DFSG NEW review for commons-digester3 version 3.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The whole tree is Apache-2.0: the top-level LICENSE.txt is the verbatim Apache licence, every one of the 308 .java files carries the ASF contributor-licence header, every NOTICE/DTD/XML/doc header is the same, and a tree-wide grep for other licence wording (GPL/LGPL, MPL, MIT-style grants, public domain, 'all rights reserved', non-commercial, no-modification) found nothing but the ASM notice quoted inside src/main/assembly/LICENSE-with-deps.txt. debian/copyright is DEP-5 with the canonical Format URL, matches every file (Files: * Apache-2.0 by the ASF, then debian/* for the packaging holders, last stanza winning), and points at /usr/share/common-licenses/Apache-2.0. The single holder the scan questioned, INRIA/France Telecom, appears only as third-party notice text for the ASM jar that upstream shades into its separate '-with-deps' distribution or at most as a quoted notice; no ASM code is shipped, so no stanza is needed.

Packaging

Standard modern Java-team packaging: debhelper compat 13, dh $@ with the maven buildsystem auto-detected from pom.xml, Build-Depends matching the plugins and dependencies the pom actually runs (jarjar, antrun, bundle, jar/compiler/surefire come from the lib* packages named plus maven-debian-helper's own Depends), and dependencies computed with mh_resolve_dependencies into the ${maven:Depends} substitute used in Depends. The one quilt patch is DEP-3 formatted and removes the only test input that fetched a DTD from the network; Standards-Version 4.7.4 matches the installed Policy 4.7.4.1; changelog, Vcs-*, Architecture: all and source format 3.0 (quilt) are all in order. I found no fault worth reporting.

Issues

None.

Verified

• Scan item src/media/logo.xcf (21 KB) is the GIMP source image of the project logo shipped as src/site/resources/images/logo.png; both sit in the upstream source tree under the Apache-2.0 licence declared for Files: *, and the pom lists Daniele Testa as the project's graphic designer. Neither is a build product, and I did not open either image.
• Scan item src/main/assembly/LICENSE-with-deps.txt is upstream's Apache-2.0 licence file for its -with-deps binary distribution; its lines 209-243 quote the BSD-3-Clause text of the ASM component, and src/main/assembly/NOTICE-with-deps.txt line 10 repeats 'ASM - Copyright (c) 2000-2011 INRIA, France Telecom'. That is the quoted copyright of ASM, not of these two ASF-authored files, and no ASM/CGLIB code is shipped: the jarjar plugin writes the shaded classes to target/classes-shaded and the with-deps classifier jar (pom.xml jarjar / maven-jar-plugin executions), while the packaging installs the plain jar from target/classes (debian/libcommons-digester3-java.poms: pom.xml --no-parent --has-package-version --java-lib).
• Licence sweep of the whole upstream tree (excluding .pc/ and debian/): grep for 'GNU General Public', 'Lesser', 'Mozilla Public', 'Permission is hereby granted', 'public domain', 'All rights reserved', 'SPDX-License-Identifier', 'non-commercial', 'no modification', 'Creative Commons', 'commercial use', 'without modification', 'Copyright ' and '©': the only hits are the Apache-2.0 headers/notices and the ASM quotation above. All 308 .java files carry 'Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements'; the @author tags name only individual contributors to Apache projects.
• No vendored third-party Java: every package declaration in the tree is org.apache.commons.digester3...; cglib, ASM, beanutils and commons-logging are Maven dependencies of the non-shaded jar, not copies. src/examples/rss/LICENSE.txt is a second copy of the Apache licence.
• No built artefacts in the source: globbing for jar/class/pdf/zip/gz/png/jpg/gif/svg/xcf found only the two logo images. The target/ shaded jar and the target/site/apidocs tree exist only for upstream's binary/site assemblies and are not in the tarball.
• debian/copyright applies as intended: Files: * (Apache-2.0, '2001-2011, The Apache Software Foundation') is overridden by the later Files: debian/* stanza, which names Takashi Okamoto, Michael Koch, Wolfgang Baer, Varun Hiremath, Kumar Appaiah, Ludovic Claude, Torsten Werner and Emmanuel Bourg, the authors of the changelog and packaging. /usr/share/common-licenses/Apache-2.0 exists, so the short pointer is correct.
• debian/patches/offline-tests.patch is the only patch in series; it has Description, Author (Emmanuel Bourg <ebourg@apache.org>) and Forwarded: no, and removes the <!DOCTYPE ... digester-rules-3.0.dtd> line from src/test/resources/org/apache/commons/digester3/xmlrules/atom-content.xml. That line pointed the test parser at http://commons.apache.org/digester/dtds/digester-rules-3.0.dtd, which is the network access the changelog says it fixed; the other digester-rules DOCTYPEs belong to rule files parsed through Digester's bundled digester-rules.dtd.
• Dependencies checked with apt-cache: libjarjar-maven-plugin-java (1.9), libmaven-antrun-plugin-java (3.2.0), libmaven-bundle-plugin-java (5.1.9), maven-debian-helper (2.8.1, which depends on the jar, compiler, resources, clean, site and surefire plugins), libcglib-java, libcommons-beanutils-java, libcommons-logging-java and junit4 all exist; the maven buildsystem module is present at /usr/share/perl5/Debian/Debhelper/Buildsystem/maven.pm and its DESCRIPTION/check_auto_buildable triggers on pom.xml, so plain dh $@ is enough.
• debian/control/changelog/source/format: compat 13 gives the substvar handling used (${maven:Depends}, ${misc:Depends} present); source format 3.0 (quilt) with an orig tarball named after the renamed source commons-digester3; top changelog entry 3.2-1, distribution unstable, urgency medium, closes #1152360; Vcs-Git/Vcs-Browser canonical salsa URLs; debian/maven.rules maps junit 4.x and debian/maven.ignoreRules drops the assembly plugin and wagon-ssh extension as the changelog states; debian/maven.properties supplies the --add-opens argLine the changelog says fixed the Java 17 tests. Standards-Version 4.7.4 versus the installed Policy 4.7.4.1 is current (first two components 4.7).
• Coverage: I read every file under debian/ (control, rules, changelog, copyright, maven.{rules,ignoreRules,properties}, the .poms, patches/series and the patch, source/format), and every non-Java upstream file that could carry a notice (LICENSE.txt, NOTICE.txt, both assembly notice files, RELEASE-NOTES.txt, PROPOSAL.html, doap_digester.rdf, checkstyle-suppressions.xml, the DTDs, site/xdoc/site.xml headers, the test XML/DTD set, the patched atom-content.xml), plus the full source listing; the Java files were covered by the header grep, not read line by line.
• uscan found the packaged version as the newest upstream release (upstream 3.2, packaged 3.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• I could not open src/media/logo.xcf or src/site/resources/images/logo.png (binary images); their licence is judged from their location in the ASF source tree and the absence of any other notice in the package.
• The upload renames the source to commons-digester3 and no longer builds libcommons-digester-java; the archive's libcommons-digester-java 1.8.1-7 (old source) still exists, and I have no tool to list its reverse dependencies, so I could not check whether its source package is meant to be removed too.

Proposed changes

None.