Hi Paul, On Tue, May 16, 2023 at 5:07 AM Paul Wise <p...@debian.org> wrote:
> Generally all build dependencies should be packaged separately instead. > > https://wiki.debian.org/EmbeddedCopies > > Many thanks for that hint. I'm basically aware of the build dependencies policy and all of my binary and header-only dependencies are satisfied from packages. However, my package additionally depends on 11 proto files (i.e., architecture-independent interface of data encoding [1]) from google-apis [2] and bazel-remote-apis [3] as a pure build dependency. In the past, it seems that there was made an exception for packages that depend on these proto files: - buildstream and bazel-bootstrap (both only build-dep) - bazel-bootstrap-source (seems temporary/hackish though) - golang-github-gogo-googleapis-dev and golang-github-grpc-ecosystem-grpc-gateway-dev (both even shipping these files in their deb package) Interestingly, none of these packages is mentioned in the list of source packages that embed code from other projects [4]. For that reason, I was initially hoping that embedding these files would be fine for my package as well, albeit as a tarball. Currently, I see 3 options: 1. Keep the tarballs in debian/third_party, which would be the cleanest solution for our bootstrap, _but_ according to your last message this is probably not a viable option for Debian. 2. If the problem is only the tarballs, I could unpack them and embed only the exact 11 proto files that we need and explicitly mention them in the copyrights file of course. 3. Taking the longer road and package google-apis and bazel-remote-apis first. However, that raises a few more questions: a. google-apis is not versioned/tagged upstream. What version would I use? I've seen that Fedora uses the version string "0-1.<YYYYMMDD>git<SHORT_GIT_HASH>". b. Where should proto files be installed to? I know that libprotobuf-dev puts it in /usr/include, but /usr/share could be also viable. What is the recommended location? c. As the file structure of google-apis changes rather frequently, should there be any prefix, so multiple versions could be installed in parallel? Could you please comment on which option you would suggest to take, and also briefly address the potential follow-up questions? Many thanks in advance, I really appreciate your help! Kind regards, Oliver [1] https://protobuf.dev/ [2] https://github.com/googleapis/googleapis [3] https://github.com/bazelbuild/remote-apis [4] https://salsa.debian.org/security-tracker-team/security-tracker/raw/master/data/embedded-code-copies
