DFSG NEW review for dart-typed-data version 1.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 (Format: line exact), with Files: * (BSD-3-clause, the Dart project authors) and Files: debian/* (Emfox Zhou), plus a stand-alone License paragraph containing the full BSD-3-clause text. Every one of the 13 upstream files carries a Copyright (c) 2013-2020, the Dart project authors ... BSD-style license ... in the LICENSE file header, matched by Files: *; LICENSE, AUTHORS, README.md, CHANGELOG.md, pubspec.yaml, analysis_options.yaml, lib/** and test/** are all covered by the same holder. BSD-3-clause is DFSG-free and nothing in the tree carries a non-free term, a built artefact or a third-party copy. The only inaccuracy is cosmetic: the reproduced clause 3 names Google Inc. where the shipped LICENSE names Google LLC.

Packaging

Small, clean, conventional packaging: debhelper compat 14 with dh $@ and a single override_dh_install, dh-sequence-single-binary, one arch:all binary package installing lib/ and pubspec.yaml into /usr/share/dart/packages/typed_data/, a Depends on the already-uploaded dart-collection (which lib/src/typed_queue.dart imports), an autopkgtest smoke test with dart-sdk in Depends and Testsuite-Triggers, upstream/metadata and gbp.conf present, 3.0 (quilt) with no patches, and Standards-Version 4.7.4 against Policy 4.7.4. Build-Depends names only real packages (dh-sequence-single-binary is provided by debhelper 14.5, which satisfies the compat constraint).

Issues

1. [minor] [licensing] debian/copyright reproduces BSD-3-clause clause 3 as "Google Inc." while the shipped LICENSE says "Google LLC"

• Files: debian/copyright, LICENSE
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright, License: BSD-3-clause: * Neither the name of Google Inc. nor the names of its against LICENSE: * Neither the name of Google LLC nor the names of its
• Problem: The stand-alone License paragraph is meant to reproduce the licence as the files carry it; the entity named in clause 3 does not match the LICENSE actually shipped (AUTHORS names "Google Inc.", the file headers name only "the Dart project authors"). The copyright holder is right and the licence is the same one, so this changes nothing about DFSG compliance, but the text is not the verbatim upstream notice.
• Fix: Use upstream's wording (Neither the name of Google LLC ...) in the License: BSD-3-clause paragraph, or a generic Neither the name of the copyright holder ....

Verified

• Prescan's author check reported every holder found is named in debian/copyright; confirmed by hand: the only holder in the tree is "the Dart project authors" (LICENSE, and the header of every lib/ and test/ .dart file), covered by the Files: * stanza, and debian/* is covered separately.
• Full upstream inventory (13 files, glob with gitignore false): AUTHORS, CHANGELOG.md, LICENSE, README.md, analysis_options.yaml, pubspec.yaml, lib/typed_data.dart, lib/typed_buffers.dart, lib/src/typed_buffer.dart, lib/src/typed_queue.dart, test/queue_test.dart, test/typed_buffers_test.dart, test/typed_buffers_vm_test.dart. Each is source: no archives, binaries, minified JS/CSS, fonts, images or generated code anywhere in the tree.
• The orig tarball's members (dart-typed-data-1.4.0/: analysis_options.yaml, AUTHORS, CHANGELOG.md, lib/, LICENSE, pubspec.yaml, README.md, test/) are exactly the unpacked tree, so nothing was repacked or removed and no Files-Excluded stanza is needed.
• No patches: debian/patches does not exist and debian/source/format is 3.0 (quilt) with nothing applied, so there are no DEP-3 header or forward-upstream concerns.
• Build-Depends resolve: dh-sequence-single-binary is provided by debhelper 14.5 (apt-cache), satisfying debhelper-compat (= 14); /usr/share/perl5/Debian/Debhelper/Sequence/single_binary.pm exists and only adds --destdir=debian/dart-typed-data/ to dh_auto_install.
• Runtime dependency resolves: dart-collection 1.19.1-2 exists (apt-cache) and provides package:collection, imported by lib/src/typed_queue.dart:6; dart-sdk 3.13.4+dfsg1-6, used by debian/tests/control, exists too.
• debian/rules' override_dh_install stamps the installed directories with SOURCE_DATE_EPOCH; man dpkg-buildpackage states the variable "is set to the Unix timestamp since the epoch of the latest entry in debian/changelog, if it is not already defined", so the touch -d "@${SOURCE_DATE_EPOCH}" cannot fail under a normal package build.
• Standards-Version 4.7.4 matches current Policy (policy tool: appendix A10 lists 4.7.4 as the newest version), so no Policy-version issue.
• debian/changelog: version 1.4.0-1, distribution unstable, maintainer matches debian/control, Initial release. (Closes: #1152044), date on the day of review.
• debian/tests/smoke is an offline comprehension/behaviour smoke test (builds Uint8Buffer/Int32Buffer, checks length, indexing and removeAt) with allow-stderr; nothing is written outside its own mktemp -d.
• uscan found the packaged version as the newest upstream release (upstream 1.4.0, packaged 1.4.0).

Not confirmed

• The autopkgtest was not run (the package cannot be built or executed here); debian/tests/smoke assumes the dart binary is on PATH or at /usr/lib/dart/bin/dart and that dart-collection installs to /usr/share/dart/packages/collection/ (the script derives package names from those directory names).
• Vcs-Git/Vcs-Browser and the Homepage/Source URLs could not be reached to check that the repository exists.
• dart-sdk is not installed on this system, so nothing could be checked about it beyond its apt-cache record.

Proposed changes

None.