On Thu, Aug 14, 2014 at 12:21 AM, Didier Roche <email address hidden> wrote:
> -> brise
> * BLOCKER: kyotocabinet-utils build-deps is in universe. Please add that one to the MIR if it matches the MIR criterias or drop those.

Added.

-> Thanks, looking at it.

> * BLOCKER: COPYING is GPL3. Some files are LGPL-2+, GPL-2+ and those requires the license to be shipped in the upstream source. Please make upstream to ship those in their tarball.

https://code.google.com/p/rimeime/issues/detail?id=644

-> do they plan to do a release soon? We can't promote brise without a release containing those files.


> * MINOR/NEED INFO: any idea why the source has a priority extra?
>

At the initial packaging time this engine isn't so popular and the
code does not build on architectures except x86 ones, so it's
considered to suit to a lower priority. Changed in git:
http://anonscm.debian.org/cgit/pkg-ime/brise.git/commit/?id=b56d9e588b5b654bae829b14b3ffa37186d7b266

-> Thanks for making the change!
For the record, your initial justification still didn't get into the extra bucket as defined by the debian policy: (https://www.debian.org/doc/debian-policy/ch-archive.html)
"""extra
This contains all packages that conflict with others with required, important, standard or optional priorities, or are only likely to be useful if you already know what they are or have specialized requirements (such as packages containing only detached debugging symbols)."""


> -------
> -> fcitx:

> * BLOCKER: presagege is missing as a build-dep, do you mind either not building with it (optional dep) or add it and check it matches the MIR criterias?

Added and checked presage and libtinyxml (b-d/dep of presage) to MIR.
Live without presage is doable, but better avoid that.

-> Thanks, looking to it.

> * BLOCKER: there are some LGPL files and no COPYING.LGPL file, please ship it in the upstream tarball.

https://github.com/fcitx/fcitx/issues/169

I can commit but usually don't do that directly.

-> Same than for brise, we need a release with this change before being able to promote to main.


> * NEED INFO/FIXING: fcitx-libs-gclient (and a lot of other binary packages): package-name-doesnt-match-sonames. Do you know why we don't follow upstream soname? They are at 0, so package name should be fcitx-libs-gclient0 as it's a public library. Otherwise, it should be in a private path.
> * NEED FIXING: I noted the remark on fcitx-libs in debian/README.source, and even if I'm not a fan of the current approach of the 3 libraries in the same package, I think we can live with it. However, we need to have a soname in the end, so that the binary package name can be bumped for any soname breaking in one of the 3 libraries (as some rdepends are not frmothe same source pacakage, like kde-config-fcitx or youker-assistant).

The reason is that we have done this for fcitx-libs before, so that
following the same convention. We plan to change that when next major
release of Fcitx is out, and for now the API/ABI is pretty stable for
a while so there is no real pressure to rush for that.

-> Still, this is a main criteria definition. So either have it committed to the packaging github and I can accept without the change being in ubuntu yet (please plan for the first library bump), either ship with the soname change now to get it acked to main.


> * NEED FIXING: even if it's wrap under a sh call, better to be coherent and get the script executable: W: fcitx-bin: script-not-executable usr/share/fcitx/data/env_setup.sh

This is intentional done by upstream, so after some communication I
don't see strong reason to maintain a diff.

-> Ack.

> * NEED FIXING: debian/copyright:
> - fcitx-4.2.8.4/src/frontend/qt/keyserver_x11.h: missing copyright to 2004 Jaroslaw Staniek <email address hidden>
> - fcitx-4.2.8.4/src/frontend/xim/lib/XimProto.h: missing the copyright (1992, 1993, 1994 by FUJITSU LIMITED)
> - src/ui/kimpanel/kimpanel.c. You set "Copyright: 2008-2010, Zealot.Hoi", but it misses "2010~2012 by CSSlayer *" (files: * doesn't cover it as it's overriden)
> - Copyright: 2003-2009, Troy D. Hanson     http://uthash.sourceforge.net => it's actually 2003-2010
> - Files: src/lib/fcitx-utils/qsort_r.c. Please mention the short name of the license "MIT/X11 (BSD like)"
> - fcitx-4.2.8.4/src/lib/fcitx-qt/fcitxqtkeysequencewidget.h and fcitx-4.2.8.4/src/lib/fcitx-qt/fcitxqtkeysequencewidget_p.h: GPL (v2 or later) LGPL (v2 or later)
>   Missing: 2007 Andreas Hartmetz <email address hidden> / 2001, 2002 Ellis Whitehead <email address hidden>
> - fcitx-4.2.8.4/src/module/lua/luawrap.c/h, fcitx-4.2.8.4/src/module/lua/luamod.c/h:: GPL (v2 or later). [Copyright: 2012~2012 by xubin *] (needs mention)

http://anonscm.debian.org/cgit/pkg-ime/fcitx.git/commit/?id=348b6dae534bb2d08e2f3728b345bb3ed18fa98a

-> Thanks!

> * MINOR: debian/patches/ubuntu-disable-fcitx-xkb.patch:
> do you mind using DEP3 for annotating the patch? (http://dep.debian.net/deps/dep3/)

That's a quick `quilt header -e`, I'll update it before next upload if
it does not get dropped (attente may don't need it now).

-> Can we get a clarification then? Or just commit the DEP3 header to the packaging git so that this comment doesn't go in limbo if you keep the patch it. Please envision to use DEP3 for all your future patches, so easier to track multiple months afterwards.

> * MINOR: I think you should add a head to debian/control (after you cp the .in to the control file) to tell to not edit that file as debian/rules, through gencontrol.mk is going to edit and sed it.

http://anonscm.debian.org/cgit/pkg-ime/fcitx.git/commit/?id=7669d5769d0e5b7de4ce011a3a3031d82f8adab5

-> Excellent!

> * NEEDS INFO: I see that we are running the unit tests at build time. Is there any integration tests that we can run, installing the various modules? (like -anthy, -chewing… and so on…)

Nope, the testing is limited to some core functions of the framework
itself, and there is no usable testing facility for other modules in
Fcitx 4.8 series.

-> Ack.

> -----
>
> -> fcitx-anthy:
> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control

It makes little sense to make sure all the modules are co-installable
since only one copy can be used, so that the work isn't actively
pushed. Changing:
http://anonscm.debian.org/cgit/pkg-ime/fcitx-anthy.git/commit/?id=0be99f31f8c8dc81afb09696d86c2095a01cc9ae

-> Thanks. Any upload with the change planned?

> * NEED FIXING: debian/copyright: doesn't contain any other copyright holder. Please fix it.
> For instance: src/factory.h: GPL (v2 or later)
>   [Copyright: 2004 Hiroyuki Ikezoe / 2004 Takuro Ashie / 2012 CSSlayer / 2004 James Su <email address hidden>]
> src/imengine.cpp: GPL (v2 or later)
>   [Copyright: 2004 - 2005 Hiroyuki Ikezoe <email address hidden> / 2012 CSSlayer / 2004 - 2005 Takuro Ashie <email address hidden> / 2004 James Su <email address hidden>]

http://anonscm.debian.org/cgit/pkg-ime/fcitx-anthy.git/commit/?id=5d5249cdf62b9a21b92ceedeeb4ef0d16f247619
http://anonscm.debian.org/cgit/pkg-ime/fcitx-anthy.git/commit/?id=d74a427fb6f53502d3c80e2b97d1b4925fe27669

-> Thanks.

> ------
> -> ficitx-cloudpinyin:
> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control

http://anonscm.debian.org/cgit/pkg-ime/fcitx-cloudpinyin.git/commit/?id=f47d60ab904aba6029e631274c899fada1758d95

-> Thanks. Any upload with the change planned?

> * MINOR: debian/copyright:
> Copyright should be 2011-2012, not only 2011

http://anonscm.debian.org/cgit/pkg-ime/fcitx-cloudpinyin.git/commit/?id=52442b5c129411cf21c4b25887af980e8b54857b

-> Thanks.

> * NITPICK: typo in debian/control: "to retrive result candidates" -> retrieve
>

http://anonscm.debian.org/cgit/pkg-ime/fcitx-cloudpinyin.git/commit/?id=82eabd3d4ee8c06e5d903a3f7fffbc5cce43f615

-> Thanks.

> ------
> -> fcitx-configtool
> * BLOCKER: debian/copyright is not well-formated:
> line 5: missing Files: line.
> The License text should be in a separate stanza as well.

http://anonscm.debian.org/cgit/pkg-ime/fcitx-configtool.git/commit/?id=a948aa5caaf4c3cdc57bb51f642276bb6754e0ce

-> Thanks. Any upload with the change planned?

> * NITPICK: debian/copyright
> Depends: line for fcitx-config-gtk is too long, please wrap it.
>

http://anonscm.debian.org/cgit/pkg-ime/fcitx-configtool.git/commit/?id=a133111096e95794fa1d221012237c4e9082e104

-> Thanks.

> ------
> -> fcitx-googlepinyin
> * BLOCKER: same issue in debian/copyright

http://anonscm.debian.org/cgit/pkg-ime/fcitx-googlepinyin.git/commit/?id=a8dda275395884afaa59d47f69c6c5dbca4f2b78

-> Thanks. Any upload with the change planned?

> * BLOCKER: build-dep on libgooglepinyin0-dev which is in universe. Please drop that plugin from the MIR or add the dependency after checking it's suiting the MIR requirements.

Added and checked.

-> Ack, will look at it.

> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control
>

http://anonscm.debian.org/cgit/pkg-ime/fcitx-googlepinyin.git/commit/?id=7dee3104f9725637d42da95424b5fbf59ad9e120

-> Thanks. Any upload with the change planned?

> ------
> -> fcitx-hangul
> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control

http://anonscm.debian.org/cgit/pkg-ime/fcitx-hangul.git/commit/?id=0d4418f3a35e1346f6c4461d3eb5d97016e4f002

-> Thanks. Any upload with the change planned?

> * NEEDS INFO: fcitx-hangul: hardening-no-stackprotector usr/lib/x86_64-linux-gnu/fcitx/fcitx-hangul.so. Any way we can fix this? Not having stackprotector leads the potentially code that can be attacked.

I don't see such problem, nor do lintian.d.o:
https://<email address hidden>#fcitx-hangul

-> It was a false positive in lintian utopic that has been fixed.

> * MINOR: debian/copyright:
> Copyright: 2012 CSSlayer <email address hidden> -> should be 2010-2012
>

http://anonscm.debian.org/cgit/pkg-ime/fcitx-hangul.git/commit/?id=648c746466c92d6b9a86a5d4bcade691e57b2f86

-> Thanks!

> ------
> -> fcitx-m17n
> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control

http://anonscm.debian.org/cgit/pkg-ime/fcitx-m17n.git/commit/?id=15108dfe41f329f4bb041ca96f2dbebda117ec24

-> Thanks. Any upload with the change planned?

> * MINOR: debian/copyright:
> missing   Copyright: 1995-1997 Peter Mattis, Spencer Kimball and Josh MacDonald in im/keysymname.c
>

http://anonscm.debian.org/cgit/pkg-ime/fcitx-m17n.git/commit/?id=9d981e902b048bc3cdb74d94b15ab896ae8029da

-> Thanks!

> ------
> -> fcitx-qimpanel:
> * BLOCKER: there is no COPYING for GPL2 and GPL3. Both are needed to be shipped upstream.

https://github.com/lenky0401/fcitx-qimpanel/issues/26

-> do they plan to do a release soon? We can't promote it without a release containing those files.

> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control

I prefer not doing it at this moment because I need some time to
verify the behavior.

-> In case of doubt, only mark it as multi-arch: same.


> * NEEDS INFO: I guess the autostart binary shouldn't be in usr/bin, but more in an exec path like libexec for instance.
>

Will talk with relevant people to see if we can move that.

-> did you get any info from it?

> ------
> -> fcitx-qimpanel-configtool:
> * BLOCKER: there is no COPYING for GPL2 and GPL3. Both are needed to be shipped upstream. There is only an empty LICENSE file.
>

This package is merged to fcitx-qimpanel upstream for next release, so
there is no need to open an issue again.

-> When is the release planned? 

> ------
> -> fcitx-qt5
> * BLOCKER: there is no COPYING for GPL2 nor LGPL2. Both are needed to be shipped upstream.

https://github.com/fcitx/fcitx-qt5/issues/4

-> do they plan to do a release soon? We can't promote it without a release containing those files.

> * NEEDS FIXING: fcitx-libs-qt5: package-name-doesnt-match-sonames libfcitx-qt5-0. Please rename the binary package + add an override, there is only one shared lib and it's better to follow debian packaging convention for Qt libs.

As expained for fcitx-libs-gclient and fcitx-libs.

-> Same remark and question than fcitx-libs then :)

> * NEEDS FIXING:
> debian/copyright:
> missing src/keyserver_x11.h: LGPL (v2 or later)
>   [Copyright: 2001 Ellis Whitehead <email address hidden> / 2004 Jaroslaw Staniek <email address hidden>]

http://anonscm.debian.org/cgit/pkg-ime/fcitx-hangul.git/commit/?id=648c746466c92d6b9a86a5d4bcade691e57b2f86

-> Thanks!

> * MINOR: it would be nice to have a .symbol file.
>

Will deal with it a bit later.

-> It will be good to invest some time on this. Not sure why I put that as MINOR, should be rather NEEDS FIXING actually. Please do work on it or ask if you need help (as we'll need a release + explanation on the soname scheme)

> ------
> -> fcitx-rime:
> * BLOCKER: COPYING is GPL2, so we can assume the only file is src/fcitx-rime.c is under that license. debian/copyright mention GPL3+. Needs to be fixed in accordance.

http://anonscm.debian.org/cgit/pkg-ime/fcitx-rime.git/commit/?id=2b0beb3d640500eb533b7fa0755a5c33c7182fc1

-> Thanks!

> * BLOCKER: build-deps on librime which is in universe. Please add that one to the MIR if it matches the MIR criterias or drop that one.

Already in the report.

-> Will look at it.

> * BLOCKER: this package doesn't build on armhf which is one of our supported arch. It needs to be buildable on that arch (librime-data can't be installed)

Need to retry the build, old librime does not build on that much
architectures so no librime-data, but current one does.

-> Thanks for retrying the build, seems it passed now!


> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control

This makes little sense here, as librime-data isn't M-A'd, which is a
Depends of this package.

-> Ack.

> * MINOR: The source in debian/copyright is fcitx one, not fcitx-rime
>

Upstream-Name shows fcitx-rime, and it's exactly maintained by fcitx
upstream. Actually it's quite normal that active modules get merged to
Fcitx's umbrella project, and Fcitx maintainers ensure APIs are synced
once there's any change.

-> Ack.

> ------
> -> fcitx-sunpinyin:
> * BLOCKER: COPYING is GPL2 as the files from the project. debian/copyright mention GPL3+. Needs to be fixed in accordance.

http://anonscm.debian.org/cgit/pkg-ime/fcitx-sunpinyin.git/commit/?id=214a48b57b3104f96168f6dd794d2fc692e46cd6

-> Thanks!

> * BLOCKER: debian/copyright is not well-formated (same issue than in fcitx-configtool)

http://anonscm.debian.org/cgit/pkg-ime/fcitx-sunpinyin.git/commit/?id=bb05161922d11fb98ee21d6154e74d91bd5a2e54

-> Thanks!

> * NEEDS FIXING: the package is multi-arch and should be marked as such in debian/control
>

This makes little sense as sunpinyin-data isn't M-A ready, which is a
Depends of fcitx-sunpinyin.

-> Ok.

> ------
> -> fcitx-table-extra:
> * BLOCKER: tables/scj6.txt is GPL3, there is no COPYING file mentionning GPL3. You need upstream to ship it.

https://github.com/fcitx/fcitx/issues/170

-> Same than the rest, we need a release with the change to be able to distribute it.

> * NEEDS FIXING:
> W: fcitx-table-cantonese: icon-size-and-directory-name-mismatch usr/share/icons/hicolor/64x64/apps/fcitx-cantonese.png 48x48
> W: fcitx-table-stroke5: icon-size-and-directory-name-mismatch usr/share/icons/hicolor/64x64/apps/fcitx-stroke5.png 48x48
> W: fcitx-table-zhengma: icon-size-and-directory-name-mismatch usr/share/icons/hicolor/48x48/apps/fcitx-zhengma.png 64x64

Will get a patch for upstream soon and apply to Debian/Ubuntu.

-> Great!

> * NEEDS INFO: debian/rules:
> override_dh_install:
>     find . -name *.mo -delete
> why stripping the generated .mo file? They aren't shown anyway in any UI?

No, they are not shown atm.

-> Mind adding a small comment in debian/rules about it?

>
> ------
> -> fcitx-table-other:
> * NEEDS INFO: debian/rules:
> override_dh_install:
>     find . -name *.mo -delete
> why stripping the generated .mo file? They aren't shown anyway in any UI?
>

No, they are not shown atm.

-> Mind adding a small comment in debian/rules about it?

> ------
> -> librime:
> * BLOCKER: libkyotocabinet-dev, libmarisa-dev and libyaml-cpp-dev build-deps are in universe. Please add that one to the MIR if it matches the MIR criterias or drop those.

Added and checked.

-> Will check them soon.

> Note that libboost-signals-dev is in universe, but the source is in main, so we can promote it as the same time.

> * MINOR: would be nice to multi-arch the library.
> * MINOR: it would be nice to have a .symbol file (not sure why there is an override no-symbols-control-file)

It makes little sense since the dependent data files aren't identical
across different architectures and upstream does not maintain it at
the moment.

-> Ok. As long as the binary package finishes with 0, it's fine as it denotes unstable ABI. Do we know more about their plan for ABI stability? (it's something that we encourage, especially for main).

> * MINOR: debian/copyright:
> Files: thirdparty/src/glog/*
>        thirdparty/src/gtest/*
> Copyright: 2008, Google Inc.
> It should be 1999-2008

http://anonscm.debian.org/cgit/pkg-ime/librime.git/commit/?id=cac4f2a7fdfec25a572d22649195c8a76809ce81

-> Thanks!

> * MINOR/NEED INFO: any idea why the source has a priority extra?
>

Same reason as brise, changed anyway:
http://anonscm.debian.org/cgit/pkg-ime/librime.git/commit/?id=42ad5837d156057344559ee89635132a1b71dd3e

-> Yeah, see my explanation in the first stenza. Thanks for changing it!

------
Packages added recently:
------
-> kyotocabinet:
* NEEDS FIXING: as upstream seems to maintainer their ABI, would be nice to have some symbols files.

------
-> libgooglepinyin:
* NEEDS FIXING: any chance for a .symbols file (seems though that the ABI is unstable, isn't it?)?

* MINOR: debian/compat is set to 9, where the build-dep on debhelper is (>= 8.1.3~). Please fix accordingly.

------
-> libtinyxml/tinyxml:
* NEEDS INFO: We already have multiple xml libraries in main. Any chance to switch the build-dep on that one to another one?
* BLOCKER: not published in ubuntu (did you subscribe the wrong component, how did you check the content?)? https://launchpad.net/ubuntu/+source/libtinyxml. I guess you meant tinyxml (and I analyzed this one). Please retarget the bug report if so.
* NEEDS FIXING: as upstream seems to maintain their ABI, would be nice to have some symbols files.

------
-> marisa:
* MINOR/NEEDS INFO: any idea why the source has a priority extra?
* NEEDS INFO: I see some benchmark/test tools shipped in the binary package (for instance, marisa ships /usr/bin/marisa-benchmark or /usr/bin/marisa-dump). Does it really makes sense? Shouldn't that rather be in a -utils package?

------
-> presage:
* MINOR/NEEDS INFO: any idea why the source has a priority extra?
* BLOCKER: pyprompter depends on python-wxgtk2.8 which is in universe. You will need a MIR for it if you want this binary package to be promoted in main. Otherwise, if not needed, just say so :)
* NEEDS INFO: it seems that in the past, presage rightly removed the build of the embeeded tinyxml copy and use the system version instead. Changelog says it was in debian/rules: "Added rule to remove embedded tinyxml source and header files.". However, I don't find anything related anymore in debian/rules nor any patch which will make that. It seems that now the configure detected if tinyxml is installed and don't build it if detected. Do you mind double-checking I'm right?
* NEEDS FIXING: Whereas presage binary package installs some debug/demos utilities like /usr/bin/presage_simulator, /usr/bin/presage_demo, /usr/bin/presage_demo_text in standard path (and IMHO, it would be better to have that package named -utils), it's fine because it states so and is a separated package. However, there is the same for python-presage installing /usr/bin/presage_python_demo, where it ships as well python bindings. I think that the binary should be installed either in libexec or in a separate binary package (like in the demo presage one)

------
-> yaml-cpp:
* NEEDS FIXING: the -dev package contains headers including boost, and so, it should depends on boosts iself and the .pc file needs to be patched to dep on boost.
* NEEDS FIXING: The tests are built, but not run during packaging build. Please wire them up.
* NEEDS FIXING: the package has been explicitely multi-arched in debian/rules, but -dev doesn't have any multi-arch tag in debian/control.
* NEEDS FIXING: it would be nice to have some symbols files.

------
Misc (to avoid having to backlog on the whole thread):
* From Aron: "Live without presage is doable, but better avoid that."
* for librime: libboost-signals-dev is in universe, but the source is in main, so we can promote it as the same time.