Re: apt ignoring check-valid-until flag

2020-12-17 Thread Ansgar
On Thu, 2020-12-17 at 00:47 +0100, John Paul Adrian Glaubitz wrote: > On 12/17/20 12:36 AM, Paul Wise wrote: > >  * snapshot could gain a re-signing service (#763419) > > That would be absolutely awesome. Whom do I throw my money at? It doesn't seem too complicated to implement and could be devel

Re: apt ignoring check-valid-until flag

2020-12-17 Thread John Paul Adrian Glaubitz
Hi Ansgar! On 12/17/20 11:02 AM, Ansgar wrote: > Maybe the same could be done for archive.d.o? > > I might be interested to experiment with this as it seems reasonably > small project to implement. :-) That would be fantastic and a huge improvement in user experience. Adrian -- .''`. John P

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Raphael Hertzog
Hi, On Wed, 16 Dec 2020, Jonas Smedegaard wrote: > 4/ analyze what yarn/npm would do during build, and translate that into > existing Debian Nodejs packages and actual need for custom work. In the > JavaScript team we use this page as starting point for analyzing large > projects: https://wiki

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Jonas Smedegaard
Quoting Raphael Hertzog (2020-12-17 13:16:14) > On Wed, 16 Dec 2020, Jonas Smedegaard wrote: > > 4/ analyze what yarn/npm would do during build, and translate that > > into existing Debian Nodejs packages and actual need for custom > > work. In the JavaScript team we use this page as starting po

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Raphael Hertzog
Hello, On Thu, 17 Dec 2020, Pirate Praveen wrote: > >1/ download all the node modules and add them to the source package, but > >then it's just impossible to write a copyright file to document the source > >package. That would be the best option though, the yarn.lock file > >effectively locks a ve

Bug#977589: ITP: r-cran-sets -- Sets, Generalized Sets, Customizable Sets and Intervals

2020-12-17 Thread Doug Torrance
Package: wnpp Severity: wishlist Owner: Doug Torrance X-Debbugs-Cc: debian-devel@lists.debian.org, dtorra...@piedmont.edu * Package name: r-cran-sets Version : 1.0.18 Upstream Author : David Meyer * URL : https://cran.r-project.org/package=sets * License : GPL

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Pirate Praveen
On Thu, Dec 17, 2020 at 2:19 pm, Raphael Hertzog wrote: Hello, On Thu, 17 Dec 2020, Pirate Praveen wrote: >1/ download all the node modules and add them to the source package, but >then it's just impossible to write a copyright file to document the source >package. That would be the b

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Raphael Hertzog
Hi, On Thu, 17 Dec 2020, Jonas Smedegaard wrote: > > Out of curiosity, I have run your script on the package.json file of > > greenbone-security-assistant and this just confirms that it's not > > realistic to package everything separately: > > https://wiki.debian.org/Javascript/Nodejs/Tasks/gsa

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Pirate Praveen
On Thu, Dec 17, 2020 at 2:55 pm, Raphael Hertzog wrote: I know this, but I also know that such an analysis is very time-consuming and needs a good knowledge of the language and of the upstream package, which I don't have. Most of the time Semantic Versioning works (https://semver.org) s

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Jonas Smedegaard
Quoting Raphael Hertzog (2020-12-17 14:55:11) > On Thu, 17 Dec 2020, Jonas Smedegaard wrote: > > In reality, most Nodejs modules declare too tight versioning for > > their > [...] > > I know this, but I also know that such an analysis is very > time-consuming and needs a good knowledge of the la

Bug#977605: ITP: arduino-core-avr -- Arduino Core for AVR microcontroller

2020-12-17 Thread Carsten Schoenert
Package: wnpp Severity: wishlist Owner: Carsten Schoenert X-Debbugs-Cc: debian-devel@lists.debian.org * Package name: arduino-core-avr Version : 1.8.3 Upstream Author : Arduino * URL : https://github.com/arduino/ArduinoCore-avr * License : BSD-3-clause, Expat,

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Adrian Bunk
On Thu, Dec 17, 2020 at 02:55:11PM +0100, Raphael Hertzog wrote: >... > By trying to shoehorn node/go modules into Debian packages we are creating > busy work with almost no value. We must go back to what is the value > added by Debian and find ways to continue to provide this value while > accepti

Bug#977612: ITP: komposter -- lightweight music composing system

2020-12-17 Thread Gürkan Myczko
Package: wnpp Severity: wishlist Owner: Gürkan Myczko X-Debbugs-Cc: debian-devel@lists.debian.org, debian-multime...@lists.debian.org * Package name: komposter Version : 0+git20201216 Upstream Author : Noora Halme, Trilkk/Faemiyah, Adrien Destugues * URL : http://ko

Work-needing packages report for Dec 18, 2020

2020-12-17 Thread wnpp
The following is a listing of packages for which help has been requested through the WNPP (Work-Needing and Prospective Packages) system in the last week. Total number of orphaned packages: 1179 (new: 4) Total number of packages offered up for adoption: 211 (new: 0) Total number of packages reques

Re: apt ignoring check-valid-until flag

2020-12-17 Thread Paul Wise
On Thu, Dec 17, 2020 at 10:03 AM Ansgar wrote: > (Bonus points if this keeps the original signature if possible.) Two separate signatures is possible for Release+Release.gpg, just rename the latter to .old, but what can you do for InRelease? Is it possible to have multiple signatures in one b

Re: apt ignoring check-valid-until flag

2020-12-17 Thread Calum McConnell
On Fri, 2020-12-18 at 01:15 +, Paul Wise wrote: > On Thu, Dec 17, 2020 at 10:03 AM Ansgar wrote: > > >     (Bonus points if this keeps the original signature if possible.) > > Two separate signatures is possible for Release+Release.gpg, just > rename the latter to .old, but what can you do fo

glibc 2.32 before bullseye?

2020-12-17 Thread Nick Black
I was wondering whether glibc 2.32 is expected to land in Bullseye. I'm guessing not, as I don't see a 2.32+ upload in experimental. In that case, I'd really like to have the Unicode 13 support introduced by 2.32 (if not the complete support, at least the wcwidth() elements). These seem pretty sel

Re: How should we handle greenbone-security-assistant?

2020-12-17 Thread Raphael Hertzog
On Thu, 17 Dec 2020, Pirate Praveen wrote: > > - ensurance that we use DFSG free code only > > => we can have tool to review licenses of what has been > > downloaded during build and embedded in the binary packages > > Then there would not be any value for Debian with such a scenario as people