bazel-buildtools 10.1.0-1

Package Information

Description	Misc utilities for Bazel such as formatter and editor This package contains developer tools for working with Google's Bazel buildtool. * buildifier For formatting BUILD, BUILD.bazel files in a standard way * buildozer For doing command-line operations on these files. * unused_deps For finding unneeded dependencies in java_library rules.
Maintainer	Debian Bazel Team <team+bazel@tracker.debian.org>
Changed By	Kentaro Hayashi <kenhys@xdump.org>
Sponsor	kenhys@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/bazel-team/bazel-buildtools.git (browse)
Closes	#1151519
Tracker	https://tracker.debian.org/pkg/bazel-buildtools
Uploaded	3 hours ago

New Package Report

.changes◂

Architecture	source amd64
Distribution	unstable
Date	Tue, 20 Oct 2026 20:03:37 +0900
Source	bazel-buildtools
Version	10.1.0-1
Changed-By	Kentaro Hayashi <kenhys@xdump.org>

Changelog◂

bazel-buildtools (10.1.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1151519)

.dsc◂

Package-List	bazel-buildtools deb utils optional arch=any
Section	utils
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/bazel-contrib/buildtools
Upstream-Name: buildtools
Upstream-Contact: Bazel Contrib <https://github.com/bazel-contrib/buildtools/issues>

Files: *
Copyright: 2016 Bazel Contrib
License: Apache-2.0

Files: debian/*
Copyright: 2026 Kentaro Hayashi <kenhys@xdump.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for bazel-buildtools version 10.1.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 1 blocker, 1 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 1 found

Licensing

All upstream files are licensed under Apache-2.0, which is DFSG-compliant, and no non-free terms or non-source artifacts were found beyond one generated data blob. However, debian/copyright does not accurately describe the copyright holders: its Files: * stanza names only 'Bazel Contrib', while the file headers in the tree name Google Inc, Google LLC and The Bazel Authors. The licence short name and text handling are otherwise correct.

Packaging

The packaging is largely sound (sane Build-Depends matching go.mod, correct use of dh-golang with the single-binary add-on, sensible test-package exclusions, DEP-3 patch). However, debian/bazel-buildtools.install lists the three binaries, which dh_auto_install at compat 14 with the single-binary add-on installs directly into debian/bazel-buildtools/usr/bin/, so dh_install cannot find them in debian/tmp and aborts the build.

Issues

1. [blocker] [licensing] Files: * stanza names only 'Bazel Contrib' and omits the real copyright holders Google Inc, Google LLC and The Bazel Authors

Files: debian/copyright, api_proto/api.proto:2, build/build_defs.bzl:3, warn/docs/build_defs.bzl:3, build/lex.go:2, build_proto/build.proto:1, deps_proto/deps.proto:1, extra_actions_base_proto/extra_actions_base.proto:1, launcher.js:2
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright Files: * says Copyright: 2016 Bazel Contrib. File headers read Copyright 2016 Google Inc. All Rights Reserved. (api_proto/api.proto, build/build_defs.bzl, warn/docs/build_defs.bzl), Copyright 2016 Google LLC (build/lex.go and ~90 other .go files), and Copyright 2014 The Bazel Authors. All rights reserved. (build_proto/build.proto, deps_proto/deps.proto, extra_actions_base_proto/extra_actions_base.proto) / Copyright 2020 The Bazel Authors (launcher.js).
Problem: debian/copyright must record the copyright holders named in the source (copyright-format 1.0 §5.2/6.5). 'Bazel Contrib' is the GitHub organisation, not a copyright holder; the actual holders Google Inc, Google LLC and The Bazel Authors are absent from every stanza, so the file is inaccurate.
Fix: Extend the Files: * Copyright field (or add narrower Files: stanzas) to name Google Inc, Google LLC and The Bazel Authors with their years, e.g. Copyright: 2014-2020 The Bazel Authors; 2016-2025 Google LLC; 2016, 2021 Google Inc.

2. [important] [packaging] debian/bazel-buildtools.install lists the binaries but dh_auto_install does not put them in debian/tmp, so dh_install aborts the build

Files: debian/bazel-buildtools.install, debian/rules
Basis: checked, in the package or with a reference tool
Evidence: debian/rules runs dh $@ --builddirectory=debian/_build --buildsystem=golang --with=single-binary and override_dh_auto_install: dh_auto_install -- --no-source; debian/bazel-buildtools.install lists usr/bin/buildifier, usr/bin/buildozer, usr/bin/unused_deps. dh_auto_install at compat 14 with a single binary package defaults destdir to debian/bazel-buildtools (dh_auto_install(1): if (@allpackages > 1 or not compat(13)) { $destdir="debian/tmp" } else { $destdir=tmpdir($dh{MAINPACKAGE}) }), and the single-binary add-on additionally passes --destdir=debian/bazel-buildtools/. dh_install only searches . and debian/tmp and calls error("missing files, aborting") when a listed file is absent.
Problem: The golang buildsystem's install copies $builddir/bin/* straight into debian/bazel-buildtools/usr/bin/, never into debian/tmp/. dh_install therefore finds none of the three paths and aborts, a build failure that keeps the package out of the archive.
Fix: Remove debian/bazel-buildtools.install and let the single-binary add-on install the binaries; or drop --with=single-binary and pass --destdir=debian/tmp to dh_auto_install while keeping the .install file. Do not install the binaries by both mechanisms.

Verified

lang/build-language.pb (flagged by the scan as unrecognised binary data) is a serialized protobuf snapshot of Bazel's build-language definitions (// generated by: bazel info build-language > build-language.pb in lang/BUILD.bazel). It is Apache-2.0 data consumed only by the in-tree generatetables/generate_tables.go tool to regenerate the checked-in lang/tables.gen.go; it is not compiled into the shipped binaries, and the actually-compiled generated table (tables.gen.go) has its regenerating input (build-language.pb + generate_tables.go) in the tree.
Generated files have their preferred form present: api.gen.pb.go/build.gen.pb.go/deps.gen.pb.go/extra_actions_base.gen.pb.go are protoc output with their .proto sources in-tree; build/parse.y.go is goyacc output with build/parse.y in-tree; lang/tables.gen.go as above.
No other binary/compiled artifacts found: no .jar/.class/.so/.dll/.exe/.pyc, no minified JS (launcher.js and the buildifier/buildozer npm wrappers are small readable sources), no fonts or images of unclear provenance.
Licence scan across the tree found only Apache-2.0: the top-level LICENSE is Apache-2.0, all file headers use the Apache-2.0 notice, and package.json files declare "license": "Apache-2.0". No GPL/LGPL/MPL/BSD/CC/NC/ND or 'public domain' terms; the only 'lgpl.txt' hit is a filename string in buildozer_test.sh with no such file shipped.
debian/copyright is DEP-5 with the correct Format: URL, a Files: * stanza, a Files: debian/* stanza, and a stand-alone Apache-2.0 paragraph pointing at /usr/share/common-licenses/Apache-2.0 (correct short name and text handling).
The copyright-holder scan's 'Google LLC'/'Google Inc'/'The Bazel Authors' files were all checked against the headers (see the blocker issue); 'Bazel Contrib' is not a holder named in any file header.
uscan found the packaged version as the newest upstream release (upstream 10.1.0, packaged 10.1.0).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

None.

Proposed changes

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-10-25 15:03 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package