DFSG NEW review for bazel-rules-proto-grpc version 5.8.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is machine-readable (DEP-5), covers every file via Files: * (upstream, Apache-2.0) and Files: debian/*, supplies the full Apache-2.0 text, and names the project's known holders. The tree is small — 25 upstream files (Starlark .bzl, Rust main.rs for the fixer/merger tools, BUILD/MODULE/WORKSPACE) plus debian/. No embedded third-party code, no minified/binary/generated files, no fonts/images, no non-free wording anywhere (grep for licence terms found nothing upstream). Upstream ships no per-file headers or in-tree LICENSE, so attribution rests on the project's declared Apache-2.0, which is accurate and DFSG-free; the prescan's holder check found every holder named in debian/copyright.

Packaging

Clean, policy-conforming packaging: debhelper compat 13 with a %: dh $@ rules file, empty build/install overrides (pure source install via debian/install with ${env:INSTALL_PATH} substitution, supported at compat 13), reproducible timestamps from SOURCE_DATE_EPOCH, Standards-Version 4.7.4 (Policy 4.7.4.1), Rules-Requires-Root: no, Vcs-* present, Multi-Arch: foreign on an arch:all library. All Depends (bazel-aspect-bazel-lib, bazel-platforms, bazel-rules-proto, bazel-rules-rust, bazel-skylib, protobuf-compiler) and test Depends (bazel-bootstrap, bazel-rules-shell, ...) exist in the archive and match the module deps in MODULE.bazel. One DEP-3 patch converts the rules to Debian's packaged rules_proto and system protoc with a clear purpose and sane fallback. The autopkgtest is an elaborate offline Bazel integration test with network blocked via proxy.

Issues

1. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read all of debian/ (copyright, control, rules, changelog, install, source/format, tests/control, test-001, test-001-artifacts/*, patches/0001, upstream/metadata, README.Debian, README.source).
• Inventory of upstream tree (glob with gitignore:false, .pc excluded): BUILD.bazel, MODULE.bazel, WORKSPACE, defs.bzl, internal/{BUILD.bazel,common.bzl,compile.bzl,filter_files.bzl,plugin.bzl,protoc.bzl,providers.bzl}, platforms/BUILD.bazel, tools/fixer/{BUILD.bazel,README.md,main.rs}, tools/merger/{BUILD.bazel,README.md,main.rs}.
• No minified/binary/generated files; fixer and merger are shipped as Rust source (main.rs) — preferred form for modification present.
• No non-free wording upstream; git grep for Copyright/SPDX/License/Apache/GPL etc. found only debian/copyright.
• All Depends and tests/control Depends resolve to packages in the archive (checked apt-cache for bazel-aspect-bazel-lib, bazel-rules-proto, bazel-rules-rust, bazel-platforms, bazel-skylib, bazel-rules-shell, bazel-bootstrap).
• debian/install *-patterns in Files: debian/* cover files recursively (copyright-format 6.9: * matches slashes), so test artifacts under debian/tests are in the debian stanza.
• Patch 0001 has DEP-3 headers (Author, Forwarded: not-needed, Last-Update) and matches the applied tree.
• uscan found the packaged version as the newest upstream release (upstream 5.8.0, packaged 5.8.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Per-file holder attribution in Files: * cannot be checked against the source because upstream ships no license headers or LICENSE/AUTHORS in this tarball; it is taken from the project's declared authorship and matched the prescan holder check.