DFSG NEW review for golang-github-dvyukov-go-fuzz version 0.0~git20240924.e577bee-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Unclear
• Issues: 1 blocker, 1 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

The distribution is DFSG-free: everything is Apache-2.0 or MIT, both compatible and free, and no non-free clauses were found. But debian/copyright does not accurately or completely describe the licensing. The vendored third-party web assets in go-fuzz/assets — Bootstrap v3.3.5, jQuery v1.11.3 and normalize.css v3.0.3, all MIT — and their embedded copies inside the generated go-fuzz/bindata_assetfs.go are swallowed by the catch-all Files: * stanza, which licenses them as Apache-2.0 (c) 2015 Dmitry Vyukov, with no MIT stanza or notice. The catch-all also names a single holder/year while the file headers say 'go-fuzz project authors' across 2015-2019.

Packaging

The packaging is otherwise solid: debhelper 14 compat, dh-sequence-golang, dpkg-build-api (=1), golang-any, Multi-Arch foreign on the -dev package, autopkgtest-pkg-go, help2man man pages, a single small quilt patch, Vcs-* and Standards-Version 4.7.4 current. The deciding fact I could not verify: golang-github-stephens2424-writerset-dev is both in Build-Depends and in the -dev Depends and names a real import (go-fuzz/coordinator.go:22), but it is absent from the local unstable/experimental package lists (which may be days-old, and the package may be co-uploaded). If it is truly not in the archive the source cannot be built and the -dev package is unsatisfiable; otherwise the packaging is good. A minor DEP-3 nit on the one patch.

Issues

1. [blocker] [packaging] Build-Depends and Depends name golang-github-stephens2424-writerset-dev, not found in the archive

• Files: debian/control:10, debian/control:21-22, go-fuzz/coordinator.go:22
• Evidence: golang-github-stephens2424-writerset-dev in Build-Depends and in the -dev Depends; apt-cache: 'No packages found ... nothing provides it' in the unstable/experimental lists; "github.com/stephens2424/writerset" imported by go-fuzz/coordinator.go:22.
• Problem: The import is real and non-optional, so the package needs writerset at build time, and the -dev package declares it at runtime. If the package is genuinely absent from the archive this source cannot be built and the -dev package is unsatisfiable (Policy 7.1). Caveat: the local package lists may be some days old, so a co-upload in the same batch cannot be ruled out.
• Fix: Before acceptance, confirm golang-github-stephens2424-writerset-dev is (or is being) uploaded to Debian; if not, upload it first, or adjust the dependency.

2. [important] [licensing] Vendored MIT assets (Bootstrap, jQuery, normalize.css) and their embedded copies are mis-licensed as Apache-2.0

• Files: debian/copyright:9-11, go-fuzz/assets/bootstrap.min.css:2-4, go-fuzz/assets/bootstrap-theme.min.css:2-4, go-fuzz/assets/bootstrap.min.js:2-4, go-fuzz/assets/jquery.min.js:1, go-fuzz/assets/stats.html:80-81, go-fuzz/bindata_assetfs.go:1-8
• Evidence: *| Bootstrap v3.3.5 (http://getbootstrap.com), *| Copyright 2011-2015 Twitter, Inc., *| Licensed under MIT; /*! jQuery v1.11.3 | (c) 2005, 2015 jQuery Foundation, Inc. | jquery.org/license */; /*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */; catch-all stanza Files: * Copyright: 2015 Dmitry Vyukov License: Apache-2.0.
• Problem: Policy 12.5 requires debian/copyright to carry the actual licence of every shipped file. The Files: * catch-all attributes these MIT-licensed third-party files (and the copies of them go-bindata embeds in bindata_assetfs.go) to Apache-2.0 (c) Dmitry Vyukov. There is no Files stanza and no standalone MIT license text for them; MIT is not in /usr/share/common-licenses, so its notice must be reproduced. Attribute holders are also wrong (Twitter, Inc.; jQuery Foundation, Inc.; Nicolas Gallagher/Jonathan Neal).
• Fix: Add a Files: go-fuzz/assets/* stanza (also covering the embedded copies in go-fuzz/bindata_assetfs.go) listing the MIT holders above, plus a standalone License: MIT paragraph with the full MIT text; leave Apache-2.0 for the remaining files.

3. [minor] [licensing] Copyright holders in the catch-all stanza do not match the file headers

• Files: debian/copyright:10, go-fuzz/main.go:1-2, internal/pcg/pcg.go:1
• Evidence: Headers read // Copyright 2015 go-fuzz project authors. All rights reserved. (2016/2018/2019 variants in test/internal/test, testdep, internal/pcg, go-fuzz-dep/cover.go); catch-all says Copyright: 2015 Dmitry Vyukov.
• Problem: The copyright file names a single individual ('Dmitry Vyukov', year 2015) while the notices across the tree name 'go-fuzz project authors' over 2015-2019. A holder not represented in the notices is a mismatch a sponsor would want corrected.
• Fix: Use something like Copyright: 2015-2019 go-fuzz project authors (optionally adding 'Dmitry Vyukov' as well).

4. [minor] [packaging] Quilt patch has no DEP-3 headers

• Files: debian/patches/no_nonexisting_vendored.patch, debian/patches/series
• Evidence: Patch begins directly with Index:/---/+++; no Description:, Origin: or Forwarded: fields. The upstream Issue#235 reference appears only in debian/changelog.
• Problem: DEP-3 headers document a patch's purpose and upstream status, which the maintainer evidently tracked in the changelog but not in the patch itself.
• Fix: Add DEP-3 Description: (and Forwarded: no/link to upstream issue 235) fields to the patch.

5. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Evidence: 0.0~git20240924.e577bee-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• Read debian/copyright (DEP-5, Format: URLs 1.0), control, rules, changelog, source/format, all install/manpages files, README.Debian, gbp.conf, salsa-ci/gitlab-ci, upstream/metadata, the patch + series, and both help2man-generated man pages.
• Inventory of the full upstream tree (excluding .pc/ and debian/), then read every textual file: all Go sources under gen/, go-fuzz/, go-fuzz-build/, go-fuzz-defs/, go-fuzz-dep/, internal/, test/, testdep/, versifier/, slides/*.go, LICENSE, README.md, .travis.yml, .gitignore.
• Every Go source carries the Apache-2.0 notice Copyright 20XX go-fuzz project authors, consistent with the root LICENSE (Apache-2.0 full text).
• Identified go-fuzz/assets/bootstrap.min.css/.theme.min.css/bootstrap.min.js (Bootstrap v3.3.5, MIT), jquery.min.js (jQuery v1.11.3, MIT), normalize.css v3.0.3 embedded in bootstrap.min.css (MIT), and that go-fuzz/bindata_assetfs.go (go-bindata generated, source assets present) embeds all of them.
• Confirmed the Build-Depends imports: writerset (coordinator.go:22) and go-bindata-assetfs (bindata_assetfs.go:23), and that golang-github-elazarl-go-bindata-assetfs-dev exists in the archive.
• Debian ships libjs-bootstrap 3.4.1 and libjs-jquery 3.7.1, so the unminified sources of the embedded Bootstrap/jQuery are available in Debian.
• Every upstream file is matched by the single catch-all Files: * stanza (the only other stanza is debian/*). No other LICENSE/COPYING/NOTICE files exist in subdirectories.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20240924.e577bee, packaged 0.0~git20240924.e577bee).

Not confirmed

• Could not confirm golang-github-stephens2424-writerset-dev exists in the archive: not found in the local (possibly days-old) unstable/experimental package lists; a pending co-upload by the maintainer cannot be ruled out.
• Binary files not opened (slides/algo.png, bugs.png, go-fuzz.png; test/corpus/0,1,2); judged from location and use (talk illustrations and test corpora, within the Apache-2.0 project).
• Could not build the package or run autopkgtest in this read-only review; whether go test ./... fully passes is unverified.
• testscripts/*.txt (upstream testscript suites, network-dependent) were read for provenance but not executed.

Proposed changes

None.