DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: golang-github-aquasecurity-go-npm-version 0.0.2+git20261005.1f16ed7-1

Package Information

Descriptionlibrary for parsing npm versions and version constraints

go-npm-version is a library for parsing npm versions and version constraints, and verifying versions against a set of constraints. go-npm-version can sort a collection of versions properly, handles prerelease versions, etc.

Versions used with go-npm-version must follow Semantic Versioning. Constraints used with go-npm-version must follow npm rules.

MaintainerDebian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed ByJuan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsortsimonq2@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/go-team/packages/golang-github-aquasecurity-go-npm-version.git (browse)
Closes#1152493
Trackerhttps://tracker.debian.org/pkg/golang-github-aquasecurity-go-npm-version
Uploaded1 day ago

New Package Report

.changes◂
Architecturesource all
Distributionunstable
DateFri, 30 Oct 2026 03:16:50 +0100
Sourcegolang-github-aquasecurity-go-npm-version
Version0.0.2+git20261005.1f16ed7-1
Changed-ByJuan Manuel Méndez Rey <juan.mendezr@proton.me>
Changelog◂
golang-github-aquasecurity-go-npm-version (0.0.2+git20261005.1f16ed7-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152493)
.dsc◂
Sectiongolang
Priorityoptional
Componentmain
Package-Listgolang-github-aquasecurity-go-npm-version-dev deb golang optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/aquasecurity/go-npm-version
Upstream-Name: go-npm-version
Upstream-Contact: https://github.com/aquasecurity/go-npm-version/issues

Files: *
Copyright: 2020 Teppei Fukuda <knqyf263@gmail.com>
           2025-2026 DmitriyLewen <https://github.com/DmitriyLewen>
License: Apache-2.0
Comment: Upstream has no copyright notice (LICENSE carries the unfilled
 Apache-2.0 appendix and no file has a header). The holders are the authors
 of the commits in the upstream history.

Files: pkg/constraint.go
Copyright: 2014-2019 Matt Butcher and Matt Farina
           2014 HashiCorp, Inc.
           2020 Teppei Fukuda <knqyf263@gmail.com>
License: Apache-2.0 and Expat and MPL-2.0
Comment: The constraint regex, the tilde and caret tables and the error
 strings come from github.com/Masterminds/semver (Expat); doc comments and
 the Constraints methods from github.com/hashicorp/go-version (MPL-2.0).

Files: pkg/version_collection.go
Copyright: 2014 HashiCorp, Inc.
           2020 Teppei Fukuda <knqyf263@gmail.com>
License: Apache-2.0 and MPL-2.0
Comment: The Collection type comes from github.com/hashicorp/go-version.

Files: hack/generator/package.json
Copyright: 2020 Teppei Fukuda <knqyf263@gmail.com>
License: ISC
Comment: The npm metadata of the test-data generator declares ISC. The
 generator is not built or installed.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: MPL-2.0
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at https://mozilla.org/MPL/2.0/.
Comment:
 On Debian systems, the complete text of the Mozilla Public License
 version 2.0 can be found in "/usr/share/common-licenses/MPL-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for golang-github-aquasecurity-go-npm-version version 0.0.2+git20261005.1f16ed7-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 1 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

All upstream code is free: the tree carries a single root LICENSE (Apache-2.0), no file carries a conflicting or restrictive notice, and the two files that carry code taken from Masterminds/semver (Expat) and hashicorp/go-version (MPL-2.0) are carved out into their own stanzas naming both holders. debian/copyright is DEP-5, its catch-all plus the later, narrower stanzas cover every path in the tree, all four short names used (Apache-2.0, ISC, Expat, MPL-2.0) have a stand-alone License paragraph, and the licences combined in pkg/constraint.go are compatible. The only text not present in the tree is the Apache-2.0 and MPL-2.0 body, both of which /usr/share/common-licenses holds and the file points to.

Packaging

Conventional Debian Go packaging: dh compat 14, dpkg-build-api 1, dh-go with the golang buildsystem, XS-Go-Import-Path and Testsuite: autopkgtest-pkg-go, a single arch:all -dev package whose Depends match the imports of the shipped pkg/, cmd/ and examples/ excluded from both build and install, correct <!nocheck> on the test-only dependency, current Standards-Version, sound changelog and Vcs-* fields. One minor defect: debian/rules overrides the golang buildsystem's default build directory with debian/_build, which the generated autopkgtest does not know about, so the autopkgtest-pkg-go run cannot find the sources it copies into _build.

Issues

minor packaging 1. debian/rules' --builddirectory=debian/_build makes the autopkgtest-pkg-go run fail: the generated override populates _build, the build then looks in debian/_build ◂
  • Files: debian/rules:5, debian/control:16
  • Basis: inferred from what was read, not seen directly
  • Evidence: debian/rules: dh $@ --builddirectory=debian/_build --buildsystem=golang --with=golang. /usr/bin/dh_golang_autopkgtest (run as the test because of Testsuite: autopkgtest-pkg-go, per autodep8's support/go/generate: Test-Command: /usr/bin/dh_golang_autopkgtest) appends override_dh_auto_configure containing APT_BDIR := $(shell ... load_buildsystem("golang")->get_builddir()) and cp -a /usr/share/gocode/src "${APT_BDIR}". Buildsystem/golang.pm: sub DEFAULT_BUILD_DIRECTORY { return $this->SUPER::DEFAULT_BUILD_DIRECTORY() if compat(13); return '_build'; }.
  • Problem: The -dev package installs its source under /usr/share/gocode/src/github.com/aquasecurity/go-npm-version, so dh_golang_autopkgtest takes its first branch: it replaces dh_auto_configure with a copy of /usr/share/gocode/src into the golang buildsystem's default build directory. That one-liner runs without the package's --builddirectory option, so get_builddir() yields _build (compat 14 default), while debian/rules build builds in debian/_build, which nothing creates or fills. get_targets() therefore finds no targets in an empty GOPATH and dh_auto_build fails changing into the non-existent debian/_build. The normal build is unaffected, which is why the maintainer's own build passes; only the autopkgtest breaks.
  • Fix: Drop the option — at compat 14 the golang buildsystem's default is already _build — or write --builddirectory=_build, so that the directory dh_golang_autopkgtest populates is the one dh builds in. Verify with autopkgtest . --testname=dh-golang-autopkgtest (or a salsa-ci pipeline run).
Verified ◂
  • debian/copyright is DEP-5 with Files: * (Apache-2.0) as catch-all; later stanzas override it for pkg/constraint.go (Apache-2.0 and Expat and MPL-2.0), pkg/version_collection.go (Apache-2.0 and MPL-2.0), hack/generator/package.json (ISC) and debian/*, so every one of the 21 files in the tree is matched.
  • The only licence text in the tree is the root LICENSE (Apache-2.0, Copyright [yyyy] [name of copyright owner] appendix left unfilled); no .go, .js, .md, .yml, .json or .csv file carries a copyright or licence notice, and a grep for Copyright/(C)/©/SPDX/Licensed under/permission notices/non-free wording found nothing else. The prescan's author check named no holder missing from debian/copyright, and its five declared holders are all in the file.
  • pkg/constraint_testcase.go is marked // Code generated by Node.js. DO NOT EDIT.; hack/generate.sh regenerates it from hack/input.csv with hack/generator/main.js, and input, generator and package-lock.json are all in the tree — no generated file lacks its preferred form for modification. The generator is neither built nor installed.
  • hack/generator/package.json declares "license": "ISC"; the ISC and Expat texts are reproduced in full in debian/copyright, and Apache-2.0 and MPL-2.0 are both present in /usr/share/common-licenses, as the file says.
  • The code the two carve-out stanzas attribute to Masterminds/semver and hashicorp/go-version carries no notice of its own in the tree; the operator/regex/tilde/caret tables and error strings of pkg/constraint.go and the Len/Less/Swap Collection of pkg/version_collection.go match those libraries' code, so the holders named (Matt Butcher and Matt Farina, HashiCorp, Teppei Fukuda) are consistent with what is shipped.
  • pkg/ imports only golang.org/x/xerrors and github.com/aquasecurity/go-version, both in the -dev package's Depends and in Build-Depends. DH_GOLANG_EXCLUDES := cmd examples removes cmd/ and examples/ from both the build targets and the installed source, so the go.mod-only urfave/cli/v2 requirement is not needed for the build, and testify, used only by the _test.go files, is correctly Build-Depends with <!nocheck>.
  • dh-go 1.69 is in the archive and provides dh_golang, the golang buildsystem and dh_golang_autopkgtest, so the Build-Depends and --with=golang resolve; autodep8's go template generates Test-Command: /usr/bin/dh_golang_autopkgtest with Depends: @, @builddeps@ for Testsuite: autopkgtest-pkg-go, so the build dependencies (including testify) are installed for the test.
  • dpkg-build-api (= 1) makes Rules-Requires-Root default to no (dpkg-build-api(7)), so the absent field is not an omission. Standards-Version 4.7.4 matches Policy 4.7.4.1 in its first two components, so it is current.
  • debian/changelog: unstable, 0.0.2+git20261005.1f16ed7-1, initial release closing #1152493, date Fri, 30 Oct 2026 which is indeed a Friday. debian/source/format is 3.0 (quilt) with no debian/patches, and gbp.conf (dist = DEP14, pristine-tar), salsa-ci.yml and upstream/metadata follow the Go team's practice; Section: golang, Multi-Arch: foreign and Architecture: all match the team's other -dev packages.
  • Whole tree reviewed (21 files, all text, no images, fonts, binaries or PDFs); prescan listed no individual files to account for.
  • uscan found the packaged version as the newest upstream release (upstream 0.0.2+git20261005.1f16ed7, packaged 0.0.2+git20261005.1f16ed7).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, MPL-2.0).
Not confirmed ◂
  • The derivation of pkg/constraint.go and pkg/version_collection.go from Masterminds/semver and hashicorp/go-version cannot be confirmed from this source alone: neither library's notice is in the tree, so the two copyright stanzas rest on upstream's history and the shape of the code.
  • The exact autopkgtest failure was reasoned from debian/rules, /usr/bin/dh_golang_autopkgtest, debian autodep8's go template and Debhelper/Buildsystem/golang.pm; it was not run.
Proposed changes ◂

None.

Uploader's response to the LLM review

Thanks, but this one does not happen: the generated override copies into debian/build (“cp -a /usr/share/gocode/src “debian/build”” in the test log), and dh-golang-autopkgtest passes with dh-go 1.69 and 1.70. Nothing to change. Please accept this upload.

— Juan Manuel Méndez Rey (mendezr), 23 hours ago

Review Information

accepted — allocated to awm 16 hours ago, started 16 hours ago, completed 16 hours ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
0.0.2+git20261005.1f16ed7-1 abfe2e04… 2026-11-06 08:01 2026-11-06 08:01 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package