DFSG NEW review for golang-github-anchore-fangs version 0.1.1+git20261012.bfda1e6-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5, and its three stanzas match the tree: Files: * (Anchore, Inc., Apache-2.0) for all 55 upstream files, overridden by Files: debian/* (2026 Rafael Passos, Apache-2.0) for the packaging. Upstream's LICENSE is the Apache-2.0 text and COPYRIGHT reads Copyright (c) Anchore, Inc.; no other file carries a copyright or licence notice, and nothing in the tree is non-free, built, minified or vendored. The Apache-2.0 short name is used correctly, the full text is pointed at /usr/share/common-licenses/Apache-2.0, which exists, and the packaging's licence is compatible with upstream's.

Packaging

Standard Debian Go Team packaging: debhelper compat 14 with dh-sequence-golang, dpkg-build-api (= 1), golang-any, an arch:all Multi-Arch: foreign -dev package, Testsuite: autopkgtest-pkg-go, Vcs-* and upstream/metadata present, one well-formed changelog entry for a new package, and no patches or maintainer scripts to get wrong. All eleven direct requires of go.mod are covered by Build-Depends and Depends, and DH_GOLANG_INSTALL_EXTRA := test-fixtures/ is the right way to ship the fixtures the tests read (they are not under a testdata/ directory, so dh-golang would otherwise drop them). The only fault is a typo in the long description.

Issues

1. [minor] [packaging] Typo nd for and in the long description of golang-github-anchore-fangs-dev

• Files: debian/control:47-49
• Basis: checked, in the package or with a reference tool
• Evidence: debian/control: The use of these tools has\n evolved over the years nd some patterns have emerged that seem to work
• Problem: The long description shipped in the -dev package contains a typographical error (nd where upstream's README, from which this text derives, reads and), so the text is shown to users as written wrong.
• Fix: Replace nd some patterns with and some patterns in the Description of golang-github-anchore-fangs-dev.

2. [minor] [packaging] uscan finds only upstream versions older than the packaged one

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: upstream 0.1.1, packaged 0.1.1+git20261012.bfda1e6
• Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
• Fix: Check where debian/watch looks and how it mangles versions.

Verified

• The scan before the review listed no files: its only output is the dfsg-author-check result (Scanned 55 files. Authors declared in debian/copyright: 2 / every holder found is named in debian/copyright), so there is no listed file to account for.
• Read debian/copyright in full: it is DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/), with Files: * -> Copyright: Anchore, Inc. / License: Apache-2.0, then Files: debian/* -> 2026 Rafael Passos <rafael@rcpassos.me> / Apache-2.0 (correct order: the later stanza overrides for debian/), and one stand-alone License: Apache-2.0 paragraph quoting the Apache boilerplate notice and pointing at /usr/share/common-licenses/Apache-2.0 (present on the reviewing system, 202 lines).
• Upstream COPYRIGHT reads Copyright (c) Anchore, Inc. and LICENSE is the unmodified Apache-2.0 text; a case-insensitive grep of the whole tree for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved, copied from, adapted from, derived from, vendor matched only LICENSE, COPYRIGHT and debian/copyright (plus a CODE comment about mapstructure behaviour in load_test.go and the word third_party in .golangci.yaml's exclude list) - no second holder and no second licence anywhere.
• No built or non-preferred-form files in the tree: no .jar/.class/.so/.dll/.exe/.pyc/firmware/PDF, no minified JS/CSS, no generated .go (DO NOT EDIT markers: none; the only hit for autogenerated is a string literal in utils.go). .make/main.go, .make/go.mod and .make/go.sum are upstream source for the Makefile wrapper (Makefile does go run -C .make . $@) and the go-make dependency is a build-time tool, not shipped code.
• The 28 upstream YAML files (.binny.yaml, .bouncer.yaml, .chronicle.yaml, .golangci.yaml, .github//*.yaml, test-fixtures//*.yaml) are project configuration and test data of upstream's own authorship, containing no third-party content; .bouncer.yaml merely lists permissive SPDX licence patterns to permit.
• All eleven direct requires of go.mod are named in Build-Depends and in the -dev package's Depends (mergo, adrg/xdg, anchore/go-homedir, anchore/go-logger, go-viper/mapstructure, go-cmp, cobra, pflag, viper, testify, go.yaml.in/yaml/v3). apt-cache confirms each binary package exists. Checked on the reviewing system that the archive's packages provide the two renamed module paths: /usr/share/gocode/src/dario.cat/mergo/ (golang-github-imdario-mergo-dev 1.0.2-1, Provides: golang-dario-mergo-dev) and /usr/share/gocode/src/go.yaml.in/yaml/v3/ (golang-gopkg-yaml.v3-dev 3.0.5-1).
• dpkg-build-api (= 1) is satisfiable: apt-cache reports it as a virtual package provided by dpkg-dev 1.23.11 with (= 1).
• Standards-Version 4.7.4 against Policy 4.7.4.1 from the policy tool: first two components match, so no issue.
• The tests read only paths under test-fixtures/ (config.yaml, all-values/, basic-profiles/, multilevel/, wd-config/, wd-subdir/, home-dir/ and the XDG fixtures; some tests set HOME to test-fixtures/fake-home-dir, which need not exist). Since none is inside a testdata/ directory, I read dh-golang's own code (/usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm, configure and install) and confirmed that DH_GOLANG_INSTALL_EXTRA := test-fixtures/ copies every regular file found below it, dot-files included, into the build workspace and hence into the -dev package - do not report it as coupling or redundancy. The same code copies .go/go.mod/go.sum files from anywhere in the tree, so upstream's dev-only nested module under .make/ (main.go, go.mod, go.sum, go 1.26.0) also lands in the -dev package; the go tool ignores dot-directories, so this is harmless.
• debian/: read control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format (3.0 (quilt)), upstream/metadata in full. No debian/patches and no debian/tests exist, so there are no patches to judge and nothing to check for DEP-3 headers or idempotence; Testsuite: autopkgtest-pkg-go provides the tests. No maintainer scripts, no debian/compat, no dirs/links/install/docs files to review.
• changelog sanity: single entry 0.1.1+git20261012.bfda1e6-1, distribution unstable, urgency medium, Closes: #1135977, matching the version in the .dsc; apt-cache confirms golang-github-anchore-fangs-dev is not in the archive, so Initial release is right. .dsc also carries Go-Import-Path and Package-List consistent with debian/control; no Files-Excluded in debian/copyright and no dfsg suffix, so no repacking is claimed.
• .pc/ and debian/cargo-checksum.json were ignored throughout (no cargo-checksum.json exists); nothing under .pc/ was read.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• fangs's go.mod requires github.com/anchore/go-logger v0.2.0 and github.com/anchore/go-homedir v0.1.1, while the archive has golang-github-anchore-go-logger-dev 0.1.0-2 and golang-github-anchore-go-homedir-dev 0.1.0-1. dh-golang builds in GOPATH mode with GO111MODULE=off (Buildsystem/golang.pm, _set_go111module), so the versions in go.mod are not enforced and the code is compiled against what /usr/share/gocode has; fangs only uses logger.Debug/Debugf/Tracef/Warnf, discard.New and homedir.Dir/Expand/SetCacheEnable/CacheEnabled/Reset. If any of those is not in the archive's 0.1.0 releases the build (or the autopkgtest of the tests, which call homedir.SetCacheEnable/Reset) fails; I could not read those packages' sources to check, since neither is installed on the reviewing system.
• Whether the tests pass: I cannot build or run anything in the package. The fixtures the tests read are all shipped by DH_GOLANG_INSTALL_EXTRA, so no missing-file failure is apparent from the package itself.

Proposed changes

None.