On 03/09/14 17:47, Ian Jackson wrote:
> Daniel Pocock writes ("Re: 2 months and no upload for pkg"):
>> It may not simply be the person
>>
>> Somebody uploading packages where they are also the upstream may know
>> the copyright situation inside out and just cut and paste
>> debian/copyright from one package to the next and it is always correct.
>>
>> Somebody ambitious who works on packages they are less familiar with
>> or really monstrous packages may well miss things from time to time
>> and be deterred by such a system. Then we have less people willing to
>> attack such monstrous packages.
>
> There is a tradeoff here, between 1. the interests of users and
> developers of the `monstrous' package, and 2. the interests of
> ftpmaster and the users and developers of everything else.
That depends on the extent to which you consider all packages to be
independent of each other or if you believe that a collection of
packages, big and small, is worth more than the sum of the values of
each individual part.
> The costs of such a `monstrous' package should be borne by those who
> are working on it and want to see it in Debian. It is true that that
> means that such packages are less likely to be in Debian than smaller
> or easier ones. We should not try to fix that by redirecting core
> team effort to fix big and difficult packages.
I'm certainly not arguing that work on monstrous packages should be
offloaded onto the ftp masters. I was only thinking about very small
errors, like missing the fact that some particular file has a slightly
different license that is otherwise fully compatible with the license of
the overall package.
There is one package I recently uploaded where I meant to use a
repackaged tarball to get rid of an embedded binary toolchain JAR. This
is a more nasty mistake of course but thanks to the diligence of the FTP
masters it was spotted.
What is fascinating though is that other developers made exactly the
same mistake with exactly the same source package - uploading it
directly into Ubuntu, binary JARs included[1], before it had passed
through the Debian NEW queue. In fact the Ubuntu changelog[2] mentions
at least three other developers who also didn't notice the same embedded
JAR in the source.
This also brings up one other concern about a procedure that
deliberately defers processing of some items in the NEW queue: it may
give an advantage to derivative distributions that are cherry-picking
the best things from NEW and appear to be getting them faster than Debian.
1.
https://launchpad.net/ubuntu/+archive/primary/+files/libphonenumber_6.0%2Br655.orig.tar.gz
2. https://launchpad.net/ubuntu/+source/libphonenumber/+changelog
--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/54083f7f.9020...@pocock.pro
