Review: flatten-maven-plugin 1.8.0-1
Package Information
| Description | Maven plugin generating a flattened version of the POM The Flatten Maven Plugin generates a flattened version of the pom.xml that Maven installs and deploys instead of the original. The flattened POM only contains the elements required by the users of the artifact: the build and development specific elements are removed, the variables are resolved, and the parent relationship is resolved, flattened and removed. |
|---|---|
| Maintainer | Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> |
| Changed By | Emmanuel Bourg <ebourg@apache.org> |
| Sponsor | ebourg@apache.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/java-team/flatten-maven-plugin.git (browse) |
| Closes | #1152160 |
| Tracker | https://tracker.debian.org/pkg/flatten-maven-plugin |
| Uploaded | 12 days ago |
New Package Report
.changes
| Source | flatten-maven-plugin |
|---|---|
| Version | 1.8.0-1 |
| Changed-By | Emmanuel Bourg <ebourg@apache.org> |
| Architecture | source all |
| Distribution | unstable |
| Date | Mon, 26 Oct 2026 14:18:36 +0100 |
Changelog
flatten-maven-plugin (1.8.0-1) unstable; urgency=medium . * Initial release (Closes: #1152160)
.dsc
| Section | java |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | libflatten-maven-plugin-java deb java optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Flatten Maven Plugin
Upstream-Contact: https://github.com/mojohaus/flatten-maven-plugin/issues
Source: https://github.com/mojohaus/flatten-maven-plugin
Files: *
Copyright: 2014-2026, MojoHaus contributors
License: Apache-2.0
Files: debian/*
Copyright: 2026, Emmanuel Bourg <ebourg@apache.org>
License: Apache-2.0
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the full text of the Apache License, Version 2.0
can be found in the file `/usr/share/common-licenses/Apache-2.0'.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 12 days ago.
Report
DFSG NEW review for flatten-maven-plugin version 1.8.0-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The whole source tree is Apache-2.0 and debian/copyright is DEP-5, matches it, and is accurate. Every licence-bearing file (pom.xml, the 24 Java sources under src/main and src/test, all verify.groovy/setup.groovy integration-test scripts, the .github workflows) carries the ASF 'Licensed under the Apache License, Version 2.0' header, and LICENSE.txt is the full Apache-2.0 text. No other licence text (GPL/LGPL/BSD/MIT/MPL/CC/public-domain/non-commercial) appears anywhere, no named copyright holder other than the ASF boilerplate appears, and there are no binary or generated files. Files: * (Apache-2.0, 'MojoHaus contributors') is the correct catch-all and debian/* is overridden for the packaging. No DFSG problem found.
Packaging
The packaging is conventional maven-debian-helper work of good quality: debhelper-compat 13 with a plain 'dh $@' (the maven build system is a third-party build system in debhelper's Dh_Buildsystems list and is auto-selected from the presence of pom.xml), source format 3.0 (quilt), a single well-described DEP-3 patch that is legitimately not forwarded (it replaces the configuration of the unpackaged org.codehaus.mojo:mojo-parent), Architecture: all, ${maven:Depends}/${misc:Depends} and a correct Standards-Version, and a sane initial changelog closing the ITP. Build-Depends covers the pom's dependencies, including libeclipse-sisu-maven-plugin-java for the sisu index the patch enables. The only gap is the absence of any autopkgtest.
Issues
minor packaging 1. No autopkgtest: debian/tests/control is missing ◂
- Files:
debian/ (no tests/ directory) - Basis: checked, in the package or with a reference tool
- Evidence: The debian/ directory contains only changelog, control, copyright, libflatten-maven-plugin-java.poms, maven.properties, maven.rules, rules, source/format, watch and patches/. There is no debian/tests/control and no Tests-Buite field in debian/control.
- Problem: The package ships a JUnit test suite (src/test/java/org/codehaus/mojo/flatten/*.java) that is run only at build time; nothing exercises the installed package. A sponsor would normally ask for a minimal autopkgtest (for example a Test-Command running the unit tests against the installed jar) so that regressions in Maven or the dependencies are caught in the Debian CI. This is optional, hence minor, not blocking.
- Fix: Add debian/tests/control with a Test-Command that runs the unit tests against the installed package, and the corresponding Testsuite: autopkgtest field in debian/control.
Verified ◂
- Prescan: its author check ('every holder found is named in debian/copyright') reported no missing copyright holder, and it listed no other file; no item needed to be accounted for.
- debian/copyright is DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/) with two stanzas (Files: * ; Files: debian/*) and one stand-alone Apache-2.0 License paragraph quoting the Apache short notice and pointing at /usr/share/common-licenses/Apache-2.0, which exists. No Files-Excluded (the tarball is not repacked).
- Licence evidence: grep over the whole tree (excluding .pc/) for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache License/MPL/public domain/All rights reserved matched only ASF 'Licensed to the Apache Software Foundation ... Apache License, Version 2.0' headers, in 127 files. A second grep for GPL|LGPL|AGPL|BSD|MPL|EPL|CC-BY|Creative Commons|public domain|non-commercial|no derivative|WTFPL|ISC|MIT|zlib found nothing. No 'Copyright ' line exists anywhere in the tree, so no holder is omitted.
- src/main/java/org/codehaus/mojo/flatten/.java (24 files counted, incl. cifriendly/, extendedinterpolation/, model/resolution/), src/test/java/..., src/it/projects//{verify,setup}.groovy, pom.xml, .github/workflows/*.yml all carry the Apache-2.0 header. LICENSE.txt is the verbatim Apache License 2.0 (202 lines).
- The individual copyright/contributor lists in pom.xml (, ) are authorship metadata, not licence or copyright notices; no additional licence results from them.
- No built or binary artifacts: no .jar/.class/.so/.dll/.exe/.pyc/.zip/.png/.jpg/.pdf/.min.js/.min.css anywhere; .mvn/keep-me is a zero-byte marker file, and the src/it/projects//.flattened-pom.xml, src/test/resources//expected-flattened-pom.xml and src/it/mrm/repository/*.pom files are plain-text integration-test fixtures whose generators are the poms beside them.
- The file headers refer to a NOTICE file ('See the NOTICE file distributed with this work') but no NOTICE exists in the tarball; this is upstream's boilerplate and absence, not a packaging defect, and Apache-2.0 does not require one.
- Packaging: debian/control has Build-Depends covering the pom's compile/provided/test dependencies (default-jdk, maven-debian-helper >= 2.7~, libmaven3-core-java, libplexus-{utils2,xml,interpolation}-java, libcommons-io-java, junit4, libassertj-core-java, libmaven-plugin-testing-java, libmaven-plugin-tools-java and libeclipse-sisu-maven-plugin-java for the sisu index the patch enables); Architecture: all; Depends: ${maven:Depends}, ${misc:Depends}; Recommends: ${maven:OptionalDepends}; compat 13 so the substvars must be (and are) named explicitly.
- debian/rules is 'dh $@': the maven build system is listed in @THIRD_PARTY_BUILDSYSTEMS (checked in /usr/share/perl5/Debian/Debhelper/Dh_Buildsystems.pm) and is auto-selected, so no --buildsystem=maven is needed (/usr/share/perl5/Debian/Debhelper/Buildsystem/maven.pm exists).
- Standards-Version: 4.7.4 against Policy 4.7.4.1 (policy tool table of contents) - first two components match, so not an issue.
- debian/patches/mojo-parent-configuration.patch is DEP-3 (Description/Author/Forwarded: not-needed), adds only the sisu and helpmojo executions that the unpackaged org.codehaus.mojo:mojo-parent would have provided; debian/maven.properties supplies the parent's encoding and compiler properties, and debian/maven.rules the version scheme for junit and org.apache.maven. apt-cache confirms no libmojo-parent-java exists in Debian, so the patch is justified.
- debian/changelog: 'flatten-maven-plugin (1.8.0-1) unstable', consistent with the source name and upstream version, initial release closing an ITP. No maintainer scripts, no *.maintscript, no debian/install|links|dirs|docs files.
- debian/watch was not reviewed, per the instructions.
- I read debian/copyright, control, changelog, rules, watch, libflatten-maven-plugin-java.poms, maven.properties, maven.rules, patches/series, patches/mojo-parent-configuration.patch, source/format, pom.xml and the prescan in full, and sampled the licence evidence across src/main, src/test, src/site and src/it (127 matching files, listed).
- uscan found the packaged version as the newest upstream release (upstream
1.8.0, packaged1.8.0). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- pom.xml lists org.apache.maven.plugin-tools:maven-plugin-annotations and junit without a (they were managed by the unpackaged mojo-parent), and debian/maven.rules has a rule only for junit. I could not check whether mh_patchpoms/POMTransformer fills the missing version from the Debian maven repository (the tool is a compiled jar, /usr/share/java/maven-repo-helper.jar, whose POMTransformer.class is not readable as text). If it does not, the Maven build would stop at model validation; the maven-plugin-annotations artifact is present in the repository as 3.10.2/debian, and this is very likely what the --no-parent handling in debian/libflatten-maven-plugin-java.poms relies on. A build would show it; I did not report it as an issue.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 12 days ago.
Review Information
accepted — allocated to awm 11 days ago, started 11 days ago, completed 11 days ago.