DFSG NEW review for dart-web version 1.1.2+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is valid DEP-5 with a Files: * catch-all, a lib/src/dom/* stanza and a debian/* stanza, and it names the only holder in the tree, the Dart project authors, under BSD-3-clause with the licence text reproduced from LICENSE. The only third-party material upstream shipped, the MDN Web Docs API documentation under CC-BY-SA-2.5, has been removed by the documented +ds repack, and no MDN prose remains (the 177 lib/src/dom/*.dart files now hold only the BSD header, 'Generated from Web IDL definitions.' and code). No non-free terms, no file without a licence, and no images, fonts or data of unclear provenance.

Packaging

A sources-only arch:all package built with compat 14 and an explicitly activated dh-sequence-single-binary (what compat 14 wants), with a correct debian/install, Standards-Version 4.7.4 against Policy 4.7.4.1, Vcs-* and upstream/metadata, and a changelog closing the ITP. debian/repack and README.source document the repack that gives the +ds version, and an autopkgtest compiles a program against the installed bindings with dart-sdk, which is in the archive. Nothing here would break a build, an upgrade or a user.

Issues

None.

Verified

• The pre-scan's author check found every holder named in debian/copyright; I re-checked it: all 209 files outside debian/ and .pc/ carry 'Copyright (c) 2023/2024/2026, the Dart project authors' BSD-style headers pointing at the root LICENSE (BSD-3-clause), and every debian/ file falls in the Emfox Zhou stanza.
• Inventory read exhaustively: 6 root files, example/ (2), lib/ (fix_data.yaml, helpers.dart, web.dart), lib/src/ (dom.dart, helpers.dart), lib/src/dom/ (177 files), lib/src/helpers/ (6) and helpers/events/ (3), test/ (4), test_fixes/ (6). No subdirectory carries its own LICENSE/COPYING/NOTICE, and no SPDX tag or other licence wording (GPL, LGPL, Apache, MPL, public domain, All rights reserved, CC-BY) occurs anywhere in the tree.
• debian/copyright: exact Format URL, header with Upstream-Name/Upstream-Contact/Source, Files: * catch-all, then Files: lib/src/dom/* (Copyright 2024; Comment records the MDN removal) and Files: debian/*, then one standalone License: BSD-3-clause paragraph whose text matches LICENSE clause for clause. The 2023/2024/2026 year spread across files matches the stanzas' holders, so only year drift; no /usr/share/common-licenses pointer is needed.
• MDN/CC-BY-SA-2.5 material: grep for MDN|Mozilla|CC-BY finds only CHANGELOG.md history (lines 40-71), the packaging's own explanations (debian/README.source, debian/changelog, the copyright Comment, debian/repack) and developer.mozilla.org URLs in doc comments (lib/src/helpers.dart:84, lib/src/helpers/http.dart:56-57, lib/src/helpers/events/streams.dart:49-50,73-74) - links to further reading, not copied text. No '///' line remains under lib/src/dom/, consistent with debian/repack's sed.
• Generated code: the 177 lib/src/dom/*.dart files say 'Generated from Web IDL definitions.' and come from upstream's separate web_generator project, which is not shipped. They are plain, readable Dart, are the form upstream maintains and hand-edits (e.g. CHANGELOG 'Correctly namespace WebAssembly types'), and are what the pub archive ships; no compiler output is installed, so the package does contain the source in a preferred form for modification.
• test_fixes/fixes_1_1_2.dart.expect and renames.dart.expect are dart fix golden outputs whose input .dart files ship beside them: test data, not built artifacts; example/index.html is a five-line hand-written page.
• debian/ read in full: control, rules, install, docs, copyright, changelog, README.source, repack, gbp.conf, source/format, tests/control, tests/smoke, upstream/metadata. There are no patches (3.0 (quilt) with empty .pc/applied-patches) and no maintainer scripts.
• Relationships and tooling: dh-sequence-single-binary is provided by debhelper 14.5 (apt-cache) and compat 14 is the recommended level (debhelper tool); the autopkgtest dependency dart-sdk is in the archive (3.13.4+dfsg1-7, matching the pubspec's sdk ^3.13.0); Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1, so not an issue.
• debian/rules' override_dh_install calls dh_install first and then stamps the installed directories with touch -d "@${SOURCE_DATE_EPOCH}", escaped as $${...} so make does not expand it - it works under dpkg-buildpackage.
• Multi-Arch: foreign on the arch:all package is appropriate: the interface is Dart source text, identical on every architecture, and Policy 5.6.34.2 allows arch-independent packages to be marked foreign; debconf is an existing example.
• Every source header says 'Please see the AUTHORS file', which upstream does not ship in its archive either; the holder is named in the header itself and in debian/copyright, so nothing is missing from the copyright file.
• uscan found the packaged version as the newest upstream release (upstream 1.1.2, packaged 1.1.2+ds).

Not confirmed

• Whether the Debian dart-sdk discovers, or is meant to consume, packages installed under /usr/share/dart/packages could not be verified (nothing is installed there on the reviewing system); debian/tests/smoke sidesteps it by writing .dart_tool/package_config.json by hand. If the SDK does not look there, the installed tree would be inert for other Dart packages.
• debian/repack was not run; its plain tar czf fixes neither gzip's header timestamp nor the tar member order, so it may not regenerate the orig tarball byte-for-byte (its content should match).

Proposed changes

None.