Debian discusses vendoring—again

Posted Jan 13, 2021 21:15 UTC (Wed) by plugwash (subscriber, #29694)
In reply to: Debian discusses vendoring—again by kleptog
Parent article: Debian discusses vendoring—again

> The issue is we don't want to spend a lot of time packaging a lot a NPM/Python modules in DEB packages.

I don't think this is correct.

Actually producing a package that builds and installs takes negligable time. What takes the time is.

1. Documenting/researching the copyright/license situation and removing anything that violates Debian standards.
2. Waiting for the ftpmasters to validate that what you have done for 1.
3. Deciding what do do about dependency versions, trying to find the path between having piles of versions of the same thing hanging around (which is bad from a security point of view) and breaking stuff when a package is updated.