and why not activated by default ?


----- Le 31 Juil 24, à 14:52, Phil Wyett philip.wyett@kathenas.org a écrit :

Hi all,

Tip of the day today comes from Sven Hartge below.

WRT the license checks, I found out that there is an integration with
Salsa CI available to get on the spot lrc reports, just by doing

include:
- https://salsa.debian.org/debian/licenserecon/raw/main/debian/licenserecon.yml

Maybe you can advertise this to more people already using Salsa CI and
DEP5 copyright files to reduce unnecessary round trips through mentors.

Grüße,
Sven.

Great one Sven.

Regards

Phil

--

"I play the game for the game’s own sake"

Arthur Conan Doyle - The Adventure of the Bruce-Partington Plans

--

Internet Relay Chat (IRC): kathenas

Website: https://kathenas.org

Instagram: https://instagram.com/kathenasorg/

Buy Me A Coffee: https://buymeacoffee.com/kathenasorg

--

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 05.08.24 16:52, PICCA Frederic-Emmanuel wrote:

WRT the license checks, I found out that there is an integration with
Salsa CI available to get on the spot lrc reports, just by doing

include:
-
https://salsa.debian.org/debian/licenserecon/raw/main/debian/licenserecon.yml

and why not activated by default ?

Not everyone has a DEP5 compatible debian/copyright file and
force-activating that check for those packages would immediately break
their CI without providing any benefit.

Grüße,
Sven.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,

I think this would have to be suggested to the Continuous Integration (CI) Team[1] and see what they think as in its value of being turned on by
default.

[1] https://salsa.debian.org/ci-team/debci - Contact details at bottom.

Apologies in advance if I am pointing in the wrong direction.

Regards

Phil


On Mon, 2024-08-05 at 16:52 +0200, PICCA Frederic-Emmanuel wrote:

and why not activated by default ?

----- Le 31 Juil 24, à 14:52, Phil Wyett philip.wyett@kathenas.org a écrit :

Hi all,

Tip of the day today comes from Sven Hartge below.

WRT the license checks, I found out that there is an integration with
Salsa CI available to get on the spot lrc reports, just by doing

include:
- https://salsa.debian.org/debian/licenserecon/raw/main/debian/licenserecon.yml

Maybe you can advertise this to more people already using Salsa CI and
DEP5 copyright files to reduce unnecessary round trips through mentors.

Grüße,
Sven.

Great one Sven.

Regards

Phil

--

"I play the game for the game’s own sake"

Arthur Conan Doyle - The Adventure of the Bruce-Partington Plans

--

Internet Relay Chat (IRC): kathenas

Website: https://kathenas.org

Instagram: https://instagram.com/kathenasorg/

Buy Me A Coffee: https://buymeacoffee.com/kathenasorg

--

--

"I play the game for the game’s own sake"

Arthur Conan Doyle - The Adventure of the Bruce-Partington Plans

--

Buy Me A Coffee: https://buymeacoffee.com/kathenasorg

Internet Relay Chat (IRC): kathenas

Matrix: #kathenas:matrix.org

Website: https://kathenas.org

Instagram: https://instagram.com/kathenasorg/

Threads: https://www.threads.net/@kathenasorg

--







-----BEGIN PGP SIGNATURE-----

iQJOBAABCAA4FiEEcKCsRax3nv6E9jrtckqptS8CTIsFAmaw6sEaHHBoaWxpcC53 eWV0dEBrYXRoZW5hcy5vcmcACgkQckqptS8CTIvJLhAAjNMHsRBx1QHE42T26IXU RovcBgPM5dFHJrjTbEj/bbG/yiqlHSSiMxJVgWdcbP4IY/oVmu9DkWoC2u28y7vi 1xzTegltlX5V2imTHZYcDt6TgCfdiUlkK8DsO2UDiraNml//XZIiW+QjU6Fjpjy1 Cf5WOSx/QCrtxcqSehnYfLsMHPDktTqnbXj9Q6EDs8tFsryXED+D1Ui/7GhftgLh DYeQ8DGQr/YBPrbwXiGw1aZ/mQPLFUGilwdviR8Yxi86Zyrj5OXILWQkDF3UpqKt iC6ChF796aNgXIpBIc5jWwjFRZM0ZYkoekuCZomLVleiU5jrHPiKLi4uUVV12vxQ Uqzdi2k5SdL1/DBt6xrvNfYnfvzy9VQ4S62cuQjbQZj+do/QrxjR2wOAFbcfjiLv Z7pVxNYcMFVnKfp5iRQV62xDVrIGqT8+Q6+8TmHgFYLtM8vU2Sbbv5Wul

Not everyone has a DEP5 compatible debian/copyright file and
force-activating that check for those packages would immediately break
their CI without providing any benefit.

the CI could detect the DEP5 copyright and run the test only when relevant :)

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Monday, August 5, 2024 7:52:26 AM MST PICCA Frederic-Emmanuel wrote:

and why not activated by default ?

In addition to the other comments, lrc is prone to a high number of false positives. It is helpful as a tool, but its failure often doesn’t indicate there is an actual problem. So, people should probably enable it manually in their CI instead of it being automatic.

----- Le 31 Juil 24, à 14:52, Phil Wyett philip.wyett@kathenas.org a écrit :

Hi all,

Tip of the day today comes from Sven Hartge below.

WRT the license checks, I found out that there is an integration with
Salsa CI available to get on the spot lrc reports, just by doing

include:
-

https://salsa.debian.org/debian/licenserecon/raw/main/debian/

licenserecon.ym

l

Maybe you can advertise this to more people already using Salsa CI and
DEP5 copyright files to reduce unnecessary round trips through mentors.

Grüße,
Sven.

Great one Sven.

Regards

Phil

--

"I play the game for the game’s own sake"

Arthur Conan Doyle - The Adventure of the Bruce-Partington Plans

--

Internet Relay Chat (IRC): kathenas

Website: https://kathenas.org

Instagram: https://instagram.com/kathenasorg/

Buy Me A Coffee: https://buymeacoffee.com/kathenasorg

--

--
Soren Stoutner
soren@debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEJKVN2yNUZnlcqOI+wufLJ66wtgMFAmaxkVsACgkQwufLJ66w tgOkWxAAl7nLyjk3bXfvbuQdfQ28B4HxL0spQ0ws/RKJeS100tgc8oIgBQh6WWEg 5WQsKvKpvxOzsnB98zW8IcYfE2QLQo5pgenPygN7+NswfsdVHsehXeqf15dmZBz3 CS2DB2/7PjEmlt8rrD1Yfv4Knzg4SijmBujj8K+djXVks6aprhS5obppZemO/+rU v1bvUNqu6Lh0VC5duuTeWCe0b61luOoJo8irM4SjbVF2WBJajdAatqjbATxUC3il u2RqCHJS3tnyStkGOxOkfNgMaCaaV5bhSPeHtD7KAN6DL4z4LW9uwILnb3lAdf1k /Yku6viK4HVaUnP7UrCFx5uF0svS71nQD2D0zwQHESuEpFohLvszLXHk3Q6oHyhF uSkRledmyFN4wITgAOxwllIpgLjdBFM/kV+BdHyoQryaMFOTXab/sBCfc/H2RHk5 57XX61jU0S5LpCvpiwqavDus8yeafU3yWMLJT7vKhKeHRMVdOlVsjYnfp20e57yl tfKQpBg6/PfNdfpX5zacd6mg6L46GGNOvPSCEUy6nGYWp8qugagDupFgxTrQsCuE nTr9chP7MfI6ZFt9RUWagdVx5uk0CkezXSDgw/R7m8BS6NlFUn5G2gsVPEfKXTMs OR/ISgeALBQIRTygbY1Mk/cQLXTPURXQZGcaA73XIugZc89xBbw=
=rM+g
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

In addition to the other comments, lrc is prone to a high number of

false

positives.  It is helpful as a tool, but its failure often doesn’t

indicate

there is an actual problem.  So, people should probably enable it

manually in

their CI instead of it being automatic.

Please report these problems.
Bug report, Salsa Issue, or just email me the name of the package in
question.
If notified, I might be able to fix it.

Regards,
Peter

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Copy: peter@pblackman.plus.com

Peter,

On Tuesday, August 6, 2024 7:38:45 AM MST Peter B wrote:

In addition to the other comments, lrc is prone to a high number of

false

positives. It is helpful as a tool, but its failure often doesn’t

indicate

there is an actual problem. So, people should probably enable it

manually in

their CI instead of it being automatic.

Please report these problems.
Bug report, Salsa Issue, or just email me the name of the package in question.
If notified, I might be able to fix it.

Thanks. It is always nice to work with someone who wants to improve their package.

I have submitted a couple of bug reports that were easy to put my finger on because I am the maintainer of the package.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1078099 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1078100

One of them should be fairly easy for you to fix and the other one might not be
fixable in an automated license check as it requires too much understanding of the context of what is being expressed in the header.

If you go back through the emails on Mentors for the past several months you will see there are several times where lrc indicated a problem that was claimed to be a false positive (probably around 25% of the time lrc detected an issue). I didn’t verify those myself, but my guess that in at least some cases lrc was indeed incorrect.

All that being said, I think that lrc is a wonderful tool. I am glad we have it and I use it myself.

In terms of using it as part of an automated CI pipeline, it would be valuable if there were some way to override false positives, similar to lintian overrides. That way, the check could still be run (detecting new issues) against packages that have known false positives.

Soren

--
Soren Stoutner
soren@debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEJKVN2yNUZnlcqOI+wufLJ66wtgMFAmayn5gACgkQwufLJ66w tgO5eA/+NMreZ162oKWzPmC/N1ak1hfIMzQQtyjU4UEI2todqBtah0nI8eOJBp5D iDGrhGk7edubuUMwccT52u7zZzzFCzO4PbiiU0veNKGBfmmtUZjFuYnjNw7jV2Ys /jc8gMWzh9Y5FEDLkTNNkjqxrYBQ1SvBb4fF+JskoMFDUlf7VPIzKY6wqt4Dfj5L 9EqvVjen65a9AF5zDX/DRC8KhiyMmf1ddebluCIiWQKkpthdrGd1x26cIAz16fWo 178wdv/Wb5jXPTJF8NbancbJdk0QKNs73h+SV5tGOSVe8tgoyTkdl/a5i/OsZCal OpWdCtW0XzfqKtWBTF+cZ/wlg1TosmQWwED0BfZYm1eQIHnARvoeoppYNMjbFMgP HT5G8AP7AZ+T/JNH/7HkUfT3x29TQeg7VY1uWmT1ZodCdM0fyTi/xsmEZtAZJDjf hrTW8/gOylFiupr6SKBAhnCSt52nRp8fOUqDonyEPWm7mj8XyjcIvUFn34icTZqA 8/evDN08WyeCinDgIFkgzHvGtPhgsbszxXtsbc7tOESulzHoflfoPUY5esS+/mIc SMzlpUjzp8pufvzuo/duWDxp9dnfWRE1ug9rLmkUaoqYmzU1TLNNnDm0BuhHAREE eZaZVvuFMMnqOmDdqUP8VeL+XbPxDETvyVW2u0XOQu4cDItw9bU=
=H0UM
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Soren,

On 06/08/2024 23:11, Soren Stoutner wrote:

Thanks. It is always nice to work with someone who wants to improve their package.

And its rewarding to create something that others find useful.

If you go back through the emails on Mentors for the past several months you will see there are several times where lrc indicated a problem that was claimed to be a false positive (probably around 25% of the time lrc detected an issue). I didn’t verify those myself, but my guess that in at least some
cases lrc was indeed incorrect.

I have noticed some comments, and fixed three issues back in July.
Best of course if folks raise bug reports, so issues are missed.

In terms of using it as part of an automated CI pipeline, it would be valuable
if there were some way to override false positives, similar to lintian overrides. That way, the check could still be run (detecting new issues) against packages that have known false positives.

Excellent idea, and could be used for your svg files.
Maybe an optional file like debian/licenserecon-excluded-files,
that just lists the files to be excluded from the check.



Regards.
Peter

P.S.
Timing isn't great here, as I shall be busy the next few weeks.
I hope to have new release(s) out in September.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)