DFSG NEW review for dart-vm-service version 15.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every file in the tree is under the 3-clause BSD licence and the copyright holder "the Dart project authors" is named correctly in the Files: * stanza, so there is no DFSG problem and the licensing is clear. debian/copyright is machine-readable (DEP-5) and otherwise complete, but the BSD-3-clause text it reproduces is not the text of the shipped LICENSE: the non-endorsement clause names Google Inc. where LICENSE names Google LLC. That is the only inaccuracy found.

Packaging

A small, careful source-only package: debhelper compat 14 with the single-binary add-on declared explicitly (the recommended form at compat 14), an install file that installs lib/ and pubspec.yaml under /usr/share/dart/packages/vm_service/ with the correct trailing slash, a reproducible-builds touch-up in override_dh_install, an autopkgtest that exercises the installed library offline, DEP-5 copyright, gbp.conf, upstream metadata and a clean 3.0 (quilt) source with no patches and no maintainer scripts. Dependencies, version scheme, distribution and Standards-Version are all in order; only debian/copyright needs a correction.

Issues

1. [blocker] [licensing] debian/copyright reproduces the BSD-3 non-endorsement clause as "Google Inc." while LICENSE names "Google LLC"

• Files: debian/copyright:31-33, LICENSE:11-13
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: * Neither the name of Google Inc. nor the names of its / contributors may be used to endorse or promote products derived; LICENSE: * Neither the name of Google LLC nor the names of its / contributors may be used to endorse or promote products derived
• Problem: The licence text in debian/copyright must be the text under which the files are actually distributed; here it differs from the shipped LICENSE in the entity the non-endorsement clause protects, so anyone relying on debian/copyright reproduces a notice different from the one the copyright holder granted. The DFSG is not offended (the licence is otherwise fully and correctly reproduced and holdership is right), but the file is not an accurate description of the licensing.
• Fix: Replace the clause in the License: BSD-3-clause paragraph with the wording of the shipped LICENSE, i.e. Neither the name of Google LLC nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. (and add a year if you also take the Copyright 2015, the Dart project authors. line from it).

2. [minor] [packaging] Installed pubspec.yaml keeps upstream dev-only fields pointing at files that are not shipped

• Files: pubspec.yaml:16-28, debian/install:2
• Basis: inferred from what was read, not seen directly
• Evidence: resolution: workspace, dependency_overrides:\n test_package:\n path: 'test/test_package' and dev_dependencies: with any constraints; debian/install ships only lib and pubspec.yaml, so test/test_package is not installed.
• Problem: The manifests Debian installs for a source-shipping library are what consumers read; the copy under /usr/share/dart/packages/vm_service/ advertises a workspace resolution and a path override that do not exist there, which is misleading in the installed tree (a dart pub get there cannot resolve). Nothing in the package consumes them: lib/ imports only dart: core libraries, and the autopkgtest deliberately builds its own package_config.json instead of going through pub.
• Fix: Either ship a trimmed copy of the manifest (name, version, description, repository, environment, and any real dependencies) instead of the upstream file, or note in the package description that the installed pubspec.yaml is upstream's and not meant to be resolved in place.

Verified

• Read all of debian/ (control, rules, copyright, changelog, install, docs, gbp.conf, source/format, tests/control, tests/smoke, upstream/metadata) and the .dsc; the .debian.tar.xz contains exactly those files - no patches directory, no maintainer scripts, no .maintscript.
• debian/copyright is DEP-5 (Format: line exactly the 1.0 URL); Files: * covers everything, the later debian/* stanza takes debian/, all short names used are BSD-3-clause with its full text, and there is no Files-Excluded.
• The pre-review author scan reported no holder missing from debian/copyright; I confirmed it: a grep over the whole tree for Copyright, (C), (c), SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved finds only the Dart project authors (733 files), the LICENSE, and the two debian/copyright stanzas. Nothing else is held and nothing else is named as a licensor.
• The only licence in the tree is that of LICENSE (BSD-3-clause): 733 upstream files carry the header use of this source code is governed by a BSD-style license that can be found in the LICENSE file, and greps for GPL/LGPL/Apache/Mozilla/MIT/Creative Commons/non-commercial wording find nothing. The remaining files that lack a header (OWNERS, java/version.properties which is one line, lib/DEPENDENCIES.md, lib/src/DEPENDENCIES.md, README.md, CONTRIBUTING.md, CHANGELOG.md, analysis_options.yaml, pubspec.yaml, the .stops files) are covered by Files: * and the shipped LICENSE.
• lib/src/vm_service.dart is generated, but its generators are in the package (tool/generate.dart, tool/dart/generate_dart_client.dart, tool/dart/generate_dart_common.dart, tool/common/*), so the preferred form for modification is present; tool/common/* is likewise upstream source.
• The .stops files under test/ are golden output - their first line says This file is generated by running the associated test with --update-goldens - with the test and library sources beside them; test data, not a missing-source binary.
• The unpacked directory matches the .orig.tar.gz exactly (same top-level entries); nothing outside debian/ was added or removed by the maintainer, so no Files-Excluded is wanted.
• Build-Depends: debhelper-compat (= 14), dh-sequence-single-binary: the debhelper tool confirms the single-binary add-on is what compat 14 wants declared explicitly (dh-sequence-single-binary), and that dh_missing defaults to --fail-missing at compat 14, which has nothing to compare because the add-on points dh_auto_install's destdir at the package directory. No relationship substvars are needed in debian/control at compat 14.
• override_dh_install's touch -d "@${SOURCE_DATE_EPOCH}" cannot fail on a normal build: dpkg-buildpackage(1) sets SOURCE_DATE_EPOCH (to the changelog date) if it is not already set, and the find touches only directories under the installed package directory, which is where dh_install puts them (debian/install uses trailing slashes, so lib lands as .../vm_service/lib).
• debian/copyright lists only the two holders actually present, and both Files patterns are correct (later stanza wins for debian/).
• Standards-Version 4.7.4 against Policy 4.7.4.1 (read from the policy tool) - current. Changelog is 15.4.0-1, unstable, matching the upstream version and closing the ITP. Autopkgtest Tests: smoke depends on @ and dart-sdk, and dart-sdk exists in Debian (3.13.4+dfsg1-6), so the dependency is satisfiable; the .dsc carries Testsuite: autopkgtest and Testsuite-Triggers: dart-sdk.
• The autopkgtest is self-contained and offline, builds its own package_config.json over /usr/share/dart/packages/*/ (the path debian/install uses) and imports package:vm_service/vm_service.dart, which exists at that path.
• uscan found the packaged version as the newest upstream release (upstream 15.4.0, packaged 15.4.0).

Not confirmed

• File modes are not visible through the tools used here; debian/tests/smoke must be executable (0755) for autopkgtest to run it, and I could not check it.
• I did not verify dart-sdk's layout (whether dart is on PATH or at /usr/lib/dart/bin/dart) or that the VM resolves /usr/share/dart/packages/<name>; that is for the autopkgtest to prove, not something this package shows.
• I did not check that lib/src/vm_service.dart's generated content corresponds to the shipped generators, nor that the smoke test's API calls (Success(), Version(major: 3, minor: 0)) exist in this version; that would need a Dart toolchain.

Proposed changes

None.