DFSG NEW review for dart-leak-tracker-testing version 3.0.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and accurate. Upstream is a single-holder BSD-3-Clause tree: LICENSE says Copyright 2022, the Dart project authors and every .dart file carries the matching 2023 header pointing at that LICENSE; Files: * names that holder and licence, and the stand-alone BSD-3-clause paragraph reproduces the upstream notice verbatim, including the Neither the name of Google LLC clause, as a permissive licence requires. Files: debian/* covers the packaging (and, since * crosses /, all of debian/ below it). No non-free terms, no built artifacts, no third-party code. The BSD-3-Clause is DFSG-free and compatible with everything the package could be combined with.

Packaging

Small, clean arch:all package that ships a Dart library's sources. debhelper compat 14 (dh's recommended level) with a plain dh $@ sequence, Standards-Version 4.7.4 against Policy 4.7.4.1, a working autopkgtest that runs offline from a generated package_config.json, Vcs-*, upstream/metadata and gbp.conf present, changelog sane. All version constraints from pubspec.yaml are mirrored in Depends and are satisfiable from the archive and NEW (dart-leak-tracker 11.0.2-1, dart-matcher 0.12.20-1, dart-meta 1.19.0). Only a small dependency nit: pubspec's meta: ^1.11.0 keeps its lower bound but loses its upper bound, unlike the other two.

Issues

1. [minor] [packaging] Depends on dart-meta keeps no upper bound, unlike the ^1.11.0 constraint in pubspec.yaml and unlike the other two dependencies

• Files: debian/control:19, pubspec.yaml:16
• Basis: checked, in the package or with a reference tool
• Evidence: pubspec.yaml: meta: ^1.11.0 (i.e. >= 1.11.0 < 2.0.0); debian/control: dart-meta (>= 1.11.0) — while leak_tracker: '>=9.0.0 <12.0.0' and matcher: ^0.12.16 are both translated with two bounds.
• Problem: The Depends field is the Debian expression of the pubspec's dependency set, and the other two entries were translated faithfully. Dropping the upper bound means a future meta 2.0.0 (breaking, per the caret range) would still satisfy this package's Depends, so a dependent package built against an API this source no longer supports would resolve without warning.
• Fix: Add dart-meta (<< 2.0.0) next to dart-meta (>= 1.11.0), or drop upper bounds everywhere if that is the intended policy.

Verified

• Read debian/ in full: changelog, control, copyright, docs, gbp.conf, install, rules, source/format, tests/control, tests/smoke, upstream/metadata; the .dsc and both tarballs.
• Upstream tree is 13 files; the .orig.tar.gz listing matches the unpacked tree exactly and debian/patches is absent with an empty applied-patches, so no upstream modifications need accounting for. (.pc/ not read.)
• Pre-scan: its author check reports every holder it found named in debian/copyright and lists no files; the Dart project authors is named in Files: *. The Dart headers' reference to an AUTHORS file that the tarball does not contain is not a licensing gap, since the holder is still named.
• Every .dart file (lib/leak_tracker_testing.dart, lib/src/leak_testing.dart, lib/src/matchers.dart, test/*.dart) carries Copyright (c) 2023, the Dart project authors ... BSD-style license that can be found in the LICENSE file; grep for Copyright/(C)/SPDX/GNU/Apache/MPL/public domain/non-commercial across the whole tree found nothing else. README.md, CHANGELOG.md, pubspec.yaml, analysis_options.yaml and LICENSE are the only other files, all plain text under the same LICENSE.
• No compiled, minified, archived or binary files anywhere. lib/DEPENDENCIES.md and lib/src/DEPENDENCIES.md are layerlens-written mermaid diagrams, generated from the .dart sources shipped beside them.
• The BSD-3-clause text in debian/copyright is the upstream LICENSE word for word, with the permissive notice reproduced as the licence requires; the licence is DFSG-free and GPL-compatible.
• Files: debian/* overrides Files: * for the packaging; DEP-5 * matches /, so debian/tests/smoke, debian/source/format etc. are covered.
• Build-Depends are real: apt-cache shows debhelper-compat (= 14) and dh-sequence-single-binary provided by debhelper 14.5, and /usr/share/perl5/Debian/Debhelper/Sequence/single_binary.pm exists and is happy with one binary package.
• Prefix-less debian/install and debian/docs are fine here: Dh_Lib.pm warns only when getpackages() > 1.
• Dependency versions satisfiable: dart-meta 1.19.0 in unstable; dart-leak-tracker 11.0.2-1 and dart-matcher 0.12.20-1 built by uploads in NEW (within >= 9.0.0 << 12.0.0 and >= 0.12.16 << 0.13.0); dart-sdk 3.13.4+dfsg1-6 in unstable for the autopkgtest.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): current. Compat 14 is debhelper's recommended level.
• Multi-Arch: foreign on an Architecture: all source-only package matches the sibling dart-args (arch: all, Multi-Arch: foreign) from the same maintainer.
• debian/tests/smoke builds an offline .dart_tool/package_config.json over the installed /usr/share/dart/packages/* and runs a Dart program that exercises LeakTesting and isLeakFree; it declares allow-stderr and depends on dart-sdk plus the three libraries; Testsuite-Triggers in the .dsc was generated from it.
• Changelog: 3.0.2-1, unstable, initial release closing #1152237, date a Tuesday; source format 3.0 (quilt); gbp.conf, upstream/metadata, Vcs-Git and Vcs-Browser consistent with the Homepage and copyright Source.
• uscan found the packaged version as the newest upstream release (upstream 3.0.2, packaged 3.0.2).

Not confirmed

• The autopkgtest's assertions (default LeakTesting.settings, withIgnoredAll/withTrackedAll, withIgnored(allNotDisposed: true), isLeakFree being a Matcher) can only be confirmed by running it against dart-leak-tracker 11.0.2.
• dart-sdk is Architecture: amd64 in the local package lists; if it is not available on other architectures, the autopkgtest, which has no Architecture restriction, would be uninstallable on them. A test run on arm64 would settle it.
• File modes of debian/tests/smoke cannot be read with the tools available; a non-executable test script would fail autopkgtest.

Proposed changes

None.