Release lintian/2.6.0 into unstable.

Format: 1.8
Date: Wed, 06 Feb 2019 22:51:14 +0100
Source: lintian
Binary: lintian
Architecture: source all
Version: 2.6.0
Distribution: unstable
Urgency: medium
Maintainer: Debian Lintian Maintainers <lintian-maint@debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description:
 lintian    - Debian package checker
Closes: 911449 920299 920469 920536 920568 920593 920638 920647 920691 920699 921084
Changes:
 lintian (2.6.0) unstable; urgency=medium
 .
   * Summary of tag changes:
     + Added:
       - package-contains-sass-cache-directory
       - package-uses-dh-runit-but-lacks-breaks-substvar
       - pkg-config-references-unknown-shared-library
 .
   [ Chris Lamb ]
 .
   * Enhancements:
     - Check for pkg-config(1) files that reference unknown shared objects
       via (for example) "Libs: -lfoo". (Closes: #920699)
     - Check for packages that use dh_runit without specifying a Breaks on
       the "${runit:Breaks}" substvar. (Closes: #920299)
     - Require that build paths aren't "/" when checking for
       file-references-package-build-path.
     - Check for packages that ship with .sass-cache directories.
       (Closes: #920593)
     - Detect accidental ".git.git" (etc.) in Vcs-Git headers.
       (Closes: #921084)
 .
   * Bug fixes:
     - Fix FTBFS by avoiding "self" false-positives when checking for
       file-references-package-build-path in the Lintian test suite.
       (Closes: #920536)
     - Ignore duplicate .buildinfo files which can be supplied by using
       mergechanges(1) from devscripts. (Closes: #920469)
     - Rewrite "old" version calculation to prevent false-positives in the
       maintainer-script-supports-ancient-package-version tag.
       (Closes: #920638)
     - Prevent false-positives in the command-with-path-in-maintainer-script
       checks for sections automatically added by debhelper.
       (Closes: #920568)
     - Ignore quilt .pc directories when checking for
       inconsistent-appstream-metadata-license. (Closes: #920647)
 .
   * Reporting improvements:
     - Include the upload and release dates in the output of the
       maintainer-script-supports-ancient-package-version tag.
     - Add a reference to the official specification in the long description
       of the unnecessary-source-date-epoch-assignment tag.
 .
   * Misc:
     - Move to "Semantic Versioning" (https://semver.org/) scheme.
     - Print Carp tracebacks in --debug mode.
 .
   [ Felix Lechner ]
   * Fix a race condition by stopping loop for collections after a task
     fails. (Closes: #920691)
   * Remove Test-For from all test specifications. (MR: !138)
   * Consolidate scripts in t/scripts; move internal harness tests there.
   * Clean up ./t; move helper binaries, including t/runtests, to t/bin.
   * Add an empty Test-Against to all tests that do not have one.
   * Calculate Test-For and Test-Against from new "Check" parameter in
     runner.
   * Add an internal self-test for all the fields in "desc" files.
   * Move all t/tags/tests addressing a single check into t/tags/checks/.
     (MR: !141)
 .
   [ Jeremy Bicha ]
   * Drop "GTK" -> "GTK+" correction. (Closes: #911449)
   * Set "multimaint-merge" in debian/gbp.conf. (MR: !125)
 .
   [ Xavier Guimard ]
   * Update debhelper addon specification now that nodejs-dev has been
     replaced by pkg-js-tools. (MR: !135)
 .
   [ Paul Wise ]
   * Add several spelling corrections.
Checksums-Sha1:
 84b7d907609819eca36a36833e77f2e1de9ef0ae 2834 lintian_2.6.0.dsc
 62a9af9a5fffdf52dad623a8cc2ffa0554df9f5f 1651240 lintian_2.6.0.tar.xz
 e88ac288c72ff3eba574b3ff128723d68b34217c 1193148 lintian_2.6.0_all.deb
 2dace63a1c38b88447807729234c30288fca885c 16787 lintian_2.6.0_amd64.buildinfo
Checksums-Sha256:
 2aa577ccede21859edb285179f8785e997f43477197c0dd5a06b3c769414d68a 2834 lintian_2.6.0.dsc
 ca69f0c72f546a3f0a99cff4139ec2e5ec4f47b962bbe5e4c8682468fc732007 1651240 lintian_2.6.0.tar.xz
 c20741a6744f583af9d6a2870729b4be17b112515926149a629746de468a8d69 1193148 lintian_2.6.0_all.deb
 d879ec8cf37d704f92cc9b9ace2ccf08fe5f33e395283c6722aa98c571d8ec0c 16787 lintian_2.6.0_amd64.buildinfo
Files:
 8b77069a9bed5a99e9dd3ce009a611ea 2834 devel optional lintian_2.6.0.dsc
 c542582e3f42da80682bc76943c3923d 1651240 devel optional lintian_2.6.0.tar.xz
 1aa97b84f961edc08f02cc33087b4d31 1193148 devel optional lintian_2.6.0_all.deb
 61a3d52c620b380b22eefbe5df799a46 16787 devel optional lintian_2.6.0_amd64.buildinfo

* tag '2.6.0': (117 commits)
  Release lintian/2.6.0 into unstable.
  Make sure new collection tasks are started even after a failure.
  Fix race; stop loop for collections after task fails. (Closes: 920691)
  Tighten requirements for Test-Against vs expected tags.
  Move lintian-no-override to t/tags/tests; is for command line option.
  Move lintian-ftp-rejects to t/tags/tests; is for command line option.
  Move runtests-empty-test-against to t/tags/tests; not check-related.
  Reassign binaries-unsafe-open to check binaries from manpages.
  Reassign watch-file-bug-765995 to check watch-file from changes-file.
  Small enhancements to desc-fields.t; better output.
  Add internal harness test enforcing sort order for tests.
  Move all t/tags/tests addressing a single check into t/tags/checks/. (MR: !141)
  Remove Test-Against from tests when it matches the computed value.
  Repurpose runtests-todo-test-for for empty Test-Against.
  Add an internal harness test for the fiels in desc files.
  Remove Test-For from all test specifications. (MR: !138)
  Calculate Test-For and Test-Against from new parameter Check in runner.
  Add Build-Depends: liblist-compare-perl.
  Set the new parameter 'Check' for all tests in suite 'tags'.
  Add an empty Test-Against to all tests that do not have one.
  ...

Felix Lechner authored Feb 05, 2019 and Chris Lamb committed Feb 06, 2019

The on_exit routine is the only way task are started after a previous
one finished. If there are additional tasks, they should be started
here even if the previous routine failed.

Gbp-Dch: ignore

Felix Lechner authored Feb 05, 2019 and Chris Lamb committed Feb 06, 2019

The primary issue was that the loop was not being stopped in case of a
failure, but the single additional line

+   $loop->loop_stop if not %{$running_jobs};

alone did not solve the issue. The way the processes were started may
have caused a race condition.

On that note, I am not sure that no race condition remains with
respect to @task. It may be better to open an IO::Async::Channel to
the parent and let the parent schedule the next task.

The commit following this one makes sure new tasks are also started in
a child in case of a failure.

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

The requirement that Test-Against may not be empty when 'tags' is
empty can be tightened. There could actually be tags present as long
as they do not belong to Check. In other words, the calculated
Test-For and the overridden Test-Against may not both be empty.

The behavior is being tested in runtests-empty-test-against from
commit ec81e0c9. We are not adding other valid tags to the test
because it is marked TODO. It would be too difficult to verify if the
test fails because a tag disappeared or because the calculation went
awry. The current situation is not perfect but more desirable.

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

Tests a command-line option of Lintian and is not tag-related. Moving
back to t/tags/tests for further evaluation.

Also, removing Check and empty Test-Against.

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

Tests a command-line feature of Lintian and is not tag-related. Moving
back to t/tags/tests for further evaluation.

Also removing Check and empty Test-Against.

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

Tests a feature of the test runner whereby Test-Against cannot be
empty while 'tags' is also empty. (Actually, not even the subset of
'tags' belonging to Check may be empty.) This test is not tag-related
in the usual sense.  Moving back to t/tags/tests for further
evaluation.

The test needs a check, so 'manpages' cannot be removed. This test
will probably be transformed into script that checks this feature of
the runner via mocking.

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

The original test specification had

    Test-For: empty-manual-page

so the test was erroneously assigned to the check manpages.
Reassigning to binaries.

Also, remove Tag-Against. Configures this as a test against false
positives for any tags in check binaries, which includes the hardening
features the test was probably designed for.

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

The original test specification had

    Test-For: orig-tarball-missing-upstream-signature

so the test was erroneously assigned to the check changes-file.
Reassigning to watch-file.

Also, the bug report does not list a tag, but rather a Perl error
message. Remove Tag-Against. Configures this as a test against false
positives for any tags in check watch-file.

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

Add test names in ok() statements for better test output. Also, move
'lib' declaration to make sure latest modules are used.

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

Enforces that all children of t/tags/checks correspond to valid
Lintian checks. Furtermore, any tests located in such a subfolder must
relate to that Lintian check (and only that check).

Gbp-Dch: ignore

Felix Lechner authored Feb 06, 2019 and Chris Lamb committed Feb 06, 2019

To disentangle the test directories in t/tags/tests, moves all test
dealing with a single check into t/tags/check. Moves 511 tests to new
locations.

The remaining 174 tests fall into one of these categories:

1. They test more than one Lintian check.
2. They test no checks, but only output (e.g. generic-dh-make-2005).
3. They belong to the old suites debs, changes or source.

Test for more than one Lintian check will be split, if possible.

Test for output unrelated to single checks may be resorted in other
meaningful ways. Some, such as basic-quilt, may be deleted. Other,
such as generic-dh-make-2005, should remain. One option is a separate
suite called output.

Tests could be sorted now but require more work. Many of them generate
files in Makefiles, which should be devolved. They also lack in
parameterization. Leaving the tests where they are just makes them
easier to find. They will be moved later manually.

Also, tests for a false positive that did not originally specify a
Test-Against but which tested positive for tags from only one
unrelated check ended up in a wrong location. Perhaps most glaringly,
binaries-unsafe-open is in t/tags/checks/manpages. These will likewise
be taken care of later.

Felix Lechner authored Feb 04, 2019 and Chris Lamb committed Feb 05, 2019

The runner computes Test-For and Test-Against from other settings.
Test-Against can be overridden to get the same behavior as before.
Removes the setting when the explicit value matches the computed one.

Gbp-Dch: ignore

Felix Lechner authored Feb 03, 2019 and Chris Lamb committed Feb 05, 2019

This test checked for implausible tags in Test-For. With the parameter
Test-For obsolete, the test is repurposed to check for an implausible
computed Test-For (rather than an actual one).

When Test-Against is overridden, it cannot be empty while the expected
'tags' are also empty. That is because an empty Test-Against implies a
non-empty Test-For. That in turn requires something in 'tags'. Any
such test must fail.

To catch the failure, the test remains marked TODO.

This logic applies only to tag-related tests, which are those using
Check.

Gbp-Dch: ignore

Felix Lechner authored Feb 03, 2019 and Chris Lamb committed Feb 05, 2019

Ensures that:

  - test name matches the name of the encapsulating directory
  - all mandatory fields are present
  - no disallowed fields are present
  - Test-Against is not present without Check
  - there are no duplicates in Test-Against
  - the entries in Check are valid Lintian checks
  - there are no duplicates in Check
  - the tags mentioned in Test-Against belong to checks in Check

This is a mandatory test that runs across over tests with each
invocation.

Felix Lechner authored Feb 03, 2019 and Chris Lamb committed Feb 05, 2019

The parameter Test-For is obsolete.  Please use the parameter Check
instead. It provides the same results with less maintainance.

From now on, the use of Test-For triggers an error.

Felix Lechner authored Feb 03, 2019 and Chris Lamb committed Feb 05, 2019

A new parameter called Check makes it possible to calculate Test-For
automatically. In terms of set theory, it is the intersection of the
tags belonging to the checks in the new parameter and the tags
expected in 'tags'. Performs this calculation in the test runner.

The parameter Test-For is obsolete.

A meaningful measure similar to Test-Against can likewise be
calculated. It is Test-For's complement, i.e.  the tags in the checks
that do not appear in 'tags'.

The mechanism works great for focused checks.  Unfortunately, many
checks are too broad. That could cause the automatic Test-Against to
contain too many tags. (The only drawback would be that more tests are
run when a tag is specified with 'onlyrun'.) Anyway, to ease the
transition, Test-Against is honored if present.

To preserve the old behavior, an empty Test-Against is added for tests
that do not use it. To get the new behavior, please remove it.

Test-Against should not be used in narrowly written checks.

Felix Lechner authored Feb 04, 2019 and Chris Lamb committed Feb 05, 2019

An earlier code version used hashed to compute the various tag sets.
That code was twice as long and probably more prone to errors going
forward. This library makes the code simpler and easier to understand.

The library is available all the way back to oo-stable.

Gbp-Dch: ignore

Felix Lechner authored Feb 02, 2019 and Chris Lamb committed Feb 05, 2019

The purpose of the new parameter is to calculate Test-For
automatically. Adds the parameter with the appropriate value to all
tests in suite tags.

The singular in Check is aspirational. The field can contain multiple
checks separated by spaces.  The value is the the sum of all checks
belonging to the tags mentioned in Test-For and in Test-Against.

Gbp-Dch: ignore

Felix Lechner authored Feb 02, 2019 and Chris Lamb committed Feb 05, 2019

A new parameter called Check will make it possible to calculate
Test-For automatically. In terms of set theory, it is the intersection
of the tags belonging to the checks in the new parameter and the tags
expected in 'tags'.

A meaningful measure similar to Test-Against can likewise be
calculated. It is Test-For's complement, i.e.  the tags in the checks
that do not appear in 'tags'.

The mechanism works great for focused checks.  Unfortunately, many
checks are too broad. That could cause the automatic Test-Against to
contain too many tags. (The only drawback would be that more tests are
run when a tag is specified with 'onlyrun'.) Anyway, to ease the
transition, Test-Against is honored if present.

To preserve the old behavior even for test that do not have a
Test-Against, we add an empty field to them. To get the new
behavior, please simply remove it.

Test-Against should never be used in narrowly written checks.

Some tests are not tag-related. Test-Against is added only when
Test-For is present. The sole exception is runtests-todo-test-for,
which claims to test a ficticous tag 'lintian-easter-egg'. That test
will be repurposed to check if the computed Test-For (rather than the
actual one) is implausible.

Gpb-Dch: ignore

Felix Lechner authored Feb 02, 2019 and Chris Lamb committed Feb 05, 2019

Some desc files have extra newline characters at the end.  Due to
restrictions imposed by the parser, the data may not be separated by
empty lines. It makes it more difficult to add fields automatically.
Removes extra white space at the end of such files.

Gbp-Dch: ignore

Felix Lechner authored Feb 02, 2019 and Chris Lamb committed Feb 05, 2019

Some desc files are not terminated with newline characters.  Due to
restrictions imposed by the parser, the data in desc may not be
separated by empty lines.  That makes it more difficult to add fields
automatically.  Adds the missing newline characters.

Gbp-Dch: ignore

Felix Lechner authored Feb 02, 2019 and Chris Lamb committed Feb 05, 2019

The tag names were renamed (before the branch introducing them was
merged) but the Test-Against field in some tests was not adjusted.
Corrects the tags.

Gbp-Dch: ignore

Felix Lechner authored Jan 31, 2019 and Chris Lamb committed Feb 05, 2019

All expected tags in the test suite are now specified as EWI. This
makes it possible to calculate Test-For automatically. That will be
implemented in short order using a new desc parameter called Check.

The line ordering in 'tags' is from now on disregarded.

Makes tag specifications invariant of output format (selected via
Output-Format) and insensitive to order. The extracted tags are sorted
automatically.

With this change the test runner no longer compares output files
verbatim. Uses tagextract and tagdiff instead.

Felix Lechner authored Feb 01, 2019 and Chris Lamb committed Feb 05, 2019

Lintian emits some warnings that are not tags. Those warnings cannot
be processed by tagextract or tagdiff.

Please also see #921112, which tracks this issue.

The messages are emitted by lib/Lintian/ProcessablePool.pm and should
probably be converted to proper lintian warnings.

The following tests are affected:

t/tags/debs/control-field-traversal-4
t/tags/source/control-field-traversal-1
t/tags/source/control-field-traversal-3

The messsages relate to relative path names in control fields and look
like this:

    warning: tainted [...] package '...', skipping

The objective is to test for this warning. The tests do not contain
any other tags. As an interim solution, the tests were given the
ficticous tag 'package-tainted'. The test calibration mechanism is
used to remove the the internal warning from the actual output. This
causes the tests to fail. As a result, they were marked TODO.

Felix Lechner authored Jan 31, 2019 and Chris Lamb committed Feb 05, 2019

Sorting is now done interally by tagextract and tagdiff. It is no
longer necessary to sort Lintian output.

As a side note, the tag specification files 'tags' can soon be in any
order.

Gbp-Dch: ignore

Felix Lechner authored Feb 01, 2019 and Chris Lamb committed Feb 05, 2019

The test suite has tests for all Lintian output formats except this
one. Adds a test. The tag specification is in EWI so the test can be
used with tagextract and tagdiff.

Gpb-Dch: ignore

Felix Lechner authored Jan 31, 2019 and Chris Lamb committed Feb 05, 2019

Test that use a non-standard output format make it harder to compute
Test-For. Replaces 'tags' with the same content but in an EWI version.
Proper matching will take place via tagextract and tagdiff.

Gbp-Dch: ignore

Felix Lechner authored Jan 30, 2019 and Chris Lamb committed Feb 05, 2019

Test that use a non-standard output format make it harder to compute
Test-For. Replaces 'tags' with the same content but in an EWI version.
Proper matching will take place via tagextract and tagdiff.

Gbp-Dch: ignore

Felix Lechner authored Jan 29, 2019 and Chris Lamb committed Feb 05, 2019

Test that use a non-standard output format make it harder to compute
Test-For. Replaces 'tags' with the same content but in an EWI version.
Proper matching will take place via tagextract and tagdiff.

Gbp-Dch: ignore

Felix Lechner authored Feb 01, 2019 and Chris Lamb committed Feb 05, 2019

The two utilities are essential components for how tests are
evaluated. A malfunction could make test results unreliable.  Adds
internal harness tests to make sure that tagextract and tagdiff work
as intended.

Gbp-Dch: ignore

Felix Lechner authored Jan 30, 2019 and Chris Lamb committed Feb 05, 2019

The tag specifications produced by tagextract have many advantages but
are designed to be readable by machines. This utility provides pretty
output for differences between two such files, hopefully even more so
in the future.

The output is sorted in reverse lexicographic order under LC_ALL=C.

Returns with a zero exit code even when the tags do not match. It
would be nice to match the behavior of standard 'diff', but that would
likely require disabling autodie and catching exceptions thrown by
Path::Tiny. For now, the exit code is non-zero only when the program
terminates abnormally.

When used in a terminal, produces colored output via Term::ANSIColor.
The test runner uses this tool to highlight discrepancies when tests
fail.

Gbp-Dch: ignore

Felix Lechner authored Jan 31, 2019 and Chris Lamb committed Feb 05, 2019

The tag specifications for tests ('tags') were previously a copy of
Lintian output. With Lintian's command line options, such formats can
differ widely.

This executable can extract tag information from all Lintian output
formats, including the experimental 'fullewi'. It will eventually make
the tag specifications output invariant. It is step toward making
Test-For and Test-Against obsolete.

The file format produced by this program is the largest subset of
values available in every output format. (Some have more, and some
have less.) It is a CSV file with a vertical bar as a separator. This
format was chosen to visually distinguish it from the colons output
format. It looks like this:

source|changelog-file-general|latest-debian-changelog-entry-without-new-date|
binary|changelog-file-general|possible-missing-colon-in-closes|"Closes #555555"
binary|changelog-file-general|misspelled-closes-bug|#666666
binary|changelog-file-general|debian-changelog-line-too-long|"line 8"
binary|changelog-file-general|debian-changelog-line-too-long|"line 15"
binary|changelog-file-general|bad-intended-distribution|"intended to experimental but uploaded to unstable"

The best way to compare two of those files is to use tagdiff.

Gbp-Dch: ignore

Felix Lechner authored Jan 31, 2019 and Chris Lamb committed Feb 05, 2019

A new utility called tagdiff uses this library to find differences
between expected and actual tags in the test suite. Tagdiff operates
on a new generalized format for tag information. That format became
necessary when cycling automatically through different Lintian output
formats.

This library is available all the way back to oo-stable.

Gbp-Dch: ignore

Felix Lechner authored Jan 29, 2019 and Chris Lamb committed Feb 05, 2019

Two new utilities called tagextract and tagdiff will use this to parse
colon-based output from Lintian and also a new generalized format for
tags. The generalized format is necessary to automatically cycle
through various Lintian output formats.

This library is available all the way back to oo-stable.

Gpb-Dch: ignore

Felix Lechner authored Jan 28, 2019 and Chris Lamb committed Feb 05, 2019

A new utility called tagextact will use this to parse Lintian's XML
output format.

The library is recommended over libxml-simple-perl, which is already
on the list but reportedly buggy and dated.

This library is available all the way back to oo-stable.

Gbp-Dch: ignore

Felix Lechner authored Jan 21, 2019 and Chris Lamb committed Feb 05, 2019

Switches the runner from a programmatic invocation of Lintian to the
template-based call. This documents the options that were used and
their order, which makes debugging easier. It also aids in the
parameterization of the Lintian invocation. This is a preparation for
cycling through a variety of Lintian settings, such as output formats.

Gbp-Dch: ignore

Felix Lechner authored Jan 21, 2019 and Chris Lamb committed Feb 05, 2019

The default settings are now propagated through a new parameter called
Default-Lintian-Options. Removes default settings of '-I -E' from test
specifications that use them and leaves only options that were clearly
meant to differ from the default settings. This is a preparation for
cycling through different output formats.

Gbp-Dch: ignore