golang-github-casbin-casbin 3.11.0-1

Package Information

Description	Authorization library that supports access control models like ACL, RBAC, ABAC Casbin is a powerful and efficient open-source access control library for Golang projects. It provides support for enforcing authorization based on various access control models.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Mathias Gibbens <gibmat@debian.org>
Sponsor	gibmat@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-casbin-casbin.git (browse)
Popcon Installs	32
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/golang-github-casbin-casbin
Uploaded	3 hours ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Sat, 14 Nov 2026 16:23:20 +0000
Source	golang-github-casbin-casbin
Version	3.11.0-1
Changed-By	Mathias Gibbens <gibmat@debian.org>

Changelog◂

golang-github-casbin-casbin (3.11.0-1) unstable; urgency=medium
 .
   * New upstream release
   * d/control:
     - Update Standards-Version to 4.7.4 (no changes needed)
     - Switch to using dh-go
     - Rename -dev package to include major version number
     - Update Build-Depends and Depends
     - Update Homepage field
   * Update d/copyright with Apache Software Foundation information
   * Update d/watch to only track proper v3 releases

.dsc◂

Section	oldlibs
Priority	optional
Component	main
Package-List	golang-github-casbin-casbin-dev deb oldlibs optional arch=all golang-github-casbin-casbin-v3-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: casbin
Source: https://github.com/apache/casbin

Files: *
Copyright:
 2017-2026 The casbin Authors
 2026 The Apache Software Foundation
License: Apache-2.0

Files: debian/*
Copyright: 2022-2026 Mathias Gibbens
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for golang-github-casbin-casbin version 3.11.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 1 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All licences in the tree are DFSG-free (Apache-2.0 for the project, MIT for one configuration file) and combine without conflict, with no non-free terms, no vendored third-party code and no build artifacts. But debian/copyright is inaccurate: the catch-all Files: * stanza declares Apache-2.0 for .golangci.yml, which upstream licenses under MIT and whose MIT copyright notice and licence text the file does not record. A DEP-5 stanza for that file with the MIT text fixes it; nothing else in the tree is misdescribed.

Packaging

Clean Go-team packaging: debhelper compat 13 with dh-go's golang sequence and buildsystem, correct DH_GOLANG_INSTALL_EXTRA for the example fixtures that the tests read, a properly split -dev package with Breaks/Replaces for the file move from the old name, a transitional dummy in oldlibs, autopkgtest-pkg-go, DEP-5 copyright, no patches, Vcs-* fields and Standards-Version 4.7.4 (Policy 4.7.4.1 here). No packaging issue worth reporting.

Issues

blocker licensing 1. Files: * declares Apache-2.0 for .golangci.yml, which is MIT-licensed under Marat Reymers' copyright, and the MIT stanza is missing ◂

Files: .golangci.yml:1-3, LICENSE:205-229, debian/copyright:6-11
Basis: checked, in the package or with a reference tool
Evidence: .golangci.yml:1-3: # Based on https://gist.github.com/maratori/47a4d00457a92aa426dbd48a18776322 / # This code is licensed under the terms of the MIT license ... / # Copyright (c) 2021 Marat Reymers. LICENSE:207 and is licensed under the MIT License. followed by the full MIT text. debian/copyright: Files: * ... License: Apache-2.0, and no other Files stanza matches it.
Problem: * in a DEP-5 Files pattern matches dotfiles and at any depth (copyright-format 6.9), so the only stanza applying to .golangci.yml is Files: * / License: Apache-2.0. That misstates the file's licence: upstream says MIT, and MIT also requires its copyright notice and permission notice to accompany copies, while debian/copyright names neither the holder nor MIT, and MIT is not in /usr/share/common-licenses, so its text must be reproduced there. Policy 2.3 by itself would not require the holder to be named here, because .golangci.yml reaches no binary package - dh-go's golang buildsystem copies only .go/.c/.cc/.cpp/.h/.hh/.hpp/.proto/.s, testdata/, go.mod, go.sum and the examples/ named in DH_GOLANG_INSTALL_EXTRA (/usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm:601-660, debian/rules:4) - but a wrong licence in debian/copyright is a fault wherever the file is, since the source package is distributed too. The tree does contain the MIT text, inside LICENSE, so the source package itself keeps the notice; debian/copyright does not.
Fix:

Add a stanza before or after Files: * (later stanzas win, so any placement works as long as it names the file):
```
Files: .golangci.yml
Copyright: 2021 Marat Reymers
License: MIT
```
and a stand-alone paragraph with the short name MIT and the full MIT text as reproduced in LICENSE:209-229. Leave LICENSE itself under Files: * (Apache-2.0): the MIT block in it is the notice for .golangci.yml, not a licence of LICENSE.

minor packaging 2. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

Licence inventory: every .go file, Makefile, README.md, CONTRIBUTING.md, .asf.yaml, .gitattributes, .rat-excludes, .github/workflows/* and .github/scripts/* carries the ASF Licensed to the Apache Software Foundation ... Apache License, Version 2.0 header; a search for MIT/BSD/GPL/LGPL/ISC/Mozilla/Creative Commons/public-domain/non-commercial/no-modification wording found only the MIT references for .golangci.yml in .golangci.yml, .rat-excludes:29 and LICENSE.
.golangci.yml (prescan): a golangci-lint configuration adapted from a MIT gist, whose MIT notice and text upstream records in .rat-excludes:29-30 and LICENSE:205-229; the file is shipped in the source package (golang-github-casbin-casbin_3.11.0.orig.tar.gz contains it with the same header) but no binary package installs it, hence the licensing issue above and no separate holder grading.
LICENSE:211 (prescan): the Copyright (c) 2021 Marat Reymers line is inside the THIRD-PARTY COMPONENTS section of upstream's Apache-2.0 LICENSE, i.e. the reproduced MIT notice for .golangci.yml; LICENSE as a file stays Apache-2.0 and correctly falls under Files: *.
NOTICE names Copyright 2026 The Apache Software Foundation and Copyright 2017-2026 The casbin Authors, matching the two holders in the Files: * stanza; it is installed in the -dev package via debian/golang-github-casbin-casbin-v3-dev.docs. The Apache-2.0 text itself is not quoted at length in debian/copyright but referred to /usr/share/common-licenses/Apache-2.0, as Policy 12.5 recommends.
debian/copyright is DEP-5 with the correct Format: line, Upstream-Name/Source (matching Homepage and the apache/casbin repository the README badges point at), a Files: * stanza, a Files: debian/* stanza naming Mathias Gibbens, and a stand-alone License: Apache-2.0 paragraph; no Files-Excluded.
casbin-logo.png: the project logo referenced from README.md:34, in the ASF repository and covered by the repository-wide Apache-2.0 licence; not installed (dh-go's extension whitelist excludes .png), so covered by Files: * with no separate notice needed.
examples/*.conf, examples/*.csv (including examples/performance/rbac_with_pattern_large_scale_policy.csv, 169 KB) and config/testdata/testini.ini: casbin model/policy test fixtures with no copyright notices of their own, covered by Files: *; installed as source data because the tests read them.
No vendored third-party code, no vendor/, third_party/ or node_modules/, and no generated or built artifacts (no PDFs, archives, bytecode, minified files) anywhere in the tree.
Packaging: debian/rules uses dh with the golang sequence and buildsystem; dh-go 1.69 exists as the debhelper add-on (it conflicts with dh-golang and ships the sequence golang.pm and dh_golang_autopkgtest), so the switch is coherent. dh's golang buildsystem runs go test, and the only external imports in the tree are the three packages in Build-Depends/Depends (all in the archive: doublestar 4.10.0-1, govaluate 1.10.0-1, uuid 1.6.0-1), which go.mod also lists.
Binary split: golang-github-casbin-casbin-v3-dev is Architecture: all, Multi-Arch: foreign, with Breaks/Replaces on the old golang-github-casbin-casbin-dev for the moved files; the old name is kept as an oldlibs dummy depending on the new package. Breaks: golang-github-go-kit-kit-dev (<= 0.13.0-8) reflects that dependent's switch to the v3 import path.
No debian/patches (source format 3.0 (quilt) with no patches, which the shipped .debian.tar.xz confirms), no maintainer scripts, Testsuite: autopkgtest-pkg-go, debian/upstream/metadata present, changelog in unstable with a valid version and date, Standards-Version: 4.7.4 against Policy 4.7.4.1, Vcs-* fields present.
uscan found the packaged version as the newest upstream release (upstream 3.11.0, packaged 3.11.0).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Whether every remaining reverse dependency of golang-github-casbin-casbin-dev has been moved off the github.com/casbin/casbin (v2) import path: the package name now only ships the v3 tree, so such a dependent would fail to build. The changelog's Breaks against golang-github-go-kit-kit-dev suggests the known one was handled, but no tool here lists reverse dependencies.
debian/watch looks at github.com/casbin/casbin, but the Source field of debian/copyright names github.com/apache/casbin. Whether these are the same upstream was not checked.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Template: Github
Dist: https://github.com/casbin/casbin
Uversionmangle: s/(\d)[_\.\-\+]?(RC|rc|pre|dev|beta|alpha)[.]?(\d*)$/$1~$2$3/

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-16 00:09 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package