DFSG NEW review for dart-platform version 3.2.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is in DEP-5 format with the exact current Format URL, a Files: * stanza (BSD-3-clause, 2017, the Dart project authors and 2013, The Flutter Authors) and a later Files: debian/* stanza (2026, Emfox Zhou), and one stand-alone License paragraph with the full BSD-3-clause text, which reproduces LICENSE and the per-file headers word for word, including the Neither the name of Google Inc. clause. Every upstream file is covered: all ~52 carry a BSD-3-clause header naming one of the two upstream holders, and the handful without a header are YAML/Markdown/JSON data covered by the catch-all. No non-free terms, no binaries, minified code, generated files or vendored third-party code; AUTHORS' Google Inc. is a contributor list entry and the licence's name clause, not an additional holder.

Packaging

Conventional and careful for the Dart team's source packages: compat 14 with dh $@ and the explicitly activated (recommended) dh-sequence-single-binary, debian/install putting lib/ and pubspec.yaml into /usr/share/dart/packages/platform/, Depends: ${misc:Depends}, dart-meta (needed, since lib/platform.dart transitively imports package:meta), Vcs-Git/Vcs-Browser/Homepage, Standards-Version 4.7.4 against Policy 4.7.4.1, a sane initial changelog closing the ITP, DEP-12 upstream metadata, and an offline autopkgtest smoke test that builds a package_config.json for the installed tree and runs the installed library. One minor fragility in the rules override is noted below; nothing else would a sponsor require changed.

Issues

1. [minor] [packaging] debian/rules override_dh_install aborts the build when SOURCE_DATE_EPOCH is unset

• Files: debian/rules:9-11
• Basis: inferred from what was read, not seen directly
• Evidence: find debian/dart-platform -type d -exec touch -d "@$${SOURCE_DATE_EPOCH}" {} +
• Problem: The recipe expands the variable unconditionally. dpkg-buildpackage always defines SOURCE_DATE_EPOCH (dpkg-buildpackage(1): "set to the Unix timestamp since the epoch of the latest entry in debian/changelog, if it is not already defined"), so archive builds are unaffected; but a direct debian/rules binary or fakeroot debian/rules binary, and any build that clears the variable, gives touch the date string @, which is not a valid date, so the command fails and the build stops at dh_install. The override is a reproducibility tweak for directory mtimes and does not need to be this brittle.
• Fix: Guard the fallback, e.g. [ -z "$$SOURCE_DATE_EPOCH" ] || find debian/dart-platform -type d -exec touch -d "@$${SOURCE_DATE_EPOCH}" {} +, or use $${SOURCE_DATE_EPOCH:-$$(date +%s)}.

Verified

• Read every file of debian/ (changelog, control, copyright, docs, gbp.conf, install, rules, watch, source/format, tests/control, tests/smoke, upstream/metadata); debian/watch not reviewed, as instructed.
• debian/copyright is machine-readable, its Format line is exactly the copyright-format 1.0 URL, its stanza order (Files: * then Files: debian/*) gives debian/ files the maintainer's own stanza, and its BSD-3-clause text matches LICENSE and the source headers verbatim. 2013, The Flutter Authors is carried by lib/platform.dart:1 and test/legacy/fake_platform_test.dart:1, so both holders in the catch-all are real; the pre-review holder check found no unnamed holder either.
• Grepped the whole tree with gitignore:false for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU General Public/GNU Lesser/Apache License/Mozilla Public/public domain/All rights reserved/Redistribution, and case-insensitively for copyright: the only licence text in the tree is LICENSE's BSD-3-clause, cited by every source file header (// Copyright (c) <year>, the Dart project authors ... governed by a BSD-style license that can be found in the LICENSE file.). Files with no header are data/config only: analysis_options.yaml, pubspec.yaml, CHANGELOG.md, README.md, migration-guide.md, example/{README.md,pubspec.yaml,analysis_options.yaml}, out/{README.md,pubspec.yaml}, lib/fix_data.yaml (hand-written dart fix data), test/legacy/platform.json (test fixture), AUTHORS.
• No binary or built artefact in the tree: no .js/.min.js/.jar/.class/.so/.dll/.exe/.pyc/.pdf/.png/*.gz, and no file marked generated/DO NOT EDIT; the only generated hit is prose in tool/check_tree_shaking.dart. No vendored third-party source: grep for adapted/copied/ported/derived/vendor found nothing, and the package:os_detect mentions are migration prose in migration-guide.md.
• Sources beside the package: dart-platform_3.2.0-1.debian.tar.xz holds exactly the debian/ seen in the tree and has no debian/patches (so no DEP-3 checks apply); dart-platform_3.2.0.orig.tar.gz's top level and lib/ sizes match the tree, i.e. no unshipped patches and no repacking that would need Files-Excluded.
• Packaging mechanics: debhelper reported that dh-sequence-single-binary is provided by debhelper 14.5 and is exactly the addon debhelper 14 recommends for a one-stanza source package (implicit at 14, explicit from 15); dh_install(1)'s own example confirms dir destdir installs the directory itself, so lib lands as /usr/share/dart/packages/platform/lib and the smoke test's packageUri: "lib/" matches. Compat 14 also means dh_gencontrol supplies ${misc:Depends} itself and dh installs docs from debian/docs.
• Dependencies exist and are satisfiable (apt-cache): dart-meta 1.19.0-2 (same maintainer) satisfies the shipped pubspec's meta: ^1.18.0, and dart-sdk is available for the autopkgtest; Testsuite: autopkgtest and Testsuite-Triggers: dart-sdk in the .dsc follow from debian/tests/control.
• The smoke test's APIs exist in this version: lib/src/legacy_implementation/legacy_classes.dart declares const factory LocalPlatform() and the members the test uses (operatingSystem, isLinux/isWindows via PlatformIsOSMixin, numberOfProcessors), and lib/platform.dart exports LocalPlatform, so the test compiles against the installed sources.
• Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1 (checked with the policy tool), so it is current enough; unstable distribution, version 3.2.0-1 matching pubspec.yaml's 3.2.0, and a bug-closing initial changelog entry.
• uscan found the packaged version as the newest upstream release (upstream 3.2.0, packaged 3.2.0).

Not confirmed

• The smoke test writes a hand-made package_config.json whose rootUri is file:///usr/share/dart/packages/<name> with no trailing slash while packageUri is lib/. If Dart resolves packageUri against rootUri per RFC 3986, the result is /usr/share/dart/packages/lib/ and the test would fail to find package:platform; if Dart appends the two (as pub always writes a trailing slash, this path may be untested), it works. I could not run dart-sdk to settle it, so I did not report it as a fault.
• Whether dart run main.dart (a file rather than a package target) is still accepted, rather than warned about or rejected, by the dart-sdk in the archive; Restrictions: allow-stderr would cover a warning but not an error.
• The mode of debian/tests/smoke (whether it is executable, as autopkgtest requires) could not be read with the available tools; lintian would have flagged it.

Proposed changes

None.