golang-github-aio-arch-graphlib 1.0.2-1

Package Information

Description	topological sorting and pruning of DAG graphs (library) graphlib is a topological sorting library for sorting and pruning DAG graphs.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Maytham Alsudany <maytham@debian.org>
Sponsor	maytham@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-aio-arch-graphlib.git (browse)
Closes	#1153140
Tracker	https://tracker.debian.org/pkg/golang-github-aio-arch-graphlib
Uploaded	3 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Fri, 06 Nov 2026 12:33:32 +0800
Source	golang-github-aio-arch-graphlib
Version	1.0.2-1
Changed-By	Maytham Alsudany <maytham@debian.org>
Architecture	source all

Changelog◂

golang-github-aio-arch-graphlib (1.0.2-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1153140)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-aio-arch-graphlib-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/aio-arch/graphlib
Upstream-Name: graphlib
Upstream-Contact: https://github.com/aio-arch/graphlib/issues

Files: *
Copyright: 2025 AIO-Arch
License: Expat

Files: debian/*
Copyright: 2026 Maytham Alsudany <maytham@debian.org>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for golang-github-aio-arch-graphlib version 1.0.2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree itself is free: LICENSE is Expat/MIT and covers the files, there is no non-free wording, no vendored third-party code and no built files. But debian/copyright attributes the whole tree to AIO-Arch alone, while graph.go's IsAcyclic is a near line-by-line Go translation of CPython's Lib/graphlib.py _find_cycle (PSF-2.0), which upstream itself cites, and order.go follows CPython's TopologicalSorter. PSF-2.0 is DFSG-free and compatible with Expat, but it requires the PSF copyright notice and licence text to be retained, so debian/copyright is inaccurate and incomplete as written.

Packaging

Textbook Debian Go packaging: debhelper compat 13 with dh-sequence-golang, golang-any, autopkgtest-pkg-go, Vcs-* and Homepage correct, Standards-Version 4.7.4 current, Architecture all with Multi-Arch foreign, the example/ main package correctly kept out of the installed source with DH_GOLANG_EXCLUDES, and DEP-14/gbp configuration. No patches, maintainer scripts or install files are needed and none are missing; the changelog is well formed and closes its ITP bug.

Issues

blocker licensing 1. debian/copyright omits that graph.go and order.go are translations of CPython's PSF-licensed Lib/graphlib.py ◂

Files: debian/copyright:6-9, graph.go:90-92, graph.go:92-139, order.go:16-45, README.md:9
Basis: checked, in the package or with a reference tool
Evidence: graph.go:90-91: // it using https://github.com/python/cpython/blob/3.14/Lib/graphlib.py#L202 _find_cycle method; the Go function repeats CPython's stack/itstack/seen/node2stacki structure verbatim (if _, has := node2stacki[node]; has { return append(stack[node2stacki[node]:], node), false } against Python's if node in node2stacki: return stack[node2stacki[node]:] + [node]). debian/copyright names only Copyright: 2025 AIO-Arch under License: Expat for Files: *. PSF-2.0 clause 2 requires that "PSF's License Agreement and PSF's notice of copyright ... are retained in Python alone or in any derivative version" (/usr/share/doc/python3.14/copyright:99-103).
Problem: graph.go's IsAcyclic (and order.go's topologicalOrder, which mirrors CPython's TopologicalSorter prepare/get_ready/done and its error type) is a translation of code from CPython, whose Lib/ is under the PSF License Agreement, not the Expat licence upstream declares. MIT-licensing a derivative of PSF code is not something AIO-Arch can do, and distributing it without the PSF notice and licence text does not meet PSF-2.0. PSF-2.0 is DFSG-free and compatible with Expat, so this is not a DFSG violation, but debian/copyright does not describe the actual copyright and licensing of these files, which is a blocker.
Fix: Add a Files: graph.go order.go stanza (or split it) with Copyright: 2020-2024 Python Software Foundation alongside AIO-Arch, License: Expat and PSF-2.0, and a stand-alone License: PSF-2.0 paragraph carrying the full PSF License Agreement text (it is not in /usr/share/common-licenses; copy it from CPython's LICENSE, e.g. /usr/share/doc/python3.14/copyright). Alternatively, ask upstream to replace the port with an independent implementation and ship that.

Verified ◂

Read all 13 upstream files in full (LICENSE, README.md, .gitignore, go.mod, go.sum, errors.go, graph.go, order.go, prune.go, topological.go, graph_test.go, topological_test.go, example/main.go, .github/workflows/go.yml).
The scan's only finding is that every holder found is already named: the sole copyright notice in the tree is LICENSE:3 Copyright (c) 2025 AIO-Arch, which the Files: * stanza covers; no .go file, README, go.mod or workflow carries a copyright line or SPDX identifier.
LICENSE is the Expat text and matches the Files: * License: Expat stanza and the stand-alone License paragraph in debian/copyright word for word; no other licence wording (non-commercial, no-modification, field-of-use) appears anywhere in the tree.
go.sum is empty and go.mod declares no requirements, so the package vendors no third-party code and embeds no Debian-shipped library.
No built artifacts, minified code, PDFs, images or fonts in the tree; the only non-source files are the Expat LICENSE, README.md, a toptal-generated .gitignore and a GitHub starter-workflow file, none of which is generated from a missing source.
example/main.go is a hand-written package main demonstration; DH_GOLANG_EXCLUDES := example in debian/rules keeps it out of the installed Go source, and it carries no separate copyright or licence.
Orig tarball contents are exactly the unpacked tree, so nothing was repacked and no Files-Excluded is needed.
Read every file of debian/: control, rules, changelog (1.0.2-1, unstable, Closes: #1153140, date consistent), copyright, gbp.conf, salsa-ci.yml, source/format (3.0 (quilt)), upstream/metadata, watch (not reviewed).
Packaging: debhelper compat 13 with dh-sequence-golang and --buildsystem=golang, golang-any in Build-Depends, Testsuite: autopkgtest-pkg-go (needs no debian/tests), Architecture all with Multi-Arch foreign, correct XS-Go-Import-Path, Vcs-* and Homepage; ${misc:Depends} present; no patches, maintainer scripts, install/links/docs files or .maintscript are needed and none are missing.
Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 to two components, so it is not an issue.
uscan found the packaged version as the newest upstream release (upstream 1.0.2, packaged 1.0.2).

Not confirmed ◂

The .gitignore (header: "Created by https://www.toptal.com/developers/gitignore/api/go") and .github/workflows/go.yml (GitHub starter-workflow boilerplate plus a codecov step) may derive from third-party templates, but they hold no copyright notice, are trivially unoriginal configuration and I could not verify any particular template licence offline; I do not treat them as needing a separate stanza.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-07 06:09 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package