DFSG NEW review for dart-crypto version 3.0.7-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every upstream file is under the 3-clause BSD licence (LICENSE at the top level, and a 'BSD-style license ... in the LICENSE file' header in every .dart file); nothing in the tree carries non-DFSG terms, and no file is missing a licence. debian/copyright is DEP-5, with a Files: * stanza (the Dart project authors) and a Files: debian/* stanza (Emfox Zhou), which between them match every file; the only defect is that the quoted licence text is not verbatim, naming 'Google Inc.' where the shipped LICENSE names 'Google LLC' (minor). All files are plain text sources; there is no minified, compiled or vendored third-party code.

Packaging

Small, clean arch:all source-only package: debhelper compat 14 with a plain dh sequencer, correct install paths (/usr/share/dart/packages/crypto), an autopkgtest that actually exercises the installed library through the Dart VM, correct Vcs-* and upstream/metadata, and a changelog with a proper distribution and version. debhelper-compat and dh-sequence-single-binary (provided by debhelper) cover the build-dependencies; dart-typed-data is not in the archive yet but is in ftp-master's NEW queue, and dart-sdk is in the archive. No maintainer scripts, no patches, nothing a sponsor would need fixed.

Issues

1. [minor] [licensing] debian/copyright quotes the BSD-3-clause no-endorsement clause as 'Google Inc.', but the shipped LICENSE names 'Google LLC'

• Files: debian/copyright:22-23, LICENSE:9-11
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright's BSD-3-clause standalone paragraph reads * Neither the name of Google Inc. nor the names of its / contributors may be used to endorse or promote products derived / from this software without specific prior written permission., while the LICENSE file it reproduces reads * Neither the name of Google LLC nor the names of its / contributors may be used to endorse or promote products derived / from this software without specific prior written permission.
• Problem: The standalone License paragraph is meant to carry the licence as it stands (copyright-format 1.0 s6.7: the field should include the full text of the licence). The third clause names the entity whose name may not be used, so quoting a different entity makes debian/copyright's copy of the licence text inaccurate, even though the terms are unchanged and DFSG-compliant.
• Fix: Change 'Google Inc.' to 'Google LLC' in the BSD-3-clause paragraph so it matches LICENSE.

Verified

• Full tree inventoried: 30 upstream files (AUTHORS, CHANGELOG.md, LICENSE, README.md, analysis_options.yaml, pubspec.yaml, benchmark/benchmark.dart, example/example.dart, lib/crypto.dart and 12 files under lib/src/, 9 files under test/, tool/md5sum.dart) plus debian/*; no other file exists, and every glob/grep was run with gitignore false.
• Every .dart file carries // Copyright (c) 2012-2025, the Dart project authors. Please see the AUTHORS file ... BSD-style license that can be found in the LICENSE file.; the year spread (2012, 2015, 2019, 2025) is covered by the Files: * stanza (minor year drift, not reported).
• The only licence texts in the tree are LICENSE (BSD-3-clause) and debian/copyright; there is no COPYING, NOTICE or per-directory licence file, and a case-insensitive grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/LGPL/Apache License/Mozilla Public/public domain/All rights reserved/non-commercial/no-modification found only those BSD notices and the FIPS/RFC/NIST references noted below.
• The large test files (sha1_test.dart, sha256_test.dart, hmac_sha1_test.dart, hmac_sha256_test.dart, sha_monte_test.dart, hmac_sha2_test.dart) are .dart sources holding NIST CAVP and RFC 4231 test vectors as hex strings, not third-party code; the file headers note their source (e.g. hmac_sha1_test.dart:28 http://csrc.nist.gov/groups/STM/cavp/documents/mac/hmactestvectors.zip), and they fall under the same Dart-project-authors stanza.
• No prebuilt or non-preferred-form files: no .jar/.class/.so/.dll/.exe/.pyc/minified JS or CSS/PDF/font/image anywhere; every file in the tree is text (.dart, .yaml, .md).
• prescan: the author check scanned 31 files and reported that every holder it found is already named in debian/copyright; the only holder in the tree is 'the Dart project authors' (Google LLC as the entity in the licence text), with AUTHORS listing Google Inc..
• debian/copyright is DEP-5 with the current Format URL, Files: * before Files: debian/*, and no Files-Excluded (nothing was repacked out of the tarball); all files are matched by one of the two stanzas.
• debian/control, rules, install, docs, changelog, copyright, gbp.conf, source/format (3.0 (quilt)), tests/control, tests/smoke and upstream/metadata were each read in full; there are no debian/patches, maintainer scripts or *.maintscript.
• Dependencies checked against the archive: dart-typed-data is not in the archive yet but is built by dart-typed-data 1.4.0-1, waiting in ftp-master's NEW queue, so its absence is not a fault; dart-sdk 3.13.4+dfsg1-6 is in the archive and supplies the dart binary the smoke test runs; dh-sequence-single-binary is provided by debhelper (14.5), so the Build-Depends is satisfiable.
• Standards-Version: 4.7.4 matches the current Policy's first two components (4.7.x), so it is not an issue.
• override_dh_install's touch -d "@${SOURCE_DATE_EPOCH}" is safe on a normal build: dpkg-buildpackage(1) sets SOURCE_DATE_EPOCH to the timestamp of the latest debian/changelog entry when it is not already defined (dpkg-buildpackage(1), ENVIRONMENT/Internal environment).
• The autopkgtest (debian/tests/smoke) writes its own .dart_tool/package_config.json from /usr/share/dart/packages/*/ and asserts known SHA-256/MD5/HMAC digests offline, with Depends: @, dart-sdk; it does not need network access.
• Depends: ${misc:Depends} at compat 14 and the absent override_dh_auto_test nocheck handling are what debhelper does by itself at this level, not faults.
• uscan found the packaged version as the newest upstream release (upstream 3.0.7, packaged 3.0.7).

Not confirmed

• /usr/share/dart/packages does not exist on the reviewing system (dart-sdk is not installed there), so I could not confirm from the system that this is the path the Debian dart tooling expects; the autopkgtest builds its own package_config.json and so does not depend on it.
• pubspec.yaml declares typed_data: ^1.3.0 while the runtime dependency is unversioned (Depends: dart-typed-data); whether pub's offline resolution of a consumer package would reject a dart-typed-data older than 1.3.0 is pub behaviour I could not check.

Proposed changes

None.