[Pkg-chromium-maint] Bug#787527: Some sources are not included in your package

[bastien ROUCARIÈS]

Package: chromium-browser 
version: 43.0.2357.65-1
user: lintian-maint at debian.org
usertags: source-is-missing
severity: serious
X-Debbugs-CC: ftpmaster at debian.org

Hi,

Your package seems to include some files that lack sources
in prefered forms of modification:

* third_party/flot/excanvas.min.js
* third_party/bidichecker/bidichecker_packaged.js
* third_party/analytics/google-analytics-bundle.js
* third_party/swig/linux/swig
* tools/perf/page_sets/tough_scheduling_cases/second_batch_js_medium.min.js
* tools/perf/page_sets/tough_scheduling_cases/second_batch_js_light.min.js
* tools/perf/page_sets/tough_scheduling_cases/second_batch_js_heavy.min.js
* tools/perf/page_sets/tough_energy_cases/test.swf
* third_party/webgl/src/resources/jquery-1.3.2.min.js
* third_party/trace-viewer/third_party/jszip/jszip.min.js
* third_party/trace-viewer/third_party/d3/d3.min.js
* third_party/trace-viewer/third_party/chai/chai.js
* third_party/pycoverage/coverage/htmlfiles/jquery.tablesorter.min.js
* third_party/pycoverage/coverage/htmlfiles/jquery.min.js
* third_party/dom_distiller_js/dist/js/domdistiller_wrapped.js
* third_party/dom_distiller_js/dist/js/domdistiller.js
* third_party/WebKit/PerformanceTests/resources/jquery.tablesorter.min.js
* third_party/WebKit/PerformanceTests/resources/jquery.flot.min.js
* third_party/WebKit/ManualTests/resources/spinbox.swf
* third_party/WebKit/ManualTests/plugins/timeout-dialog-displayed-over-navigation.swf
* third_party/WebKit/ManualTests/plugins/test.swf
* third_party/trace-viewer/third_party/components/polymer/polymer.js
* third_party/trace-viewer/third_party/components/platform/platform.js
* third_party/webgl/src/other/get.webgl.org/tdl/tdl-minified.js
* third_party/skia/platform_tools/android/bin/linux/perfhost
* third_party/android_platform/bionic/tools/relocation_packer/test_data/elf_file_unittest_relocs_arm64_packed.so
* third_party/android_platform/bionic/tools/relocation_packer/test_data/elf_file_unittest_relocs_arm64.so
* third_party/android_platform/bionic/tools/relocation_packer/test_data/elf_file_unittest_relocs_arm32_packed.so
* third_party/android_platform/bionic/tools/relocation_packer/test_data/elf_file_unittest_relocs_arm32.so
* third_party/webgl/src/sdk/demos/mozilla/spore/sylvester.js
* third_party/webgl/src/sdk/demos/google/shiny-teapot/teapot-streams.js
* third_party/webgl/src/sdk/demos/google/high-dpi/teapot-streams.js
* third_party/webgl/src/sdk/demos/google/san-angeles/glut/SanOGLES
* third_party/webgl/src/sdk/demos/google/san-angeles/gles/bob/bob

Maybe:
* tools/relocation_packer/test_data/*.so

Please override:
* tools/trace/trace_data.js
* third_party/web-animations-js/sources/web-animations.min.js
* third_party/web-animations-js/sources/web-animations-next.min.js
* third_party/web-animations-js/sources/web-animations-next-lite.min.js
* ui/webui/resources/js/jstemplate_compiled.js



According to Debian Free Software Guidelines [1] (DFSG) #2:
 "The program must include source code, and must allow distribution 
  in source code as well as compiled form.".

This could also constitute a license violation for some copyleft licenses such as the GNU GPL.

In order to solve this problem, you could:
1. repack the origin tarball adding the missing source to it.
2  add the source files to "debian/missing-sources" directory

Both way satisfies the requirement that we ship the source. Second option
might be preferable due to the following reasons [2]:
 - Upstream can do it too and you could even supply a patch to them, thus full filling our social contract [3], see particularly §2.
 - If source and non-source are in different locations, ftpmasters may
   miss the source and (needlessly) reject the package.
 - The source isn't duplicated in every .diff.gz/.debian.tar.* (though
   this only really matters for larger sources).

You could also ask debian-qa at lists.debian.org or #debian-qa for more
guidance.

[1] https://www.debian.org/social_contract.en.html#guidelines
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736873#8
[3] https://www.debian.org/social_contract
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.alioth.debian.org/pipermail/pkg-chromium-maint/attachments/20150602/1c0c86f2/attachment.sig>