DFSG NEW review for golang-github-anchore-clio version 0.1.0+git20261016.46604ad-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the correct 1.0 Format URL, a Files: * stanza (Anchore, Inc., Apache-2.0) and a later debian/* stanza for the packager, and the full Apache-2.0 text is pointed at in /usr/share/common-licenses/Apache-2.0 with the short header quoted. The tree is 46 text files (Go sources, YAML/CI configs, Markdown, testdata); there is no vendored or bundled third-party code, no binaries, archives, minified or generated files, and no vendor/ directory. Grepping the whole tree for copyright and licence wording found notices only in COPYRIGHT (Copyright (c) Anchore, Inc.), the verbatim Apache-2.0 LICENSE, and debian/copyright; the pre-review scan likewise found every copyright holder already named. Apache-2.0 is DFSG-free and is compatible with everything the library links against, so the licensing is compliant and debian/copyright is accurate as far as the evidence in the tree goes.

Packaging

The packaging follows current Debian Go team practice: debhelper-compat 14 with dh-sequence-golang and dpkg-build-api (= 1), a single Architecture: all / Multi-Arch: foreign -dev package, Build-Depends and Depends both carrying every direct module requirement (test-only ones included, which is required here because the shipped cliotestutils/application.go imports testify and go-cmp at runtime), autopkgtest-pkg-go, Vcs-*, Homepage and XS-Go-Import-Path, and Standards-Version: 4.7.4 against Policy 4.7.4.1. debian/rules builds only via the Go build system (so the upstream Makefile/.make helper that needs github.com/anchore/go-make is not used), and its overide_dh_auto_test skips two tests that do exist in the tree, so the -skip regex is not dead. The only thing I would raise is the age of the changelog date; nothing in the packaging would block a sponsor.

Issues

1. [minor] [packaging] Changelog entry dated 2026-05-07 for the 0.1.0+git20261016.46604ad snapshot

• Files: debian/changelog:1-5
• Basis: checked, in the package or with a reference tool
• Evidence: golang-github-anchore-clio (0.1.0+git20261016.46604ad-1) unstable; urgency=medium ... -- Rafael Passos <rafael@rcpassos.me> Thu, 07 May 2026 23:51:48 -0300
• Problem: The entry is dated about five months before the upstream commit (46604ad, 2026-10-16) whose version it carries, so the date was not refreshed when the snapshot version was written into the changelog. dpkg-genchanges keeps that date in the .changes and .dsc, so the uploaded revision is recorded as prepared long before the code it packages.
• Fix: Refresh the entry date (dch -r or edit the trailer) so it is not earlier than the upstream snapshot it packages.

Verified

• debian/copyright read in full; it is DEP-5 with the exact 1.0 Format URL, Files: * (Anchore, Inc., Apache-2.0), Files: debian/* (2026 Rafael Passos) and one stand-alone Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0; no Files-Excluded, and no field a draft format would have.
• The pre-review scan's author check reports every copyright holder in the tree named in debian/copyright; my own grep of the whole tree (case-insensitive: copyright, (c), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, Apache License, public domain, All rights reserved, licence/license) matched only COPYRIGHT, LICENSE and debian/copyright, and an explicit grep of .github/, .make/, cliotestutils/ and testdata/ matched nothing.
• LICENSE is the verbatim Apache-2.0 text including the APPENDIX boilerplate; COPYRIGHT names Anchore, Inc.; CONTRIBUTORS.md names no further holder (it refers to git log), so Files: * needs no extra holder.
• No vendored, bundled or prebuilt third-party material anywhere: no vendor/ directory, no .jar/.class/.so/.dll/.exe/.pyc, no minified JS/CSS, no fonts, images, PDFs or firmware; the only non-Go files are YAML/Markdown/CI configs, .gitignore, go.mod/go.sum, llms.txt and two testdata YAML files.
• The unpacked tree matches the shipped orig tarball file for file (36 entries at the top level plus .github/, .make/, cliotestutils/, testdata/); nothing was added or dropped, and debian/ comes from the debian tarball (no debian/patches, no debian/compat, no maintainer scripts, no debian/tests).
• All .go imports have a corresponding Build-Depends entry; github.com/anchore/clio/cliotestutils/application.go imports testify and go-cmp, so their presence in Depends (not only Build-Depends) is correct, not gratuitous.
• golang-github-felixge-fgprof-dev in Depends/Build-Depends is redundant with golang-github-pkg-profile-dev's own Depends (checked with apt-cache) and is not imported by clio's own code; harmless Go-team tooling output, not reported.
• dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11 (apt-cache); Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1 (policy tool).
• golang-github-anchore-fangs-dev is not yet in the archive but is built by golang-github-anchore-fangs 0.1.1+git20261012.bfda1e6-1 waiting in NEW (apt-cache), so its absence is not a fault.
• The import path go.yaml.in/yaml/v3 used by application.go resolves in a GOPATH build: /usr/share/gocode/src/go.yaml.in/yaml/v3 exists (golang-gopkg-yaml.v3-dev 3.0.5-1, apt-cache).
• -skip='Test_ConfigCommandDefaults|Test_ConfigCommandLoad' in debian/rules matches real tests (config_command_test.go:15,74), and dh-golang's build system passes arguments after -- through to go test (golang.pm sub test); the two tests use os.UserHomeDir(), which explains why they are skipped in a build environment, and at compat 14 dh skips this override itself under DEB_BUILD_OPTIONS=nocheck.
• dh-golang builds in GOPATH mode by default (GO111MODULE=off, golang.pm:412) and excludes ./debian and ./.pc from the build copy (preprocess in golang.pm), so go.mod version requirements are not enforced and the quilt record does not reach the binary package.
• %: dh $@ --builddirectory=debian/_build --buildsystem=golang is valid at compat 14 (the default build directory is _build anyway), and the upstream Makefile/.make module (a separate module needing github.com/anchore/go-make) is not used by the Debian build.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.1.1, packaged 0.1.0+git20261016.46604ad), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• go.mod requires github.com/anchore/go-logger v0.2.0, github.com/gookit/color v1.6.2 and github.com/anchore/go-homedir v0.1.1, while the archive ships 0.1.0-2, 1.5.4-3 and 0.1.0-1 (apt-cache; a newer upload may be in NEW, which the tool cannot show for a name already in the archive). Because dh-golang builds in GOPATH mode these requirements are not enforced, so the package alone cannot show whether the compiles: clio's color use (color.Magenta.Sprint, color.Red.Render) exists in 1.5.4, but its go-logger use is broad (logger.Controller, LevelFromVerbosity, IsVerbose, Levels, adapter/redact, adapter/discard, adapter/logrus with Config/TextFormatter), and I could not inspect go-logger 0.1.0's contents. A build or autopkgtest would settle it.
• Whether the two tests skipped in the build (Test_ConfigCommandDefaults, Test_ConfigCommandLoad) pass under the autopkgtest-pkg-go run, where the skip does not apply and HOME is set: I cannot run anything, so this is not asserted as a problem.

Proposed changes

None.