Bug#1001036: chromium: build-depends on uglifyjs.terser which is going away

[Jonas Smedegaard]

Source: chromium
Version: 93.0.4577.82-1
Severity: important

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Dear maintainer,

Source package chromium build-depends on uglifyjs.terser which will soon
be dropped.

Please instead build-depend on package terser, and use the executable
"terser".


Kind regards,

- Jonas

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAmGpPZwACgkQLHwxRsGg
ASGxKg//dpNwUjL55jIlobVw2CcmLZAg9bV+t8nOjFP1cegwcxYplD0+dXPTRD7P
pZDtWvZRQAMOIowh298yZasKnsLFaZa64YCESqMeaWiiwf3eaStVXBVm5nSNlhUj
JYfIBpYtFnb8a8hWvdijZUBM9hQeldEfwsgNkauv03ZrrZWk1YogWs1i71z1/ruo
gBhiXYJQ4EbXPPhAlPl+X6KkGZIqHhKZHMKRLr2g1hbeEFFoXWybkPXq1MhytxxF
HHO7ZAoAYYrSZ2VYZdC5PXQdrmDDyBGUPc+Qtu8ugiQI4gGk4evt+hfLX7CZPgx+
RO6rMn4xJ+Sd70eDQw+P9GEr+KexSzp2YWjeulcjWY5DAr2jM25Xe6v+gDjdWyJW
n5i+z+czRK+/4T849fFIVtDh4SIH3Cgo41EApGaxdrsyFuwUoL2L1MYNgjgNq0VF
f37DgBTFje1a2gstEF8o5fLZkb6jGJcVzKgEDCUbEs9bq5uZDkU/b7m5iglvUA9s
7IkUDiA+dAvsWYFjp5jFcYgBEmF1G/AEnRcTggoaFGe1psiw40i/2zVtZ8QH9vlw
2X6RWLMUsGNXMSyq+PRp+NFoxYgjU7z5O4q+KaeSQBk6r4lNzpzhpp3fLZVwlDCe
OulzfinEecJheoZrSamPHn02hWueuELS8TTlEthCRCzPN18L73E=
=OvUi
-----END PGP SIGNATURE-----

[Andres Salomon]

On Thu, 02 Dec 2021 22:41:48 +0100 Jonas Smedegaard wrote:
> Source: chromium
> Version: 93.0.4577.82-1
> Severity: important
>

> Dear maintainer,
>
> Source package chromium build-depends on uglifyjs.terser which will soon
> be dropped.
>
> Please instead build-depend on package terser, and use the executable
> "terser".
>
>
> Kind regards,
>

> Jonas
>

I'm going to add a build-dep on "terser | uglifyjs.terser", since the
terser package is still only in experimental. However, I'm concerned
about the uglifyjs.terser executable going away; what is the timeline
for that? It would be ideal if the /usr/bin/uglifyjs.terser symlink
remained at least for the bookworm release, so users don't need a
special patch when doing bullseye-backports. After bookworm, users can
switch to /usr/bin/terser and not need to patch anything for bookworm
backports.

[Jonas Smedegaard]

Hi Andres,

Quoting Andres Salomon (2022-01-20 19:46:13)

> On Thu, 02 Dec 2021 22:41:48 +0100 Jonas Smedegaard wrote:
> > Source package chromium build-depends on uglifyjs.terser which will
> > soon be dropped.
> >
> > Please instead build-depend on package terser, and use the
> > executable "terser".

> I'm going to add a build-dep on "terser | uglifyjs.terser", since the
> terser package is still only in experimental.

That should be unneded: uglifyjs.terser 4.1.2-9 in unstable and testing
provides terser as virtual package.

> However, I'm concerned about the uglifyjs.terser executable going
> away; what is the timeline for that? It would be ideal if the
> /usr/bin/uglifyjs.terser symlink remained at least for the bookworm
> release, so users don't need a special patch when doing
> bullseye-backports. After bookworm, users can switch to
> /usr/bin/terser and not need to patch anything for bookworm backports.

I agree that a more gentle migration would be nicer. Unfortunately
Terser is already dangerously old - v4.1.2 was released in July 2019,
v4.8.0 was released in May 2020. Upstream does not provide any support
for older releases.

Backports will need to carry a small patch. Unfortunately.

So to answer your question: uglifyjs.terser will be dropped any day now!
Plan is to drop it as soon as verified among the packages that have
prepared for the switch, that there are no surprises among them.

- Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/

[x] quote me freely [ ] ask before reusing [ ] keep private

[Andres Salomon]

On 1/20/22 15:26, Jonas Smedegaard wrote:
> Hi Andres,
>
> Quoting Andres Salomon (2022-01-20 19:46:13)
>> On Thu, 02 Dec 2021 22:41:48 +0100 Jonas Smedegaard wrote:
>>> Source package chromium build-depends on uglifyjs.terser which will
>>> soon be dropped.
>>>
>>> Please instead build-depend on package terser, and use the
>>> executable "terser".
>> I'm going to add a build-dep on "terser | uglifyjs.terser", since the
>> terser package is still only in experimental.
> That should be unneded: uglifyjs.terser 4.1.2-9 in unstable and testing
> provides terser as virtual package.

Because new chromium releases in sid are immediately backported and
released to bullseye-security, it's easier to do an ORed build-dep than
to have to modify debian/control for the bullseye security update every
other week.

Thanks,

Andres

[Jonas Smedegaard]

Quoting Andres Salomon (2022-01-20 21:34:52)

Fair enough - I didn't mean to say there would be no reason to use
fallback dependencies - only that the reason you gave seemed unfounded.

Also, if you are talking about the semi-official¹ backports target in
Debian, then I am not sure if fallback-dependencies are taken into
account or deliberately suppressed for the reason of ensuring
reproducibility, same as for the official targets.

- Jonas

¹ Official as tied to a debian.org host, but officially unsupported by
security team and Debbugs and release team.

[Andres Salomon]

On 1/20/22 16:13, Jonas Smedegaard wrote:
>
> Also, if you are talking about the semi-official¹ backports target in
> Debian, then I am not sure if fallback-dependencies are taken into
> account or deliberately suppressed for the reason of ensuring
> reproducibility, same as for the official targets.
>
>
>

Ooh, good point, thanks! I just asked in #d-d and got a rundown on how
it would work (and not work).

[Jonas Smedegaard]

Quoting Andres Salomon (2022-01-20 22:40:30)

Happy that I could help. Good luck with Chromium - quite a challenge
you have taken on there!

- Jonas