gobgp 4.8.0-2

Package Information

Description	BGP implemented in Go (daemon and client) GoBGP is an open source BGP implementation designed from scratch for modern environment and implemented in Go. It is designed to exploit multicore processors and can be easily integrated with other software through an RPC API. This package contains both the daemon and the client.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Mathias Gibbens <gibmat@debian.org>
Sponsor	gibmat@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/go-team/packages/gobgp.git (browse)
Popcon Installs	11
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/gobgp
Uploaded	8 hours ago

New Package Report

.changes◂

Changed-By	Mathias Gibbens <gibmat@debian.org>
Architecture	source amd64 all
Distribution	unstable
Date	Wed, 11 Nov 2026 17:08:34 +0000
Source	gobgp
Version	4.8.0-2

Changelog◂

gobgp (4.8.0-2) unstable; urgency=medium
 .
   * Upload changes from experimental
   * Rename -dev package to include major version number

.dsc◂

Priority	optional
Component	main
Package-List	gobgpd deb net optional arch=any golang-github-osrg-gobgp-dev deb oldlibs optional arch=all golang-github-osrg-gobgp-v4-dev deb golang optional arch=all
Section	net

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: gobgp
Source: https://github.com/osrg/gobgp
Files-Excluded:
 .gitignore

# Note -- the file docs/sources/zebra-multipath.md contains a copyright
#         string, but it is from output of a different program.

Files: *
Copyright: 2014-2021 Nippon Telegraph and Telephone Corporation.
License: Apache-2.0

Files: tools/grpc/cpp/Makefile
Copyright: 2015 gRPC authors
License: Apache-2.0

Files: test/scenario_test/mup_test.py
Copyright: 2022 Yuya Kusakabe
License: Apache-2.0

Files: debian/*
Copyright:
 Copyright 2016-2022 Vincent Bernat <bernat@debian.org>
 Copyright 2022-2026 Mathias Gibbens
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 hours ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for gobgp version 4.8.0-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 1 important, 4 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: 11 found

Licensing

All licences in the tree are free and mutually compatible (Apache-2.0 plus Expat), so there is no DFSG violation and the source is complete in its preferred form. debian/copyright is, however, inaccurate: several files carry their own notices that the file does not reflect. proto/api/{attribute,capability,gobgp}.proto and the api/*.pb.go generated from them grant an MIT/Expat permission, not the Apache-2.0 that Files: * declares, and no Expat stanza exists. Three 2026 copyright holders named in file headers (Cisco, Cisco Systems, Inc., The GoBGP Authors) are absent. The Copyright 1996-2005 Kunihiro Ishiguro line in docs/sources/zebra-multipath.md is quoted zebra output, as the file's own comment says, and the binary files under pkg/packet/bgp/testdata/bad-len/ are BGP fuzz/test inputs with no copyrightable content.

Packaging

Solid, modern packaging: debhelper compat 13, dh-go/golang buildsystem, correct Go team splits with a versioned -dev package and a transitional dummy, DEP-3 patch with a forwarding link, working autopkgtests, current Standards-Version (4.7.4 against Policy 4.7.4.1), Vcs-* and Homepage present. Two minor flaws: Build-Depends omits one test-only import that is currently satisfied only transitively, and the build creates man1/ in the source tree which debian/clean does not remove, so a rebuild in the same tree fails.

Issues

blocker licensing 1. api/.proto and generated api/.pb.go are MIT/Expat-licensed, but debian/copyright declares Apache-2.0 for them ◂

Files: proto/api/attribute.proto:1-20, proto/api/capability.proto:1-20, proto/api/gobgp.proto:1-20, api/attribute.pb.go:1-20, api/capability.pb.go:1-20, api/gobgp.pb.go:1-20, api/gobgp_grpc.pb.go:1-20, debian/copyright:9-11
Basis: checked, in the package or with a reference tool
Evidence: proto/api/attribute.proto: Copyright (C) 2018 Nippon Telegraph and Telephone Corporation. followed by Permission is hereby granted, free of charge, to any person obtaining a copy of this software ... The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.; debian/copyright's only stanza reaching them is Files: * / License: Apache-2.0.
Problem: Those files are licensed under the Expat (MIT) text, not Apache-2.0, and the generated api/*.pb.go carry the same notice (protoc copies the .proto header comments). debian/copyright therefore misstates the licence of files that are shipped in the -dev package and compiled into gobgpd, and it contains no Expat licence text, which DEP-5 requires for a licence that is not in /usr/share/common-licenses (copyright-format 6.7).
Fix: Add a Files: proto/api/*.proto api/*.pb.go stanza with Copyright: 2015-2018 Nippon Telegraph and Telephone Corporation. and License: Expat, and a stand-alone License: Expat paragraph with the full MIT text (the text in the files themselves). Leave common.proto/extcom.proto/nlri.proto and their generated files under Apache-2.0.

important licensing 2. debian/copyright does not name the holders Cisco, Cisco Systems, Inc., or The GoBGP Authors ◂

Files: internal/pkg/table/table_manager_race_test.go:1, pkg/server/server_handlefsmmessage_test.go:1, internal/pkg/netutils/tcp_ao.go:1, internal/pkg/netutils/tcp_ao_linux.go:1, internal/pkg/netutils/tcp_ao_linux_test.go:1, internal/pkg/netutils/tcp_ao_stub.go:1, internal/pkg/netutils/tcp_ao_uapi.go:1, debian/copyright:9-11
Basis: checked, in the package or with a reference tool
Evidence: Files: // Copyright (C) 2026 Cisco, // Copyright (C) 2026 Cisco Systems, Inc., // Copyright (C) 2026 The GoBGP Authors.; debian/copyright's catch-all Files: * names only Copyright: 2014-2021 Nippon Telegraph and Telephone Corporation.
Problem: The licence (Apache-2.0) matches, but the copyright holders stated in the files are not represented, so debian/copyright does not describe the copyright of every file. This is the only remaining inaccuracy apart from the Expat files above.
Fix: Add these holders to debian/copyright, for example a stanza covering pkg/server/server_handlefsmmessage_test.go, internal/pkg/table/table_manager_race_test.go and internal/pkg/netutils/tcp_ao*.go with Copyright: 2026 Cisco / 2026 Cisco Systems, Inc. / 2026 The GoBGP Authors and License: Apache-2.0.

minor packaging 3. Build-Depends lacks golang-github-prometheus-client-model-dev, imported by pkg/metrics/metrics_test.go ◂

Files: debian/control:9-46, pkg/metrics/metrics_test.go:9
Basis: checked, in the package or with a reference tool
Evidence: Test import dto "github.com/prometheus/client_model/go"; Build-Depends lists golang-github-prometheus-client-golang-dev but not client-model-dev. /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm sub test runs go test -vet=off -v over all targets, so the test package is compiled at build time. apt-cache show golang-github-prometheus-client-golang-dev shows client-model-dev only arrives through that package's Depends: golang-github-prometheus-client-model-dev (>= 0.5.0).
Problem: Policy 7.7 requires the build dependencies needed by the package to be listed directly; the build currently succeeds only because another build dependency pulls client-model-dev in transitively, so its test build depends on that package's Depends set.
Fix: Add golang-github-prometheus-client-model-dev to Build-Depends (test-only import, so not needed in the -dev package's Depends).

minor packaging 4. debian/rules creates man1/ without debian/clean removing it, so a second build in the same tree fails ◂

Files: debian/rules:17-24, debian/clean:1
Basis: inferred from what was read, not seen directly
Evidence: mkdir man1/ in execute_after_dh_auto_build (no -p), and debian/clean contains only */*.pb.go; the generated man1/gobgp.1 and man1/gobgpd.1 are read by debian/gobgpd.manpages.
Problem: debian/rules clean does not remove man1/, so after one build the next build's mkdir man1/ fails with File exists and the build aborts; the source tree is also left dirty after clean. The archive's clean-chroot builds never hit this, which is why it goes unnoticed.
Fix: Use mkdir -p man1/ and add man1/ to debian/clean.

minor packaging 5. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

minor packaging 6. Files-Excluded is set but the version carries no repack suffix ◂

Files: debian/copyright, debian/changelog, debian/watch
Basis: found by the review tooling's own checks
Evidence: 4.8.0-2
Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified ◂

License inventory completed across the whole tree (excluding .pc/): every .go and .py file either carries the NTT Apache-2.0 header or relies on the top-level LICENSE; the only other notices are api/proto Expat (reported), pkg/server/server_handlefsmmessage_test.go and internal/pkg/table/table_manager_race_test.go Cisco, internal/pkg/netutils/tcp_ao*.go The GoBGP Authors, test/scenario_test/mup_test.py Yuya Kusakabe (already in debian/copyright), and tools/grpc/cpp/Makefile gRPC authors (already in its own stanza, matching the Apache-2.0 header in that file).
pkg/packet/bgp/testdata/bad-len/000852858287eb2ece5cd12aabef453f87b77adb: raw BGP message bytes, read by TestParseMessageWithBadLength (pkg/packet/bgp/bgp_test.go:2378); test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/0b229debaa2fc1e8b997c9894ad3184cce8c7bb4: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/147a924d9a4a4d9960f8bb49e3ec782ee93f82a7: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/1d1fb484828b4f23af3ff0ab71b67682d5876fd6: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/27f19d6959e9cbecfcd09b28c3aec493a4b6f18d: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/3765bb2392d48ca8edaf0b5e39209eb2d1b87c53: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/3dce7e046d709b142092e15b78e9ad20ee5144fa: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/4d4dc736bc89bf41363774d282b8a7641c3e7a98: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/66e6aab4f34c9c5783c18f90b2d987e5dad241e0: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/a8ecedce17e2e28a466cf9fb3bfaf2d8554fef42: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
pkg/packet/bgp/testdata/bad-len/b7ed0646a97127bf424da480a53a84a0cb9c9565: raw BGP message bytes, read by TestParseMessageWithBadLength; test data, no licensing or provenance issue.
docs/sources/zebra-multipath.md:26 Copyright 1996-2005 Kunihiro Ishiguro, et al. is inside a fenced block quoting zebra --version from Quagga, not a notice on the file; this matches the comment in debian/copyright, so no stanza is needed.
internal/pkg/netutils/tcp_ao_uapi.go re-states Linux UAPI socket-option numbers and structure sizes as Go constants; it is upstream's own Apache-2.0 code, and the Linux UAPI it follows (GPL-2.0 WITH Linux-syscall-note) allows use by programs not under the GPL.
Generated files all have their inputs in the tree: api/.pb.go from proto/api/.proto (removed by debian/clean */*.pb.go, regenerated in execute_before_dh_auto_configure); pkg/config/oc/.go by pyang with the generator at tools/pyang_plugins/bgpyang2golang.py; pkg/packet/{bgp,bfd,zebra}/_string.go by stringer, with the matching //go:generate stringer lines present.
LICENSE is the unmodified Apache License 2.0 and README.md states Apache-2.0; debian/copyright is DEP-5 machine-readable with exactly the canonical Format URL, and its Apache-2.0 stanza correctly points at /usr/share/common-licenses/Apache-2.0.
No vendored third-party code: no vendor/ directory, all Go imports resolve to Debian packages, and tools/config/example_toml.go (the only user of github.com/BurntSushi/toml) is excluded from both build and -dev source by DH_GOLANG_EXCLUDES.
Documentation figures docs/sources/policy.png, docs/sources/policy-component.png and docs/sources/rs-policy.png are upstream's diagrams, with corresponding SVG sources (policy.svg, policy_component.svg, rs-policy.svg) shipped in the same directory.
Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match, current); Vcs-Git/Vcs-Browser/Homepage/upstream metadata all consistent with the source.
Every package named in Build-Depends and in the -dev Depends exists in the archive at a version satisfying the constraints: dh-go 1.69, golang-github-go-viper-mapstructure-dev 2.5.0 (>= 2.4.0), golang-github-spf13-viper-dev 1.21.0 (>= 1.21.0), protoc-gen-go-grpc 1.81.1 (>= 1.33.3), golang-github-prometheus-client-golang-dev 1.23.2, golang-github-getsentry-sentry-go-dev 0.40.0, and the rest (checked via apt-cache); the -dev package's Depends set covers all non-test imports.
debian/patches/0001-skip-TestWatchEvent.patch has DEP-3 headers (From, Description, Forwarded to upstream issue 2851), still applies, and skips only TestWatchEvent, whose flakiness is the recorded reason.
debian/tests/control is valid: gobgp --help, plus a daemon smoke test; gobgpd logs to os.Stdout (cmd/gobgpd/main.go:170-176), so no Restrictions: allow-stderr is needed, and both bind only unprivileged ports.
debian/gobgpd.service guards on ConditionPathExists=/etc/gobgpd.conf, which the package does not ship; deliberate (no default BGP configuration is distributable) rather than a missing conffile.
The -dev package rename is complete: XS-Go-Import-Path has the /v4 element, golang-github-osrg-gobgp-v4-dev Breaks/Replaces golang-github-osrg-gobgp-dev (<< ${source:Version}), and the latter remains as an oldlibs transitional package depending on it.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 4.11.0, packaged 4.8.0), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

None.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Template: Github
Dist: https://github.com/osrg/gobgp
Uversionmangle: s/(\d)[_\.\-\+]?(RC|rc|pre|dev|beta|alpha)[.]?(\d*)$/$1~$2$3/

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-12 22:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package