kaoh / globalplatform

C library + command-line for Open- / GlobalPlatform smart cards
https://kaoh.github.io/globalplatform/
Other
72 stars 30 forks source link

Generated DotZLib.chm file included in git/tarball #80

Closed jas4711 closed 1 year ago

jas4711 commented 1 year ago

Hi. I got this (fatal) lintian warning about the globalplatform source tarball:

E: globalplatform source: source-contains-prebuilt-ms-help-file [zlib-1.2.8/contrib/dotzlib/DotZLib.chm]
N: 
N:   The source tarball contains a prebuilt Microsoft precompiled help file
N:   (CHM file). These are often included by mistake when developers generate a
N:   tarball without cleaning the source directory first.
N:   
N:   CHM files are mainly produced by proprietary, Windows-specific software.
N:   They are also mainly consumed by the Microsoft HTML Help Workshop.
N:   
N:   Whilst there is free software to read and write them, any examples
N:   existing in source packages are likely to be created by the proprietary
N:   Microsoft software and are probably missing the source HTML and associated
N:   files.
N:   
N:   If there is no sign this was intended, consider reporting it as an
N:   upstream bug.
N: 
N:   Visibility: error
N:   Show-Always: no
N:   Check: files/banned/compiled-help

While this could be something I can fix in the Debian packaging -- either by ignoring the error (if Debian policies allows that) or using a repacked release tarball without that file -- I'm reporting it to raise the possibility of improving things upstream, if you agree this is a problem.

I assume that this file is not actually needed for globalplatform, and only included because it is included in the upstream zlib tarball.

Why is even a copy of zlib included in the globalplatform git repository? It causes uncertainty if the system zlib or the included (usually outdated and unpatched) copy is used during the build, and adds complexity in case the system zlib shared library is used but the included zlib header files are used.

One solution to this would be to remove the entire zlib-*/ sub-directory from git, and updated documentation to request the person building globalplatform to install zlib separately. Chances are high that zlib is already installed on most systems anyway.

koh-osug commented 1 year ago

The zlib binary is needed for Windows. It is really hard to get a working pre-compiled version.The linker flags are all wrong and this must be compiled manually. This is too cumbersome for Windows developers. It might be sufficient to include just the binary. Is there an option to exclude this directory just for Unix?

jas4711 commented 1 year ago

I understand!

Meanwhile I learned how to repack the globalplatform tarball for Debian, to avoid the embedded copies of zlib, minizip and pcsclite-includes, and this resolves my issue. Embedded copies are generally usually a problem: https://wiki.debian.org/EmbeddedCopies