Review: golang-github-aquasecurity-bolt-fixtures 0.0~git20200903.d34e7f9-1

Package Information

Description	Test fixtures for BoltDB (library) Test fixtures for BoltDB. Write tests against a real database.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-aquasecurity-bolt-fixtures.git (browse)
Closes	#1152541
Tracker	https://tracker.debian.org/pkg/golang-github-aquasecurity-bolt-fixtures
Uploaded	2 days ago

New Package Report

.changes◂

Source	golang-github-aquasecurity-bolt-fixtures
Version	0.0~git20200903.d34e7f9-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Fri, 30 Oct 2026 12:02:42 +0100

Changelog◂

golang-github-aquasecurity-bolt-fixtures (0.0~git20200903.d34e7f9-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152541)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-aquasecurity-bolt-fixtures-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/aquasecurity/bolt-fixtures
Upstream-Name: bolt-fixtures
Upstream-Contact: https://github.com/aquasecurity/bolt-fixtures/issues

Files: *
Copyright: 2020 Teppei Fukuda <knqyf263@gmail.com>
License: Apache-2.0
Comment: Upstream has no copyright notice (LICENSE carries the unfilled
 Apache-2.0 appendix and no file has a header). Teppei Fukuda wrote every
 commit in the upstream history.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for golang-github-aquasecurity-bolt-fixtures version 0.0~git20200903.d34e7f9-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole upstream tree is Apache-2.0: LICENSE is the verbatim Apache-2.0 text (appendix unfilled, so no holder is named there) and no other file carries a notice. debian/copyright is DEP-5, covers everything with Files: * (Teppei Fukuda, 2020, Apache-2.0, with a comment explaining why the holder is inferred from the git history) and Files: debian/* (Juan Manuel Méndez Rey, 2026, Apache-2.0), and points to /usr/share/common-licenses/Apache-2.0 for the license text. Test data, .github workflow and go.sum/go.mod fall inside Files: *. There is no vendored third-party code, no built or generated file, no binary, font or image, and no non-free wording anywhere in the tree. The prescan's author check found no holder that the copyright file omits.

Packaging

Textbook Debian Go team packaging: debhelper 14 with dh-go (which provides the golang buildsystem, the golang sequence addon and dh_golang/dh_golang_autopkgtest, and Conflicts with dh-golang), dpkg-build-api (= 1), the golang buildsystem with the Go sources installed under /usr/share/gocode/src via XS-Go-Import-Path, a single arch:all -dev package with Multi-Arch: foreign (the Go team convention, as golang-github-coreos-bbolt-dev shows), complete Depends on both libraries the code imports, testify as <!nocheck> build dependency, Testsuite: autopkgtest-pkg-go and Standards-Version 4.7.4 against Policy 4.7.4.1. All Build-Depends exist in the archive (dh-go 1.69, dpkg-build-api provided by dpkg-dev 1.23.11, golang-any 1:1.27, bbolt-dev 1.4.3-1, go-yaml-dev 1.18.0-2, testify-dev 1.11.1). The only deviation from upstream, the skipped TestLoader_Load/invalid_yaml subtest because Debian's go-yaml words its error differently, is explained in debian/rules and also applies in autopkgtest, since autodep8's go test runs the package's own make -f debian/rules build.

Issues

None.

Verified ◂

Read every file in the tree except .pc/: LICENSE, README.md, fixtures.go, fixtures_test.go, go.mod, go.sum, .gitignore, .github/workflows/test.yml, testdata/test.yaml, testdata/invalid.yaml, and all nine files under debian/ (control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, watch, source/format, upstream/metadata).
Prescan: the 9 scanned files yield only two holders, Teppei Fukuda (Files: , 2020) and Juan Manuel Méndez Rey (debian/, 2026), both named in debian/copyright; grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, All rights reserved, Aqua Security and Fukuda matched only LICENSE and debian/copyright.
testdata/test.yaml (nested bucket fixture) and testdata/invalid.yaml (abcdefg) are plain upstream test fixtures for the loader's success and error paths; they are data, covered by Files: *.
.github/workflows/test.yml is upstream's GitHub CI configuration, Apache-2.0 under Files: *, and is never installed by the -dev package (DH_GOLANG_INSTALL_ALL is not set; only .go/.c/.h/.proto/.s, testdata and go.mod/go.sum are copied).
LICENSE is the Apache-2.0 text with the unfilled appendix; there is no NOTICE file, no vendored or embedded third-party code, no vendor/ directory, no binary, generated, minified or PDF file, and no image or font.
go.mod (module github.com/aquasecurity/bolt-fixtures, go 1.14) and go.sum are consistent with each other; the two real imports (go.etcd.io/bbolt, github.com/goccy/go-yaml) are the two Depends of the -dev package.
apt-cache: dh-go 1.69 (Provides the golang sequence addon, the golang buildsystem and dh_golang/dh_golang_autopkgtest; Conflicts: dh-golang) exists, so --buildsystem=golang --with=golang is served by it; dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11; dpkg-build-api(7) documents exactly this Build-Depends declaration and notes level 1 needs no explicit Rules-Requires-Root.
golang-github-coreos-bbolt-dev 1.4.3-1, golang-github-goccy-go-yaml-dev 1.18.0-2, golang-any 1:1.27 and golang-github-stretchr-testify-dev 1.11.1 all exist; testify is used only by fixtures_test.go, so the <!nocheck> restriction is correct.
debhelper tool at compat 14: dh_gencontrol adds relationship substvars itself and overrides of dh_auto_test do not run when DEB_BUILD_OPTIONS contains nocheck, so the override needs no nocheck test and ${misc:Depends} is optional (it is present anyway).
Read /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm: test forwards the arguments after -- to go test -vet=off -v -p N ... <targets>, so -skip 'TestLoader_Load/invalid_yaml' reaches go test (-skip filters subtest names); testdata is copied into the workspace by default and GO111MODULE defaults to off, so the newer go-yaml in Debian is used without network access.
Read /usr/bin/dh_golang_autopkgtest and /usr/share/autodep8/support/go/{detect,generate}: autodep8 matches the golang-any Build-Depends and its generated test runs make -f debian/rules build, so the invalid_yaml skip applies in autopkgtest as well; the Go source is shipped in /usr/share/gocode/src so the helper's installed-source configure override is triggered.
debian/changelog: initial upload, distribution unstable, version 0.0~git20200903.d34e7f9-1 matching the .dsc, clobber-safe date; debian/source/format is 3.0 (quilt) and the .dsc lists only the one binary the control file declares.
The .dsc and the orig tarball match the reviewed tree (single top-level directory bolt-fixtures/, which dpkg-source's 3.0 (quilt) format accepts, and the debian tarball holds exactly the nine debian/ files reviewed); the tarball has no debian/patches, so no patch needed reviewing.
uscan found the packaged version as the newest upstream release (upstream 0.0~git20200903.d34e7f9, packaged 0.0~git20200903.d34e7f9).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Teppei Fukuda as sole copyright holder for 2020 cannot be verified from the source package (no git history, AUTHORS, NOTICE or per-file headers are shipped); debian/copyright states it in a comment and nothing in the tree contradicts it, and the prescan's author check found no other holder.
That Debian's go-yaml 1.18.0 rejects testdata/invalid.yaml with wording different from "String node doesn't ArrayNode" (the stated reason for skipping that subtest) could not be run here; it is the maintainer's claim in debian/rules and would be visible in the build log.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 day ago.

Review Information

accepted — allocated to awm 1 day ago, started 1 day ago, completed 1 day ago.

Final Comment

Back to Dashboard | View all reviews for this package