DFSG NEW review for flutter version 3.47.5+ds1-3

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Yes. debian/copyright is DEP-5: a Files: * stanza (2014, the Flutter Authors, BSD-3-clause), a debian/* stanza (2026, Emfox Zhou, BSD-3-clause) and the full BSD-3 text, which matches the shipped root LICENSE and packages/flutter/LICENSE including the Google Inc. non-endorsement clause. Every upstream file is covered: the .dart/.yaml/.java headers all name the Flutter Authors, and the data files (.arb, pubspec.yaml, README) sit under the root LICENSE; no other holder, licence or non-free term appears anywhere in the tree, no third-party source is shipped (third_party is excluded), and the single scan hit, The Sample Authors, is placeholder text in a dartdoc example.

Packaging

Good overall: six Architecture: all source packages at debhelper compat 14, a minimal dh rules that installs the six Dart packages under /usr/share/dart/packages and drops the workspace-resolution line from each installed pubspec, DEP-5 copyright, an autopkgtest limited to the architectures where dart-sdk and the engine exist, and every runtime dependency is satisfiable at the versions required (dart-fake-async and dart-vm-service are in NEW). The one defect is minor: flutter-test imports test_api's private src/backend API, which upstream pins exactly, but its Depends is unbounded and the installed pubspec still claims 0.7.12 while Debian ships 0.7.15.

Issues

1. [minor] [packaging] flutter-test imports test_api's private internals, but dart-test-api/dart-matcher are unbounded and disagree with the installed pubspec pins

• Files: debian/control:62-63, packages/flutter_test/pubspec.yaml:17-21, packages/flutter_test/lib/src/test_compat.dart:14-24, packages/flutter_test/lib/src/matchers.dart:18
• Basis: checked, in the package or with a reference tool
• Evidence: test_api: 0.7.12 / matcher: 0.12.20 under the comment We depend on very specific internal implementation details of the 'test' package, which change between versions; import 'package:test_api/src/backend/declarer.dart'; // ignore: implementation_imports (11 such imports at test_compat.dart:14-24, plus package:matcher/src/expect/async_matcher.dart); control has only dart-test-api (>= 0.7.12), and dart-matcher (>= 0.12.20),.
• Problem: The shipped library depends on private implementation files of test_api and matcher, and upstream pins both packages exactly because those internals change between versions. The installed pubspec.yaml is shipped unchanged except for the resolution: workspace line, so it declares test_api 0.7.12, while the Depends relation admits any later dart-test-api (Debian ships 0.7.15 and would admit 0.8.x) and any later dart-matcher. The binary package therefore declares a dependency contract that contradicts both its own pubspec and the code's supported version, and nothing would catch a break: the autopkgtest only analyses flutter/material, never flutter_test.
• Fix: Either port test_compat.dart to the test_api version Debian ships and update the installed pubspec pin (e.g. sed the pin alongside resolution: workspace, with (>= 0.7.15) (<< 0.8.0)), or keep the exact pins and bound the relations to them ((>= 0.7.12) (<< 0.7.13), (>= 0.12.20) (<< 0.13.0)), adding the respective dart-test-api version to the archive.

Verified

• Prescan file: packages/flutter/lib/src/foundation/licenses.dart:85 is inside a {@tool snippet} example of LicenseEntryWithLineBreaks (the same snippet also says Example Inc.); The Sample Authors is placeholder licence text, not a copyright holder, so no stanza is missing.
• All 2555 files outside debian//.pc carry either the Copyright 2014 The Flutter Authors ... BSD-style license header or no notice of their own and are covered by the root LICENSE and packages/flutter/LICENSE; greps for Copyright, (C), ©, SPDX-License-Identifier, Permission is hereby granted, GNU, Apache, MPL, public domain, All rights reserved and non-commercial/no-modification wording found no other holder or licence.
• No compiled programs, libraries, bytecode, archives, fonts, PDFs or minified code: the only binary files are the launcher/favicon PNGs of the integration_test example app, and the .g.dart / generated_*_localizations.dart files are plain, readable Dart sources shipped from upstream.
• Every path in Files-Excluded is absent from the tarball; wildcardless names (README.md, pubspec.yaml, .gitignore) are anchored at the top, so the nested package-level files legitimately remain.
• Dependency versions checked with apt-cache: dart-characters 1.4.1-1, dart-collection 1.19.1-2, dart-material-color-utilities 0.13.0+ds1-2, dart-meta 1.19.0-2, dart-vector-math 2.4.3+ds1-1, dart-intl 0.20.3-1, dart-path 1.9.1-2, dart-test-api 0.7.15-1, dart-matcher 0.12.20-1, dart-clock 1.1.3-1, dart-stack-trace 1.12.2-2, dart-leak-tracker-flutter-testing 3.0.10-1, dart-stream-channel 2.1.4-2, dart-file 7.0.1-1, dart-crypto 3.0.7-1, dart-platform 3.2.0-1, dart-process 5.0.6-1 and sky-engine 3.47.5+ds1-3 all satisfy their relations; dart-fake-async 1.3.3-1 and dart-vm-service 15.4.0-1 are in NEW.
• dart-sdk 3.13.4 satisfies every ^3.11.0-0 SDK constraint and the smoke test's languageVersion 3.11, and the imports of each shipped lib resolve to packages in its Depends (only flutter_test reaches into test_api/src and matcher/src).
• dh_missing cannot fail this build: with no --sourcedir it scans debian/tmp, which this rules file never creates, and exits 0; dpkg-deb clamps the mtimes written by dh_install and the six sed -i rewrites to SOURCE_DATE_EPOCH, so the touch/find step is not the only thing keeping the build reproducible.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 3.47.8, packaged 3.47.5+ds1), which is not a fault of the package.

Not confirmed

• Whether dart-test-api 0.7.15 still exposes the test_api/src/backend/* API that flutter_test imports at 0.7.12, and whether dart-matcher 0.12.20's src/expect/async_matcher.dart is unchanged for the shipped code; only building or analysing flutter_test against those versions would show it, and the autopkgtest does not exercise flutter_test.

Proposed changes

None.