Path: csiph.com!news.samoylyk.net!gothmog.csi.it!bofh.it!news.nic.it!robomod From: Mahangu Weerasinghe Newsgroups: linux.debian.maint.python Subject: Re: review for datasette/0.65.2-1 Date: Sun, 30 Nov 2025 17:10:01 +0100 Message-ID: References: X-Original-To: Jeroen Ploemen X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Nov 30 16:07:21 2025 Old-Return-Path: X-Amavis-Spam-Status: No, score=-5.099 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=2, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-vk1-xa36.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AOJu0YzswrBrSIrHn67jY08e3bye9fSo+OsXsP4VYq8PYn5BUuPrhkmQ WSrqvUF3AwWZ7ou206lx3UmhC/vsRiaQDpEyv9/P+F4EZifcC5bsz+LOMg7pDn50piS2hHhs9ZQ OwvSH+m21brjyNbfrPwA+oA2+qrDf7ilrWipg2No= X-Gm-Gg: ASbGncsb6kbdHN2tN81o0J+oaIaYfsK8HstWbgdMsW4LyqSaO4ZW++F2pelo9WE6Xpr lj3sXuqjA5uTNee44O/Vu/p31oqb8XeT94129T9aWLUvds/ZdM951QZuYogvtuwNYi7r62gzvNU PtaTMf28DeRxlkExXrClquZXOShYtOVOyi4YLrdeiG7JofwfIH2rBQ9AFRtoFAQTYCuKwyV1rBd wQIC6lvn8zmiKvNKumX6nJNqrtFgvuV1OQ0LXzrJS6RyOWua+jN/VEQ8BQHvgzqMkMflTVE X-Google-SMTP-Source: AGHT+IFLmgDOIKWRhVAtE91JnD3DF0Qvsxq+YwVQNSeYgVPVvHEH2XLff7U2YTEmHecXPdxO7hlsK7NYs8rxNz0yaRU= X-Received: by 2002:a05:6122:6150:b0:55b:6b20:a17a with SMTP id 71dfb90a1353d-55cd767debcmr7725235e0c.9.1764518819051; Sun, 30 Nov 2025 08:06:59 -0800 (PST) MIME-Version: 1.0 X-Gm-Features: AWmQ_bkSw8f-DaTiKOsNLROZChRZB1S3BafSZWLqvrX7-CD87S84f3vJPdYjW58 Content-Type: multipart/alternative; boundary="00000000000068c5330644d20d86" X-Mailing-List: archive/latest/23436 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CACe4y=8kyv_KLRqQRtUvSeunnZmhLUbWQMaqwLp5YO+5N1_UaA@mail.gmail.com Approved: robomod@news.nic.it Lines: 376 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org X-Original-Date: Sun, 30 Nov 2025 21:36:48 +0530 X-Original-Message-ID: X-Original-References: <20251129104928.530c2227@debian.org> Xref: csiph.com linux.debian.maint.python:17203 --00000000000068c5330644d20d86 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Jeroen, Thanks for the thorough review! I believe I have addressed all your suggested changes: > repo: don't tag until upload / CI not active Fixed. Removed premature tags, added .gitlab-ci.yml. > changelog UNRELEASED / watch test releases / upstream/metadata docs link All addressed. Changelog is UNRELEASED, watch has Uversion-Mangle for pre-releases, metadata has Documentation link. > orig tarball differs from uscan Switched from PyPI to GitHub tarball. Now includes docs/, tests/, etc. > vendored pint Removed. Using system python3-pint via quilt patch. > copyright years / Andreas Borgen / vendored pint Years based on git history (2017-2024). Fixed cm-resize attribution to Andreas Borgen. Vendored pint copyright now moot since removed. > rules: use d/clean instead of dh_auto_clean override Done. > manpage: autogenerate with help2man Done. Static file removed. Now generated at build time. > control: sort deps / hardcoded deps / markupsafe / test deps / nocheck All fixed. Deps sorted, using ${python3:Depends}, added markupsafe, pytest, pytest-asyncio, bs4, trustme with . Removed pytest-runner. > lintian: application-in-library-section Added override. Datasette is both an app AND a library - plugins import from the datasette module - https://docs.datasette.io/en/stable/writing_plugins.html - so standard Python path seems correct. > Does pip install/uninstall work in Debian? No - blocked by PEP 668 (externally-managed-environment). Added README.Debian documenting this and recommending pipx/venv for plugin management. Tested in clean chroot and Salsa CI also now passing. Ready for re-review. Note: I made additional changes to get CI green (test configuration via PYBUILD_TEST_ARGS/PYBUILD_BEFORE_TEST, pristine-tar, Build-Depends adjustments). I'm still learning Debian packaging, so I'd appreciate any feedback if these aren't the right approaches. Thanks again for your continued help and support with this! Best, Mahangu On Sat, Nov 29, 2025 at 4:19=E2=80=AFPM Jeroen Ploemen wr= ote: > hi Mahangu, > > I took a look at the datasette package, up for sponsorship in the > Python team: > > * repo: current Debian revision is already tagged on some old commit; > please don't tag until an upload has been done, see team policy. > * repo: CI not active, please enable. > > * changelog: please leave the release at UNRELEASED, per team policy. > > * watch: needs to handle upstream test releases, either by preventing > them from getting matched in the first place, or by properly > mangling the upstream version. > > * orig tarball generated from the pristine-tar branch differs from > what uscan pulls in from github for the same upstream release: > (output from tardiff -m -s) > - .coveragerc > - .dockerignore > - .git-blame-ignore-revs > - .gitattributes > - .github > [...] > - .gitignore > - .isort.cfg > - .prettierrc > - .readthedocs.yaml > - CODE_OF_CONDUCT.md > - Dockerfile > + PKG-INFO > - codecov.yml > + datasette.egg-info > [...] > - datasette/vendored/pint/LICENSE > - demos > [...] > - docs > [...] > - package-lock.json > - package.json > - pytest.ini > / setup.cfg ( 6 + / > 1 -) > - test-in-pyodide-with-shot-scraper.sh > - tests/__init__.py > - tests/build_small_spatialite_db.py > - tests/conftest.py > - tests/ext.c > - tests/fixtures.py > - tests/plugins > [...] > - tests/spatialite.db > - tests/test_datasette_https_server.sh > - tests/test_templates > [...] > - tests/utils.py > > * sources have a vendored copy of 'pint', already packaged in debian > as python3-pint. Please try using the packaged one, unless the > vendored copy somehow special/modified. > > * copyright: what are the 2017-2024 upstream copyright years based on? > * copyright: missing info for datasette/vendored/pint. > * copyright: minified file datasette/static/cm-resize-1.0.1.min.js > does come with explicit info on the copyright holder (2017-2018 > Andreas Borgen, rather than just a nickname). > > * rules: no need to override dh_auto_clean just to 'rm -rf' a bunch of > files; simply list everything in d/clean instead. > > * manpage: debian/datasette.1 says it's generated by help2man. Do you > actually need to keep a static copy in git, or could this file be > autogenerated on build (ensuring it's always up-to-date for the > packaged release)? > > * upstream/metadata: missing link to upstream documentation. > (https://docs.datasette.io/) > > * control: sorting the deps would be helpful for readability. > * control: why all the hardcoded deps on the binary pkg? You usually > shouldn't be doing that unless the substitution variable > ${python3:Depends} gets things wrong. > * control: missing deps for unconditional imports of markupsafe: > datasette/tracer.py:4:from markupsafe import escape > datasette/app.py:23:from markupsafe import Markup, escape > datasette/views/base.py:8:from markupsafe import escape > datasette/views/database.py:5:from markupsafe import Markup, escape > datasette/views/database.py:8:import markupsafe > datasette/views/table.py:5:import markupsafe > datasette/handle_exception.py:8:from markupsafe import Markup > datasette/utils/__init__.py:9:import markupsafe > > ...which seems to be missing from install_requires in setup.py as > well; possible upstream bug? > * control: missing build-deps on pytest, pytest_asyncio, bs4, > possibly others; needed for tests. The missing pytest causes pybuild > to default to unittests, and therefore not run any tests on build > at all. > * control: setting the testsuite field to autopkgtest-pkg-pybuild is > pointless when no tests are run on build. > * control: please mark any build-deps that are only needed for > testing with . > * control: possible unused build-dep on pytest-runner? > > * lintian: X: datasette: application-in-library-section python > [usr/bin/datasette] > > > Does the datasette module see use outside of the app itself (for > example by scripts, plugins or addons), or is the whole thing an > application that just happens to be written in Python and thus > internally takes the shape of a module? In the latter case, it is > customary to install the module in a private dir (typically > /usr/share//...). > > Was any testing done, preferably in a somewhat clean environment (VM > or similar)? Does the whole install/uninstall code (using pip) in > datasette/cli.py actually work in Debian? > > > Once the above comments have been addressed, simply re-add the > package to the IRC channel topic and/or ping me by e-mail. > --00000000000068c5330644d20d86 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Jeroen,
Thanks for the thorough review! I believe I = have addressed all your suggested changes:

> repo: don't tag = until upload / CI not active

Fixed. Removed premature tags, added .g= itlab-ci.yml.

> changelog UNRELEASED / watch test releases / upst= ream/metadata docs link

All addressed. Changelog is UNRELEASED, watc= h has Uversion-Mangle for pre-releases, metadata has Documentation link.
> orig tarball differs from uscan

Switched from PyPI to GitH= ub tarball. Now includes docs/, tests/, etc.

> vendored pint
<= br>Removed. Using system python3-pint via quilt patch.

> copyrigh= t years / Andreas Borgen / vendored pint

Years based on git history = (2017-2024). Fixed cm-resize attribution to Andreas Borgen. Vendored pint c= opyright now moot since removed.

> rules: use d/clean instead of = dh_auto_clean override

Done.

> manpage: autogenerate with = help2man

Done. Static file removed. Now generated at build time.
=
> control: sort deps / hardcoded deps / markupsafe / test deps / noc= heck

All fixed. Deps sorted, using ${python3:Depends}, added markups= afe, pytest, pytest-asyncio, bs4, trustme with <!nocheck>. Removed py= test-runner.

> lintian: application-in-library-section

Add= ed override. Datasette is both an app AND a library - plugins import from t= he datasette module - https://docs.datasette.io/en/stable/writing_plugins.html - so standard Python path seems correct.

> Does pip install/uni= nstall work in Debian?

No - blocked by PEP 668 (externally-managed-e= nvironment). Added README.Debian documenting this and recommending pipx/ven= v for plugin management.

Tested in clean chroot and Salsa CI also no= w passing. Ready for re-review.

Note: I made additional changes to g= et CI green (test configuration via PYBUILD_TEST_ARGS/PYBUILD_BEFORE_TEST, = pristine-tar, Build-Depends adjustments). I'm still learning Debian pac= kaging, so I'd appreciate any feedback if these aren't the right ap= proaches.

Thanks again for your continued help and support with this= !

Best,
Mahangu


On Sat, Nov 29, 2025 at 4:19=E2= =80=AFPM Jeroen Ploemen <jcfp@debian.org> wrote:
hi Mahangu,<= br>
I took a look at the datasette package, up for sponsorship in the
Python team:

* repo: current Debian revision is already tagged on some old commit;
=C2=A0 please don't tag until an upload has been done, see team policy.=
* repo: CI not active, please enable.

* changelog: please leave the release at UNRELEASED, per team policy.

* watch: needs to handle upstream test releases, either by preventing
=C2=A0 them from getting matched in the first place, or by properly
=C2=A0 mangling the upstream version.

* orig tarball generated from the pristine-tar branch differs from
=C2=A0 what uscan pulls in from github for the same upstream release:
=C2=A0 (output from tardiff -m -s)
=C2=A0 - .coveragerc
=C2=A0 - .dockerignore
=C2=A0 - .git-blame-ignore-revs
=C2=A0 - .gitattributes
=C2=A0 - .github
=C2=A0 =C2=A0 [...]
=C2=A0 - .gitignore
=C2=A0 - .isort.cfg
=C2=A0 - .prettierrc
=C2=A0 - .readthedocs.yaml
=C2=A0 - CODE_OF_CONDUCT.md
=C2=A0 - Dockerfile
=C2=A0 + PKG-INFO
=C2=A0 - codecov.yml
=C2=A0 + datasette.egg-info
=C2=A0 =C2=A0 [...]
=C2=A0 - datasette/vendored/pint/LICENSE
=C2=A0 - demos
=C2=A0 =C2=A0 [...]
=C2=A0 - docs
=C2=A0 =C2=A0 [...]
=C2=A0 - package-lock.json
=C2=A0 - package.json
=C2=A0 - pytest.ini
=C2=A0 / setup.cfg=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0(=C2=A0 =C2=A0 6 + /
=C2=A0 1 -)
=C2=A0 - test-in-pyodide-with-shot-scraper.sh
=C2=A0 - tests/__init__.py
=C2=A0 - tests/build_small_spatialite_db.py
=C2=A0 - tests/conftest.py
=C2=A0 - tests/ext.c
=C2=A0 - tests/fixtures.py
=C2=A0 - tests/plugins
=C2=A0 =C2=A0 [...]
=C2=A0 - tests/spatialite.db
=C2=A0 - tests/test_datasette_https_server.sh
=C2=A0 - tests/test_templates
=C2=A0 =C2=A0 [...]
=C2=A0 - tests/utils.py

* sources have a vendored copy of 'pint', already packaged in debia= n
=C2=A0 as python3-pint. Please try using the packaged one, unless the
=C2=A0 vendored copy somehow special/modified.

* copyright: what are the 2017-2024 upstream copyright years based on?
* copyright: missing info for datasette/vendored/pint.
* copyright: minified file datasette/static/cm-resize-1.0.1.min.js
=C2=A0 does come with explicit info on the copyright holder (2017-2018
=C2=A0 Andreas Borgen, rather than just a nickname).

* rules: no need to override dh_auto_clean just to 'rm -rf' a bunch= of
=C2=A0 files; simply list everything in d/clean instead.

* manpage: debian/datasette.1 says it's generated by help2man. Do you =C2=A0 actually need to keep a static copy in git, or could this file be =C2=A0 autogenerated on build (ensuring it's always up-to-date for the<= br> =C2=A0 packaged release)?

* upstream/metadata: missing link to upstream documentation.
=C2=A0 (https://docs.datasette.io/)

* control: sorting the deps would be helpful for readability.
* control: why all the hardcoded deps on the binary pkg? You usually
=C2=A0 shouldn't be doing that unless the substitution variable
=C2=A0 ${python3:Depends} gets things wrong.
* control: missing deps for unconditional imports of markupsafe:
=C2=A0 datasette/tracer.py:4:from markupsafe import escape
=C2=A0 datasette/app.py:23:from markupsafe import Markup, escape
=C2=A0 datasette/views/base.py:8:from markupsafe import escape
=C2=A0 datasette/views/database.py:5:from markupsafe import Markup, escape<= br> =C2=A0 datasette/views/database.py:8:import markupsafe
=C2=A0 datasette/views/table.py:5:import markupsafe
=C2=A0 datasette/handle_exception.py:8:from markupsafe import Markup
=C2=A0 datasette/utils/__init__.py:9:import markupsafe

=C2=A0 ...which seems to be missing from install_requires in setup.py as =C2=A0 well; possible upstream bug?
* control: missing build-deps on pytest, pytest_asyncio, bs4,
=C2=A0 possibly others; needed for tests. The missing pytest causes pybuild=
=C2=A0 to default to unittests, and therefore not run any tests on build =C2=A0 at all.
* control: setting the testsuite field to autopkgtest-pkg-pybuild is
=C2=A0 pointless when no tests are run on build.
* control: please mark any build-deps that are only needed for
=C2=A0 testing with <!nocheck>.
* control: possible unused build-dep on pytest-runner?

* lintian: X: datasette: application-in-library-section python
=C2=A0 [usr/bin/datasette]


Does the datasette module see use outside of the app itself (for
example by scripts, plugins or addons), or is the whole thing an
application that just happens to be written in Python and thus
internally takes the shape of a module? In the latter case, it is
customary to install the module in a private dir (typically
/usr/share/<pkgname>/...).

Was any testing done, preferably in a somewhat clean environment (VM
or similar)? Does the whole install/uninstall code (using pip) in
datasette/cli.py actually work in Debian?


Once the above comments have been addressed, simply re-add the
package to the IRC channel topic and/or ping me by e-mail.
--00000000000068c5330644d20d86--