DFSG NEW review for golang-github-deitch-magic version 0.0~git20230404.1ff89d7-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 (Format 1.0) and matches the tree. Every one of the 12 upstream files is covered by Files: * with Copyright: 2023 Avi Deitcher / License: Apache-2.0, matching the only licence statement in the package, upstream's LICENSE (Apache-2.0 boilerplate only). The Apache-2.0 short name is the standard one and the full text is correctly pointed at /usr/share/common-licenses/Apache-2.0, which is permitted by copyright-format 6.7. No non-free wording, no binary/blob/minified/generated file, no vendored third-party code, and no other copyright holder appears anywhere in the tree; the pre-scan's author check likewise found no holder missing from debian/copyright.

Packaging

Textbook Go team packaging: dh $@ --buildsystem=golang --with=golang at debhelper compat 14 with dh-go, a source package and a single Architecture: all / Multi-Arch: foreign -dev package, Vcs-*, Homepage, XS-Go-Import-Path, upstream/metadata, salsa-ci and a DEP-14 gbp.conf all present and consistent. Dependencies, Standards-Version (4.7.4 against Policy 4.7.4.1), the lintian override for the dh-go/dh-golang split and the choice of the git snapshot as upstream version all check out. The only thing worth mentioning is that the long description advertises a command-line wrapper although debian/rules deliberately keeps that binary out of the package.

Issues

1. [minor] [packaging] Long description says a file(1)-like command-line wrapper is included, but debian/rules excludes it so no such command is installed

• Files: debian/control:26-27, debian/rules:6
• Basis: checked, in the package or with a reference tool
• Evidence: debian/control: A tiny command-line wrapper behaving like file(1) is included, which upstream / describes as a testing aid rather than a replacement for file(1). against debian/rules: export DH_GOLANG_EXCLUDES := github.com/deitch/magic$.
• Problem: dh_golang builds the targets of go list github.com/deitch/magic/... and copies $builddir/bin/* into /usr/bin, and at compat 14 DH_GOLANG_EXCLUDES also filters the installed source. The pattern github.com/deitch/magic$ removes the root main package, so only the library packages are built and no magic command is shipped (source main.go is still installed under /usr/share/gocode). A binary package's description must describe what the package provides (Policy 3.4), and this sentence tells a user to expect a command that dpkg will never install.
• Fix: Reword the paragraph so it does not claim an installed command, e.g. note that the source of a small wrapper that behaves like file(1) is shipped for building locally, or drop the sentence.

Verified

• Inventory: the tree holds exactly 12 upstream files (.gitignore, LICENSE, README.md, actual.txt, go.mod, go.sum, main.go, pkg/magic/parse.go, pkg/magic/internal/{common.go,kernel.go}, pkg/magic/parser/{message.go,offset.go,tester.go}) plus debian/; .pc/ and debian/cargo-checksum.json were excluded as instructed. No .so/.jar/.class/.pyc/minified/generated file, no font, image or sound, no vendored third-party tree.
• The pre-scan listed no file to account for: its holder check reports every holder found is named in debian/copyright.
• LICENSE is the Apache-2.0 boilerplate with Copyright 2023 Avi Deitcher, and no .go file carries a separate copyright or licence header; greps for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/GNU General Public/LGPL/Apache License/public domain/All rights reserved and for non-free wording (non-commercial, no modification, no-derivatives) returned only LICENSE and debian/copyright.
• debian/copyright is DEP-5 with Format 1.0; Files: * then Files: debian/* override it for packaging (2026 Juan Manuel Méndez Rey, same licence). The Apache-2.0 short name matches the licence text and version, the stand-alone License paragraph legitimately carries a Comment (copyright-format 5.3), and the pointer to /usr/share/common-licenses/Apache-2.0 is allowed by copyright-format 6.7.
• The orig tarball's contents are identical to the unpacked tree (top-level member magic/); nothing was removed or added by packaging, so no Files-Excluded is needed, and the debian.tar.xz contains only the debian/ files that are present, with no debian/patches.
• go.mod requires github.com/google/uuid v1.3.0, but no file in the tree imports it (grep); dh-go's golang buildsystem defaults GO111MODULE to off (Buildsystem/golang.pm, _set_go111module), so the build runs in GOPATH mode and no Build-Depends on golang-github-google-uuid-dev is missing.
• Build-Depends and fields checked against the archive: dh-go 1.69 exists, provides the golang debhelper sequence addon and Conflicts with dh-golang (and does not Provide dh-sequence-golang), so --with=golang plus the debian/source/lintian-overrides entry is correct; dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11; golang-any exists; /usr/bin/magic is indeed the VLSI tool from the magic package, so excluding this package's wrapper from /usr/bin is justified. Standards-Version 4.7.4 is fine against Policy 4.7.4.1.
• debian/control's Uploaders: ... <juan.mendezr@proton.me>, trailing comma is harmless: the generated .dsc shows the field normalised to a single entry. Depends: ${misc:Depends}, with no further substvar is correct at compat 14.
• debian/gbp.conf's dist = DEP14 is a real gbp option (buildpackage.py: add_config_file_option(option_name="dist", dest="pbuilder_dist")) and accepts DEP14; with debian-branch = debian/sid it resolves to the empty (unstable) dist rather than raising the DEP-14 branch error.
• actual.txt is a one-line sample of file(1) output for a kernel image (plain text, no licence implications); README.md, the parse.go TODO pointing at file(1)'s Magdir and the README link to darwinsys.com are upstream informational references only, and I fetched nothing.
• pkg/magic/parser/tester.go was read to line 63 of 182; it(and the remainder of the tree) is plain Go source with no licence wording, as the whole-tree greps above confirm.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.0~git20240306.c67ab88, packaged 0.0~git20230404.1ff89d7), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The ITP number in the changelog (#1148630) and the correspondence of the snapshot date 20230404 to commit 1ff89d7 could not be checked: no tool here reaches the Debian BTS or the upstream repository.
• That main.go's kernel magic rules are a transcription of file(1)'s magic database (the comments reference "leshort") is plausible but unproven; no file(1) copyright notice is claimed anywhere, and the pre-scan found no missing holder, so nothing is reported on it.

Proposed changes

None.