DFSG NEW review for dart-clock version 1.1.3-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the correct Format line, a Files: * stanza (2013, Google Inc., Apache-2.0) and a later Files: debian/* stanza (2026, Emfox Zhou, Apache-2.0); that last stanza correctly overrides the catch-all for the packaging. Every upstream file is Apache-2.0: all fifteen upstream files carry the Apache-2.0 boilerplate naming Google Inc., LICENSE holds the full Apache-2.0 text, and the pointer to /usr/share/common-licenses/Apache-2.0 is valid. No non-free terms, no source-less binaries, no unrelated holders; the one year drift in Files: * (files say 2013 or 2018) is not noteworthy.

Packaging

A small, clean single-binary source package: compat 14 with an explicit dh-sequence-single-binary (which debhelper 14.5 provides, and which is the right forward-compatible choice for compat 15), no patches, Standards-Version 4.7.4 against Policy 4.7.4.1, a present and sensible autopkgtest, correct changelog and Vcs-* fields, and no substvar or lintian-style problems that are in fact debhelper doing the work. The only point I would raise is that the autopkgtest requires dart-sdk, which the archive has for amd64 only, while the package is Architecture: all and the test stanza restricts nothing.

Issues

1. [minor] [packaging] debian/tests/control runs the test on every architecture, but its dependency dart-sdk exists for amd64 only

• Files: debian/tests/control:1-3, debian/control
• Basis: inferred from what was read, not seen directly
• Evidence: Tests: smoke / Depends: @, dart-sdk / Restrictions: allow-stderr, with no Architecture field; debian/control has Architecture: all. apt-cache show dart-sdk lists one stanza, Architecture: amd64 (version 3.13.4+dfsg1-6). Lintian's known-field list for debian/tests/control includes Architecture (/usr/share/lintian/lib/Lintian/Check/Testsuite.pm:42-51).
• Problem: autopkgtest runs the tests of an Architecture: all package on each architecture, so on release architectures other than amd64 dart-sdk cannot be installed; the test result there is an uninstallable-dependency failure rather than a pass, which works against migration of the package into testing. The dependency itself is right - the test needs the SDK - so the missing piece is the restriction to the architectures that have it.
• Fix: Add Architecture: amd64 to the stanza in debian/tests/control (or list there the architectures on which dart-sdk is or will be built). If dart-sdk is meant to be available everywhere, nothing is needed.

Verified

• The scan before the review listed no file and no copyright holder to account for: dfsg-author-check found every holder it saw named in debian/copyright, and neither it nor any of my own greps (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, GNU/Apache/MPL/public domain/All rights reserved) turned up a holder, a licence or a built artifact besides the Apache-2.0 concern below.
• Inventory: 15 upstream files (AUTHORS, CHANGELOG.md, LICENSE, README.md, analysis_options.yaml, pubspec.yaml, lib/clock.dart, lib/src/{clock,default,stopwatch,utils}.dart, test/{clock_test,default_test,stopwatch_test,utils}.dart) - all readable text, no binary, archive, minified or generated file. Every .dart file has the same Apache-2.0 header naming Google Inc. (2013 in clock.dart and test/clock_test.dart, 2018 elsewhere); AUTHORS names only Google Inc.
• LICENSE is the complete Apache-2.0 text, and /usr/share/common-licenses/Apache-2.0 exists on the reviewing system, so the Files: * stanza's pointer is sufficient.
• lib/src/utils.dart:14-16 says the code below is copied from quiver. That is upstream's inline copy, the file's own header keeps Google Inc. under Apache-2.0, and apt-cache shows no binary package quiver in Debian, so it neither misattributes a holder nor duplicates a library Debian ships.
• debian/copyright covers everything: Files: * is the catch-all, Files: debian/* comes later and so overrides it for the packaging; the Format line is the 1.0 URL, so no replacement file is proposed.
• /review/dart-clock_1.1.3.orig.tar.gz contains exactly the eight top-level entries of the unpacked tree (nothing was removed, so no Files-Excluded is needed), and /review/dart-clock_1.1.3-1.debian.tar.xz contains exactly the debian/ files present in the tree.
• Build-Depends: dh-sequence-single-binary is a real name - apt-cache reports it as a virtual package provided by debhelper 14.5 - so with debhelper-compat (= 14) the add-on is present and the compat-15 warning is avoided; the binary stanza having no Depends field is correct at compat 14, where dh_gencontrol adds the relationship substvars itself.
• debian/rules' touch -d "@${SOURCE_DATE_EPOCH}" cannot fail under a normal build: dpkg-buildpackage(1) (ENVIRONMENT) sets SOURCE_DATE_EPOCH from the latest changelog entry when it is not already defined. Its purpose is consistent with the tree - the orig tarball's directories (lib/, test/) carry epoch mtimes.
• autopkgtest wiring is complete: the .dsc carries Testsuite: autopkgtest and Testsuite-Triggers: dart-sdk, which dpkg-source adds itself (autopkgtest specification, 'Source package header'), so debian/control need not name them; dart-sdk is a real binary package in the archive and /usr/lib/dart/bin/dart exists, matching the fallback path in debian/tests/smoke:9.
• Standards-Version 4.7.4 has the same first two components as the reviewing system's Policy 4.7.4.1; Multi-Arch: foreign on an Architecture: all package is allowed; debian/changelog is a well-formed single 1.1.3-1 entry for unstable closing #1152034 with a valid date.
• uscan found the packaged version as the newest upstream release (upstream 1.1.3, packaged 1.1.3).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• I could not run anything, so I did not check that dart run main.dart in debian/tests/smoke succeeds in a directory that has only .dart_tool/package_config.json and no pubspec.yaml; a test run would show it.
• File modes could not be inspected with the tools available (they show names and sizes only), so I did not confirm that debian/rules and debian/tests/smoke are executable.
• The upstream test suite in test/ is not run (it needs package:test, which I did not find in the archive); that the hand-written smoke test exercises the same behaviour is the maintainer's design choice, not a fault.

Proposed changes

None.