Hi

You may have noticed I adopted gnulib and have made an upload to
experimental. I am happy to have this team maintained, so feel free to
join the effort -- I added Boyuan to Uploaders: since you've been doing
QA uploads for some time, but happy to add others too.

If you don't object, I will upload to unstable in a couple of days if
nothing comes up. Relevant reading material on the changes I did for
this package:

https://salsa.debian.org/debian/gnulib/-/blob/debian/sid/debian/README.source https://blog.josefsson.org/2024/04/13/reproducible-and-minimal-source-only-tarballs/

What do you think? I hope I'm not stepping on anyone's toes here. The
package was orphaned and is a critical component to be able to build source-only tarballs for other packages in Debian.

/Simon

Simon Josefsson <simon@josefsson.org> writes:

Hi. I noticed gnulib in Debian was orphaned. I work upstream on gnulib
and intend to adopt it in Debian, but I’m happy to co-maintain it. My
plan is to keep it updated to latest upstream version, and see if we
can offer some way for it to be used to bootstrap various projects
that depend on vendored gnulib code.

/Simon

--=-=-Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iIoEARYIADIWIQSjzJyHC50xCrrUzy9RcisI/kdFogUCZhrC/hQcc2ltb25Aam9z ZWZzc29uLm9yZwAKCRBRcisI/kdFohnjAP0aknhP8a2LZ59J7TNVSpoME8uRK99p rcfaXSBOSXuwQAD/bt0fT+DEo3+uulEDOxHYQkDt6NnSmAxDml8Ldg+ruQ8=TxnW
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Simon (and Boyuan),

Quoting Simon Josefsson (2024-04-13 19:38:06)

You may have noticed I adopted gnulib and have made an upload to experimental. I am happy to have this team maintained, so feel free to
join the effort -- I added Boyuan to Uploaders: since you've been doing
QA uploads for some time, but happy to add others too.

If you don't object, I will upload to unstable in a couple of days if
nothing comes up. Relevant reading material on the changes I did for
this package:

https://salsa.debian.org/debian/gnulib/-/blob/debian/sid/debian/README.source https://blog.josefsson.org/2024/04/13/reproducible-and-minimal-source-only-tarballs/

What do you think? I hope I'm not stepping on anyone's toes here. The package was orphaned and is a critical component to be able to build source-only tarballs for other packages in Debian.

I am happy that gnulib is in good hands.

I've moved on to other challenges, and have no interest in working on
gnulib now. That said, you are welcome to try nudge me if some concrete
task emerges where you image I might be of help.


Kind regards,

- Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private --==============38629128944045031=MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Description: signature
Content-Type: application/pgp-signature; name="signature.asc"; charset="us-ascii"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAmYa5l4ACgkQLHwxRsGg ASF89g//R2e1bzIzVUgMxbUXlC73RDdjDAZ4Y66HuwTeruCzhJTIxE0UL8RAtcrk G0YFBnnfkRUiR8J0FT+evwUWswg1YXIB4IPqv4XH+Dc83AtHb3wew4RLgEbYTVJ7 QDCZ37Rb0KIkH1vhoIUB9U72QIBVyJ9GxLIwhDAZ461WRUqUnGxkwCulriNZFhP5 THTbI7YgMyt7AkyX4fnlSotbSebjFcDVqfds24AjX94fipX644FIeW6G3MtJ06JT whnm14QVWna1aXMLBuc+PbpsP50S2fmzf9uTCGifbk43+djVgMI6fOL5Swgk1F0B RbMlNGwJ2gaNFSsO3VOQc816q1thH2zRGEMblMkpcKtCcYINwGsVeCAQ7prsBUKC CGRm9XM0XXCLa9QoZGf3j/gIk6EmSuFpQMleepvu1DA7Qy/uwwSxFyjA+H5BYOm+ 3BJZZVNlfalq4SOLSSyOkGnPWGmJdYwC0o1JrS3s

Hi,

On Sat, 2024-04-13 at 22:09 +0200, Jonas Smedegaard wrote:

Hi Simon (and Boyuan),

Quoting Simon Josefsson (2024-04-13 19:38:06)

You may have noticed I adopted gnulib and have made an upload to experimental.  I am happy to have this team maintained, so feel free
to
join the effort -- I added Boyuan to Uploaders: since you've been
doing
QA uploads for some time, but happy to add others too.

If you don't object, I will upload to unstable in a couple of days if nothing comes up.  Relevant reading material on the changes I did for
this package:

https://salsa.debian.org/debian/gnulib/-/blob/debian/sid/debian/README.source
https://blog.josefsson.org/2024/04/13/reproducible-and-minimal-source-only-tarballs/

What do you think?  I hope I'm not stepping on anyone's toes here. 
The
package was orphaned and is a critical component to be able to build source-only tarballs for other packages in Debian.

I am happy that gnulib is in good hands.

I've moved on to other challenges, and have no interest in working on
gnulib now.  That said, you are welcome to try nudge me if some
concrete
task emerges where you image I might be of help.

Thanks for your work; I am okay with the changes. For git bundle reproducibility, seeking advice from Debian people in the reproducible-
builds project may be helpful. With the changes in project structure, it
might be useful to provide documents about how to use the updated gnulib
Debian package for other Debian software packagers.


Thanks,
Boyuan

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEfncpR22H1vEdkazLwpPntGGCWs4FAmYcIUwACgkQwpPntGGC Ws5hFQ/6AsT9MLo6O4zSjqA3mTHvyyUbRu3tgG/dTsUR+I9rcvtx4ama7W8h49ud PHeBrgILHxo9Ku+BUtVDdrvjYOasPw2g/lGLWu2Tba0vJqYcSUxvVRuprobIQyYX oZ8mZ8pE0PXYcqXoJHxFUgT7GZcTqaNfWmFrIfNcSAZoLNy3VqUwF+KD7h2+VAai Udh2ODqWi16hCblpBvNn4geuzs3PyrLdtlt0rQByxKY+EvtVHoXOM773/e9vHZ51 hMx//ossRhmbkuQzPJ0xcZxF4PcTDEcKfP1R7yVh8v0V3YmAHQLw1A8zdSzxuCA5 pv1nji7V6tmZaC33kJzYLiLajrQl+wWwN++eHTtQUh/vEy5B7ps2oek+uv1S0SQM DEEyoaRDwFg2C1onmkkPbHUuywRXmkZSflnIZDcIoc8aQWE58eZ1T8fb7LJtG82T Pp0FPp9AHLT7uNgzibGlfO2x7/NDSybOs0PE/FNG2zOmRGpNkEX7SeeE3/E3Zd5F bZ/sPPuqjk0m7ysYMtUPtClOnWPza4bGy/7Jdf+tUE5MTfYLccCIxuulsTxbSDmJ WZCXunHEARLSWU/5Js++8Y8SnfYmGgk9jG0Jj/NUJbFHo7l9GeOxzCkwM7O1HIIz gLM29hBLcoR2eXyZ3U/VNJU84TMiQu3laY/B3ShoAFeB7r5ukbE=
=eTiD
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Jonas Smedegaard <dr@jones.dk> writes:

I am happy that gnulib is in good hands.

I've moved on to other challenges, and have no interest in working on
gnulib now. That said, you are welcome to try nudge me if some concrete
task emerges where you image I might be of help.

Thank you for support!

Boyuan Yang <byang@debian.org> writes:

Thanks for your work; I am okay with the changes. For git bundle reproducibility, seeking advice from Debian people in the reproducible- builds project may be helpful. With the changes in project structure, it might be useful to provide documents about how to use the updated gnulib Debian package for other Debian software packagers.

Definitely, my blog post [1] illustrates how it can be done, but the
details for a Debian packager is sketchy. I should summarize how to
convert a Debian package from a traditional 'make dist' tarball that
includes gnulib to a 'git-archive' based approach that uses gnulib from
the Debian package, maybe as a debian-devel post.

However I don't think it is wise to do that for packages that are
validating PGP signatures of the existing tarball and there is an
upstream that doesn't provide PGP signed 'git-archive' releases. We can
nudge upstream's to sign 'git-archive' exports of their projects,
though.

/Simon

[1] https://blog.josefsson.org/2024/04/13/reproducible-and-minimal-source-only-tarballs/

-----BEGIN PGP SIGNATURE-----

iIoEARYIADIWIQSjzJyHC50xCrrUzy9RcisI/kdFogUCZhzSSBQcc2ltb25Aam9z ZWZzc29uLm9yZwAKCRBRcisI/kdFoo2wAQCrQv5GB5PdFmUBPHYBjR7+AnoTbMfy 3VTLbibLFjQOdQEA2jDawT6z/XQ4ahngihr8msg036TTHzfDoQaP7L7GVwc=
=vGgg
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)