Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Bug#816611: RFS: yamllint/1.0.3-1 [ITP] -- A linter for YAML files

21 views
Skip to first unread message

Adrien Vergé

unread,
Mar 3, 2016, 8:50:04 AM3/3/16
to
Package: sponsorship-requests
Severity: wishlist

Dear mentors,

I am looking for a sponsor for my package "yamllint"

Package name : yamllint
Version : 1.0.3-1
Upstream Author : Adrien Vergé <adrie...@gmail.com>
URL : https://github.com/adrienverge/yamllint
License : GPL-3+
Section : devel

It builds this binary package:

yamllint - A linter for YAML files

To access further information about this package, please visit the
following URL:

http://mentors.debian.net/package/yamllint

Alternatively, one can download the package with dget using this command:

dget -x http://mentors.debian.net/debian/pool/main/y/yamllint/yamllint_1.0.3-1.dsc

More information about yamllint can be obtained from
http://yamllint.readthedocs.org/en/latest/

Regards,
Adrien Vergé

Adrien Vergé

unread,
Mar 4, 2016, 2:30:04 PM3/4/16
to
Paul, thanks for this complete answer.

> Since I am interested in more static analysis and linting tools for
> check-all-the-things I'm willing to sponsor this, but only in return
> for a patch for check-all-the-things adding support for any one of the
> tools with TODO comments or checks flagged todo.

OK. Please find 4 enhancement commits (they are signed):

git fetch https://github.com/adrienverge/check-all-the-things.git enhancements
git log 7017206..FETCH_HEAD

(The "how to contribute section" suppose contributors have write
access to collab-maint, but this is not my case).

> In addition, you may want to submit pull requests to the linters and
> git-lint repos to advertise yamllint more widely and get it supported
> by git-lint.

Done for `linters`, will do for `git-lint`.

> The package fails to build in a clean chroot, see below for the log.

Thanks, fixed upstream and repackaged as 1.0.4-1.
https://mentors.debian.net/package/yamllint

> Please sign your tags, commits and releases using OpenPGP and have
> uscan verify them tarball signatures.

I might sign upstream commits in the future, but not right now.

> debian/copyright has unknown@unknown as your email address.

Fixed.

> Did you really mean for the license for debian/ to be different to the
> rest of the code? debian/copyright says GPL-2+ for it but GPL-3+ for
> the rest.

Fixed.

> The Standards-Version in debian/control is out of date, please read
> the upgrading guide and bump it:

Upgraded.

> Please uncomment the Vcs-* fields and point them at the VCS for the
> Debian packaging.

Done.

> You may want to wrap-and-sort the debian meta-data for easier to read
> diffs.

Done.

> Please add some upstream metadata: https://wiki.debian.org/UpstreamMetadata

Done.

Paul Wise

unread,
Mar 4, 2016, 2:40:03 PM3/4/16
to
On Thu, Mar 3, 2016 at 9:43 PM, Adrien Vergé wrote:

> yamllint - A linter for YAML files

Since I am interested in more static analysis and linting tools for
check-all-the-things I'm willing to sponsor this, but only in return
for a patch for check-all-the-things adding support for any one of the
tools with TODO comments or checks flagged todo.

https://anonscm.debian.org/cgit/collab-maint/check-all-the-things.git/tree/data/

In addition, you may want to submit pull requests to the linters and
git-lint repos to advertise yamllint more widely and get it supported
by git-lint.

https://github.com/mcandre/linters
https://github.com/sk-/git-lint

Some thoughts about yamllint while you consider my offer:

The package fails to build in a clean chroot, see below for the log.

Since you are upstream, you may want to read our guide for upstreams:

https://wiki.debian.org/UpstreamGuide

Please sign your tags, commits and releases using OpenPGP and have
uscan verify them tarball signatures.

http://mikegerwitz.com/papers/git-horror-story
https://wiki.debian.org/debian/watch#Cryptographic_signature_verification
https://wiki.debian.org/Creating%20signed%20GitHub%20releases
https://help.riseup.net/en/security/message-security/openpgp/best-practices

debian/copyright has unknown@unknown as your email address.

Did you really mean for the license for debian/ to be different to the
rest of the code? debian/copyright says GPL-2+ for it but GPL-3+ for
the rest.

The Standards-Version in debian/control is out of date, please read
the upgrading guide and bump it:

https://www.debian.org/doc/debian-policy/upgrading-checklist

Please uncomment the Vcs-* fields and point them at the VCS for the
Debian packaging. It seems that is at github too:

https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-VCS-fields
https://github.com/adrienverge/yamllint/tree/packaging/packaging/debian/

You may want to wrap-and-sort the debian meta-data for easier to read
diffs. My favourite command is:

wrap-and-sort --short-indent --wrap-always --sort-binary-packages
--trailing-comma --verbose

Please add some upstream metadata: https://wiki.debian.org/UpstreamMetadata

You may want to add some DEP-8 tests: http://dep.debian.net/deps/dep8/

Automatic checks:

build

warning: build_py: byte-compiling is disabled, skipping.

dh_auto_test -O--buildsystem=pybuild
I: pybuild base:184: cd
/build/yamllint-1.0.3/.pybuild/pythonX.Y_3.5/build; python3.5 -m nose
tests
.....................................................................................................................................E.....
======================================================================
ERROR: Failure: FileNotFoundError ([Errno 2] No such file or
directory: 'tests/yaml-1.2-spec-examples')
----------------------------------------------------------------------
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/nose/failure.py", line 39, in runTest
raise self.exc_val.with_traceback(self.tb)
File "/usr/lib/python3/dist-packages/nose/loader.py", line 418, in
loadTestsFromName
addr.filename, addr.module)
File "/usr/lib/python3/dist-packages/nose/importer.py", line 47, in
importFromPath
return self.importFromDir(dir_path, fqname)
File "/usr/lib/python3/dist-packages/nose/importer.py", line 94, in
importFromDir
mod = load_module(part_fqname, fh, filename, desc)
File "/usr/lib/python3.5/imp.py", line 234, in load_module
return load_source(name, filename, file)
File "/usr/lib/python3.5/imp.py", line 172, in load_source
module = _load(spec)
File "<frozen importlib._bootstrap>", line 693, in _load
File "<frozen importlib._bootstrap>", line 673, in _load_unlocked
File "<frozen importlib._bootstrap_external>", line 662, in exec_module
File "<frozen importlib._bootstrap>", line 222, in _call_with_frames_removed
File "/build/yamllint-1.0.3/.pybuild/pythonX.Y_3.5/build/tests/test_spec_examples.py",
line 124, in <module>
files = os.listdir('tests/yaml-1.2-spec-examples')
FileNotFoundError: [Errno 2] No such file or directory:
'tests/yaml-1.2-spec-examples'

----------------------------------------------------------------------
Ran 139 tests in 7.107s

FAILED (errors=1)
E: pybuild pybuild:274: test: plugin distutils failed with: exit
code=1: cd /build/yamllint-1.0.3/.pybuild/pythonX.Y_3.5/build;
python3.5 -m nose tests
dh_auto_test: pybuild --test --test-nose -i python{version} -p 3.5
--dir . returned exit code 13
debian/rules:4: recipe for target 'build' failed
...
/build/yamllint-1.0.3# find -iname *1.2*
./tests/yaml-1.2-spec-examples

lintian

W: yamllint source: out-of-date-standards-version 3.9.6 (current is 3.9.7)
P: yamllint source: debian-watch-may-check-gpg-signature

check-all-the-things:

$ duck
E: debian/copyright:6: Email: unknown@unknown: ERROR (Certainty:possible)
unknown@unknown: No MX entry found.
unknown@unknown: No A entry found.
unknown@unknown: No AAAA entry found.

$ fdupes -q -r . | grep -vE
'/(\.(git|svn|bzr|hg|sgdrawer)|_(darcs|FOSSIL_)|CVS)(/|$)' | cat -s
./tests/rules/__init__.py
./tests/__init__.py
./.pc/applied-patches

./tests/yaml-1.2-spec-examples/example-5.5
./tests/yaml-1.2-spec-examples/example-5.1

./tests/yaml-1.2-spec-examples/example-8.11
./tests/yaml-1.2-spec-examples/example-8.10

./PKG-INFO
./yamllint.egg-info/PKG-INFO

# check if these can be switched to https://
$ grep -rF http: .
./tests/test_linter.py:# along with this program. If not, see
<http://www.gnu.org/licenses/>.
./tests/test_config.py:# along with this program. If not, see
<http://www.gnu.org/licenses/>.
<lots>

$ find -type d \( -iname .bzr -o -iname .git -o -iname .hg -o -iname
.svn -o -iname CVS -o -iname RCS -o -iname SCCS -o -iname _MTN -o
-iname _darcs -o -iname .pc -o -iname .cabal-sandbox -o -iname .cdv -o
-iname .metadata -o -iname CMakeFiles -o -iname _build -o -iname
_sgbak -o -iname autom4te.cache -o -iname blib -o -iname cover_db -o
-iname node_modules -o -iname '~.dep' -o -iname '~.dot' -o -iname
'~.nib' -o -iname '~.plst' \) -prune -o -type f ! \( -iname '*.bak' -o
-iname '*.swp' -o -iname '#.*' -o -iname '#*#' -o -iname 'core.*' -o
-iname '*~' -o -iname '*.gif' -o -iname '*.jpg' -o -iname '*.jpeg' -o
-iname '*.png' -o -iname '*.min.js' -o -iname '*.js.map' -o -iname
'*.js.min' -o -iname '*.min.css' -o -iname '*.css.map' -o -iname
'*.css.min' \) -exec spellintian --picky {} +
./tests/yaml-1.2-spec-examples/example-2.3: american -> American
./catt: python -> Python
./docs/quickstart.rst: python -> Python
./docs/Makefile: latex -> LaTeX
./yamllint/rules/line_length.py: splitted -> split
./yamllint/rules/empty_lines.py: serie -> series

$ grep -riE 'fixme|todo|hack|xxx|broken' .
./yamllint/cli.py: # TODO: read from stdin when no filename?


--
bye,
pabs

https://wiki.debian.org/PaulWise

Paul Wise

unread,
Mar 4, 2016, 3:10:03 PM3/4/16
to
On Fri, 2016-03-04 at 13:01 +0100, Adrien Vergé wrote:

> OK. Please find 4 enhancement commits (they are signed):
>
> git fetch https://github.com/adrienverge/check-all-the-things.git enhancements
> git log 7017206..FETCH_HEAD

Merged. Modified the yamllint commit, no need to comment out apt since
the dependencies for todo-flagged checks are put into suggests.

> Thanks, fixed upstream and repackaged as 1.0.4-1.
> https://mentors.debian.net/package/yamllint

Thanks, I'll look at this tomorrow.
signature.asc

Paul Wise

unread,
Mar 4, 2016, 9:40:02 PM3/4/16
to
Looks like you released a new version.

There was one issue to fix, I've taken the liberty of doing that myself.

https://lintian.debian.org/tags/copyright-should-refer-to-common-license-file-for-gpl.html
https://www.debian.org/doc/debian-policy/ch-docs.html#s-copyrightfile

I added these 3 lines to the end of debian/copyright, you may want to
commit that to your git repository:

.
On Debian systems, the complete text of the GNU General
Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".

After fixing that issue I've uploaded it to NEW:

http://ftp-master.debian.org/new.html

Some things you may want to do/fix:

Add a manual page, you can do that automatically using either sphinx
and sphinxcontrib-autoprogram or python3-sphinx-argparse.

Add shell completion, you can do that automatically using python3-argcomplete.

The URLs in the Vcs-* fields are 404 (see duck output below), probably
you need to point them at the right branch in the github repo.

https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-VCS-fields
https://github.com/adrienverge/yamllint/tree/packaging/

Automatic checks:

build

lintian

I: yamllint source: vcs-field-uses-insecure-uri vcs-git
git://anonscm.debian.org/collab-maint/yamllint.git
P: yamllint source: debian-watch-may-check-gpg-signature
P: yamllint: no-upstream-changelog
E: yamllint: copyright-should-refer-to-common-license-file-for-gpl
W: yamllint: description-synopsis-starts-with-article
W: yamllint: binary-without-manpage usr/bin/yamllint

check-all-the-things

$ find .. -maxdepth 1 -type f -iwholename '../*.build' -exec grep -H
-i warn {} +
../yamllint_1.1.0-1_amd64.build:dpkg-gencontrol: warning: Depends
field of package yamllint: unknown substitution variable
${shlibs:Depends}

$ cme check dpkg
...
Warning in 'control source Vcs-Git' value
'git://anonscm.debian.org/collab-maint/yamllint.git': An unencrypted
transport protocol is used for this URI. It is recommended to use a
secure transport such as HTTPS for anonymous read-only access.
Warning in 'control source Vcs-Git' value
'git://anonscm.debian.org/collab-maint/yamllint.git': URL to debian
system is not the recommended one (this can be fixed with 'cme fix'
command)

$ duck
E: debian/control: Vcs-Browser:
https://anonscm.debian.org/cgit/collab-maint/yamllint.git: ERROR
(Certainty:certain)
Curl:0 HTTP:404 No error

E: debian/control: Vcs-Git:
git://anonscm.debian.org/collab-maint/yamllint.git: ERROR
(Certainty:certain)
fatal: '/git/collab-maint/yamllint.git' does not appear to be a git
repository
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

$ fdupes -q -r . | grep -vE
'/(\.(git|svn|bzr|hg|sgdrawer)|_(darcs|FOSSIL_)|CVS)(/|$)' | cat -s
./tests/yaml-1.2-spec-examples/example-5.5
./tests/yaml-1.2-spec-examples/example-5.1

./tests/yaml-1.2-spec-examples/example-8.11
./tests/yaml-1.2-spec-examples/example-8.10

./PKG-INFO
./yamllint.egg-info/PKG-INFO

# check if these can be switched to https://
$ grep -rF http: .
./tests/test_linter.py:# along with this program. If not, see
<http://www.gnu.org/licenses/>.
./tests/test_config.py:# along with this program. If not, see
<http://www.gnu.org/licenses/>.
<lots>

$ find -type f -iname '*.py' -exec pylint
--msg-template='{abspath}:{line}:{column}: [{category}:{symbol}]
{obj}: {msg}' --reports=n {} +
<lots>

$ find -type d \( -iname .bzr -o -iname .git -o -iname .hg -o -iname
.svn -o -iname CVS -o -iname RCS -o -iname SCCS -o -iname _MTN -o
-iname _darcs -o -iname .pc -o -iname .cabal-sandbox -o -iname .cdv -o
-iname .metadata -o -iname CMakeFiles -o -iname _build -o -iname
_sgbak -o -iname autom4te.cache -o -iname blib -o -iname cover_db -o
-iname node_modules -o -iname '~.dep' -o -iname '~.dot' -o -iname
'~.nib' -o -iname '~.plst' \) -prune -o -type f ! \( -iname '*.bak' -o
-iname '*.swp' -o -iname '#.*' -o -iname '#*#' -o -iname 'core.*' -o
-iname '*~' -o -iname '*.gif' -o -iname '*.jpg' -o -iname '*.jpeg' -o
-iname '*.png' -o -iname '*.min.js' -o -iname '*.js.map' -o -iname
'*.js.min' -o -iname '*.min.css' -o -iname '*.css.map' -o -iname
'*.css.min' \) -exec spellintian --picky {} +
./tests/yaml-1.2-spec-examples/example-2.3: american -> American
./docs/quickstart.rst: python -> Python
./docs/Makefile: latex -> LaTeX
./yamllint/rules/line_length.py: splitted -> split
./yamllint/rules/empty_lines.py: serie -> series

$ grep -riE 'fixme|todo|hack|xxx|broken' .
...
./yamllint/cli.py: # TODO: read from stdin when no filename?

Adrien Vergé

unread,
Mar 7, 2016, 6:30:03 AM3/7/16
to
2016-03-05 3:28 GMT+01:00 Paul Wise <pa...@debian.org>:
> There was one issue to fix, I've taken the liberty of doing that myself.

Thanks.

> Add a manual page, you can do that automatically using either sphinx
> and sphinxcontrib-autoprogram or python3-sphinx-argparse.

Good idea. I did this in my local package, should I upload it on
mentors again? Or wait for the package to be published to unstable?
(Sorry, first package on Debian.)

> The URLs in the Vcs-* fields are 404 (see duck output below), probably
> you need to point them at the right branch in the github repo.
>
> https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-VCS-fields
> https://github.com/adrienverge/yamllint/tree/packaging/

Actually the branch on GitHub is temporary. I thought
git://anonscm.debian.org/collab-maint/yamllint.git was going to be
created once the package is uploaded, isn't it the case? If not,
should I remove the Vcs-* tags?

Thanks again for your help.

Paul Wise

unread,
Mar 7, 2016, 7:00:04 AM3/7/16
to
On Mon, 2016-03-07 at 12:16 +0100, Adrien Vergé wrote:

> Good idea. I did this in my local package, should I upload it on
> mentors again? Or wait for the package to be published to unstable?
> (Sorry, first package on Debian.)

I would suggest that you make this and other upstream changes in the
upstream git repository and upload a new version to mentors when you
make a new release.

On that note, please file new RFS bugs for future uploads.


> Actually the branch on GitHub is temporary. I thought
> git://anonscm.debian.org/collab-maint/yamllint.git was going to be
> created once the package is uploaded, isn't it the case? If not,
> should I remove the Vcs-* tags?

collab-maint repos are only manually created, perhaps you were thinking
of dgit, but that is also manual creation.

https://wiki.debian.org/Teams/CollabMaint
https://browse.dgit.debian.org/

I suggest keeping the Vcs-* fields but pointing them at the place where
you intend to maintain the packaging, so either github or collab-maint.
signature.asc
0 new messages