Review: golang-github-diskfs-go-diskfs 1.9.4+ds-2

Package Information

Description	manipulate disks, disk images and filesystems natively in Go (library) go-diskfs manipulates disks, disk images and filesystems entirely in Go, without mounting anything and without shelling out to fdisk, gdisk, mkfs.vfat, mtools or libguestfs, and so without needing root. It can read, create and modify MBR and GPT partition tables, and read and write FAT32, ISO 9660 (including Rock Ridge and El Torito boot images), squashfs and ext4 filesystems, working either on a whole image or block device or within a single partition.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-diskfs-go-diskfs.git (browse)
Closes	#1148636
Tracker	https://tracker.debian.org/pkg/golang-github-diskfs-go-diskfs
Uploaded	7 days ago
Supersedes	1.9.4+ds-1

New Package Report

.changes◂

Version	1.9.4+ds-2
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Sat, 31 Oct 2026 17:03:04 +0100
Source	golang-github-diskfs-go-diskfs

Changelog◂

golang-github-diskfs-go-diskfs (1.9.4+ds-2) unstable; urgency=medium
 .
   * Initial release (Closes: #1148636)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-diskfs-go-diskfs-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/diskfs/go-diskfs
Upstream-Name: go-diskfs
Upstream-Contact: https://github.com/diskfs/go-diskfs/issues
Files-Excluded:
 filesystem/squashfs/testdata/tools
 examples/create-iso-from-folder/my-folder/gopher.gif
Comment: filesystem/squashfs/testdata/tools holds mksquashfs and unsquashfs as
 checked-in ELF x86-64 executables, dynamically linked and not stripped,
 shipped with no source, no licence statement and no provenance note anywhere
 in the repository. gopher.gif is the Go gopher artwork, shipped without
 attribution or a licence statement. Both are removed from the source tarball.
 The remaining binary filesystem images under testdata are kept: each of those
 directories carries a README and a generator script (buildtestsqs.sh,
 buildtestiso.sh, mkfat32.sh, buildimg.sh), so their preferred form for
 modification is present.

Files: *
Copyright: 2017 Avi Deitcher
License: Expat

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 days ago.

Report◂

DFSG NEW review for golang-github-diskfs-go-diskfs version 1.9.4+ds-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 1 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 12 found

Licensing

Most of the tree is the root LICENSE's unmodified MIT/Expat text with a single 2017 Avi Deitcher notice, and debian/copyright reproduces that text and holder correctly. But two files carry code from other projects whose licences debian/copyright does not record: filesystem/ext4/dirhash.go and filesystem/ext4/md4/md4.go are a port of the GPL-2 Linux kernel ext4 directory-hash code (the package's own filesystem/ext4/ext4.md points at lib/halfmd4.c for the transform), and testhelper/docker.go credits moby/tool, which it states is Apache-2.0. Neither a GPL-2 nor an Apache-2.0 stanza, holder or licence text is present. A third, smaller problem is filesystem/squashfs/testdata/file2_uncompressed.sqs, a 5.3 MB built fixture that no test uses and no script generates, contradicting the copyright Comment's claim that each testdata directory carries its generator. So debian/copyright is not accurate for every file.

Packaging

The packaging is well made for a first-time Go library: one arch:all -dev package with Multi-Arch: foreign, dh-go's golang addon and buildsystem with examples/ excluded, four DEP-3 patches (two forwarded, two applied upstream), autodep8 autopkgtest support, Vcs-* and upstream/metadata, a valid +ds repack, and every module in go.mod backed by a Build-Depends that exists in unstable. Standards-Version 4.7.4 matches the reviewing Policy 4.7.4.1, and gbp.conf's dist = DEP14 is a value gbp handles. The only packaging defect is the changelog: its sole entry is 1.9.4+ds-2 marked Initial release.

Issues

blocker licensing 1. filesystem/ext4/dirhash.go and md4/md4.go port GPL-2 kernel ext4 hash code but debian/copyright says Expat ◂

Files: filesystem/ext4/dirhash.go:7-13, filesystem/ext4/dirhash.go:107-110, filesystem/ext4/md4/md4.go:33-70, filesystem/ext4/ext4.md:208-210, debian/copyright:18-20
Basis: inferred from what was read, not seen directly
Evidence: ext4.md:208-210: The "half md4" algorithm is given by the transformation code [here](https://elixir.bootlin.com/linux/v4.6/source/lib/halfmd4.c#L26); dirhash.go:8-11: teaDelta uint32 = 0x9E3779B9 / k2 uint32 = 0o13240474631 / k3 uint32 = 0o15666365641 (0x5A827999/0x6ED9EBA1, the kernel's k2/k3), and ext4fsDirhash seeds buf with {0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476}; md4.go:33: // halfMD4Transform basic cut-down MD4 transform. Returns only 32 bits of result.
Problem: These are near-literal Go ports of the Linux kernel's fs/ext4/hash.c (dx_hack_hash, TEA_transform, str2hashbuf, ext4fs_dirhash, the same k1/k2/k3 and MD4 initial values) and lib/halfmd4.c, whose code is GPL-2.0 (/usr/share/doc/linux-libc-dev/copyright records the kernel's License: GPL-2). GPL-2 code cannot be relicensed under Expat, so debian/copyright's Files: * (2017 Avi Deitcher, Expat) is wrong for these files: the GPL-2 licence and the kernel's copyright holders are absent, and the -dev package is presented to consumers as Expat-only.
Fix: Add a Files: filesystem/ext4/dirhash.go filesystem/ext4/md4/* stanza naming the holders from the kernel files (Theodore Ts'o and others) and License: GPL-2, with a stand-alone GPL-2 paragraph referring to /usr/share/common-licenses/GPL-2, and state that the package then contains GPL-2 code (Expat is GPL-compatible, so it can still be shipped). Alternatively replace the port with an original implementation and have upstream confirm the provenance; tell upstream that the current Expat claim covers copied kernel code.

important licensing 2. testhelper/docker.go credits moby/tool (Apache-2.0) but debian/copyright gives Expat only ◂

Files: testhelper/docker.go:11-13, debian/copyright:18-20
Basis: inferred from what was read, not seen directly
Evidence: testhelper/docker.go:11-12: // DockerRun run a docker container / // thanks to moby/tool, which is licensed apache 2.0
Problem: The file's own header says the code comes from moby/tool and that that project is Apache-2.0, but debian/copyright's Files: * declares it Expat by Avi Deitcher and contains no Apache-2.0 stanza, no moby/tool holder and no Apache-2.0 text (Apache-2.0 section 4 requires the licence and notices be kept). testhelper/docker.go is installed in the -dev package, so the package ships it on a licence the copyright file does not state.
Fix: Add a Files: testhelper/docker.go stanza with the holder from moby/tool's LICENSE (Docker, Inc./the Moby Project) and License: Apache-2.0, with a stand-alone Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0 (and any NOTICE text), or establish that the file is independent and drop the attribution.

minor licensing 3. filesystem/squashfs/testdata/file2_uncompressed.sqs is an unused squashfs image no script generates ◂

Files: filesystem/squashfs/testdata/file2_uncompressed.sqs, filesystem/squashfs/testdata/buildtestsqs.sh:1-30, filesystem/squashfs/testdata/README.md:1-10, debian/copyright:13-16
Basis: checked, in the package or with a reference tool
Evidence: buildtestsqs.sh removes and rebuilds only file.sqs file_uncompressed.sqs list.txt, then read_test.sqs read_test.md5sums, then dir_read.sqs; it never creates or mentions file2_uncompressed.sqs, no test opens it (const_internal_test.go names only file.sqs, file_uncompressed.sqs, read_test.sqs and dir_read.sqs), and the testdata README lists only file.sqs and read_test.sqs. debian/copyright:13-16 says the remaining testdata images' directories ... carries a README and a generator script ... so their preferred form for modification is present.
Problem: This is a 5.3 MB mksquashfs-built image with no generator and no provenance note in the package, and it is dead weight: nothing builds, opens or documents it. Its preferred form for modification is therefore missing, which contradicts the Comment in debian/copyright, even though it is test data rather than code.
Fix: Drop the file in the repack (add it to Files-Excluded and the watch repack) and adjust the Comment, or have upstream delete it or add it to buildtestsqs.sh and the README.

minor packaging 4. changelog's only entry is 1.9.4+ds-2 'Initial release' ◂

Files: debian/changelog:1-5
Basis: inferred from what was read, not seen directly
Evidence: golang-github-diskfs-go-diskfs (1.9.4+ds-2) unstable; urgency=medium with * Initial release (Closes: #1148636) as the only entry
Problem: A first upload carries Debian revision -1. A -2 entry labelled Initial release means either the version is wrong for a first upload, or an earlier -1 upload happened and its changelog entry was dropped, leaving the upload history incomplete.
Fix: Use 1.9.4+ds-1 if nothing was uploaded before, or restore the -1 entry above the -2 one if it was.

Verified ◂

Read every file under debian/ in full: control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata, patches/series and all four patches. debian/watch was not reviewed, as instructed.
Upstream inventory is 267 files (.pc/ and debian/ aside). The only licence/notice file is the root LICENSE: unmodified MIT/Expat text with Copyright (c) 2017 Avi Deitcher. Greps for Copyright/(C)/©/SPDX-License-Identifier/Permission is hereby granted/GNU/Apache/MPL/BSD/public domain found no other notices; the two third-party pointers that are not Copyright lines are the kernel halfmd4 link in ext4.md and the moby/tool comment in testhelper/docker.go, both reported.
debian/copyright is DEP-5: Files: * (2017 Avi Deitcher, Expat, full text inline), Files: debian/* (2026 Juan Manuel Méndez Rey, Expat) and Files-Excluded. Both excluded paths, filesystem/squashfs/testdata/tools and examples/create-iso-from-folder/my-folder/gopher.gif, are absent from the orig tarball (checked in its listing), and the tarball's root otherwise matches the unpacked tree.
All 12 files the prescan listed are accounted for: 9660.iso and rockridge.iso come from filesystem/iso9660/testdata/buildtestiso.sh (xorriso in a container; the README still calls the first one file.iso); volrecords.iso is four volume-descriptor sectors dd'ed from the Ubuntu 18.04.1 ISO as that README documents, factual metadata; file.sqs, file_uncompressed.sqs, read_test.sqs, dir_read.sqs, list.txt and read_test.md5sums come from filesystem/squashfs/testdata/buildtestsqs.sh; gpt.img, gpt_partition.dat, mbr.img and mbr_partition.dat come from the docker/sgdisk/sfdisk/dd recipes in partition/gpt/testdata/README.md and partition/mbr/testdata/README.md. file2_uncompressed.sqs is the one without a generator and is reported.
Build dependencies: every module in go.mod is covered by a Build-Depends that exists in unstable (golang-any 1.27~1, klauspost/compress 1.20.0, x/sys 0.49.0, djherbis/times 1.6.0, pkg/xattr 0.4.12, ulikunitz/xz 0.5.15, google/uuid, google/go-cmp, sirupsen/logrus, go-test/deep, pierrec/lz4, anchore/go-lzo 0.1.1, asciiset); dh-go provides the golang addon and buildsystem that debian/rules asks for.
The golang buildsystem installed on the reviewing system (/usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm) matches DH_GOLANG_EXCLUDES against the whole import path, so export DH_GOLANG_EXCLUDES := examples removes examples/ from build, test and (compat >= 12 default) install; the exclusion is needed because examples/create-iso-from-folder is a separate module and the other examples are package main.
Standards-Version 4.7.4 against Policy 4.7.4.1 on the reviewing system: first two components match, so it is current enough.
gbp.conf's dist = DEP14 is a value gbp handles: buildpackage.py maps DEP14 to the suite from the debian/ branch, yielding the unstable distribution for debian/sid, so it is not a fault.
Patches: all four have DEP-3 headers; 0001/0002 are Forwarded: not-yet and 0003/0004 Applied-Upstream with a commit URL. 0001's added exec.LookPath calls compile because os/exec is already imported in all three files; 0002's t.Setenv("SOURCE_DATE_EPOCH", "") matches util/timestamp/timestamp.go, which treats an empty value as unset.
Autopkgtest: Testsuite: autopkgtest-pkg-go is served by autodep8's go detector (Build-Depends contains golang-any) and the generated test runs /usr/bin/dh_golang_autopkgtest, which runs debian/rules build, so dh_auto_test -- -short applies and the docker-gated tests skip.
dh compat 14: the single-binary addon sets dh_auto_install's destdir to debian/ (tmpdir()), so execute_after_dh_auto_install's find on debian/golang-github-diskfs-go-diskfs-dev is the right path; relationship substvars are added by dh_gencontrol at compat 14.
No images, fonts, sounds, PDFs, minified JavaScript, bytecode or prebuilt programs remain in the tree; a glob for archive and binary extensions found none. partition/mbr/table.go's Format string taken from libblkid is a printf format (%.33s-%02x), not copied code.
uscan found the packaged version as the newest upstream release (upstream 1.9.4, packaged 1.9.4+ds).

Not confirmed ◂

Whether 1.9.4+ds-1 was ever uploaded, which decides the changelog issue.
Whether the package compiles against the versions Debian ships where go.mod names newer ones (pierrec/lz4 v4.1.26 against 4.1.18, go-test-deep v1.1.1 against 1.0.8, asciiset 2026-01 against 2024-02, logrus): the golang buildsystem builds with GO111MODULE=off, where go.mod versions are not enforced, so this is not necessarily a failure, and I could not build.
Whether debian/gbp.conf's debian/sid branch is the salsa repository's Debian branch; the VCS was not accessible.
I did not obtain the Linux kernel source to diff fs/ext4/hash.c and lib/halfmd4.c against the Go port; the derivation rests on the package's own ext4.md link and the matching constants, names and flow.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 7 days ago, started 7 days ago, completed 7 days ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

The uploader said:

All four are right, and I am rejecting this upload over the first one.

One correction to the finding: The same code is
in e2fsprogs lib/ext2fs/dirhash.c under LGPL-2, I have asked upstream
which file it came from and for a notice:
https://github.com/diskfs/go-diskfs/issues/455

[important] Right. testhelper/docker.go says "thanks to moby/tool, which is
licensed apache 2.0" and debian/copyright has no Apache-2.0 paragraph.

[minor] The single entry is deliberate: the package has never been accepted, so
the changelog carries one "Initial release". The -2 exists only because dak will
not take 1.9.4+ds-1 twice while the upload I rejected on 27 October is still in
the queue.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.9.4+ds1-1	e12f289c…	2026-11-01 09:12	2026-11-01 09:13	mechtilde	accepted	VIEW
1.9.4+ds-1	7d1a3073…	2026-10-27 18:13	2026-10-27 18:13	dfsg-uploader	rejected	VIEW
1.9.4+ds-1	7d1a3073…	2026-11-01 09:13	2026-11-01 09:13	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package