Path: csiph.com!1.us.feeder.erje.net!3.us.feeder.erje.net!3.eu.feeder.erje.net!feeder.erje.net!usenet.goja.nl.eu.org!aioe.org!bofh.it!news.nic.it!robomod From: Elena ``of Valhalla'' Grandi Newsgroups: linux.debian.maint.python Subject: bringing python-django-registration back into testing, dfsg issues Date: Mon, 26 Sep 2022 11:20:01 +0200 Message-ID: X-Mailbox-Line: From debian-python-request@lists.debian.org Mon Sep 26 09:18:24 2022 Old-Return-Path: X-Amavis-Spam-Status: No, score=-12.6 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FOURLA=0.1, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02, PGPSIGNATURE=-5, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .debian. - helo: .relay1-d.mail.gandi. - helo-domain: .gandi.) FROM/MX_MATCHES_NOT_HELO(DOMAIN)=0; rate: -3.5 Mail-Followup-To: "debian-python@lists.debian.org" MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="iYjSiPGZoDc/GYVJ" Content-Disposition: inline X-Mailing-List: archive/latest/20344 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/YzFuPEy0miBrGJAI@manillaroad.local.home.trueelena.org Approved: robomod@news.nic.it Lines: 60 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Mon, 26 Sep 2022 11:17:48 +0200 X-Original-Message-ID: Xref: csiph.com linux.debian.maint.python:14499 --iYjSiPGZoDc/GYVJ Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hello python-django-registration has been removed from testing, and since it's an useful package I'd like to bring it back into it. There is a new upstream release, and there was already some work done in git to package it, but it was failing because upstream has added a new dependency on https://pypi.org/project/confusable_homoglyphs/ The problem with the latter is that it includes two files from the unicode consortium: http://www.unicode.org/Public/UNIDATA/Scripts.txt http://www.unicode.org/Public/security/latest/confusables.txt which, if my understanding of https://www.unicode.org/copyright.html is correct aren't DFSG, but could be redistributed. I have two questions on how to proceed. 1) I've pushed to git a patch to make confusable_homoglyphs optional: it seems to be working, but it's still missing proper warning of the user that that specific protection is disabled. I would add both a runtime warning and a .NEWS. Do you think it is ok to upload the package like this? 2) Even if the answer to 1 is yes, I can also try to package confusable_homoglyphs: upstream can download the files from the unicode consortium if they aren't available: do you think it's better to use that ability and package the file in contrib, or just put everything in non-free? Personally, the latter sounds quite easier, and I would be strongly tempted by it. --=20 Elena ``of Valhalla'' =F0=9F=A7=9B --iYjSiPGZoDc/GYVJ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEY8n6rGg5PpTPkl4ZcL0i0xEjtDEFAmMxbjkACgkQcL0i0xEj tDE6cAgAh+0qSTwWRoZd62A9ZFcZXrUxVYfgZ6Ipw4fMlek1TGRQan7DFKonVJEk LB2Hu8t9PKjSve4IyG/ufre102GkCsq8pK0p+AKiTwrxTqmRkdLpTp59BThxRGKq 2HE1cnIjiPrlp/lxPcT0WiWJe/+XRwIalc9dUnSOEcnuisndneRawkV41aNocDVJ meQm9ot4ftL+lc4ZW3gpxr/ApZVG9oRqciyCV8x8P1wtSIGydOHQPvElH6vowWay U63JbT/LKTOVZrRn0/XvFGavNmFWiPW3kuDWtNttnpTozVm8l969dOHJZeEbCYme LfQfarAJeBtPRUwnBbk2eRPJ13Sf1w== =iRVT -----END PGP SIGNATURE----- --iYjSiPGZoDc/GYVJ--