golang-charm-glamour-v2 2.0.1-1

Package Information

Description	stylesheet-based markdown rendering for CLI apps (library) glamour lets CLI-based apps render markdown documents & templates on ANSI compatible terminals. Apps can use their own stylesheet or simply use one of the provided defaults.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Maytham Alsudany <maytham@debian.org>
Sponsor	maytham@debian.org
Distribution	experimental
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-charm-glamour-v2.git (browse)
Closes	#1153142
Tracker	https://tracker.debian.org/pkg/golang-charm-glamour-v2
Uploaded	2 hours ago

New Package Report

.changes◂

Source	golang-charm-glamour-v2
Version	2.0.1-1
Changed-By	Maytham Alsudany <maytham@debian.org>
Architecture	source all
Distribution	experimental
Date	Fri, 06 Nov 2026 13:14:47 +0800

Changelog◂

golang-charm-glamour-v2 (2.0.1-1) experimental; urgency=medium
 .
   * Initial release (Closes: #1153142)

.dsc◂

Priority	optional
Component	main
Package-List	golang-charm-glamour-v2-dev deb golang optional arch=all
Section	golang

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/charmbracelet/glamour
Upstream-Name: glamour
Upstream-Contact: https://github.com/charmbracelet/glamour/issues

Files: *
Copyright: 2019-2023 Charmbracelet, Inc
License: Expat

Files: debian/*
Copyright: 2026 Maytham Alsudany <maytham@debian.org>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for golang-charm-glamour-v2 version 2.0.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Everything in the tree is under the Expat (MIT) licence: the top-level LICENSE names Charmbracelet, Inc (2019-2023) and no other file in the tree carries a copyright notice, SPDX tag or licence text, and there is no vendored third-party code. debian/copyright is DEP-5, has a Files: * stanza with that holder and Expat, a later debian/* stanza for the packaging, and the full Expat text; the patterns cover the whole tree correctly. No non-free terms, no files without a licence, and the copy of Expat is compatible with the packaging.

Packaging

Standard Debian Go team packaging: dh compat 13 with dh-sequence-golang, an arch:all -dev package with Multi-Arch: foreign, XS-Go-Import-Path, Vcs-* and Homepage set, a 3.0 (quilt) source with one testdata patch, and autopkgtest via autopkgtest-pkg-go. Standards-Version 4.7.4 is current against Policy 4.7.4.1. Only small fixes are wanted: one direct import (goldmark) is not declared as a dependency, one unnecessary dependency (colorprofile) is declared, and the patch lacks DEP-3 Forwarded and does not describe its go.mod/go.sum hunks.

Issues

minor packaging 1. Build-Depends and Depends omit golang-github-yuin-goldmark-dev, which the source imports directly ◂

Files: debian/control:8-18, debian/control:30-38, glamour.go:13, go.mod:8
Basis: checked, in the package or with a reference tool
Evidence: glamour.go imports "github.com/yuin/goldmark" (also ansi/renderer.go, ansi/elements.go, ansi/table*.go); go.mod has it in the direct require block (github.com/yuin/goldmark v1.7.8); debian/control lists only golang-github-yuin-goldmark-emoji-dev.
Problem: The build and the installed source depend on goldmark only transitively, through goldmark-emoji (apt-cache: golang-github-yuin-goldmark-emoji-dev 1.0.3-1 Depends golang-github-yuin-goldmark-dev (>= 1.7.1)). A directly imported module should be a declared build and binary dependency; otherwise a change in goldmark-emoji's dependencies silently breaks this package's build, and the -dev package does not declare a library its installed packages import.
Fix: Add golang-github-yuin-goldmark-dev to Build-Depends and to the -dev package's Depends.

minor packaging 2. Dependency on golang-github-charmbracelet-colorprofile-dev is unused: only the excluded examples import it ◂

Files: debian/control:15, debian/control:33, debian/rules:3, examples/artichokes/main.go:14
Basis: checked, in the package or with a reference tool
Evidence: go.mod marks it github.com/charmbracelet/colorprofile v0.4.3 // indirect; the only import in the tree is examples/artichokes/main.go:14; debian/rules sets DH_GOLANG_EXCLUDES := examples, and at compat 13 dh-golang excludes those files from install as well (DH_GOLANG_EXCLUDES_ALL defaults to true from compat 12).
Problem: Neither the built package nor its tests use colorprofile, so the -dev package pulls in an unneeded dependency (and it is already a dependency of golang-github-charmbracelet-x-dev and golang-charm-lipgloss-v2-dev anyway).
Fix: Drop golang-github-charmbracelet-colorprofile-dev from Build-Depends and from Depends.

minor packaging 3. Patch 0001-testdata-for-new-chroma has no Forwarded field and its Description omits the go.mod/go.sum changes ◂

Files: debian/patches/0001-testdata-for-new-chroma.patch:1-6, debian/patches/0001-testdata-for-new-chroma.patch:63-85
Basis: checked, in the package or with a reference tool
Evidence: Header is only From: Maytham Alsudany <maytham@debian.org> and Description: Testdata for new chroma / Regenerated the testdata using go test . ./ansi -update since the version of chroma in Debian is newer than the version specified by upstream in their go.mod; the patch also rewrites go.mod (github.com/alecthomas/chroma/v2 v2.14.0 -> v2.27.0) and the chroma/regexp2 go.sum entries.
Problem: DEP-3 recommends a Forwarded field; this patch is Debian-specific (it exists because Debian ships chroma 2.27.0), so it should say Forwarded: not-needed, and a Description that mentions only the regenerated testdata hides part of the patch's effect from whoever rebases the package on the next upstream release.
Fix: Add Forwarded: not-needed (or an upstream issue URL) and extend the Description to mention that go.mod/go.sum are updated to the chroma version Debian ships.

Verified ◂

The prescan's only finding is that every copyright holder it found is named in debian/copyright; that matches the tree: the single LICENSE file names Charmbracelet, Inc and searches for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/GNU/Apache/Mozilla/BSD/CC/GPL/LGPL/AGPL/public domain/All rights reserved/non-commercial/field-of-use wording found no other holder or licence text anywhere (including .github/, examples/, styles/, testdata/).
debian/copyright read in full: DEP-5, Files: * (2019-2023 Charmbracelet, Inc, Expat) and a later Files: debian/* stanza (2026 Maytham Alsudany, Expat), with the complete Expat text as a stand-alone License paragraph; DEP-5 patterns anchor at the top of the tree, so * covers everything and debian/* covers all packaging files (copyright-format 6.9).
No repack: the orig tarball's top directory lists exactly the same top-level entries as the unpacked tree (plus the patch's changes to go.mod/go.sum and testdata/*.golden), so no Files-Excluded is needed.
The images in the tree are styles/examples/.png (rendered examples), styles/gallery/.png (gallery screenshots) and examples/helloworld/helloworld.png; they sit inside the MIT-licensed upstream project and were not opened (binary).
Generated files have their generators in the package: styles/.json are written from the Go style structs by internal/generate-style-json/main.go (invoked by //go:generate in styles/styles.go), which is present, and the .golden files are test expectations produced by go test -update from the committed test inputs (testdata/issues/.md, testdata/.in). No built programs, libraries, bytecode, minified code, archives or PDFs; the rest is .go, .md, .json, .style, .yml and shell scripts.
Packaging files read in full: control, rules, changelog, source/format (3.0 (quilt)), patches/series, the patch, gbp.conf, upstream/metadata, salsa-ci.yml; no install/links/docs/dirs files, maintainer scripts, *.maintscript or debian/tests, and none are needed (Testsuite: autopkgtest-pkg-go generates the test; dh_installdocs installs README.md).
Dependency existence checked with apt-cache: golang-charm-lipgloss-v2-dev 2.0.3-1, golang-github-alecthomas-chroma-v2-dev 2.27.0-3 (matches the version the patch pins), golang-github-yuin-goldmark-emoji-dev 1.0.3-1, golang-github-charmbracelet-x-dev 0.0~git20260429.b16bcd1+ds-1 (which Depends on go-udiff, needed by x/exp/golden), golang-github-microcosm-cc-bluemonday-dev 1.0.27-1, golang-golang-x-text-dev 0.43.0-1, golang-github-charmbracelet-colorprofile-dev 0.4.3-1.
go.mod requires lipgloss 2.0.4 and goldmark-emoji 1.0.5 while Debian has 2.0.3 and 1.0.3; dh-golang's build system (buildsystem/golang.pm read) sets GO111MODULE=off and GOTOOLCHAIN=local, so go.mod version requirements and the go 1.25.8 directive are not enforced at build time - this is not the build failure it looks like.
Build-Depends need no versioned constraints that Debian cannot satisfy, and no ${misc:Depends} is missing at compat 13; patches/series lists the single patch, which applies to the tree as unpacked.
Standards-Version 4.7.4 has the same first two components as the reviewing system's Policy 4.7.4.1, so it is current (policy tool table of contents).
uscan found the packaged version as the newest upstream release (upstream 2.0.1, packaged 2.0.1).

Not confirmed ◂

I could not check the contents of golang-github-charmbracelet-x-dev (not installed on the reviewing system) to confirm it ships github.com/charmbracelet/x/exp/golden and x/exp/slice, which the tests and ansi/table_links.go import; if it did not, dh_auto_test would fail to compile the tests, which a build would show.
I could not check that golang-charm-lipgloss-v2-dev 2.0.3-1 ships charm.land/lipgloss/v2/table, imported by ansi/table.go; go.mod asks for 2.0.4. A build would show it.
The changelog targets experimental while debian/gbp.conf names debian-branch = debian/unstable; whether the git branch is debian/experimental cannot be seen from the source package, and with dist = DEP14 and ignore-branch = True this only affects git-buildpackage's defaults, not the uploaded package.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Back to Dashboard | View all reviews for this package