1824089 - deb: Fix linting errors found by lintian

Status: ASSIGNED

(Release Engineering :: General, defect, P3)

Description

[Johan Lorenzo [:jlorenzo]]

Found by :sylvestre:

$ lintian target.deb
E: firefox-nightly: depends-on-obsolete-package Depends: libgdk-pixbuf2.0-0 (>= 2.22.0) => libgdk-pixbuf-2.0-0 and optionally libgdk-pixbuf-xlib-2.0-0
E: firefox-nightly: embedded-library libavutil [usr/lib/firefox-nightly/libmozavutil.so]
E: firefox-nightly: embedded-library libjpeg [usr/lib/firefox-nightly/libxul.so]
E: firefox-nightly: embedded-library libjsoncpp [usr/lib/firefox-nightly/crashreporter]
E: firefox-nightly: embedded-library ... use "--tag-display-limit 0" to see all (or pipe to a file/program)
E: firefox-nightly: extended-description-is-empty
E: firefox-nightly: no-copyright-file
E: firefox-nightly: python3-script-but-no-python3-dep python3 (does not satisfy python3:any | python3-minimal:any) [usr/lib/firefox-nightly/dmd.py]
E: firefox-nightly: python3-script-but-no-python3-dep python3 (does not satisfy python3:any | python3-minimal:any) [usr/lib/firefox-nightly/fix_stacks.py]
W: firefox-nightly: hardening-no-pie [usr/lib/firefox-nightly/firefox]
W: firefox-nightly: no-manual-page [usr/bin/firefox-nightly]

Lintian is a package checker[1] available there[2]. Per :sylvestre, the embedded-library should be overridden[3] and the rest should be fixed:

• the copyright file can be imported from the debian package[4]
• extended-description-is-empty[5] should be a matter of adding and extended Description[6]
• python3-script-but-no-python3-dep[7] would be about adding python3 as a dependency
• I'm not sure about the best approach for depends-on-obsolete-package[8].

What are your takes on this list - especially the last item -, :jcristau and :glandium?

[1] https://wiki.debian.org/Lintian
[2] https://packages.debian.org/bullseye/lintian
[3] https://lintian.debian.org/manual/index.html#overrides
[4] https://packages.debian.org/bullseye/amd64/firefox-esr/filelist
[5] https://lintian.debian.org/tags/extended-description-is-empty
[6] https://www.debian.org/doc/debian-policy/ch-binary.html#the-extended-description
[7] https://lintian.debian.org/tags/python3-script-but-no-python3-dep
[8] https://lintian.debian.org/tags/depends-on-obsolete-package

Comment 1

[Julien Cristau [:jcristau]]

depends-on-obsolete-package: ignore it
embedded-library: ignore it
extended-description-is-empty: needs a fix
no-copyright-file: needs a fix
python3-script-but-no-python3-dep: I'm surprised we're shipping those scripts, but ignore it
hardening-no-pie: I'd probably ignore it, but defer to Mike
no-manual-page: debian's is https://salsa.debian.org/mozilla-team/firefox/-/blob/release/master/debian/browser.1.in, I don't know how up-to-date it is, but it could be stolen if we want it.

Comment 2

[Mike Hommey [:glandium]]

hardening-no-pie: I'd probably ignore it, but defer to Mike

Yes, ignore. That binary is made non-PIE on purpose, and its only purpose is to execute a binary that is PIE.

Comment 3

[Mike Hommey [:glandium]]

the copyright file can be imported from the debian package[4]

FWIW, it's outdated. I wonder whose fault that is :-p.

Comment 4

[Mike Hommey [:glandium]]

python3-script-but-no-python3-dep: I'm surprised we're shipping those scripts, but ignore it

Only on nightly IIRC.