golang-github-anchore-go-lzo 0.1.1-1

Package Information

Description	LZO1X decompression library for Go (library) A decompressor for the LZO1X compression format, written in pure Go with no cgo and no binding to the reference liblzo2 implementation. Upstream created it specifically so that LZO1X streams could be read under a permissive licence, the reference implementation being GPL-2.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-anchore-go-lzo.git (browse)
Closes	#1148639
Tracker	https://tracker.debian.org/pkg/golang-github-anchore-go-lzo
Uploaded	5 hours ago

New Package Report

.changes◂

Version	0.1.1-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Tue, 22 Sep 2026 03:47:08 +0200
Source	golang-github-anchore-go-lzo

Changelog◂

golang-github-anchore-go-lzo (0.1.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148639)

.dsc◂

Package-List	golang-github-anchore-go-lzo-dev deb golang optional arch=all
Section	golang
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/anchore/go-lzo
Upstream-Name: go-lzo
Upstream-Contact: https://github.com/anchore/go-lzo/issues

Files: *
Copyright: 2025 Anchore, Inc
License: Expat
Comment: CONTRIBUTING.md states that contributions to the project are made
 under the Apache License 2.0, which is anchore's standard contribution
 boilerplate and differs from the Expat grant in LICENSE that covers the
 distributed work. Only the latter governs what Debian ships. DEVELOPING.md
 separately notes that the original LZO suite is GPL-2+ and that this
 implementation was deliberately derived from the Linux kernel's format
 documentation and the MIT-licensed lzokay instead, precisely to avoid it;
 that is an attribution note, not a grant.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for golang-github-anchore-go-lzo version 0.1.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All 33 upstream files are covered by "Files: " as Expat, matching LICENSE (MIT/Expat text, "Copyright (c) 2025 Anchore, Inc"), and debian/ is a separate Expat stanza for the packager. debian/copyright is DEP-5, uses the current Format URL, reproduces the full Expat text, and its Comments correctly dispose of the two licence-looking passages in CONTRIBUTING.md (Apache-2.0 contribution policy) and DEVELOPING.md/README.md (GPL-2+ attribution note about the original LZO suite). No non-free terms, no unlicensed file, no vendored or binary code. Licensing is DFSG-compliant and accurately described.

Packaging

Clean, conventional Go packaging: debhelper compat 14 with dh-go's golang buildsystem, Standards-Version 4.7.4 (current), a single Architecture: all / Multi-Arch: foreign -dev package, autopkgtest-pkg-go, satisfying dependencies (golang-any -> golang-go 1.27 for go.mod's go 1.24.0; dpkg-build-api (= 1) provided by dpkg-dev), and a debian/rules hook that strips the test-generated artefacts and the .make submodule from the installed source. Only two minor points: liblzo2-dev is a test-only build dependency but is not marked <!nocheck>, and README.source claims g++ is a Build-Depends while debian/control (correctly) omits it.

Issues

1. [minor] [packaging] liblzo2-dev is needed only for the build-time test suite and should be marked <!nocheck>

Files: debian/control (Build-Depends: liblzo2-dev); debian/README.source
Basis: checked, in the package or with a reference tool
Evidence: debian/control: Build-Depends: ..., golang-any, liblzo2-dev with no restriction. debian/README.source: "liblzo2-dev is used only to validate the output at build time; nothing from it is linked into or shipped with this package." Policy 4.9.2 (nocheck profile): "In addition to disabling build-time testing, it allows skipping the installation of dependencies required for those tests during the build."
Problem: liblzo2-dev is used only by the go test suite, and at compat 13+ dh skips dh_auto_test (and its overrides) when DEB_BUILD_OPTIONS lists nocheck, so a nocheck build does not need it. Left unrestricted, nocheck/nocheck-profile builds still install it, which Policy 4.9.2 exists to avoid.
Fix: Declare it as liblzo2-dev <!nocheck>.

2. [minor] [packaging] README.source says g++ is a Build-Depends but debian/control does not list it

Files: debian/README.source:16-18; debian/control
Basis: checked, in the package or with a reference tool
Evidence: debian/README.source: "so g++ and liblzo2-dev are Build-Depends to keep the native path working". debian/control Build-Depends: debhelper-compat (= 14), dh-go, dpkg-build-api (= 1), golang-any, liblzo2-dev — no g++.
Problem: g++ is not listed. That omission is correct: g++ is a build-essential package and Policy 7.7 says build-dependencies on build-essential binary packages can be omitted. But the README states g++ is a Build-Depends, so it misdescribes what debian/control (and the archive's build chroots) actually provide.
Fix: Reword README.source to say the test suite needs a C++ compiler (g++, which build-essential provides) and liblzo2-dev, and that only the latter is declared.

Verified

Inventory: 33 upstream files besides debian/ and .pc/ (root .go/.yaml/.md/Makefile/LICENSE/go.mod/go.sum, .github/, .make/, testdata/); every one is text, none is a built artefact (no .o/.a/.so/.jar/.class/.min.js/.pdf).
LICENSE is the MIT/Expat text, "Copyright (c) 2025 Anchore, Inc"; debian/copyright is DEP-5 with the current Format URL, a Files: * Expat stanza naming that holder, a later Files: debian/* Expat stanza for the packager, and the full Expat text as a stand-alone License paragraph.
CONTRIBUTING.md:58,90 state contributions are made under DCO 1.1 and Apache-2.0 — a contribution policy, not a grant on the distributed work; explained in the Files: * Comment and in debian/lrc.config.
DEVELOPING.md:20, README.md:4 and decompress.go:1-5 are attribution notes naming the GPL-2+ original LZO suite (avoided deliberately) and the MIT-licensed lzokay implementation the code was derived from; they grant nothing and are covered by Files: * Expat.
.bouncer.yaml lists permitted dependency licences (BSD/MIT/Apache/Unlicense) for anchore's scanner; it is configuration, not a licence on the file, and is covered by Files: * Expat. The remaining YAML/MD (.binny.yaml, .chronicle.yaml, .golangci.yaml, .github/*, CHANGELOG.md, CONTRIBUTING.md) carry no separate licence and are likewise covered by Files: *.
testdata/lzo-tool.cpp, lzo-tool.py, Dockerfile and testdata/.gitignore are upstream test fixtures/tooling, covered by Files: * Expat; lzo-tool.py is a data file for the suite, not a program (debian/rules removes its +x bit). No third-party/vendored code anywhere in the tree.
debian/control: Multi-Arch: foreign matches the Go team's convention for -dev packages (e.g. golang-github-spf13-pflag-dev); Standards-Version 4.7.4 has the same first two components as current Policy 4.7.4.1; dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11; golang-any resolves to golang-go 2:1.27~1, satisfying go.mod's go 1.24.0; dh-go 1.69 provides the golang addon and Conflicts dh-golang, so the source lintian-override for missing-build-dependency-for-dh-addon golang is justified.
debian/rules hook execute_after_dh_auto_install removes from the installed source the test-generated cache/, crash/, bin/, cache.fingerprint (upstream's own testdata/.gitignore output), testdata/.gitignore, and the nested .make module (whose anchore/go-make dependency is not in Debian), and removes the +x bit from lzo-tool.py — consistent with what dh-golang installs by default (testdata/ contents plus subdirectory go.mod/go.sum).
No debian/patches (source/format is 3.0 (quilt)); changelog 0.1.1-1 targets unstable, closes #1148639, version/dates consistent; debian/upstream/metadata and debian/gbp.conf are conventional and correct.
debian/copyright already begins with the current 1.0 Format field, so no replacement is proposed; the tool's own checks of the /usr/share/common-licenses pointers do not apply (Expat text is given inline).
uscan found the packaged version as the newest upstream release (upstream 0.1.1, packaged 0.1.1).

Not confirmed

The autopkgtest-pkg-go declared suite relies on an implicit control file supplied by dh-go's dh_golang_autopkgtest, which is not installed on the reviewing system, so I could not confirm that it makes the C++ toolchain and liblzo2 headers available in the testbed; if it does not, the go test run (which compiles testdata/lzo-tool.cpp) would fail there.
I could not run the build or the go test suite; the build-time tests compile testdata/lzo-tool.cpp with g++ and fall back to docker if that fails, and g++ is only guaranteed by build-essential, which I did not see installed on this system (Policy 7.7 says build-essential deps may be omitted from Build-Depends).

Proposed changes

None.

Uploader's response to the LLM review

The uploader was emailed about the review 2 hours ago.

Back to Dashboard | View all reviews for this package