DFSG NEW review for dart-sync-http version 0.3.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Everything in the tree is BSD-3-clause: the LICENSE file, the header of every Dart source and test file ('Copyright (c) 2017, the Dart project authors ... BSD-style license'), and the packaging in debian/* (2026 Emfox Zhou). debian/copyright is DEP-5, matches every file through Files: * plus Files: debian/*, names the correct holder, and reproduces the full BSD-3 clause text, which is required because BSD-3-clause is not in /usr/share/common-licenses. No non-free terms, no generated or vendored third-party code, and nothing was removed from upstream, so no Files-Excluded is needed. The scan named no unnamed holder, and none is missing.

Packaging

Small, clean debhelper-14 packaging: single architecture-all binary shipping the library sources and pubspec under /usr/share/dart/packages/sync_http/, no maintainer scripts, one DEP-3-labelled quilt patch whose installed result matches the shipped pubspec.yaml, an autopkgtest that performs a real offline request against a loopback server, valid Vcs-*, upstream/metadata and gbp.conf, and Standards-Version 4.7.4 against Policy 4.7.4.1. The autopkgtest dependency dart-sdk exists in unstable (3.13.4), so the test is runnable, and the package is new to the archive, consistent with the initial release closing #1152427.

Issues

None.

Verified

• Read debian/copyright in full: DEP-5 with the correct Format URL, Files: * = 2017 the Dart project authors, BSD-3-clause; Files: debian/* = 2026 Emfox Zhou, BSD-3-clause.
• All 9 upstream files were checked (LICENSE, pubspec.yaml, analysis_options.yaml, README.md, CHANGELOG.md, lib/sync_http.dart, lib/src/sync_http.dart, lib/src/line_decoder.dart, test/http_basic_test.dart). The four Dart files each open with // Copyright (c) 2017, the Dart project authors. ... BSD-style license that can be found in the LICENSE file.; the other five contain no licence or copyright notice beyond the stanza in debian/copyright.
• The stand-alone License: BSD-3-clause paragraph is verbatim the text of LICENSE (including the Copyright 2017, the Dart project authors. line and the Google LLC endorsement clause), so the notice is reproduced for the binaries as BSD-3 requires, and the text is included rather than pointed at because BSD-3-clause is not in /usr/share/common-licenses (Policy 12.5).
• The source headers point at an AUTHORS file that the pub.dev tarball does not ship; it is irrelevant to the licence because the holder is named in debian/copyright and the full licence text is there.
• The scan before the review named no files and reported no holder missing; I confirmed by reading the tree that the only holder is 'the Dart project authors' (plus the Debian maintainer for debian/*).
• No generated, minified, compiled or vendored third-party files, no fonts, images or data of unclear provenance; the library is handwritten Dart. The one patch touches only pubspec.yaml.
• dart-sync-http_0.3.1.orig.tar.gz contains exactly the unpacked upstream tree (analysis_options.yaml, CHANGELOG.md, lib/, LICENSE, pubspec.yaml, README.md, test/); nothing was dropped, so debian/copyright needs no Files-Excluded. dart-sync-http_0.3.1-1.debian.tar.xz contains only debian/.
• Packaging read in full: control (debhelper-compat 14, dh-sequence-single-binary, Architecture: all, Multi-Arch: foreign), rules, install, docs, changelog, copyright, gbp.conf, source/format 3.0 (quilt), tests/control, tests/smoke, upstream/metadata, patches/series and the patch. No maintainer scripts, no dirs/links files, no compatibility or shlibs files.
• debian/install puts lib/ and pubspec.yaml under /usr/share/dart/packages/sync_http/, which matches the package_config.json the autopkgtest scripts generate (rootUri file:///usr/share/dart/packages/sync_http, packageUri lib/). Depends only on ${misc:Depends}, which is automatic at compat 14.
• Standards-Version 4.7.4 against Policy 4.7.4.1: current (first two components match).
• The patch series has one patch, applied (the working tree pubspec.yaml and the .quilt record agree): it relaxes environment: sdk to '>=2.12.0 <4.0.0' so the library works with Debian's Dart 3, and its header carries Description, Origin: vendor and Forwarded: not-needed; I considered the absent optional Author/Last-Update headers and the missing long description not worth an issue for a one-line patch.
• autopkgtest: debian/tests/control declares Tests: smoke, Depends: @, dart-sdk, Restrictions: allow-stderr; dart-sdk exists in unstable (3.13.4+dfsg1-7, apt-cache), so the dependency is satisfiable, and the script needs no network (loopback server, own package_config under a private HOME).
• changelog: 0.3.1-1, unstable, 'Initial release. (Closes: #1152427)', dated Thu, 29 Oct 2026, which is a Thursday. apt-cache finds no dart-sync-http in the archive, consistent with a new package.
• debian/rules' override_dh_install touches installed directories with ${SOURCE_DATE_EPOCH}, which dpkg-buildpackage sets from the latest changelog entry if it is unset (dpkg-buildpackage(1), SOURCE_DATE_EPOCH), so ordinary builds are unaffected.
• debian/gbp.conf, debian/source/format and the debian/upstream/metadata fields are well formed. Nothing was built or run (read-only review).
• uscan found the packaged version as the newest upstream release (upstream 0.3.1, packaged 0.3.1).

Not confirmed

• Could not build the package or run debian/tests/smoke; the review assumes the clean build and the autopkgtest succeed.
• Could not confirm that /usr/share/dart/packages/ is the layout dart-sdk and the archive's other dart-* packages expect: dart-sdk is not installed on the reviewing system, and the package's own smoke test builds its package_config.json itself, so the path is only self-consistent.
• Could not check that the upstream GitHub repository and the salsa VCS repository named in control and debian/copyright exist (no network access).

Proposed changes

None.