Le 29/01/2019 à 22:17, Jonas Smedegaard a écrit : > Source: twitter-bootstrap4 > Version: 4.2.1+dfsg1-1 > Severity: serious > Justification: Policy 2.1 > > Source package contains below <dist/> several files embedding code from > external project fileOverview Kickass, without source included. > > Thanks to Xavier for noticing (although only as comment in copyright > file). > > > - Jonas
I succeed to build source, but this needs: - to upgrade: rollup-plugin-babel, browserslist - to package or upgrade at least (I reduced this list to the minimum possible): node-releases, rollup-plugin-babel, trim-right, @babel/core @babel/generator @babel/helper-annotate-as-pure @babel/helper-builder-binary-assignment-operator-visitor @babel/helper-call-delegate @babel/helper-define-map @babel/helper-explode-assignable-expression @babel/helper-function-name @babel/helper-get-function-arity @babel/helper-hoist-variables @babel/helper-member-expression-to-functions @babel/helper-module-imports @babel/helper-module-transforms @babel/helper-optimise-call-expression @babel/helper-plugin-utils @babel/helper-regex @babel/helper-remap-async-to-generator @babel/helper-replace-supers @babel/helpers @babel/helper-simple-access @babel/helper-split-export-declaration @babel/helper-wrap-function @babel/highlight @babel/parser @babel/plugin-proposal-async-generator-functions @babel/plugin-proposal-json-strings @babel/plugin-proposal-object-rest-spread @babel/plugin-proposal-optional-catch-binding @babel/plugin-proposal-unicode-property-regex @babel/plugin-syntax-async-generators @babel/plugin-syntax-json-strings @babel/plugin-syntax-object-rest-spread @babel/plugin-syntax-optional-catch-binding @babel/plugin-transform-arrow-functions @babel/plugin-transform-async-to-generator @babel/plugin-transform-block-scoped-functions @babel/plugin-transform-block-scoping @babel/plugin-transform-classes @babel/plugin-transform-computed-properties @babel/plugin-transform-destructuring @babel/plugin-transform-dotall-regex @babel/plugin-transform-duplicate-keys @babel/plugin-transform-exponentiation-operator @babel/plugin-transform-for-of @babel/plugin-transform-function-name @babel/plugin-transform-literals @babel/plugin-transform-modules-amd @babel/plugin-transform-modules-commonjs @babel/plugin-transform-modules-systemjs @babel/plugin-transform-modules-umd @babel/plugin-transform-new-target @babel/plugin-transform-object-super @babel/plugin-transform-parameters @babel/plugin-transform-regenerator @babel/plugin-transform-shorthand-properties @babel/plugin-transform-spread @babel/plugin-transform-sticky-regex @babel/plugin-transform-template-literals @babel/plugin-transform-typeof-symbol @babel/plugin-transform-unicode-regex @babel/preset-env @babel/template @babel/traverse @babel/types However, generated code is readable, not minified and contains some comments, perhaps not enough. So I think it's not a significant DFSG break. I won't package all of them so if we consider than using generated dist/* files is a policy break, I think that twitter-bootstrap4 can't be released in buster. Another crazy alternative: embeds that (4,8 Mo) ! I won't do it.
