Severity: serious Retitle: -1 Bundles vue without source code
Le mar. 29 sept. 2026 à 17:26, Jonas Smedegaard <[email protected]> a écrit : > Quoting Andrew Lee (2026-09-29 14:59:31) > > On Tue, Sep 29, 2026 at 2:45 PM Jonas Smedegaard <[email protected]> wrote: > > > No, I have not checked the code. > > > > Please have a look so that you can answer my question correctly. > > Sorry for my previous misunderstanding of the above remark: I will now > look at the below (assuming that's what you meant) and answer based on > that. > > > > It is permitted to package dead-end tools to "infect" users' systems > > > with non-Debian tools, but what is your point in doing that? You cannot > > > package any code that _needs_ vue if that package is only available > > > through pulling it in from an external source. > > > > > > An example of dead-end helpers is the official Debian package rustup > > > which is nice and convenient for users *not* caring about source, but > > > totally useless for Debian developers for packaging anything depending > > > on that side-installed tool. > > > > > > So back to your original question: Why do you ask? What is the aim? > > > > Thank you for checking my original question. > > > > My main goal is to build web front for a golang package. The is a > > missing build-deps on vue3. Jermeny suggest to update vue.js 2.7 to > > version 3.5 in Debian, and you asked me to make sure all the > > reverse-dependency such as python-trame-client works correctly with > > updated vue.js versoin 3.5. > > > > And my original question here: I wanted to ask if the way > > python-trame-client currently handles its web app is fully compliant > > with Debian policy. If this approach is acceptable, I am hoping to > > follow the same method to build the web frontend for the golang > > package, which would save me from having to package all of the missing > > Node.js build-deps from scratch. > > Debian packages must include source, where compacted JavaScript code is > not considered source. > That answers the question of Andrew. The actual issue is that python-trame-client source package does just that, it embeds compiled files to work around Debian Policy: https://sources.debian.org/src/python-trame-client/3.12.3-2/debian/vue-apps I can understand that *source files* of other softwares are sometimes embedded, but they are unavailable in Debian, and are needed to build the package. This is not the case here, this violates DFSG 2.2 I am retitling and raising severity. *** I propose to solve it this way, and even better, I propose to solve it myself: python3-trame-server supports multiple client types (vue2, vue3, even react in latest upstream version). https://sources.debian.org/src/python-trame-server/3.12.4-2/src/trame_server/core.py#L22 The default client type is vue3. As this is meant for backward compatibility, and as I don't see any application in Debian that currently depends on python3-trame-client and vue2, we can probably move forward and let trame-client provide the vue3 client type, using the latest node-vue package, instead of bundling compiled versions of vue2 and vue3 without providing the sources. Jérémy
