Oh god, my eyes (packaging a hairball of bundled PHP stuff, tt-rss)

[Adam Williamson]

Hey, all. So, I'm looking at packaging tt-rss - an RSS reader
implemented as a PHP webapp - for Fedora, since I run it on my own
server. It became rapidly clear that it's a landmine of bundled PHP
libraries and snippets and uncertain licensing. I'm unsure which of the
things it bundles would be likely to qualify as copylibs, and also a few
of the things it bundles seem to raise wider questions, so I thought I'd
post my 'deps list' here and raise some of the issues:

* dojo/dijit - F/OSS, packaged

* simplepie - F/OSS, packaged

* CheckBoxTree.js - requires formal license, unpackaged -
http://www.thejekels.com/blog/dojo/dijit-tree-with-multi-state-checkboxes/comment-page-1/#comment-46 . not entirely sure whether this would count as a copylib.

* htmlpurifier - F/OSS, unpackaged but its PEAR channel is packaged as
php-channel-htmlpurifier, review at
https://bugzilla.redhat.com/show_bug.cgi?id=542045

* iui - F/OSS, unpackaged - https://code.google.com/p/iui/

* MiniTemplator - F/OSS, unpackaged -
http://www.source-code.biz/MiniTemplator/

* phpmailer - F/OSS, packaged

* position.js - comprises http://codesnippets.joyent.com/posts/show/835
and http://codesnippets.joyent.com/posts/show/836 - unlicensed, author
contacted - these are probably copylibs?

* prototypejs - F/OSS, unpackaged, already embedded in many other
packages - https://bugzilla.redhat.com/show_bug.cgi?id=523277

* php-pubsubhubbub - F/OSS, unpackaged:
https://code.google.com/p/pubsubhubbub/ (was
https://code.google.com/p/pubsubhubbub-php/ , merged into upstream)

* scriptaculous - F/OSS, mostly unpackaged, but part of
http://pypi.python.org/pypi/Scriptaculous , which is a python wrapper
with old versions of scriptaculous and prototype embedded in it

* sphinxapi.php - F/OSS, packaged (sphinx-php)

* tmhoauth - F/OSS, unpackaged -
https://github.com/themattharris/tmhOAuth

* xsl_mop-up.js - public domain, unpackaged -
http://www.fadshop.net/xsl_mop-up.js but link is dead, ref
https://bugzilla.mozilla.org/show_bug.cgi?id=98168 . probably a copylib

So the major issues that come up: prototypejs seems to be embedded into
an awful lot of Fedora packages, if you look at
https://bugzilla.redhat.com/show_bug.cgi?id=523277 as a reference.
mediatomb has a copy, wordpress has a copy, python-webhelpers has a copy
(actually it seems it's not there any more), python-Scriptaculous has a
copy, asterisk has a copy. Isn't this a major issue? Should I file a bug
for this and try to split prototypejs out into a single package which
all those other packages could depend on, or am I missing something? Has
it been declared a copylib? wordpress review request does not appear to
have dealt with it, stating "* no shared libraries are present: okay" -
I don't know if it was missed, or wasn't present in wordpress at the
time of review. mediatomb review similarly didn't catch it.

python-Scriptaculous seems to be a python (TurboGears) wrapper for
scriptaculous, and it has scriptaculous and prototypejs embedded in it.
the review request doesn't seem to have dealt with this at all, it
simply states "+ no headers or static libraries.", which seems to be,
well, a bit of a porky. =)
https://bugzilla.redhat.com/show_bug.cgi?id=508510 . should I raise this
as a bug, or again, am I missing something?

If anyone clueful has thoughts on the prototypejs and
python-scriptaculous issues, or on which of the tt-rss deps are likely
copylibs and don't need to be packaged separately, that'd be really
helpful. thanks!
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | identi.ca: adamwfedora
http://www.happyassassin.net