Re: deduplicating jquery/
Wookey <wookey@wookware.org> writes:
> Having read #903428 I see there is no enthusiasm for fixing this in the
> tooling. And also that I am not the only person coming across this and
> wondering what to do about it. I've had this experience before with both
> doxygen and javadoc and have spent some years assuming that someone will
> sort this out eventually.
This is essentially another iteration of the vendoring debate. Normal
development practice in the JavaScript world is to aggressively vendor and
pin, and only occasionally update the pinned version. (Well, arguably,
normal development practice for web pages in the JavaScript world is to
just load libraries like jQuery from a CDN because the browser will
normally already have that cached, but that's yet another debate that I
don't feel like getting into.)
The root problem, at least as I understand it, is that the two relevant
upstreams (and probably lots more) have followed those practices to vendor
and pin versions of jQuery, and are not regularly updating those pins, so
the current version in Debian may or may not work.
It's an inherent mismatch with our packaging practices, made somewhat
worse in at least some JavaScript cases (I don't remember if either of
these upstreams have this problem, but I know some jQuery users do) of
vendoring the minimized version, which isn't source.
If we want to unvendor jQuery without breaking functionality, I think we'd
need to either (a) help usptream do the work of constantly moving their
pin to the latest version and fix any resulting problems (which we and
upstream may not have resources to do and which upstream may not want to
commit to doing, and which upstream is generally unenthusiastic about), or
(b) package every version of jQuery that soemthing might be using, so that
we can always link to a compatible version. The latter has interesting
security implications, plus either it bloats a single package or it
requires a possibly large number of packages of numerous jQuery versions.
All of this is work that doesn't do a lot for our users. Do we want to do
this work? Is it a high enough priority to warrant the effort?
The minimum amount of work we have to do per the Social Contract is to
provide the source of minimized versions, so it's probably not possible to
avoid doing some amount of tedious effort here.
> Given that the maintainers of both javadoc and doxygen have declared
> this "wontfix" should we not at least stop lintian complaining about it?
Personally, I would think so, since it makes the Lintian tag effectively
unactionable.
--
Russ Allbery (rra@debian.org) <https://www.eyrie.org/~eagle/>
Reply to: