DFSG NEW review for dart-webdriver version 3.2.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is Apache-2.0: every .dart file and both test HTML pages carry the standard 'Copyright 20xx Google Inc. ... Apache License, Version 2.0' header, LICENSE is the Apache-2.0 text, and no other licence wording (GPL/LGPL/BSD/MIT/MPL/CC/non-commercial/no-derivatives/public-domain) appears anywhere in the tree. debian/copyright is DEP-5 with the correct short name Apache-2.0 and, as Policy 12.5 allows for Apache-2.0, points at /usr/share/common-licenses/Apache-2.0 instead of quoting the text; the only defect is that its Files: * stanza names only 'Google Inc.' while LICENSE's own notice says 'Copyright 2013 Google LLC'. Nothing non-free, no vendored third-party code, no built or minified files, and no file lacking a licence.

Packaging

Small, clean source-only package: compat 14 with debhelper-compat and the explicitly named dh-sequence-single-binary add-on (the recommended form at compat 14), 3.0 (quilt) with no patches needed, a five-line Depends that exactly matches the package: imports in the installed lib/ and whose versions satisfy pubspec.yaml's constraints, and a coherent offline autopkgtest. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 in its first two components. The rules override only stamps directory mtimes for reproducibility. I found no packaging fault worth reporting.

Issues

1. [minor] [licensing] debian/copyright names only Google Inc., but LICENSE's copyright notice says Google LLC

• Files: debian/copyright:6, LICENSE:189
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: Copyright: 2015 Google Inc.; LICENSE:189 Copyright 2013 Google LLC
• Problem: LICENSE is the work's licence file and its appendix carries the filled-in copyright notice for the work; that notice names Google LLC, which debian/copyright does not mention at all, so the Files: * stanza does not reproduce every copyright notice in the source as Policy 12.5 and copyright-format 1.0 require. The licence itself is unchanged (Apache-2.0), so this is an accuracy defect, not a DFSG problem.
• Fix: Name both entities in the Files: * Copyright field, e.g. Copyright: 2013 Google LLC, 2015-2022 Google Inc. (the file headers run from 2013 to 2022).

Verified

• Scanned 115 .dart files, the two test HTML pages, markdown, YAML, and JSON test fixtures: all carry the Apache-2.0 header naming Google Inc. (2013, 2015, 2017, 2019 and 2022 variants), or are non-code data under the top-level LICENSE; no other holder appears anywhere in the tree.
• Prescan item: LICENSE:189 Copyright 2013 Google LLC — reported as an issue above; it is the only place Google LLC appears (AUTHORS and every source header say Google Inc.).
• No rare or non-free licence wording: grep for GNU General Public, GNU Lesser, Mozilla Public, BSD, MIT, GPL/LGPL, non-commercial, NonCommercial, NoDerivatives, public domain and 'Permission is hereby granted' found nothing outside LICENSE's own Apache-2.0 text.
• debian/copyright is DEP-5: correct Format line, Upstream-Name/Source, Files: * then Files: debian/* (later stanza overrides), valid Apache-2.0 short name, stand-alone License paragraph referencing /usr/share/common-licenses/Apache-2.0, which Policy 12.5 explicitly allows for Apache-2.0. No Files-Excluded is needed; nothing was removed from the upstream tarball.
• No binaries, fonts, images, archives, generated or minified files in the tree; the orig tarball contains exactly the same top-level entries (analysis_options.yaml, AUTHORS, CHANGELOG.md, CONTRIBUTING.md, dart_test.yaml, lib/, LICENSE, pubspec.yaml, README.md, test/).
• test/support/firefox_profile/prefs.js is Firefox-generated profile test data (a list of user_pref values; its 'Mozilla User Preferences' comment is not a licence term), and addons.json/webapps.json are empty JSON fixtures — test data, not third-party code.
• test/frame.html and test/test_page.html carry their own Copyright 2013 Google Inc. Apache-2.0 header, consistent with the Files: * stanza.
• Dependencies cover the code exactly: the installed lib/ imports only package:stack_trace, package:sync_http, package:matcher, package:path and package:web, which are the five Depends; dart-matcher 0.12.20, dart-path 1.9.1 and dart-stack-trace 1.12.2 are in unstable, and dart-web 1.1.2 (source dart-web 1.1.2-1) and dart-sync-http 0.3.1 (source dart-sync-http 0.3.1-1) are in the NEW queue, satisfying pubspec.yaml's ^0.12.10, ^1.8.0, ^1.10.0, ^1.1.0 and ^0.3.0 constraints.
• dart-sdk 3.13.4+dfsg1-7 is in unstable and installs the SDK under /usr/lib/dart, which is the fallback path debian/tests/smoke uses; the test's Depends (@, dart-sdk) match debian/tests/control.
• dh-sequence-single-binary is provided by debhelper 14.5 (debhelper tool/apt-cache), and naming it explicitly is what debhelper recommends at compat 14 to silence the implicit-activation warning; with no build system dh_auto_install puts nothing in debian/tmp, so dh_missing's --fail-missing default at compat 13+ has nothing to reject for the uninstalled test/ tree and README/CHANGELOG.
• The autopkgtest is coherent with the library it exercises: fromExistingSession(spec: WebDriverSpec.W3c), get, currentUrl and quit exist with those signatures, and the requests it makes (POST/GET session/abc/url, DELETE session/abc) are exactly the endpoints the fake server implements; for W3C, buildInfoRequest is a nullRequest and RequestClient.send short-circuits it, so no GET /session/abc is needed (lib/src/handler/w3c/session.dart, lib/src/common/request_client.dart).
• debian/install puts lib/ and pubspec.yaml under /usr/share/dart/packages/webdriver/, matching both pubspec.yaml's name: webdriver (the package: URI the test imports) and the package_config.json the test builds.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components equal, so not an issue (per the review rules).
• Changelog is well formed: unstable, 3.2.0-1, initial release closing #1152429, and the date 29 Oct 2026 is a Thursday.
• Ignored .pc/ and there is no debian/cargo-checksum.json; the debian tar contains only the files under debian/.
• uscan found the packaged version as the newest upstream release (upstream 3.2.0, packaged 3.2.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Read-only review: I did not build the package or run the autopkgtest; its behaviour was checked by reading it against the library's API, not by running it.
• The file mode of debian/tests/smoke cannot be seen with the read-only tools available, so I could not confirm it is executable for autopkgtest.
• No other Dart package is installed on the reviewing system, so I could not compare the /usr/share/dart/packages/ installation layout with sibling dart-* packages; the package and its own test agree on that path.
• Vcs-Git/Vcs-Browser point at salsa.debian.org/dart-team/dart-webdriver; without network access I could not confirm the repository exists.

Proposed changes

None.