DFSG NEW review for dart-webdriver version 3.2.0-2

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is Apache-2.0 (LICENSE plus a per-file Apache-2.0 header on every .dart file and on the two test HTML pages), which is DFSG-free, and no other holder or licence appears anywhere. debian/copyright is DEP-5: exact Format URL, Files: * naming both Google entities that the files name (Google Inc. 2013-2022; Google LLC 2013, from the LICENSE appendix), a Files: debian/* stanza for Emfox Zhou, and a stand-alone Apache-2.0 paragraph pointing at /usr/share/common-licenses/Apache-2.0. The header-less files (JSON fixtures, README/CHANGELOG, pubspec) and the Firefox profile fixture are covered by Files: *.

Packaging

Sound packaging: debhelper compat 14 with dh-sequence-single-binary explicitly declared (the compat-14 checklist's recommendation for a single-binary source package), a correct install layout (dh_install's directory source keeps its lib/ basename under /usr/share/dart/packages/webdriver, matching what the smoke test resolves), an offline autopkgtest, current Standards-Version 4.7.4, sane changelog, Vcs-* and DEP-5 copyright. The only risk left is that two of the five runtime Depends (dart-web, dart-sync-http) are not in the archive lists or NEW queue the reference tool knows, so the package's installability could not be confirmed; the other three exist and satisfy the pubspec's version constraints.

Issues

None.

Verified

• The pre-review author check (157 files) reported no holder missing from debian/copyright; the two holders it counts are Google Inc. and Google LLC, both named in the Files: * stanza, and the Debian packaging is credited to Emfox Zhou.
• debian/copyright is machine-readable: Format is exactly the 1.0 URL, with Upstream-Name/Source, Files: * (Apache-2.0), Files: debian/* (2026 Emfox Zhou, Apache-2.0), and one stand-alone License: Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0; no Files-Excluded is needed, as the orig tarball is the complete pub.dev source.
• Licence evidence over the whole upstream tree: 112 .dart/.html files carry the Apache-2.0 header, with Copyright 2015/2017/2022 Google Inc. All Rights Reserved. in lib/ and test/, and Copyright 2013 Google Inc. in test/frame.html and test/test_page.html; LICENSE is the full Apache-2.0 text whose appendix reads Copyright 2013 Google LLC. The year range 2013-2022 in debian/copyright covers every notice.
• grep for copyright/licence wording (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GPL/LGPL, Apache License, Mozilla Public, Python-style, public domain, All rights reserved, non-commercial, no modification) across lib/, test/ and the top-level files found only the Apache-2.0 headers and documentation links to the Selenium JsonWireProtocol wiki and the W3C spec, which are references, not licence terms. There is no NOTICE, no subdirectory LICENSE/COPYING, and no other holder.
• Header-less files (e.g. lib/src/common/by.dart, lib/src/common/exception.dart, lib/src/common/spec.dart, lib/src/async/common_io.dart, the JSON fixtures, README.md, CHANGELOG.md, pubspec.yaml) contain no third-party notice and are covered by Files: * and the project LICENSE; their omission of a per-file header is upstream's choice, not a licensing defect.
• No built, minified, binary, image or PDF files exist in the tree; lib/src/common/zip.dart is upstream's own Apache-2.0-headered zip encoder, not a copy of package:archive (which upstream dropped in 3.0.2), and no third-party library is vendored.
• test/support/firefox_profile/prefs.js is a Firefox-generated profile dump (# Mozilla User Preferences, user_pref(...) lines, an /opt/firefox path), a test fixture that is not installed; addons.json ({schema:5,addons:[]}) and webapps/webapps.json ({}) are trivial test data. They carry no licence terms and are not a DFSG concern.
• debian/install installs lib and pubspec.yaml into usr/share/dart/packages/webdriver/; dh_install copies a directory source with its basename (cp -a $src $dest/ in /usr/bin/dh_install), so the result is .../webdriver/lib/*.dart plus .../webdriver/pubspec.yaml, which is what debian/tests/smoke's package_config (rootUri .../webdriver, packageUri lib/) resolves.
• debian/rules is dh $@ plus an override of dh_install that touches installed directories with @$SOURCE_DATE_EPOCH; dpkg-buildpackage sets that variable from debian/changelog when unset, so the touch has a valid value in normal builds.
• debhelper compat 14 is handled correctly: dh-sequence-single-binary is declared in Build-Depends as the compat-14 checklist recommends, relationship substvars are added by dh_gencontrol at this level, and dh_missing's fail-by-default is a no-op here because there is no debian/tmp. No maintainer scripts or maintscript entries exist and none are needed.
• Standards-Version 4.7.4 matches the policy tool's 4.7.4; Architecture all with Multi-Arch: foreign, Section devel; changelog 3.2.0-2 on unstable closes the ITP in 3.2.0-1; Homepage, Vcs-Git, Vcs-Browser and debian/upstream/metadata agree. debian/source/format is 3.0 (quilt) with no patches, so no DEP-3 review applies.
• autopkgtest: debian/tests/control has one test, smoke, Depends @ and dart-sdk, Restrictions allow-stderr; the script writes a package_config for /usr/share/dart/packages/*, starts a fake WebDriver on loopback and exercises fromExistingSession (a null request for W3c), get, currentUrl and quit, all of whose request paths match the fake server, so the test is meaningful and offline.
• dart-matcher 0.12.20, dart-path 1.9.1 and dart-stack-trace 1.12.2 are in the archive and satisfy the pubspec's ^0.12.10, ^1.8.0 and ^1.10.0; dart-matcher/path also confirm the dart- naming used in Depends.
• uscan found the packaged version as the newest upstream release (upstream 3.2.0, packaged 3.2.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The runtime Depends dart-web (pub web, ^1.1.0 in pubspec.yaml) and dart-sync-http (pub sync_http, ^0.3.0) are neither in the archive lists nor among the binaries of uploads waiting in NEW as of 2026-10-29T12:07Z; nothing provides those names. If they are not pending acceptance the package is uninstallable, but the lists can lag behind an upload, so this is not treated as a finding.
• Whether the salsa repository named in Vcs-Git actually uses the debian/latest branch set in debian/gbp.conf cannot be checked from the package.

Proposed changes

None.