Review: golang-github-aquasecurity-go-npm-version 0.0.2+git20261005.1f16ed7-1
Package Information
| Description | library for parsing npm versions and version constraints go-npm-version is a library for parsing npm versions and version constraints, and verifying versions against a set of constraints. go-npm-version can sort a collection of versions properly, handles prerelease versions, etc. Versions used with go-npm-version must follow Semantic Versioning. Constraints used with go-npm-version must follow npm rules. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-aquasecurity-go-npm-version.git (browse) |
| Closes | #1152493 |
| Tracker | https://tracker.debian.org/pkg/golang-github-aquasecurity-go-npm-version |
| Uploaded | 1 day ago |
New Package Report
.changes
| Architecture | source all |
|---|---|
| Distribution | unstable |
| Date | Fri, 30 Oct 2026 03:16:50 +0100 |
| Source | golang-github-aquasecurity-go-npm-version |
| Version | 0.0.2+git20261005.1f16ed7-1 |
| Changed-By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
Changelog
golang-github-aquasecurity-go-npm-version (0.0.2+git20261005.1f16ed7-1) unstable; urgency=medium . * Initial release (Closes: #1152493)
.dsc
| Section | golang |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | golang-github-aquasecurity-go-npm-version-dev deb golang optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/aquasecurity/go-npm-version
Upstream-Name: go-npm-version
Upstream-Contact: https://github.com/aquasecurity/go-npm-version/issues
Files: *
Copyright: 2020 Teppei Fukuda <knqyf263@gmail.com>
2025-2026 DmitriyLewen <https://github.com/DmitriyLewen>
License: Apache-2.0
Comment: Upstream has no copyright notice (LICENSE carries the unfilled
Apache-2.0 appendix and no file has a header). The holders are the authors
of the commits in the upstream history.
Files: pkg/constraint.go
Copyright: 2014-2019 Matt Butcher and Matt Farina
2014 HashiCorp, Inc.
2020 Teppei Fukuda <knqyf263@gmail.com>
License: Apache-2.0 and Expat and MPL-2.0
Comment: The constraint regex, the tilde and caret tables and the error
strings come from github.com/Masterminds/semver (Expat); doc comments and
the Constraints methods from github.com/hashicorp/go-version (MPL-2.0).
Files: pkg/version_collection.go
Copyright: 2014 HashiCorp, Inc.
2020 Teppei Fukuda <knqyf263@gmail.com>
License: Apache-2.0 and MPL-2.0
Comment: The Collection type comes from github.com/hashicorp/go-version.
Files: hack/generator/package.json
Copyright: 2020 Teppei Fukuda <knqyf263@gmail.com>
License: ISC
Comment: The npm metadata of the test-data generator declares ISC. The
generator is not built or installed.
Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Comment:
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".
License: ISC
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
License: MPL-2.0
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at https://mozilla.org/MPL/2.0/.
Comment:
On Debian systems, the complete text of the Mozilla Public License
version 2.0 can be found in "/usr/share/common-licenses/MPL-2.0".
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 day ago.
Report
DFSG NEW review for golang-github-aquasecurity-go-npm-version version 0.0.2+git20261005.1f16ed7-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
All upstream code is free: the tree carries a single root LICENSE (Apache-2.0), no file carries a conflicting or restrictive notice, and the two files that carry code taken from Masterminds/semver (Expat) and hashicorp/go-version (MPL-2.0) are carved out into their own stanzas naming both holders. debian/copyright is DEP-5, its catch-all plus the later, narrower stanzas cover every path in the tree, all four short names used (Apache-2.0, ISC, Expat, MPL-2.0) have a stand-alone License paragraph, and the licences combined in pkg/constraint.go are compatible. The only text not present in the tree is the Apache-2.0 and MPL-2.0 body, both of which /usr/share/common-licenses holds and the file points to.
Packaging
Conventional Debian Go packaging: dh compat 14, dpkg-build-api 1, dh-go with the golang buildsystem, XS-Go-Import-Path and Testsuite: autopkgtest-pkg-go, a single arch:all -dev package whose Depends match the imports of the shipped pkg/, cmd/ and examples/ excluded from both build and install, correct <!nocheck> on the test-only dependency, current Standards-Version, sound changelog and Vcs-* fields. One minor defect: debian/rules overrides the golang buildsystem's default build directory with debian/_build, which the generated autopkgtest does not know about, so the autopkgtest-pkg-go run cannot find the sources it copies into _build.
Issues
minor packaging 1. debian/rules' --builddirectory=debian/_build makes the autopkgtest-pkg-go run fail: the generated override populates _build, the build then looks in debian/_build ◂
- Files:
debian/rules:5,debian/control:16 - Basis: inferred from what was read, not seen directly
- Evidence: debian/rules:
dh $@ --builddirectory=debian/_build --buildsystem=golang --with=golang. /usr/bin/dh_golang_autopkgtest (run as the test because ofTestsuite: autopkgtest-pkg-go, per autodep8's support/go/generate:Test-Command: /usr/bin/dh_golang_autopkgtest) appendsoverride_dh_auto_configurecontainingAPT_BDIR := $(shell ... load_buildsystem("golang")->get_builddir())andcp -a /usr/share/gocode/src "${APT_BDIR}". Buildsystem/golang.pm:sub DEFAULT_BUILD_DIRECTORY { return $this->SUPER::DEFAULT_BUILD_DIRECTORY() if compat(13); return '_build'; }. - Problem: The -dev package installs its source under /usr/share/gocode/src/github.com/aquasecurity/go-npm-version, so dh_golang_autopkgtest takes its first branch: it replaces dh_auto_configure with a copy of /usr/share/gocode/src into the golang buildsystem's default build directory. That one-liner runs without the package's --builddirectory option, so
get_builddir()yields_build(compat 14 default), whiledebian/rules buildbuilds indebian/_build, which nothing creates or fills.get_targets()therefore finds no targets in an empty GOPATH anddh_auto_buildfails changing into the non-existent debian/_build. The normal build is unaffected, which is why the maintainer's own build passes; only the autopkgtest breaks. - Fix: Drop the option — at compat 14 the golang buildsystem's default is already
_build— or write--builddirectory=_build, so that the directory dh_golang_autopkgtest populates is the one dh builds in. Verify withautopkgtest . --testname=dh-golang-autopkgtest(or a salsa-ci pipeline run).
Verified ◂
- debian/copyright is DEP-5 with
Files: *(Apache-2.0) as catch-all; later stanzas override it for pkg/constraint.go (Apache-2.0 and Expat and MPL-2.0), pkg/version_collection.go (Apache-2.0 and MPL-2.0), hack/generator/package.json (ISC) and debian/*, so every one of the 21 files in the tree is matched. - The only licence text in the tree is the root LICENSE (Apache-2.0,
Copyright [yyyy] [name of copyright owner]appendix left unfilled); no .go, .js, .md, .yml, .json or .csv file carries a copyright or licence notice, and a grep for Copyright/(C)/©/SPDX/Licensed under/permission notices/non-free wording found nothing else. The prescan's author check named no holder missing from debian/copyright, and its five declared holders are all in the file. - pkg/constraint_testcase.go is marked
// Code generated by Node.js. DO NOT EDIT.; hack/generate.sh regenerates it from hack/input.csv with hack/generator/main.js, and input, generator and package-lock.json are all in the tree — no generated file lacks its preferred form for modification. The generator is neither built nor installed. - hack/generator/package.json declares
"license": "ISC"; the ISC and Expat texts are reproduced in full in debian/copyright, and Apache-2.0 and MPL-2.0 are both present in /usr/share/common-licenses, as the file says. - The code the two carve-out stanzas attribute to Masterminds/semver and hashicorp/go-version carries no notice of its own in the tree; the operator/regex/tilde/caret tables and error strings of pkg/constraint.go and the Len/Less/Swap Collection of pkg/version_collection.go match those libraries' code, so the holders named (Matt Butcher and Matt Farina, HashiCorp, Teppei Fukuda) are consistent with what is shipped.
- pkg/ imports only golang.org/x/xerrors and github.com/aquasecurity/go-version, both in the -dev package's Depends and in Build-Depends. DH_GOLANG_EXCLUDES := cmd examples removes cmd/ and examples/ from both the build targets and the installed source, so the go.mod-only urfave/cli/v2 requirement is not needed for the build, and testify, used only by the _test.go files, is correctly Build-Depends with <!nocheck>.
- dh-go 1.69 is in the archive and provides dh_golang, the golang buildsystem and dh_golang_autopkgtest, so the Build-Depends and
--with=golangresolve; autodep8's go template generatesTest-Command: /usr/bin/dh_golang_autopkgtestwithDepends: @, @builddeps@for Testsuite: autopkgtest-pkg-go, so the build dependencies (including testify) are installed for the test. dpkg-build-api (= 1)makes Rules-Requires-Root default tono(dpkg-build-api(7)), so the absent field is not an omission. Standards-Version 4.7.4 matches Policy 4.7.4.1 in its first two components, so it is current.- debian/changelog: unstable, 0.0.2+git20261005.1f16ed7-1, initial release closing #1152493, date
Fri, 30 Oct 2026which is indeed a Friday. debian/source/format is 3.0 (quilt) with no debian/patches, and gbp.conf (dist = DEP14, pristine-tar), salsa-ci.yml and upstream/metadata follow the Go team's practice; Section: golang, Multi-Arch: foreign and Architecture: all match the team's other -dev packages. - Whole tree reviewed (21 files, all text, no images, fonts, binaries or PDFs); prescan listed no individual files to account for.
- uscan found the packaged version as the newest upstream release (upstream
0.0.2+git20261005.1f16ed7, packaged0.0.2+git20261005.1f16ed7). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,MPL-2.0).
Not confirmed ◂
- The derivation of pkg/constraint.go and pkg/version_collection.go from Masterminds/semver and hashicorp/go-version cannot be confirmed from this source alone: neither library's notice is in the tree, so the two copyright stanzas rest on upstream's history and the shape of the code.
- The exact autopkgtest failure was reasoned from debian/rules, /usr/bin/dh_golang_autopkgtest, debian autodep8's go template and Debhelper/Buildsystem/golang.pm; it was not run.
Proposed changes ◂
None.
Uploader's response to the LLM review
Thanks, but this one does not happen: the generated override copies into debian/build (“cp -a /usr/share/gocode/src “debian/build”” in the test log), and dh-golang-autopkgtest passes with dh-go 1.69 and 1.70. Nothing to change. Please accept this upload.
— Juan Manuel Méndez Rey (mendezr), 23 hours ago
Review Information
accepted — allocated to awm 16 hours ago, started 16 hours ago, completed 16 hours ago.
Final Comment
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 0.0.2+git20261005.1f16ed7-1 | abfe2e04… | 2026-11-06 08:01 | 2026-11-06 08:01 | dfsg-uploader | rejected | VIEW |