DFSG NEW review for dart-vm-service version 15.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole upstream tree is under the Dart project's BSD-3-clause licence: every source, YAML and Markdown file carries a "Copyright (c) , the Dart project authors" header (years 2015-2026) or is package data/documentation covered by the top-level LICENSE, and no other holder or licence text exists anywhere in the tree. debian/copyright is valid DEP-5 with a Files: * stanza naming the holder, a Files: debian/* stanza, and a stand-alone License paragraph whose text matches LICENSE verbatim, including the non-endorsement clause naming Google LLC. No non-free terms, no vendored third-party code, and the orig tarball is the complete upstream tree, so nothing needs to be excluded.

Packaging

Modern and correct for a first upload: debhelper compat 14 with the single-binary addon declared explicitly, Standards-Version 4.7.4 against Policy 4.7.4.1, a valid DEP-5 copyright, gbp.conf, upstream/metadata, and an autopkgtest (Tests: smoke, Depends: @, dart-sdk) whose dependency exists in the archive. The .dsc matches debian/control, there are no patches or maintainer scripts to go stale, and the install is narrow: lib/ plus the pubspec.yaml, with the workspace-only fields trimmed and directory mtimes stamped from SOURCE_DATE_EPOCH. I found no missing, wrong or overly tight dependency, no wrong install path and no policy violation.

Issues

None.

Verified

• Prescan: it listed no files and no holders to account for - dfsg-author-check reported "every holder found is named in debian/copyright". Independently, a full-tree grep for copyright notices (gitignore off, hidden files included) finds only "Copyright (c) , the Dart project authors" in 733 files, the years spanning 2015-2026, which Files: * names.
• LICENSE is the Dart BSD-3-clause text; the stand-alone License: BSD-3-clause paragraph in debian/copyright (lines 14-36) reproduces it word for word, including "Neither the name of Google LLC nor the names of its contributors" and the disclaimer.
• The Files: * patent covers the whole tree (* matches /, per copyright-format 6.9) and Files: debian/* follows it, overriding the catch-all for the packaging files.
• Full-tree greps for GNU ... General Public, Apache, Mozilla Public, Permission is hereby granted, public domain, SPDX-License-Identifier, \u00a9, non-commercial, no modification, research only, field of use, reverse engineer: no other licence, no restrictive or field-of-use term, no non-free wording.
• Read all of debian/ in full (changelog, control, copyright, docs, gbp.conf, install, rules, source/format, tests/control, tests/smoke, upstream/metadata) except debian/watch, which is out of scope; read the top-level files, all of lib/, tool/, example/, and sampled the 700+ test/ files by grep.
• dart-vm-service_15.4.0.orig.tar.gz contains exactly the unpacked tree (analysis_options.yaml, CHANGELOG.md, CONTRIBUTING.md, example/, java/, lib/, LICENSE, OWNERS, pubspec.yaml, README.md, test/, tool/); no file was removed or added, so no Files-Excluded is needed. The .debian.tar.xz contains the same nine debian/ files, with no debian/patches.
• Generated files accounted for: lib/src/vm_service.dart is marked generated; the generator tool/generate.dart (and tool/common, tool/dart) is shipped, and the only missing input is the protocol spec runtime/vm/service/service.md, documented in CONTRIBUTING.md as living in the same upstream dart-lang/sdk repository - the shipped Dart file is the form upstream publishes and is itself editable source, so not a missing-source problem. test/*.stops are golden data generated by the shipped tests with --update-goldens, lib/DEPENDENCIES.md and lib/src/DEPENDENCIES.md are layerlens dependency-graph documentation generated from the shipped sources, and java/version.properties is a two-line data file. No binaries, no minified code, no vendored third-party library.
• The installed library needs nothing outside the Dart core: no import/export/part of a non-relative package: URI in lib/, and pubspec.yaml's only dependency lists are dev_dependencies/dependency_overrides, which the trimming removes.
• debian/rules: sed -i '12,$d' runs inside override_dh_install after dh_install; in the 15.4.0 pubspec.yaml line 12 is resolution: workspace, so the installed manifest keeps name/version/description/repository/environment and is valid. The command is brittle against upstream reordering, but correct for this version. dpkg-deb clamps mtimes newer than SOURCE_DATE_EPOCH (dpkg-deb(1), SOURCE_DATE_EPOCH), so the sed after the find ... touch does not break reproducibility.
• dh_install's fallback to debian/tmp does not apply (lib and pubspec.yaml exist at the source root), and the single-binary addon only changes dh_auto_install's --destdir (Debian::Debhelper::Sequence::single_binary), so the debian/dart-vm-service paths in rules are right.
• Tool checks: dh-sequence-single-binary is a virtual package provided by debhelper 14.5, so the Build-Depends resolve at compat 14; dart-sdk (3.13.4+dfsg1-7) exists in the archive, and satisfies the installed manifest's environment: sdk: ^3.5.0; Policy is 4.7.4.1, so Standards-Version 4.7.4 is current.
• The autopkgtest script uses Success() and Version({major, minor}), both of which exist with exactly those signatures in lib/src/vm_service.dart, and both /usr/bin/dart and the fallback /usr/lib/dart/bin/dart exist on the reviewing system.
• .pc/ (quilt's record) and debian/watch were left out of the review as instructed; the .dsc reports Testsuite: autopkgtest and Testsuite-Triggers: dart-sdk consistent with debian/tests/control.
• uscan found the packaged version as the newest upstream release (upstream 15.4.0, packaged 15.4.0).

Not confirmed

• The Vcs-Git/Vcs-Browser URLs on salsa and the ITP number 1152045 in the changelog cannot be checked from the package.
• Not executed: whether dart run main.dart succeeds in a directory that has .dart_tool/package_config.json but no pubspec.yaml (the smoke test relies on this). Test failures are anyway not a reason to reject the upload.

Proposed changes

None.