DFSG NEW review for golang-github-diskfs-go-diskfs version 1.9.4+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 12 found

Licensing

The whole tree is Expat (MIT) with a single holder: the only copyright notice anywhere is LICENSE ("MIT License / Copyright (c) 2017 Avi Deitcher"), and an exhaustive case-insensitive search for Copyright, (C), (c), SPDX-License-Identifier, Licensed under, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved and licence words in all 267 files (READMEs and docs included) found no other holder, licence or non-free term. debian/copyright is DEP-5, matches that exactly (Files: * -> 2017 Avi Deitcher, Expat; Files: debian/* -> the packager), and reproduces the full Expat text, which is required because it is not in /usr/share/common-licenses. The two Files-Excluded entries (an unlicensed check-in of mksquashfs/unsquashfs and the Go gopher gif) are justified and neither file is in the tarball; the binary testdata that is kept is fixture data whose generator script and README are shipped beside it.

Packaging

Standard, current Go packaging: compat 14, dh-go with --with=golang, XS-Go-Import-Path, Multi-Arch: foreign, Testsuite: autopkgtest-pkg-go, dpkg-build-api (= 1), correct dependencies (every name exists, and Debian's versions meet go.mod), sane changelog and Vcs-* fields. One thing a sponsor would require fixed: override_dh_auto_test ends in || true, so no test failure can ever fail the build, and the reason given for it (the excluded prebuilt mksquashfs binaries) does not apply to this upstream version - the tests that actually fail are the ext4/fat32/disk ones whose fixtures are generated by scripts that call docker. Otherwise clean, apart from a minor point about relying on debhelper's implicitly activated single-binary addon.

Issues

1. [important] [packaging] dh_auto_test -- -short || true discards every test result, and the reason given for it is not the reason the tests fail

• Files: debian/rules:9-14, filesystem/ext4/common_test.go, filesystem/ext4/testdata/buildimg.sh, filesystem/fat32/common_test.go, filesystem/fat32/testdata/mkfat32.sh, disk/disk_test.go, filesystem/squashfs/finalize_test.go:166-190

• Basis: checked, in the package or with a reference tool

• Evidence:

  debian/rules:9-14:

  override_dh_auto_test:
  	# The squashfs tests shell out to mksquashfs/unsquashfs, which upstream
  	# shipped as prebuilt binaries; those are excluded from the source tarball
  	# (see debian/copyright Files-Excluded). Integration tests need docker.
  	dh_auto_test -- -short || true
  

  No test or source file outside the testdata/ generator scripts invokes mksquashfs or unsquashfs, and every docker call in the tests is gated: filesystem/squashfs/finalize_test.go:166 // only do this test if os.Getenv("TEST_IMAGE") contains a real image for integration testing / if intImage == "" { / return, with intImage = os.Getenv("TEST_IMAGE") at line 18; the same guard is in iso9660 (combined_xorriso_test.go:185, joliet_xorriso_test.go:178, rockridge_xorriso_test.go:211), squashfs and fat32 (fat32_test.go:458), gpt (table_test.go:296) and mbr (table_test.go:283). TEST_IMAGE is never set by the build, so those paths are not reached. The unguarded, always-run paths are the fixture generators: filesystem/ext4/common_test.go TestMain runs exec.Command("sh", "buildimg.sh") and os.Exit(1) on error; filesystem/fat32/common_test.go TestMain runs exec.Command("sh", "mkfat32.sh") and exits 1 likewise; disk/disk_test.go ("whole disk" subtest) runs exec.Command("sh", "mkfat32.sh", tmpDir) and t.Fatalfs. Those scripts only work through docker: filesystem/ext4/testdata/buildimg.sh does cat << "EOF" | docker run -i --rm -v $PWD/dist:/data -w /data --privileged alpine:3.22 then apk --update add e2fsprogs e2fsprogs-extra, and filesystem/fat32/testdata/mkfat32.sh does the same. The fixtures they would produce are absent (filesystem/ext4/testdata/.gitignore is just dist/), and docker is not installed in a build chroot, so the filesystem/ext4, filesystem/fat32 and disk tests fail on every build, and || true is what lets the build succeed.

• Problem: The upstream suite is run but its result is not a build gate: a real regression in any package would still build and be uploaded. The comment states a cause that no longer exists in this version (the excluded prebuilt unsquashfs/mksquashfs are not used by any test, and the integration tests that do need docker are skipped without TEST_IMAGE), which hides the actual cause from anyone reading debian/rules later. The same fixture generators are what an autopkgtest would run, so this also puts the package's migration to testing at risk.

• Fix: Drop || true and make the docker dependence explicit instead: patch the TestMain functions (ext4, fat32) and disk_test.go's "whole disk" subtest to skip when docker is not in PATH - the right upstream fix, and small enough to forward - or, failing that, restrict the test run to the packages that can pass in a build environment. Correct the comment to name the real cause. Do not leave the whole suite's exit status ignored.

2. [minor] [packaging] debian/rules depends on debhelper's implicitly activated single-binary addon for its post-install find

• Files: debian/rules:16-20, debian/control:11

• Basis: checked, in the package or with a reference tool

• Evidence:

  debian/rules:16-20:

  execute_after_dh_auto_install:
  	# Four testdata directories carry a .gitignore listing build outputs that
  	# upstream does not ship. The outputs are genuinely absent; only the
  	# .gitignore files come along, and they mean nothing in a binary package.
  	find debian/golang-github-diskfs-go-diskfs-dev -name .gitignore -delete
  

  That path is dh_auto_install's destdir only because of the single-binary addon. debhelper 14.5, debhelper-compat-upgrade-checklist(7), v14: "The dh_auto_install command now unconditionally uses --destdir=debian/tmp by default. The special-case for source packages building a single binary package is now moved to single-binary dh addon. Note, this add-on is activated by default in compat 14 but not in compat 15" and "The dh sequencer will warn if the single-binary addon is implicitly activated ... Maintainers are urged to either explicitly activate the single-binary addon to preserve the existing behaviour (e.g., by adding dh-sequence-single-binary to Build-Depends), or explicitly passing --destdir to dh_auto_install if used and then passing --without single-binary to dh".

• Problem: The rule works today only through a transitional debhelper behaviour that dh announces with a warning on every build, and it will silently stop matching anything at compat 15, when the add-on is no longer implicit. The .gitignore files installed into /usr/share/gocode/src/.../testdata/ are harmless in themselves, so the failure would be quiet.

• Fix: Add dh-sequence-single-binary to Build-Depends to pin the behaviour debian/rules assumes, or pass --destdir=debian/golang-github-diskfs-go-diskfs-dev to dh_auto_install and --without single-binary to dh.

Verified

• Coverage: every path outside .pc/ and debian/ (267 files) was enumerated with glob and searched case-insensitively for licence and copyright wording; every LICENSE/COPYING/NOTICE/AUTHORS-type file was read (LICENSE is the only one); all of debian/ was read; the binary files below were identified from the generator scripts and READMEs beside them, not opened.
• debian/copyright is machine-readable (correct 1.0 Format:), one Files: * (2017 Avi Deitcher, Expat) plus Files: debian/* (2026 Juan Manuel Mendez Rey, Expat), and the full Expat text is present as a stand-alone License: Expat paragraph, which is required as Expat is not in /usr/share/common-licenses.
• The only copyright notice in the tree is LICENSE lines 1-3 (MIT License / Copyright (c) 2017 Avi Deitcher), matching Files: *; the prescan's author check over 267 files likewise found every holder named.
• Files-Excluded names filesystem/squashfs/testdata/tools and examples/create-iso-from-folder/my-folder/gopher.gif; a glob for **/tools/*, **/*.gif, **/*.png, **/*.jpg finds nothing, so neither is still in the tree. No ELF, .jar, .class, .so, .dll, .pyc, PDF or minified JS/CSS remains.
• Prescan binary file filesystem/iso9660/testdata/9660.iso: test fixture, generated by the testdata/buildtestiso.sh shipped beside it (xorriso under docker) and described in testdata/README.md - preferred form present.
• Prescan binary file filesystem/iso9660/testdata/rockridge.iso: same generator (testdata/buildtestiso.sh produces both 9660.iso and rockridge.iso).
• Prescan binary file filesystem/iso9660/testdata/volrecords.iso: 8192-byte excerpt of ISO volume descriptors, reproducible with the dd if=...iso of=volrecords.iso bs=2048 count=4 skip=16 documented in testdata/README.md; the provenance note (a Ubuntu live-server ISO) is a description of test data, not a licence term.
• Prescan binary files filesystem/squashfs/testdata/dir_read.sqs, file.sqs, file2_uncompressed.sqs, file_uncompressed.sqs, read_test.sqs: test fixtures generated by testdata/buildtestsqs.sh (mksquashfs under docker) and listed in testdata/README.md, with list.txt and read_test.md5sums produced by the same script - preferred form present.
• Prescan binary files partition/gpt/testdata/gpt.img and partition/gpt/testdata/gpt_partition.dat: fixtures; partition/gpt/testdata/README.md gives the exact sgdisk/dd commands that produce both - preferred form present.
• Prescan binary files partition/mbr/testdata/mbr.img and partition/mbr/testdata/mbr_partition.dat: fixtures; partition/mbr/testdata/README.md gives the exact sfdisk/mkfs.vfat/dd commands that produce both - preferred form present.
• filesystem/ext4/crc/crc16.go, filesystem/ext4/crc/crc32.go, filesystem/ext4/md4/md4.go and filesystem/ext4/dirhash.go carry no separate copyright or licence notice; they are reimplementations of standard ext4/TEA/MD4/CRC algorithms, and filesystem/ext4/checksum.go:14 cites the e2fsprogs lib/ext2fs/csum.c they were written from, so nothing in the package suggests a copied file with an unstated licence.
• debian/control dependencies all exist and are satisfiable: golang-github-djherbis-times-dev 1.6.0, golang-github-klauspost-compress-dev 1.20.0, golang-github-ulikunitz-xz-dev 0.5.15, golang-github-elliotwutingfeng-asciiset-dev, golang-go/golang-any 1.27 and dh-go 1.69 in the archive; golang-github-anchore-go-lzo-dev is not yet in the archive but is in NEW as the binary of golang-github-anchore-go-lzo 0.1.1-1, so it is not a fault (go.mod requires 0.1.0). Debian's versions are equal to or newer than every requirement in go.mod, and dh-golang's default GO111MODULE=off (read in Buildsystem/golang.pm, _set_go111module) means those requirements are not resolved in any case.
• Standards-Version: 4.7.4 against Policy 4.7.4.1 - current enough, not an issue.
• Build-Depends: dpkg-build-api (= 1) is a valid level (dpkg-build-api(7): "This is the recommended level. Since dpkg 1.22.0"); that level defaults Rules-Requires-Root to no, so omitting the field is correct.
• --with=golang together with Build-Depends: dh-go is right: dh-go 1.69 provides the addon named golang and Conflicts: dh-golang, so the single override in debian/source/lintian-overrides is legitimate.
• debian/rules uses no deprecated construct: at compat 14 debhelper adds relationship substvars itself (so naming only ${misc:Depends} is fine) and dh skips override_dh_auto_test under DEB_BUILD_OPTIONS=nocheck.
• Testsuite: autopkgtest-pkg-go with no debian/tests/control is correct: autodep8 generates Test-Command: /usr/bin/dh_golang_autopkgtest from it (read /usr/share/autodep8/support/go/generate, whose detect matches golang-(go|any) in debian/control).
• debian/source/format is 3.0 (quilt) with no debian/patches/ and an empty .pc/applied-patches - consistent; no patch needs DEP-3 headers or forwarding.
• debian/changelog (1.9.4+ds-1, unstable, initial release closing #1148636, consistent date), debian/upstream/metadata, debian/gbp.conf and debian/salsa-ci.yml are present and well-formed. No debian/install, links, docs or maintainer scripts are needed for a Go library.
• uscan found the packaged version as the newest upstream release (upstream 1.9.4, packaged 1.9.4+ds).

Not confirmed

• What Testsuite: autopkgtest-pkg-go will do with the failing tests: /usr/bin/dh_golang_autopkgtest comes from dh-go, which is not installed on the reviewing system, so its behaviour could not be read. If it runs go test over all packages, the autopkgtest will fail for the same docker reason the build tests do; if it restricts itself, it may pass.
• Whether filesystem/ext4/md4/md4.go (and the ext4 hash code in filesystem/ext4/dirhash.go) is a transliteration of the half-MD4/TEA code in the Linux kernel's fs/ext4/hash.c (GPL-2.0) or of e2fsprogs, which would need attribution and a licence notice: neither source is on this system and no available tool can fetch it, so this rests on the shape of the code alone and is raised as a question for upstream, not as a finding.
• No build or test run was performed (read-only review), so the pass/fail state of the suite outside the docker-dependent packages is inferred from reading the test code, not observed.

Proposed changes

None.