https://ftp-master.debian.org/new.html or https://ftp-master.debian.org/backports-new.html for *-backports -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
[Pkg-javascript-devel] Processing of node-chart.js_1.0.2-1_amd64.changes
node-chart.js_1.0.2-1_amd64.changes uploaded successfully to localhost along with the files: node-chart.js_1.0.2-1.dsc node-chart.js_1.0.2.orig.tar.gz node-chart.js_1.0.2-1.debian.tar.xz libjs-chart.js_1.0.2-1_all.deb node-chart.js_1.0.2-1_all.deb node-chart.js_1.0.2-1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org) -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] node packages in NEW
Le 07/09/2018 à 16:36, Xavier a écrit : > Le 07/09/2018 à 13:38, Bastien ROUCARIES a écrit : >> On Thu, Sep 6, 2018 at 9:45 PM Thorsten Alteholz wrote: >>> >>> Hi Bastien, >>> >>> On Wed, 5 Sep 2018, Bastien ROUCARIES wrote: > - put together packages that belong together; I am not sure here, but > wouldn't it be fine to have just one package node-d3 or node-babel > that contains all corresponding modules (though their different > versions > might create problems in keeping track of them)? I strongly oppose to keep different version.# >>> >>> I don't meant to have different versions of one package here, but >>> bundling several packages with different versions, so that it might not be >>> clear what version the resulting package might get. >> >> I agree with this maybe we could get something like: >> mainpackage+embded-nameembded1-version+embded-namembdedversion2-version+version >> ? >> >> Bastien > > Hello, > > I've written a little draft: > https://wiki.debian.org/Javascript/GroupedSourcePackageProxy I've updated draft to build a stateless proxy: DB was a bad idea since it can be modified at each request. I started to build groupedsources.cgi. The function to build grouped upstream sources works. Now I'm going to write the download part. When ready, you will be able to test with node-tap, simply by changing debian/watch. If this proposition is acceptable, I'll propose a policy patch to authorize JS grouped sources and a JS policy patch for details. Cheers, Xavier -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Thank you for ‘npm’ in Debian!
On 09/06/2018 06:22 AM, Pirate Praveen wrote: > > On 2018, സെപ്റ്റംബർ 5 9:29:37 PM IST, Ross Gammon > wrote: >> I can try and help out with a few node-* backports. But work is keeping >> me busy, so progress would be slow. If it is a team effort, we probably >> need a list. Or use the ITP tracker on Gitlab? > Thanks! I think we can use the salsa wiki for npm package. If someone with > python knowledge can modify the task tracker script, that would be better. > https://salsa.debian.org/js-team/npm/wikis/home Ross -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Please substitute my DD account for my old -guest account in Salsa GitLab js-team
Dear Debian JavaScript Team admins, A week has passed and I'm wondering about your decision of my previous mail. I have sent request to replace my old -guest account on Salsa platform with the new DD account and that request is still pending. Could you please help process it? It is a simple task and only needs 1 to 2 minutes: 1. Visit https://salsa.debian.org/groups/js-team/-/group_members after login 2. Process the request and grant me (@byang) a "Developer" role 3. Remove my old account (@hosiet-guest) from the team This is the last blocker for my DM->DD account migration and your work would be appreciated. -- Best Regards, Boyuan Yang 在 2018年8月31日星期五 EDT 上午9:27:03，Boyuan Yang 写道： > Dear Debian Javascript Team & Admins, > > I just received my new Debian Developer account days before. According to > Salsa administrator [1], the merge / replacement between my old -guest > account and the new DD Salsa account will not take place automatically. As > a result, I am actively replacing my accounts in various teams on Salsa > these days. > > I previously hold a Developer role in js-team [2] and I am maintaining a > node package [3] under the group. Could you please add my new DD account > (@byang) into the js team so that my Salsa account migration could be > completed? I have submitted the request via web interface and you will be > able to find that application on [2] as team Owner. After that, I will > remove my old account (@hosiet-guest) to reach consistency for accounts in > the group. > > Thank you very much for your help. > > -- > Regards, > Boyuan Yang > > > [1] https://salsa.debian.org/salsa/support/issues/100 > [2] https://salsa.debian.org/groups/js-team/-/group_members? > utf8=%E2%9C%93=hosiet-guest > [3] https://tracker.debian.org/pkg/node-macaddress signature.asc Description: This is a digitally signed message part. -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
