Debian Bug report logs - #787774
RFP: node-openpgp -- OpenPGP JavaScript Implementation (OpenPGP.js)

Reply or subscribe to this bug.

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "W. Martin Borgert" <debacle@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: RFP: libjs-openpgp -- OpenPGP JavaScript Implementation

Date: Thu, 4 Jun 2015 23:43:14 +0200

Package: wnpp
Severity: wishlist

Package name    : libjs-openpgp
Version         : v0.10.1
Upstream Author : OpenPGP Development Team <list@openpgpjs.org>
URL             : http://openpgpjs.org/
License         : LGPL3+
Programming Lang: JavaScript
Description     : OpenPGP JavaScript Implementation

From the web page:

"This project aims to provide an Open Source OpenPGP library in
JavaScript so it can be used on virtually every device. Instead
of other implementations that are aimed at using native code,
OpenPGP.js is meant to bypass this requirement (i.e. people will
not have to install gpg on their machines in order to use the
library). The idea is to implement all the needed OpenPGP
functionality in a JavaScript library that can be reused in other
projects that provide browser extensions or server applications.
It should allow you to sign, encrypt, decrypt, and verify any
kind of text - in particular e-mails - as well as managing keys."

Message #12 received at 787774@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@debian.org>

To: "W. Martin Borgert" <debacle@debian.org>, 787774@bugs.debian.org, pkg-javascript-devel@lists.alioth.debian.org

Subject: Looking for help Re: Bug#787774: RFP: libjs-openpgp -- OpenPGP JavaScript Implementation (OpenPGP.js)

Date: Wed, 31 Jan 2018 15:51:46 -0500

[Message part 1 (text/plain, inline)]

Over on https://bugs.debian.org/787774, On Fri 2015-06-05 00:43:14 +0200, W. Martin Borgert wrote:
> Package: wnpp
> Severity: wishlist
>
> Package name    : libjs-openpgp
> Version         : v0.10.1
> Upstream Author : OpenPGP Development Team <list@openpgpjs.org>
> URL             : http://openpgpjs.org/
> License         : LGPL3+
> Programming Lang: JavaScript
> Description     : OpenPGP JavaScript Implementation

OpenPGP.js is in even better shape today when this bug was filed, but it
hasn't been included in debian yet.  This is an e-mail asking about the
best next steps to get it into Debian.

(btw, URL should be https://openpgpjs.org/ these days)

I need OpenPGP.js in debian in order for me to upload the upcoming
enigmail 2.0 release, because enigmail 2.0 includes OpenPGP.js, and
upstream only has the minified versions available, which clearly isn't
DFSG-free.

I'm not very skilled with the node/grunt toolchain in debian, or with
the current debian javascript packaging policy but i'd be happy to learn
if someone wants to give me pointers.

the upstream documentation looks like it can prepare everything for
publication with:

    npm install
    npm test

but that itself looks likely to use network access which is something we
can't depend on during the debian build.

Should i try to follow the npm2deb guidance here:

   https://wiki.debian.org/Javascript/Nodejs/Npm2Deb

or is there a better approach?

Also, is libjs-openpgp still the best-practice name for the debian
package for OpenPGP.js?  I'd be happy to take over this RFP if i can get
guidance from wiser javascript people about this.

   --dkg

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 787774@bugs.debian.org (full text, mbox, reply):

From: Jérémy Lal <kapouer@melix.org>

To: Daniel Kahn Gillmor <dkg@debian.org>

Cc: "W. Martin Borgert" <debacle@debian.org>, 787774@bugs.debian.org, Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>

Subject: Re: [Pkg-javascript-devel] Looking for help Re: Bug#787774: RFP: libjs-openpgp -- OpenPGP JavaScript Implementation (OpenPGP.js)

Date: Wed, 31 Jan 2018 23:05:56 +0100

[Message part 1 (text/plain, inline)]

2018-01-31 21:51 GMT+01:00 Daniel Kahn Gillmor <dkg@debian.org>:

> Over on https://bugs.debian.org/787774, On Fri 2015-06-05 00:43:14 +0200,
> W. Martin Borgert wrote:
> > Package: wnpp
> > Severity: wishlist
> >
> > Package name    : libjs-openpgp
> > Version         : v0.10.1
> > Upstream Author : OpenPGP Development Team <list@openpgpjs.org>
> > URL             : http://openpgpjs.org/
> > License         : LGPL3+
> > Programming Lang: JavaScript
> > Description     : OpenPGP JavaScript Implementation
>
> OpenPGP.js is in even better shape today when this bug was filed, but it
> hasn't been included in debian yet.  This is an e-mail asking about the
> best next steps to get it into Debian.
>
> (btw, URL should be https://openpgpjs.org/ these days)
>
> I need OpenPGP.js in debian in order for me to upload the upcoming
> enigmail 2.0 release, because enigmail 2.0 includes OpenPGP.js, and
> upstream only has the minified versions available, which clearly isn't
> DFSG-free.
>
> I'm not very skilled with the node/grunt toolchain in debian, or with
> the current debian javascript packaging policy but i'd be happy to learn
> if someone wants to give me pointers.
>
> the upstream documentation looks like it can prepare everything for
> publication with:
>
>     npm install
>     npm test
>
> but that itself looks likely to use network access which is something we
> can't depend on during the debian build.
>

Indeed.


> Should i try to follow the npm2deb guidance here:
>
>    https://wiki.debian.org/Javascript/Nodejs/Npm2Deb
>
> or is there a better approach?
>

Not really.
npm2deb can help you setting up things more quickly.
For example it will tell there's a missing dependency on node-localstorage,
which in turn luckily depends on a package already in debian.
The build system (using grunt) might be missing some packages too.


> Also, is libjs-openpgp still the best-practice name for the debian
> package for OpenPGP.js?  I'd be happy to take over this RFP if i can get
> guidance from wiser javascript people about this.
>

Since it's distributed with a package.json and it is built using nodejs,
the source package should be node-openpgp
and built packages should be node-openpgp and libjs-openpgp.

Hope that helps,
Jérémy

[Message part 2 (text/html, inline)]

Message #22 received at 787774@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@debian.org>

To: Jérémy Lal <kapouer@melix.org>

Cc: "W. Martin Borgert" <debacle@debian.org>, 787774@bugs.debian.org, Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>

Subject: Re: [Pkg-javascript-devel] Looking for help Re: Bug#787774: RFP: libjs-openpgp -- OpenPGP JavaScript Implementation (OpenPGP.js)

Date: Wed, 31 Jan 2018 19:12:12 -0500

[Message part 1 (text/plain, inline)]

Control: retitle 787774 ITP: node-openpgp -- OpenPGP JavaScript Implementation (OpenPGP.js)
Control: claim 787774
Control: owner 787774 dkg@fifthhorseman.net
Control: block 787774 with 888989

On Wed 2018-01-31 23:05:56 +0100, Jérémy Lal wrote:
> npm2deb can help you setting up things more quickly.
> For example it will tell there's a missing dependency on node-localstorage,
> which in turn luckily depends on a package already in debian.
> The build system (using grunt) might be missing some packages too.

thanks very much for your guidance!

I've run into https://bugs.debian.org/888989 in the process of trying to
follow the npm2deb instructions on a debian sid virtual machine. :(

If npm2deb isn't fixable in the near term, perhaps there's another
package that has similar layout that i could look to as an example instead?

> Since it's distributed with a package.json and it is built using nodejs,
> the source package should be node-openpgp
> and built packages should be node-openpgp and libjs-openpgp.

thanks, this is good to know.

i'm likely to set up a packaging repo for this, using the
git-buildpackage pattern with a debian branch that derives from the
upstream git repo.  Is this something that you'd want in salsa within
the js-team/ namespace (i.e. as js-team/node-openpgp), or should i upload it
as debian/node-openpgp ?  If you prefer the former, i guess i need
membership on the js-team group.

   --dkg

[signature.asc (application/pgp-signature, inline)]

Message #35 received at 787774@bugs.debian.org (full text, mbox, reply):

From: Pirate Praveen <praveen@debian.org>

To: 787774@bugs.debian.org, Daniel Kahn Gillmor <dkg@debian.org>

Subject: Re: [Pkg-javascript-devel] Looking for help Re: Bug#787774: RFP: libjs-openpgp -- OpenPGP JavaScript Implementation (OpenPGP.js)

Date: Thu, 1 Feb 2018 21:35:01 +0530

[Message part 1 (text/plain, inline)]

On Wed, 31 Jan 2018 23:05:56 +0100 =?UTF-8?B?SsOpcsOpbXkgTGFs?=
<kapouer@melix.org> wrote:
> 2018-01-31 21:51 GMT+01:00 Daniel Kahn Gillmor <dkg@debian.org>:
> > I'm not very skilled with the node/grunt toolchain in debian, or with
> > the current debian javascript packaging policy but i'd be happy to learn
> > if someone wants to give me pointers.

Hi Daniel,

You can just call grunt during build target in rules. See

https://wiki.debian.org/Javascript/Nodejs#Using_build_tools_like_grunt

(though the current path in grunt for using globally installed tasks is
not perfect, it may work in sbuild only and not with dpkg-buildpackage).

See this also
https://anonscm.debian.org/cgit/pkg-javascript/node-fuzzaldrin-plus.git/tree/debian/patches/use-global-tasks.patch

You will need to remove optional grunt plugins too

see
https://anonscm.debian.org/cgit/pkg-javascript/node-handlebars.git/tree/debian/patches/skip-some-modules.patch

Just ask if you hit any issues.

Thanks
Praveen

[signature.asc (application/pgp-signature, attachment)]

Message #40 received at 787774@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: 896846@bugs.debian.org, 894753@bugs.debian.org, 894752@bugs.debian.org, 787774@bugs.debian.org

Subject: giving up on packaging OpenPGP.js

Date: Thu, 31 May 2018 14:23:31 -0400

[Message part 1 (text/plain, inline)]

Control: retitle 896846 RFP: node-compressjs -- fast pure-JavaScript compression/decompression algorithms
Control: unclaim 896846 dkg@fifthhorseman.net
Control: noowner 896846
Control: retitle 894753 RFP: node-asmcrypto -- JavaScript Cryptographic Library
Control: unclaim 894753 dkg@fifthhorseman.net
Control: noowner 894753
Control: retitle 894752 RFP: node-rusha -- high-performance pure-javascript SHA1 implementation
Control: unclaim 894752 dkg@fifthhorseman.net
Control: noowner 894752
Control: retitle 787774 RFP: node-openpgp -- OpenPGP JavaScript Implementation (OpenPGP.js)
Control: unclaim 787774 dkg@fifthhorseman.net
Control: noowner 787774

I have tried to package OpenPGP.js for debian, but i don't think i have
the capacity to do it responsibly, so i'm releasing these tickets in the
hope that someone else with more stamina (or more
confidence/understanding of the node/npm ecosystem) can take the process
over.

I still want OpenPGP.js in debian, but i won't be the one maintaining it
in its current form.  I would be very grateful to anyone who steps up to
this task.

What i've found in trying to package it is that each attempt to package
turns up several additional missing dependencies, and this process is
recursive.  Including the packages necessary to actually build each
package from source (rather than just redistributing the blobs) and run
the package's unit tests adds even more dependencies.  (i'm basing this
understanding on the output of npm2deb more than anything else -- if
that tool is incorrect, i'd love to hear more about it!)

i don't currently have the time to maintain dozens of new node packages,
unfortunately.

Furthermore, it seems that OpenPGP.js uses some slight variants of other
packages.  for example, it uses a variant of compressjs that builds a
deployable version of bzip2, rather than either making that deployable
version as part of the openpgpjs build process, or getting that change
upstreamed into compressjs.  in another example, the 3.0.x branch of
OpenPGP.js uses git master of https://github.com/indutny/elliptic,
rather than relying on a released version.

There are several tools that depend on OpenPGP.js that would be really
good to have in debian, and in general having another implementation of
OpenPGP built with the attention to software freedom, distributability,
and reproducibility that are the hallmarks of debian would be healthy
for the OpenPGP ecosystem.  So i hope someone else can pick up this
packaging work.  If you're interested and have questions about it, i'm
happy to try to consult with you, but i can't do it myself.

Many thanks to the folks on #debian-js who helped me understand just how
far over my head i'd need to go!

        --dkg

[signature.asc (application/pgp-signature, inline)]

Message #49 received at 787774@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupre <anarcat@debian.org>

To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>, 787774@bugs.debian.org

Cc: 896846@bugs.debian.org, 894753@bugs.debian.org, 894752@bugs.debian.org

Subject: Re: Bug#787774: giving up on packaging OpenPGP.js

Date: Mon, 24 Sep 2018 14:02:52 -0400

[Message part 1 (text/plain, inline)]

On Thu, May 31, 2018 at 02:23:31PM -0400, Daniel Kahn Gillmor wrote:
> i don't currently have the time to maintain dozens of new node packages,
> unfortunately.

Hi Daniel!

I feel so sorry for you. I understand how you feel - packaging
Javascript stuff is hard in Debian! I have never managed to do anything
in there myself.

That said, I did spend a few minutes creating a task page here, as seems
to be the custom in the team:

https://wiki.debian.org/Javascript/Nodejs/Tasks/openpgp

It reused part of your RFPs (in CC) but somehow missed asmcrypto which I
added by hand. node-rusha also seems to be missing from the current
dependencies, so maybe that was fixed/changed.

Anways - from the looks of it, there are at least seven run-time
dependencies missing, and 26 (or more?) build-time depends missing.

And that's not counting the peculiarities of OpenPGP.js you found during
your work as well.

Hopefully some Debian JavaScript wizard can pick that up eventually!

A.

[signature.asc (application/pgp-signature, inline)]

Message #54 received at 787774@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@debian.org>

To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>, 787774@bugs.debian.org

Subject: Re: Bug#787774: giving up on packaging OpenPGP.js

Date: Fri, 28 Sep 2018 11:17:27 -0400

On 2018-09-24 14:02:52, Antoine Beaupre wrote:
> On Thu, May 31, 2018 at 02:23:31PM -0400, Daniel Kahn Gillmor wrote:
>> i don't currently have the time to maintain dozens of new node packages,
>> unfortunately.
>
> Hi Daniel!
>
> I feel so sorry for you. I understand how you feel - packaging
> Javascript stuff is hard in Debian! I have never managed to do anything
> in there myself.
>
> That said, I did spend a few minutes creating a task page here, as seems
> to be the custom in the team:
>
> https://wiki.debian.org/Javascript/Nodejs/Tasks/openpgp
>
> It reused part of your RFPs (in CC) but somehow missed asmcrypto which I
> added by hand. node-rusha also seems to be missing from the current
> dependencies, so maybe that was fixed/changed.
>
> Anways - from the looks of it, there are at least seven run-time
> dependencies missing, and 26 (or more?) build-time depends missing.

I found bugs in the js-task-edit script that mis-detected some
packages. After much wrangling (details in #909753), I managed to update
the page again and we're down to twenty build and seven run-time depends
missing.

Well. That was disappointing. But at least no one started working on
those 6 build-deps, right? :)

A.

-- 
That's the kind of society I want to build. I want a guarantee - with
physics and mathematics, not with laws - that we can give ourselves
real privacy of personal communications.
                         - John Gilmore

Send a report that this bug log contains spam.