golang-github-anchore-stereoscope 0.3.2-1

Package Information

Description	read container images and their file trees (library) This library loads a container image from a registry, a Docker or Podman daemon, an OCI layout, a tarball or a Singularity SIF file, and presents its layers as file trees that can be searched by path, glob or MIME type. The squashed view of an image is simulated in Go, so no container runtime is needed to read the contents of a layer. It is the image reading layer of syft, which builds software bills of materials, and of grype.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-anchore-stereoscope.git (browse)
Closes	#1135909
Tracker	https://tracker.debian.org/pkg/golang-github-anchore-stereoscope
Uploaded	2 hours ago

New Package Report

.changes◂

Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Sat, 26 Sep 2026 02:45:00 +0200
Source	golang-github-anchore-stereoscope
Version	0.3.2-1

Changelog◂

golang-github-anchore-stereoscope (0.3.2-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1135909)
   * Do not ship upstream's .make build-tooling module.

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-anchore-stereoscope-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: stereoscope
Upstream-Contact: https://github.com/anchore/stereoscope/issues
Source: https://github.com/anchore/stereoscope

Files: *
Copyright: 2020-2026 Anchore, Inc.
License: Apache-2.0
Comment:
 Upstream names the holder itself, in a COPYRIGHT file that says
 "Copyright (c) Anchore, Inc.". It was added on 2026-10-12 in
 https://github.com/anchore/stereoscope/commit/d05cd7aa9ccd19bec48099ada95695e32c8b092e,
 part of the same change across the Anchore repositories that
 https://github.com/anchore/syft/issues/5394 asked for, and the LICENSE
 appendix was left as the Apache-2.0 boilerplate,
 "Copyright [yyyy] [name of copyright owner]".
 .
 That file is not in this release: it landed after 0.3.2 was tagged, so the
 tarball here does not contain it and this comment stands in for it. The first
 upstream release after 2026-10-12 ships the file and this comment can go.
 Upstream states no year, so the range above is this repository's history,
 from its first commit in 2020 to the current release.

Files: pkg/image/sif/testdata/empty.sif
       pkg/image/sif/testdata/one-group.sif
Copyright: 2018-2025 Sylabs Inc.
 2018 Divya Cote <divya.cote@gmail.com>
 2017 SingularityWare, LLC
 2017 Yannick Cote <yhcote@gmail.com>
License: BSD-3-clause
Comment:
 These two are byte-identical to test/images/empty.sif and
 test/images/one-group.sif in github.com/sylabs/sif (sha256 1987d604... and
 92d82d3d...), so they carry that project's copyright rather than anchore's.
 The holders are the ones golang-github-sylabs-sif declares. The third fixture
 in that directory, fifo.sif, does not exist in sylabs/sif and is anchore's.

Files: debian/*
Copyright: 2026 Juan Manuel Mendez Rey <juan.mendezr@proton.me>
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0 can
 be found in /usr/share/common-licenses/Apache-2.0.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
  1. Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright notice,
     this list of conditions and the following disclaimer in the documentation
     and/or other materials provided with the distribution.
  3. Neither the name of the copyright holder nor the names of its
     contributors may be used to endorse or promote products derived from this
     software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for golang-github-anchore-stereoscope version 0.3.2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 12 found

Licensing

The tree is Apache-2.0 (LICENSE, confirmed by CONTRIBUTING.md and README.md), with two binary test fixtures under BSD-3-Clause; both licences are DFSG-free and compatible. debian/copyright is DEP-5 with the canonical Format line, a Files: * catch-all (Apache-2.0, pointing at /usr/share/common-licenses/Apache-2.0), a stanza for pkg/image/sif/testdata/{empty,one-group}.sif naming Sylabs Inc., Divya Cote, SingularityWare LLC and Yannick Cote under BSD-3-Clause with the full text, and a debian/* stanza. No per-file licence headers exist anywhere (grep over copyright/C)©/SPDX/Licensed under/GNU/LGPL/MPL/public domain found nothing outside LICENSE, CONTRIBUTING.md and debian/), no non-free wording, no vendor/ directory and no embedded library copy; the prescan's author check agrees every holder found is named.

Packaging

Well-built first upload: single Architecture: all -dev package, Multi-Arch: foreign, debhelper-compat 14 with dpkg-build-api (= 1), dh-go as the golang addon/buildsystem, complete Build-Depends and Depends (checked against apt-cache), autopkgtest-pkg-go, salsa CI, upstream/metadata, gbp.conf and a README.source that explains the alternatives situation. The unusual parts of debian/rules (nested .make module removal, go.work stubbing, test skips) are documented and reasoned; the only real defect is patch organisation, where the docker-credential-gcr /v2 hunk for the test file sits in the wildmatch patch.

Issues

1. [minor] [packaging] 0001-docker-credential-gcr-v2.patch leaves the /v2 change of gcr_helper_test.go to 0002-wildmatch-matches.patch

Files: debian/patches/0001-docker-credential-gcr-v2.patch, debian/patches/0002-wildmatch-matches.patch:36-44
Basis: checked, in the package or with a reference tool
Evidence: 0002 ends with --- a/pkg/image/oci/credhelpers/gcr_helper_test.go / -\t"github.com/GoogleCloudPlatform/docker-credential-gcr/config" / +\t"github.com/GoogleCloudPlatform/docker-credential-gcr/v2/config", while 0001's Description says it makes the sources use the /v2 module path but patches only go.mod and gcr_helper.go.
Problem: The hunk belongs to the docker-credential-gcr patch, not the wildmatch one. With only 0001 applied (a rebase that drops or reorders 0002, or quilt pop 0002), gcr_helper_test.go still imports the old module path and the package's tests do not compile; 0002's DEP-3 Description also does not describe this change, so the patch headers misdescribe their content.
Fix: Move the gcr_helper_test.go hunk into 0001-docker-credential-gcr-v2.patch and remove it from 0002, so each patch is self-contained and its Description matches.

Verified

Prescan built file: pkg/file/testdata/mime/mach-binary is a 512-byte capture (head -c 512 in the neighbouring capture.sh) used only by Test_MIMEType in pkg/file/mime_type_test.go to detect application/x-mach-binary; test data, not a program that needs source.
Prescan archives: pkg/image/oci/testdata/valid-oci.tar and the gzip layer blobs pkg/image/oci/testdata/attestation_oci_dir/blobs/sha256/00ffd085e9e7c06d20fdc61119a8d08e5c8bd3c1c320d10494ce6ed86691c06c, pkg/image/oci/testdata/duplicate_platform_oci_dir/blobs/sha256/00ffd085e9e7c06d20fdc61119a8d08e5c8bd3c1c320d10494ce6ed86691c06c, pkg/image/oci/testdata/mismatched_descriptor_oci_dir/blobs/sha256/00ffd085e9e7c06d20fdc61119a8d08e5c8bd3c1c320d10494ce6ed86691c06c, pkg/image/oci/testdata/multiplatform_oci_dir/blobs/sha256/1803d4b442b422fa8380e13687da6cc408e6db8f173baa89c95d08539083e8dd, pkg/image/oci/testdata/multiplatform_oci_dir/blobs/sha256/9795e995b4d86eb9409970bc5bff940f0d67a54e8f52dd39abb8c6504187af89, pkg/image/oci/testdata/single_image_no_platform_oci_dir/blobs/sha256/00ffd085e9e7c06d20fdc61119a8d08e5c8bd3c1c320d10494ce6ed86691c06c and pkg/image/oci/testdata/valid_oci_dir/blobs/sha256/00ffd085e9e7c06d20fdc61119a8d08e5c8bd3c1c320d10494ce6ed86691c06c are the OCI-image fixtures read by pkg/image/oci/*_test.go; file name equals content digest, which is why debian/golang-github-anchore-stereoscope-dev.lintian-overrides overrides package-contains-timestamped-gzip. Committed test data, no source needed.
Prescan binary data: pkg/image/sif/testdata/empty.sif, pkg/image/sif/testdata/one-group.sif and pkg/image/sif/testdata/fifo.sif are SIF container images used by pkg/image/sif/{archive_provider,image}_test.go; the first two are the BSD-3-Clause stanzas of debian/copyright, fifo.sif is covered by Files: *. Binary test data, no generated source missing.
Licence inventory: every file outside debian/ and .pc/ is covered by Files: * (DEP-5 patterns match across directories and dotfiles), the only textual licence evidence being LICENSE (Apache-2.0, with the unmodified Copyright [yyyy] [name of copyright owner] appendix), CONTRIBUTING.md (Apache License Version 2.0) and README.md's Apache-2.0 badge; LICENSE is not duplicated in any subdirectory.
Provenance comments were checked: pkg/image/containerd/jobs.go (copied from .../containerd/.../content.go), pkg/image/containerd/api_state.go (HEAVILY derived from the same file) and pkg/image/oci/platform_helpers.go (two functions copied from the GGCR repo) are stated in the files to be Apache-2.0, i.e. the same licence as the Files: * stanza, so no conflicting or restricted term enters the binary; CODE_OF_CONDUCT.md carries its own attribution section (adapted from Contributor Covenant 2.0).
debian/control: Build-Depends and Depends package names were checked with apt-cache. All exist except golang-github-moby-moby-client-dev, which is built by golang-github-moby-moby-client 0.6.0-1 waiting in NEW, and golang-github-docker-cli-dev, which does not exist yet but whose Depends alternative is satisfied by golang-github-docker-docker-dev (28.5.2). Nothing imported by non-test code is missing from Depends; testify is listed as well, while the test-only go-snaps/go-cmp/go-test-deep are in Build-Depends, which is what the autopkgtest needs (autodep8's /usr/share/autodep8/support/go/generate depends on @builddeps@).
Standards-Version 4.7.4 versus the reviewing system's Policy 4.7.4.1: same first two components, no issue. dpkg-build-api (= 1) is the documented declaration (dpkg-build-api(7)) and is provided by dpkg-dev 1.23.11. dh-go 1.69 in the archive provides the golang addon/buildsystem but no dh-sequence-golang (it Conflicts with dh-golang), so debian/source/lintian-overrides' explanation is accurate.
debian/rules: the exclusions (test/integration, examples, test/linter) keep the docker/podman/singularity integration tests and the two main programs out of build and install; the 14 names passed to go test -skip cover the tests that need docker-generated tarballs, a registry, or the /dev/fd count that the comment describes; dh_auto_install -- --no-binaries and DH_GOLANG_INSTALL_EXTRA are options the golang buildsystem supports, and --builddirectory=debian/_build is consistent with the paths used by the execute_after hooks. dh_install falls back to debian/tmp (debhelper >= 7), so the .install line for the gocode directory matches what dh_auto_install stages.
Changelog: one 0.3.2-1 entry targeting unstable, initial release closing the ITP #1135909, date and timestamp consistent; source format 3.0 (quilt), no Files-Excluded needed and none present.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.3.4, packaged 0.3.2), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

That pkg/image/sif/testdata/empty.sif and one-group.sif really are byte-identical to the sylabs/sif fixtures named in debian/copyright, and that the four holders in that stanza are the right ones: no network and no sylabs/sif package installed, so only the comment could be read.
That golang-github-docker-docker-dev 28.5.2 ships github.com/docker/cli (the reason Build-Depends names only it, per README.source): the package is not installed and no file lists are available to check it.
dh-go 1.69 is not installed here (dh-golang is), so the go.work generation that the sed/stub workarounds in execute_after_dh_auto_configure and the .make removal target could not be read or exercised; the code is conditional and the build is assumed to work.
Whether CODE_OF_CONDUCT.md's adaptation of the Contributor Covenant 2.0 needs its own copyright stanza: the file states the adaptation and attribution but not a licence (the Covenant is CC BY 4.0, which is DFSG-free, so this cannot change DFSG compliance).

Proposed changes

None.

Back to Dashboard | View all reviews for this package