Review: golang-github-diskfs-go-diskfs 1.9.4+ds1-1

Package Information

Description	manipulate disks, disk images and filesystems natively in Go (library) go-diskfs manipulates disks, disk images and filesystems entirely in Go, without mounting anything and without shelling out to fdisk, gdisk, mkfs.vfat, mtools or libguestfs, and so without needing root. It can read, create and modify MBR and GPT partition tables, and read and write FAT32, ISO 9660 (including Rock Ridge and El Torito boot images), squashfs and ext4 filesystems, working either on a whole image or block device or within a single partition.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-diskfs-go-diskfs.git (browse)
Closes	#1148636
Tracker	https://tracker.debian.org/pkg/golang-github-diskfs-go-diskfs
Uploaded	7 days ago
Supersedes	1.9.4+ds-1

New Package Report

.changes◂

Version	1.9.4+ds1-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Sat, 31 Oct 2026 20:40:10 +0100
Source	golang-github-diskfs-go-diskfs

Changelog◂

golang-github-diskfs-go-diskfs (1.9.4+ds1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148636)

.dsc◂

Priority	optional
Component	main
Package-List	golang-github-diskfs-go-diskfs-dev deb golang optional arch=all
Section	golang

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/diskfs/go-diskfs
Upstream-Name: go-diskfs
Upstream-Contact: https://github.com/diskfs/go-diskfs/issues
Files-Excluded:
 filesystem/squashfs/testdata/tools
 examples/create-iso-from-folder/my-folder/gopher.gif
 filesystem/squashfs/testdata/file2_uncompressed.sqs
Comment: filesystem/squashfs/testdata/tools holds mksquashfs and unsquashfs as
 checked-in ELF x86-64 executables, dynamically linked and not stripped,
 shipped with no source, no licence statement and no provenance note anywhere
 in the repository. gopher.gif is the Go gopher artwork, shipped without
 attribution or a licence statement. file2_uncompressed.sqs is a squashfs image
 that buildtestsqs.sh does not generate and no test reads, so unlike the other
 images it has no preferred form of modification in the tree. All three are
 removed from the source tarball.
 The remaining binary filesystem images under testdata are kept: each of those
 directories carries a README and a generator script (buildtestsqs.sh,
 buildtestiso.sh, mkfat32.sh, buildimg.sh), so their preferred form for
 modification is present.

Files: *
Copyright: 2017 Avi Deitcher
License: Expat

Files: filesystem/ext4/dirhash.go
       filesystem/ext4/md4/md4.go
Copyright: 2002 Theodore Ts'o
License: GPL-2
Comment: These two files carry no notice of their own, and upstream licenses the
 whole repository as Expat, but they are a transliteration of the ext4 directory
 hash: the constants (teaDelta 0x9E3779B9, k2 0o13240474631, k3 0o15666365641),
 the TEA loop, the f, g and h functions under the comment "basic MD4 functions",
 and a round() whose own comment says it "applies the round function as a
 macro", which is the C ROUND macro.
 The same code exists in two places. The Linux kernel ships it in
 fs/ext4/hash.c under GPL-2.0, and e2fsprogs in lib/ext2fs/dirhash.c under
 LGPL-2, both written by Theodore Ts'o. The constants and macros are identical
 in the two, so they do not say which one was used, but dirhash.go declares
 HashVersionSIP = 6 and siphash appears only in the kernel file. GPL-2 is
 therefore declared here, as the stricter of the two candidates.
 Upstream has been asked which file it was ported from, at
 https://github.com/diskfs/go-diskfs/issues/455 . If the answer is e2fsprogs,
 this becomes LGPL-2.

Files: testhelper/docker.go
Copyright: 2017 Avi Deitcher
           2015-2017 Docker, Inc.
License: Apache-2.0
Comment: The file says "thanks to moby/tool, which is licensed apache 2.0" and
 carries no notice of its own. github.com/moby/tool is Apache-2.0 and its NOTICE
 reads "Copyright 2015-2017 Docker, Inc."; the function here follows its
 src/moby/docker.go.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: GPL-2
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License version 2 as
 published by the Free Software Foundation.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 On Debian systems, the complete text of the GNU General Public License
 version 2 can be found in /usr/share/common-licenses/GPL-2.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 License for the specific language governing permissions and limitations
 under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0 can
 be found in /usr/share/common-licenses/Apache-2.0.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 days ago.

Report◂

DFSG NEW review for golang-github-diskfs-go-diskfs version 1.9.4+ds1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 11 found

Licensing

debian/copyright is DEP-5 with a correct header (Format, Upstream-Name, Upstream-Contact, Source, Files-Excluded and its rationale), a Files: * Expat stanza matching LICENSE, and three file-specific stanzas whose claims I checked against the code: the ext4 dirhash/md4 pair is a transliteration of Theodore Ts'o's ext4 directory hash, declared GPL-2 (the stricter of the kernel's GPL-2.0 and e2fsprogs' LGPL-2), and testhelper/docker.go is the Apache-2.0 moby/tool helper with Docker, Inc. named. Every licence is free and the GPL-2/Expat/Apache-2.0 mix in one source package is distributable, Expat being GPL-compatible and the ext4 code living in its own package. The three Files-Excluded paths are gone and unreferenced; the eleven binary files the scan listed are test fixtures that each have a generator script or documented commands in the tree, so their preferred form for modification is present. I found no unlicensed file, no non-free term and no missing licence text.

Packaging

Modern, conventional Go library packaging: source format 3.0 (quilt) with a +ds1 repack, debhelper compat 14 with dpkg-build-api 1, dh-go (which ships the golang sequence addon, hence the explicit --with=golang and a documented lintian override for lintian's stale dh-golang mapping), the single-binary addon activated explicitly, DEP-3 patches, and an arch:all Multi-Arch: foreign binary package. All twelve go.mod requirements appear in both Build-Depends and Depends and all exist in the archive; the two test-only modules in Depends are what the autopkgtest-pkg-go test needs to compile the test files. The docker-dependent suites are neutralised by a documented patch and a -short test run, not by broken Build-Depends. I found no policy violation and no defect that would break a build or an upgrade.

Issues

None.

Verified ◂

Coverage: read every file in debian/ (control, rules, changelog, copyright, gbp.conf, README.source, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata, patches/series and all four patches); grepped all 267 upstream files (excluding .pc/) for Copyright, (C), the copyright sign, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, Apache License, Mozilla Public, public domain, All rights reserved, thanks to, based on, derived from, Code generated and go:generate.
Licence evidence in the tree: the only licence text is LICENSE (MIT/Expat, Copyright (c) 2017 Avi Deitcher); the only attribution comments are testhelper/docker.go:12 (thanks to moby/tool, which is licensed apache 2.0) and the ext4 hash code, both already given stanzas in debian/copyright; there is no other LICENSE/COPYING/NOTICE/AUTHORS anywhere below the root, and no notice names a holder debian/copyright omits, which matches the prescan's author check.
DFSG compliance of the mixed licences: GPL-2, Expat and Apache-2.0 are all free; Expat is GPL-compatible, so the ext4 package (GPL-2 dirhash.go and md4.go plus Expat files) is distributable, and the Apache-2.0 file is in a separate package that ext4 does not import. debian/README.source states the consequence for consumers correctly: importing filesystem or filesystem/squashfs does not link the ext4 package.
ext4 GPL-2 claim checked in the code: filesystem/ext4/md4/md4.go and filesystem/ext4/dirhash.go reproduce kernel fs/ext4/hash.c and e2fsprogs lib/ext2fs/dirhash.c - teaDelta 0x9E3779B9, MD4 k2/k3, the ROUND shift schedules (3,7,11,19 / 3,5,9,13 / 3,9,11,15), the basic MD4 functions f/g/h and round applies the round function as a macro. Declaring GPL-2 as the stricter candidate is defensible, and it is documented in the stanza's Comment, in README.source and at https://github.com/diskfs/go-diskfs/issues/455. The rest of ext4 (checksum.go, xattr.go, features.go, inode.go and the others) only cites e2fsprogs and kernel documentation, which is not copying.
Binary files the scan listed, all test fixtures whose preferred form is in the tree and all read by a test: filesystem/iso9660/testdata/9660.iso and rockridge.iso are built by filesystem/iso9660/testdata/buildtestiso.sh (xorriso writes both) and opened at common_internal_test.go:13-14; filesystem/iso9660/testdata/volrecords.iso is an 8 KiB volume-descriptor slice of the Ubuntu 18.04.1 server ISO, produced by the dd documented at filesystem/iso9660/testdata/README.md:17-19 and read at volume_descriptor_internal_test.go:14; it is data, no code copied.
filesystem/squashfs/testdata/file.sqs, file_uncompressed.sqs, read_test.sqs and dir_read.sqs are all produced by filesystem/squashfs/testdata/buildtestsqs.sh (mksquashfs in a container) and are opened by const_internal_test.go, superblock_internal_test.go, compatibility_test.go and squashfs_test.go; with list.txt and read_test.md5sums they are unchanged test data, not built programs.
partition/gpt/testdata/gpt.img and gpt_partition.dat, and partition/mbr/testdata/mbr.img and mbr_partition.dat, are raw images written from /dev/zero and /dev/random by the sgdisk, sfdisk, mkfs.vfat and dd commands in the two testdata READMEs, and are read by partition_internal_test.go. The README bullets call the .dat files .img; the documented commands write exactly the shipped names. The Files-Excluded Comment says every kept testdata directory carries a README and a generator script; for partition/gpt and partition/mbr the regeneration steps are in the README rather than a script, so that sentence is loose, but the instructions are present.
Files-Excluded honoured: filesystem/squashfs/testdata/tools, examples/create-iso-from-folder/my-folder/gopher.gif and filesystem/squashfs/testdata/file2_uncompressed.sqs are absent, and no Go file, script or README refers to them; filesystem/squashfs/testdata/.gitignore still lists tools/, but the directory is gone. file2_uncompressed.sqs is indeed not produced by buildtestsqs.sh and read by no test, unlike file_uncompressed.sqs at const_internal_test.go:19.
Dependencies: every require in go.mod (anchore/go-lzo, djherbis/times, elliotwutingfeng/asciiset, go-test/deep, google/go-cmp, google/uuid, klauspost/compress, pierrec/lz4/v4, pkg/xattr, sirupsen/logrus, ulikunitz/xz, golang.org/x/sys) appears in Build-Depends and in the -dev package's Depends, and each is imported by at least one file. Found in the archive: golang-github-elliotwutingfeng-asciiset-dev, golang-github-anchore-go-lzo-dev, golang-github-djherbis-times-dev, golang-github-pierrec-lz4-dev 4.1.18, golang-github-go-test-deep-dev 1.0.8. golang-go is 1.27, so go.mod's go 1.25.0 is satisfiable.
debhelper use: dh-go ships the sequence addon named golang, the golang buildsystem and dh_golang (apt-cache description) and has dropped Provides: dh-sequence-golang, so --with=golang at debian/rules:7 is necessary and correct, and the debian/source/lintian-overrides entry explains exactly that; /usr/share/perl5/Debian/Debhelper/Sequence/golang.pm inserts dh_golang before dh_gencontrol. Compat 14 with dpkg-build-api (= 1) is the recommended API level per dpkg-build-api(7).
Single-binary addon: at compat 14 dh_auto_install uses debian/tmp unless the single-binary addon is active, and it is explicitly in Build-Depends (dh-sequence-single-binary is first provided by debhelper 14.5); the golang buildsystem therefore installs into debian/golang-github-diskfs-go-diskfs-dev/usr/share/gocode/src, so the find hook in debian/rules:14 targets the right directory, and the four testdata .gitignore files are the only stray files it has to remove.
Tests: override_dh_auto_test at compat 14 needs no nocheck check of its own and is skipped under that option (debhelper tool, dh compat 13 change); dh_auto_test -- -short reaches the buildsystem and becomes go test -vet=off -v -p N -short plus the targets. Docker users are gated: filesystem/ext4/common_test.go:44, filesystem/fat32/common_test.go:66 and disk/disk_test.go:536 skip via exec.LookPath(docker), and the other docker callers (partition/gpt/table_test.go:303, partition/mbr/table_test.go:292, the squashfs and iso9660 finalize tests) return or skip when TEST_IMAGE is empty. os/exec is already imported in every file patch 0001 touches.
Patches: all four have DEP-3 Description, Author and Last-Update headers; 0001 and 0002 are Forwarded: not-yet, 0003 and 0004 are Applied-Upstream with a commit URL; the series is in order and the patched files in the tree contain the changes (sync/time_other.go:23, filesystem/ext4/journal_test.go:670, util/timestamp/timestamp_test.go:38-41). Patch 0002 is correct: GetTime treats an empty SOURCE_DATE_EPOCH as unset.
Changelog and metadata: version 1.9.4+ds1-1 for distribution unstable, a single entry closing ITP #1148636; +ds1 is right for a repack that removes files. Standards-Version 4.7.4 shares its first two components with the reviewing system's Policy 4.7.4.1, so it is current. Vcs-Git, Vcs-Browser, Homepage and XS-Go-Import-Path all name the same project and agree.
debian/gbp.conf's dist = DEP14 is not an option of any gbp command (gbp.conf(5) keys are command-line option names; gbp-dch(1) says --distribution cannot be set via gbp.conf). gbp ignores unknown keys, so the line is inert leftover configuration, not a fault; the rest of the file (debian-branch = debian/sid, ignore-branch) is conventional.
There are no maintainer scripts, maintscript files, .install/.links/.docs/.dirs files or debian/tests directory: dh_golang installs the library source including testdata itself, and the autopkgtest is the autodep8-generated one declared through Testsuite: autopkgtest-pkg-go.
uscan found the packaged version as the newest upstream release (upstream 1.9.4, packaged 1.9.4+ds1).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2).

Not confirmed ◂

Whether the archive's golang-github-elliotwutingfeng-asciiset-dev (0.0 git20240214.24af97c) exports MakeASCIISet, the only asciiset API used at filesystem/fat12/directoryentry.go:24, while go.mod asks for a 2026-01 commit; GOPATH builds use whichever copy Debian ships. The maintainer's clean build implies it is present, but I could not read the installed package's source to check.
Test coverage, not reported as an issue: with docker absent, as in every build chroot and autopkgtest container, patched TestMain in filesystem/ext4 and filesystem/fat32 exits before m.Run(), so those two suites run no tests in Debian and the disk whole-disk subtest skips; running the suite would show how much of the four filesystems is actually covered.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 7 days ago.

Review Information

accepted — allocated to mechtilde 6 days ago, started 6 days ago, completed 6 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.9.4+ds-2	58afa913…	2026-10-31 19:30	2026-10-31 19:30	dfsg-uploader	rejected	VIEW
1.9.4+ds-1	7d1a3073…	2026-10-27 18:13	2026-10-27 18:13	dfsg-uploader	rejected	VIEW
1.9.4+ds-1	7d1a3073…	2026-11-01 09:13	2026-11-01 09:13	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package