Dear mentors,
I am looking for a sponsor for my package "cunit":
* Package name : cunit
Version : 2.1-3-dfsg-3
Upstream contact : Jerry St.Clair <jds2@users.sourceforge.net>
Anil Kumar <anilsaharan@users.sourceforge.net>
* URL : https://cunit.sourceforge.net/
* License : LGPL-2.0+, GFDL-NIV-1.2+ (documentation),
GPL-2.0+ (debian/*)
* Vcs : https://salsa.debian.org/ejjl/cunit
Section : libs
The source builds the following binary packages:
libcunit1 - Unit Testing Library for C
libcunit1-dev - Unit Testing Library for C -- development files
libcunit1-ncurses - Unit Testing Library for C (ncurses)
libcunit1-ncurses-dev - Unit Testing Library for C (ncurses) -- development files
libcunit1-doc - Unit Testing Library for C -- documentation
To access further information about this package, please visit the
following URL:
https://mentors.debian.net/package/cunit/
Alternatively, one can download the package with dget using this command:
dget -x https://mentors.debian.net/debian/pool/main/c/cunit/cunit_2.1-3-dfsg-3.dsc
The package needed quite a bit of polishing up after updating the
debhelper-compat to 14, which is all reported here below.
Changes for the just uploaded package:
cunit (2.1-3-dfsg-3) unstable; urgency=medium
.
* New maintainer (Closes: #1136394)
* debian/control:
- Maintainer set to myself; Uploaders and debian/compat dropped
- debhelper-compat: 9 -> 14; Build-Depends: dh-autoreconf dropped
- Standards-Version: 3.9.6 -> 4.7.4
- Priority and Rules-Requires-Root dropped: both are the default since
dpkg 1.22.13 and are now flagged as redundant
- Homepage: switched to https
- Vcs-Git and Vcs-Browser: point at the repository where the package is
actually maintained
* debian/rules:
- drop --with autoreconf (implicit since compat 10)
- drop DH_VERBOSE and the legacy DPKG_EXPORT_BUILDFLAGS
- set DEB_BUILD_MAINT_OPTIONS = hardening=+all; the ncurses build had
lost every hardening flag because -lncurses was passed as a configure
LDFLAGS assignment, overriding dpkg-buildflags. Pass it via LIBS
- split the dh_install, dh_installman and dh_installexamples overrides
into -arch and -indep variants. "dpkg-buildpackage -A" installed both
build trees but built only libcunit1-doc, so dh_missing, which is fatal
since compat 13, aborted the arch:all-only build
- keep the examples in /usr/share/doc/libcunit1-doc; since compat 11
debhelper would auto-detect libcunit1 as the main package and relocate
them, and libcunit1-doc does not depend on libcunit1
* debian/watch: rewritten in the version 5 format, https URL, fixed mangles
* debian/patches: DEP-3 headers on all patches; new patches renaming
configure.in to configure.ac and fixing a manpage typo
* debian/not-installed: added (dh_missing is fatal since compat 13)
* debian/upstream/metadata: added
* debian/salsa-ci.yml: added, with the arm64 and riscv64 build jobs enabled
in addition to the default amd64 and i386
* debian/tests: replaced the stale test.sh, which referenced build
directories that do not exist at test time, with two tests compiling
against the installed packages via pkg-config
* debian/source/lintian-overrides: document the unavoidable
hyphen-in-upstream-part tag
* debian/copyright: https URLs; added myself to debian/*
This is my first package as a maintainer; I filed the ITA as #1136394 after
the package was orphaned. The changes are packaging-only: there is no new
upstream release (upstream last released 2.1-3 in April 2014) and no security
component. The upload targets unstable/forky.
Verification performed:
* builds cleanly with sbuild against unstable (amd64), both the full build
and the arch:all-only build (dpkg-buildpackage -A)
* autopkgtest passes both tests (basic and ncurses variants), compiling
against the installed packages via pkg-config
* lintian from unstable is clean apart from the tags discussed below
* Salsa CI is green: builds on amd64, i386, and arm64, plus source build,
lintian, piuparts, autopkgtest, blhc, reprotest/debrebuild, uscan,
test-build-any and test-build-all
* debdiff against 2.1-3-dfsg-2.7 shows no unintended change to the shipped
files
Three packaging bugs were found and fixed in the process:
* The arch:all-only build (dpkg-buildpackage -A) failed. debian/rules
installed both build trees unconditionally, but a binary-indep build only
builds libcunit1-doc, leaving the libraries, headers, pkg-config file and
manpage unclaimed; dh_missing, fatal since compat 13, then aborted the
build. This was introduced by the compat 9 -> 14 upgrade in this very
upload - at compat 9 dh_missing did not run at all - and would have meant
libcunit1-doc never building on the archive's arch:all buildd. Caught by
Salsa CI's test-build-all job. Fixed by splitting the dh_install,
dh_installman and dh_installexamples overrides into -arch and -indep
variants, and by having dh_missing only list (not fail on) the arch:any
files during an arch:all-only build.
* debian/rules passed LDFLAGS="-lncurses" as a configure command-line
assignment for the ncurses build. That overrides the environment set by
dpkg-buildflags, so the ncurses library was built without any hardening
flags (no bindnow, no relro) and without -Wl,-z,defs. Fixed by passing
-lncurses via LIBS, which is where libraries belong; the hardening flags
are now present in both libraries.
* debian/tests/test.sh referenced debian/tmp and debian/tmp-ncurses, which
do not exist when autopkgtest runs. The test passed only because gcc fell
back to the installed headers and library.
One further consequence of the compat upgrade was caught by debdiff: since
compat 11, debhelper auto-detects libcunit1 as the "main package" for
libcunit1-doc and would have relocated the examples from
/usr/share/doc/libcunit1-doc/examples to /usr/share/doc/libcunit1/examples,
even though libcunit1-doc does not depend on libcunit1. debian/rules now
passes --doc-main-package=libcunit1-doc so the files stay where the archive
has always had them.
Remaining lintian tags, all deliberate:
* no-symbols-control-file (I, both libraries): upstream has been frozen
since 2014, so per-symbol versioning would produce dependencies identical
to the existing shlibs. Happy to add symbols files if you prefer.
* patch-not-forwarded-upstream (I, two patches): both patches are from
previous NMUs. Upstream is dormant - no release since 2014 and the
SourceForge bug tracker is inactive.
* hyphen-in-upstream-part-of-debian-changelog-version (P): overridden with
an explanatory comment. The upstream version genuinely is "2.1-3".
Switching to +dfsg is not possible without breaking version ordering:
dpkg --compare-versions "2.1-3+dfsg-3" gt "2.1-3-dfsg-2.7" is false.
I intend to switch to +dfsg if upstream ever releases above 2.1-3.
* package-uses-experimental-debhelper-compat-version: no longer emitted by
lintian in unstable; compat 14 is a deliberate choice, as this targets
unstable/forky only.
* debian-watch-does-not-check-openpgp-signature (X): upstream publishes no
OpenPGP signatures - the 2.1-3 release directory contains only the
tarball.
Note on debian/watch: it uses the version 5 (rfc822-style) format. This is
parsed correctly by devscripts 2.26 in unstable and accepted by lintian
there, but uscan in trixie cannot read it. I am happy to revert to version=4
if you consider that premature.
Many thanks also to all on IRC and the mentors mailing list who helped
with this!
Kind regards,
Edmund Lodewijks