badger 4.8.0-4

Package Information

Description	fast key-value DB in Go - command-line tools BadgerDB is an embeddable, persistent and fast key-value (KV) database written in pure Go. It is the underlying database for Dgraph (https://dgraph.io), a fast, distributed graph database. It's meant to be a performant alternative to non-Go-based key-value stores like RocksDB. Project Status [Jun 26, 2019] Badger is stable and is being used to serve data sets worth hundreds of terabytes. Badger supports concurrent ACID transactions with serializable snapshot isolation (SSI) guarantees. A Jepsen-style bank test runs nightly for 8h, with --race flag and ensures the maintenance of transactional guarantees. Badger has also been tested to work with filesystem level anomalies, to ensure persistence and consistency. Badger v1.0 was released in Nov 2017, and the latest version that is data-compatible with v1.0 is v1.6.0. Badger v2.0, use a new storage format which won't be compatible with all of the v1.x.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Simon Quigley <tsimonq2@debian.org>
Sponsor	maytham@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/go-team/packages/badger.git (browse)
Popcon Installs	8
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/badger
Uploaded	4 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Mon, 09 Nov 2026 21:04:28 -0600
Source	badger
Version	4.8.0-4
Changed-By	Simon Quigley <tsimonq2@debian.org>
Architecture	source amd64 all

Changelog◂

badger (4.8.0-4) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Juan Manuel Méndez Rey ]
   * Install at the /v4 module path, rename the library package
   * Override the library-version tag for the transitional package
   * Restore pb/gen.sh and pb/protos_test.go to upstream
   * Breaks/Replaces up to 4.8.0-4~
   * Tie Breaks/Replaces to binary:Version, wrap-and-sort -abk

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	badger deb golang optional arch=any golang-github-dgraph-io-badger-dev deb oldlibs optional arch=all golang-github-dgraph-io-badger-v4-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: badger
Source: https://github.com/dgraph-io/badger

Files: *
Copyright: © Hypermode Inc.
License: Apache-2.0

Files: y/bloom.go y/bloom_test.go
Copyright: 2013 The LevelDB-Go Authors
License: BSD-3-Clause
Comment: https://github.com/golang/leveldb/blob/master/LICENSE

Files: debian/*
Copyright: 2019 Andreas Henriksson <andreas@fatal.se>
           2024-2025 Simon Josefsson <simon@josefsson.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
    * Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
    * Neither the name of Google Inc. nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 5 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 3 hours ago.

Report◂

DFSG NEW review for badger version 4.8.0-4

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 5 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is Apache-2.0 (Hypermode Inc.) throughout, except y/bloom.go and y/bloom_test.go, which carry the LevelDB-Go BSD-3-Clause notice; both licences are DFSG-free and compatible. debian/copyright is DEP-5 with a correct Format line, a Files: * stanza, a stanza for the two BSD files and one for debian/*, names both holders, reproduces the BSD text (not in /usr/share/common-licenses) and points at /usr/share/common-licenses/Apache-2.0. The generated Go files (pb/badgerpb4.pb.go, fb/BlockOffset.go, fb/TableIndex.go) all have their inputs in the tree.

Packaging

Competent go-team packaging: debhelper compat 13 with dh-go and the golang buildsystem, source format 3.0 (quilt), a properly built transitional package with Section oldlibs and Breaks/Replaces tied to ${binary:Version}, correct install files, Multi-Arch: foreign on the library, autopkgtest-pkg-go and Standards-Version 4.7.2 (Policy here is 4.7.4.1). The remaining problems are minor: a dependency list carrying six modules the source does not use (and naming the wrong protobuf/xxhash packages), a DH_GOLANG_EXCLUDES setting that also silently skips the core test suite, a blanket ignore of test failures on 32-bit, and a patch stack whose two smaller patches are inert.

Issues

minor packaging 1. Build-Depends and the -dev package's Depends list six Go modules the source neither imports nor requires ◂

Files: debian/control:11, debian/control:13, debian/control:15, debian/control:19, debian/control:22, debian/control:27, debian/control:82, debian/control:84, debian/control:89, debian/control:92, debian/control:97
Basis: checked, in the package or with a reference tool
Evidence: golang-github-datadog-zstd-dev, golang-github-gogo-protobuf-dev, golang-github-pkg-errors-dev, golang-go.opencensus-dev, golang-snappy-go-dev, golang-github-dgryski-go-farm-dev. No .go file in the tree imports any of them (the only hits for datadog, gogo, pkg/errors, opencensus are CHANGELOG lines and a comment in y/zstd.go; snappy comes from github.com/klauspost/compress/snappy in table/table.go, zstd from github.com/klauspost/compress/zstd). go.mod requires none of them, and go.sum has no entry at all for datadog, gogo, pkg/errors, opencensus or golang/snappy; github.com/dgryski/go-farm is in go.sum only as a dependency of ristretto, whose Debian package already Depends on golang-github-dgryski-go-farm-dev.
Problem: These are leftovers of the v2 packaging (the changelog for 4.2/4.5 says datadog zstd, gogo/protobuf and pkg/errors were replaced or dropped). They lengthen every clean build and, because they are also in the library package's Depends, they are pulled into every package that builds against badger. The same list is inconsistent between the two fields (gogo-protobuf is a Build-Depends but not a Depends).
Fix: Drop those six entries from Build-Depends and from golang-github-dgraph-io-badger-v4-dev's Depends. Also consider dropping flatbuffers-compiler, protobuf-compiler and protoc-gen-go: nothing in the build runs them (DH_GOLANG_GO_GENERATE is unset and the only test that regenerated files, TestProtosRegenerate, is disabled by patch 0003), so keep them only if regeneration is meant to stay possible.

minor packaging 2. Build-Depends names golang-github-golang-protobuf-1-5-dev for code importing google.golang.org/protobuf, and golang-github-cespare-xxhash-dev is a transitional dummy ◂

Files: debian/control:10, debian/control:16, debian/control:81, debian/control:86
Basis: checked, in the package or with a reference tool
Evidence: Source: "google.golang.org/protobuf/proto" in backup.go:16, batch.go:14, manifest.go:21, table/table.go:26, y/y_test.go:18; no file imports github.com/golang/protobuf. apt-cache: google.golang.org/protobuf is shipped by golang-google-protobuf-dev (1.36.10-2); golang-github-golang-protobuf-1-5-dev (1.5.4-2) only Depends on golang-google-protobuf-dev (>= 1.33.0). golang-github-cespare-xxhash-dev (2.3.0-4) is described as a "transitional dummy package" depending on golang-github-cespare-xxhash-v2-dev.
Problem: The library package's Depends is supposed to name the packages that provide the modules its source imports. Here the module imported from google.golang.org/protobuf is only reached through the dependency of a package the source never imports, which breaks if golang-github-golang-protobuf-1-5-dev is ever removed, and two of the entries point at a package that exists only for upgrades.
Fix: Replace golang-github-golang-protobuf-1-5-dev with golang-google-protobuf-dev (in both fields) and golang-github-cespare-xxhash-dev with golang-github-cespare-xxhash-v2-dev.

minor packaging 3. DH_GOLANG_EXCLUDES removes the root module package from the test targets, so the package's core test suite is never run ◂

Files: debian/rules:3, debian/rules:4
Basis: checked, in the package or with a reference tool
Evidence: export DH_GOLANG_EXCLUDES := github.com/dgraph-io/badger/v4$ together with DH_GOLANG_EXCLUDES_ALL := 0. In dh-go's golang buildsystem (/usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm), sub test calls the same get_targets() as sub build, and get_targets() filters go list $DH_GOPKG/... through every DH_GOLANG_EXCLUDES pattern; the pattern matches exactly the root import path. All of the main test files are in that package: db_test.go, levels_test.go, txn_test.go, value_test.go, iterator_test.go and the rest declare package badger.
Problem: dh_auto_test therefore tests only the subpackages (fb, options, pb, skl, table, trie, y, badger/cmd), not the database core, and dh_golang_autopkgtest (what Testsuite: autopkgtest-pkg-go runs) calls make build, so the same applies to autopkgtest. Neither a comment in debian/rules nor the changelog explains the exclusion, and DH_GOLANG_EXCLUDES_ALL := 0 shows the root package is deliberately still installed - the only effect of the excludes line is on what is built and tested.
Fix: Drop the DH_GOLANG_EXCLUDES line so the root package's tests run, or, if running them is deliberately avoided (memory or length on buildds), say so in a comment and in the changelog, and consider excluding only the specific directories intended.

minor packaging 4. override_dh_auto_test silently ignores every test failure on 32-bit architectures ◂

Files: debian/rules:11-13
Basis: checked, in the package or with a reference tool

Evidence:

ifeq ($(DEB_HOST_ARCH_BITS),32)
override_dh_auto_test:
	-dh_auto_test
endif

Problem: A leading - makes make discard dh_auto_test's exit status, so a real regression on i386/armhf passes unnoticed; the patch that motivated this (d/p/fix-int-overflow.patch, changelog 2.2007.2-3) is no longer in the series, and the analogous ppc64el workaround was removed in 4.8.0-3 because the Go bug it worked around was fixed (Closes: #1150078). Leaving a blanket ignore means the 32-bit builds carry no test signal at all.
Fix: Remove the override and see whether the 32-bit tests pass; if a specific test still fails, disable or skip that test in a patch rather than ignoring the whole suite.

minor packaging 5. Two of the three patches only alter the regeneration test that the third one skips, and none is marked forwarded ◂

Files: debian/patches/series, debian/patches/pb-gen.patch, debian/patches/pb-gen-diff.patch, debian/patches/0003-Disable-TestProtosRegenerate-test.patch:33
Basis: checked, in the package or with a reference tool
Evidence: series lists pb-gen.patch, pb-gen-diff.patch, 0003-Disable-TestProtosRegenerate-test.patch. pb-gen.patch comments out go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.31.0 in pb/gen.sh, pb-gen-diff.patch replaces the git diff check in TestProtosRegenerate with a cmp against a saved copy, and 0003 then inserts t.Skip("Disabled test, ...") as the first statement of TestProtosRegenerate. pb-gen.patch and pb-gen-diff.patch start at Index: badger/pb/... with no From/Subject/Description headers; 0003 has From/Date/Subject but no Forwarded or Bug field. The 4.8.0-4 changelog entry says pb/gen.sh and pb/protos_test.go were "Restore[d] ... to upstream", yet the patches still modify both.
Problem: Once the test is skipped, the changes made by the other two patches are inert, so three patches maintain a single disabled test and the changelog describes the opposite. The two patches also lack DEP-3 headers, which Debian expects of every quilt patch so that its purpose and forward status can be read without diffing it.
Fix: Reduce this to one patch (the skip, with the reason and a Forwarded: not-needed or Bug: reference), drop pb-gen.patch and pb-gen-diff.patch, and give the remaining patch a full DEP-3 header; or drop all three and disable the test upstream.

Verified ◂

Prescan: it reported no copyright holder missing from debian/copyright (140 files scanned, 4 declared holders) and listed no built files, PDFs or non-free wording; nothing was left to account for individually.
debian/copyright read in full: DEP-5, correct Format URL, stanzas Files: *, Files: y/bloom.go y/bloom_test.go, Files: debian/*, and licence paragraphs for Apache-2.0 (pointer to /usr/share/common-licenses/Apache-2.0 plus the notice) and BSD-3-Clause (full text with the Google Inc. clause).
Grepped the whole tree (excluding .pc/) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, All rights reserved, GNU, MIT, ISC, Creative Commons, Apache License, public domain, non-commercial: 103 hits. Every .go file except y/bloom.go and y/bloom_test.go carries SPDX-FileCopyrightText: © Hypermode Inc. <hello@hypermode.com> and SPDX-License-Identifier: Apache-2.0, which is what Files: * says; the two bloom files carry Copyright 2013 The LevelDB-Go Authors and match the BSD-3-Clause stanza; no other licence appears anywhere and no non-free term was found.
y/bloom.go and y/bloom_test.go: BSD-3-Clause text is reproduced in debian/copyright (it is not in /usr/share/common-licenses), and the same copyright file is installed in both binary packages, so the notice accompanies the compiled bloom filter.
pb/badgerpb4.pb.go is generated from pb/badgerpb4.proto, which is shipped, together with pb/gen.sh; fb/BlockOffset.go and fb/TableIndex.go are "Code generated by the FlatBuffers compiler" from fb/flatbuffer.fbs, which is shipped with fb/gen.sh. Both generated sets carry the Apache-2.0 SPDX header; their generator inputs are in the tree, so no built file lacks its preferred form for modification.
images/benchmarks-rocksdb.png and images/diggy-shadow.png: binary PNGs, not opened. They are the README's benchmark chart and the Badger mascot, they are covered by Files: *, they are not installed into any binary package (dh-go installs only .go/.proto and the two gen.sh files added through DH_GOLANG_INSTALL_EXTRA), and the image itself is its own modifiable form.
CODE_OF_CONDUCT.md is the Contributor Covenant 2.0 with its "Attribution" section intact, so the CC-BY attribution the Covenant asks for is preserved; the file itself states no separate licence and is covered by Files: *.
dir_plan9.go:49-53 says of one block This bit of code is copied from Go's lockedfile internal package: with a link to the exact file; it is the ~8-line stat/chmod/ModeExclusive idiom, the rest of the file being badger's own port. Noted; the file is Plan 9-only and not treated as an undeclared third-party file.
There is no vendor/ directory and no other bundled third-party library; the only code of other origin is the LevelDB-Go bloom filter, which debian/copyright covers.
Read in full: debian/control, rules, changelog, copyright, source/format, source/lintian-overrides, the three install files, all patches and patches/series, upstream/metadata, gbp.conf, salsa-ci.yml, gitlab-ci.yml. debian/watch was not reviewed.
Build-Depends: dh-go is correct for this upload: dh-go 1.69 (apt-cache) provides the golang addon and buildsystem and Conflicts with dh-golang, which the source-side lintian override explains; debian/rules' --with=golang --buildsystem=golang --builddirectory=_build matches dh-go's golang.pm.
The transitional golang-github-dgraph-io-badger-dev is Arch: all, Section oldlibs, Depends on -v4-dev (= ${binary:Version}), and -v4-dev Breaks/Replaces it below ${binary:Version}, which is what is needed because 4.8.0-3 already installed the source at the /v4 path under the old name.
Standards-Version 4.7.2 against the reviewing system's Policy 4.7.4.1: the first two components match, so not an issue.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 4.9.6, packaged 4.8.0), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 3 hours ago.

Back to Dashboard | View all reviews for this package