DFSG NEW review for bazel-rules-proto-grpc-cpp version 5.8.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the exact Format URL. Files: * (Apache-2.0; PCJohnstone/stackb, Adam Liddell, rules_proto_grpc Authors) covers every upstream file and the later Files: debian/* (PaulLiu, Apache-2.0) covers the packaging and the Debian-authored test artifacts; the stand-alone Apache-2.0 stanza refers to /usr/share/common-licenses/Apache-2.0, as Policy 12.5 recommends. The tree is eight short Starlark/Bazel text files with no vendored third-party code, no binaries, minified or generated-without-source files and no non-free wording; Apache-2.0 is DFSG-free. Caveat: the repacked orig tarball carries no LICENSE or notices at all, so the copyright file is the only licensing statement in the package.

Packaging

Small arch:all Bzlmod module package built with the dh sequencer at compat 13, Rules-Requires-Root: no, one DEP-3 patch that repoints the protobuf/gRPC Bazel dependencies at Debian's system libraries, and a debian/install that lists exactly the eight upstream files (so the compat-13 dh_missing --fail-missing default is satisfied). Changelog, Standards-Version 4.7.4 (current Policy is 4.7.4.1), Vcs-* fields, upstream metadata and an offline autopkgtest that builds and runs generated protobuf/gRPC C++ code are all present. Neither finding below is a fault of the packaging itself: the sibling module package it Depends on is not yet in the archive, and the documented offline recipe's sufficiency depends on the bazel-bootstrap setup.

Issues

minor packaging 1. debian/watch is in the old version 4 format ◂

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

• Read every file of debian/ (control, rules, copyright, changelog, install, README.Debian, gbp.conf, source/format, tests/control, tests/test-001 with its five artifacts, patches/series, patches/0001-debian-offline.patch, upstream/metadata) and all eight upstream files in full. .pc/ was excluded throughout.
• Prescan: its author check scanned 8 files and reported every holder it found already named in debian/copyright; it listed no built files, no rare/non-free licence wording and no licence outside the copyright file, so there is no other scan finding to account for.
• debian/copyright matches the tree: Files: * reaches every upstream file, the later Files: debian/* stanza covers debian/ (including the Debian-authored hunks in 0001-debian-offline.patch and debian/tests/test-001-artifacts/*), and there is no file left over from either pattern.
• The eight upstream files (BUILD.bazel, MODULE.bazel, WORKSPACE, defs.bzl, cpp_grpc_compile.bzl, cpp_grpc_library.bzl, cpp_proto_compile.bzl, cpp_proto_library.bzl) carry no copyright or licence notice; the orig tarball holds exactly those eight under rules_proto_grpc_cpp-5.8.0/ with no LICENSE or README, so the copyright file is the package's only licensing statement.
• Apache-2.0 is a DFSG-free licence; the License stanza's boilerplate plus the /usr/share/common-licenses/Apache-2.0 pointer is what Policy 12.5 asks for, and the file is not compressed or a symlink when installed (dh_installdocs).
• No binary, minified, archived, font or image files, and nothing generated whose generator input is absent; the whole upstream tree is eight short text files.
• Packaging: compat 13 with dh $@, Rules-Requires-Root: no, single arch:all binary, Multi-Arch: foreign, ${misc:Depends} present, Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components current, so not an issue), changelog 5.8.0-1 to unstable closing #1152140, Vcs-Git/Vcs-Browser and debian/upstream/metadata filled in.
• debian/install lists all eight upstream files, so dh_missing (which defaults to --fail-missing from compat 13) has nothing to report. Its ${env:INSTALL_PATH} is a supported config-file substitution at compat 13 (dh_install(1), FILES: "Supports substitution variables in compat 13 and later"; debhelper(7) documents ${env:VAR}), and the leading slash in the destination is harmless because dh_install prepends the package build directory ($tmp/$target_dest) rather than writing to /usr.
• The single quilt patch is DEP-3 complete (Description, Author, Forwarded: not-needed, Last-Update) and only replaces the grpc/protobuf module dependencies with Debian system libraries and the /usr/bin/grpc_cpp_plugin wrapper; debian/rules' execute_after_dh_install resets the 1970 tarball timestamps to SOURCE_DATE_EPOCH, and dpkg-buildpackage exports that variable.
• debian/tests/test-001 blocks the network with dead proxies, overrides every module in the graph to a system path or a local stub, and builds and runs proto_test and grpc_test; its extra deps (rustc, libstd-rust-dev, librust-tinyjson-dev) are used only to fabricate the mocked Rust toolchain and tinyjson repository, not by the package's own rules.
• uscan found the packaged version as the newest upstream release (upstream 5.8.0, packaged 5.8.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

• Depends: bazel-rules-proto-grpc (debian/control) names a package that is in neither the archive lists nor ftp-master's NEW queues at the time of the review; it is presumably the sibling source package for the rules_proto_grpc base module. If no such package is accepted, this binary is uninstallable and autopkgtest cannot install @.
• debian/tests/control names neither bazel-rules-rust, bazel-lib, bazel-stardoc nor bazel-aspect-bazel-lib, although test-001 overrides /usr/share/bazel/rules/rust and /usr/share/bazel/tools/{aspect_bazel_lib,bazel_lib,stardoc}; those packages may be pulled in through the missing bazel-rules-proto-grpc, and only a test run would show.
• README.Debian promises offline consumption with the single --override_module=rules_proto_grpc_cpp=... line, but the installed MODULE.bazel also requires rules_cc and rules_proto_grpc, and the package's own test has to stub protobuf, zlib, apple_support, buildozer and aspect_rules_js; whether Debian's bazel resolves these from a system bazelrc or registry could not be checked because bazel-bootstrap is not installed on the reviewing system (there is no /etc/bazel or /usr/share/bazel here).
• The copyright holders (PCJohnstone / stackb, Adam Liddell) could not be checked against upstream's LICENSE/AUTHORS, which the repacked tarball does not contain.