Review: golang-github-dvyukov-go-fuzz 0.0~git20240924.e577bee+ds-1

Package Information

Description	Randomized testing for Go (library) Go-fuzz is a coverage-guided fuzzing solution (http://en.wikipedia.org/wiki/Fuzz_testing) for testing of Go packages. Fuzzing is mainly applicable to packages that parse complex inputs (both text and binary), and is especially useful for hardening of systems that parse inputs from potentially malicious users (e.g. anything accepted over a network). This package provides the go source code for development using dvyukov/go-fuzz.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Drew Parsons <dparsons@debian.org>
Sponsor	dparsons@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-dvyukov-go-fuzz.git (browse)
Closes	#1150708
Tracker	https://tracker.debian.org/pkg/golang-github-dvyukov-go-fuzz
Uploaded	23 days ago

New Package Report

.changes◂

Date	Thu, 15 Oct 2026 18:07:10 +0200
Source	golang-github-dvyukov-go-fuzz
Version	0.0~git20240924.e577bee+ds-1
Changed-By	Drew Parsons <dparsons@debian.org>
Architecture	source amd64 all
Distribution	unstable

Changelog◂

golang-github-dvyukov-go-fuzz (0.0~git20240924.e577bee+ds-1) unstable; urgency=medium
 .
   * add Depends: golang-golang-x-tools-dev
   * update debian/copyright
     - acknowledge go-fuzz project authors along with Dmitry Vyukov for
       main project (2015-2019 Apache-2.0)
     - go-fuzz/assets/bootstrap* and stats.html
       2011-2015 Twitter, Inc., MIT licence
       from Bootstrap v3.3.5 (http://getbootstrap.com)
     -  bootstrap.min.css contains normalize.css v3.0.3
       (github.com/necolas/normalize.css), also MIT licensed.
       © 2015 Nicolas Gallagher and Jonathan Neal
     - go-fuzz/assets/jquery.min.js
       2005, 2015 jQuery Foundation, Inc. MIT licence.
       jQuery v1.11.3, see jquery.org/license
   * add description to no_nonexisting_vendored.patch
     Upstream's copy of the nonexisting module was removed by
     Files-Excluded in debian/copyright
   * add Repack rules to debian/watch (use suffix +ds)
     since vendor directories are removed from the upstream tarball
     (Files-Excluded in debian/copyright)
 .
 golang-github-dvyukov-go-fuzz (0.0~git20240924.e577bee-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1150708)
     - golang-github-dvyukov-go-fuzz-dev provides the dev Go source
     - the go-fuzz package provides the go-fuzz and go-fuzz-build binary
       executables. Man pages generated via help2man (see README.Debian)
   * debian patch no_nonexisting_vendored.patch removes nonexisting
     vendored module from tests. See upstream Issue#235.

.dsc◂

Priority	optional
Component	main
Package-List	go-fuzz deb golang optional arch=any golang-github-dvyukov-go-fuzz-dev deb golang optional arch=all
Section	golang

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/dvyukov/go-fuzz
Upstream-Name: go-fuzz
Upstream-Contact: Dmitry Vyukov <dvyukov@google.com>
Files-Excluded:
  go-fuzz/vendor
  test/vendor

Files: *
Copyright: 2015-2019 Dmitry Vyukov and go-fuzz project authors
License: Apache-2.0

Files: go-fuzz/assets/bootstrap*
 go-fuzz/assets/stats.html
Copyright: 2011-2015 Twitter, Inc.
 2015 Nicolas Gallagher and Jonathan Neal (normalize.css)
License: MIT
Comment:Bootstrap v3.3.5 (http://getbootstrap.com)
 bootstrap.min.css contains normalize.css v3.0.3
 (github.com/necolas/normalize.css), also MIT licensed.

Files: go-fuzz/assets/jquery.min.js
Copyright: 2005, 2015 jQuery Foundation, Inc.
License: MIT
Comment:jQuery v1.11.3, see  jquery.org/license

Files: debian/*
Copyright: 2026 Drew Parsons <dparsons@debian.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 23 days ago.

Report◂

DFSG NEW review for golang-github-dvyukov-go-fuzz version 0.0~git20240924.e577bee+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 4 found

Licensing

All licences in the tree are free and debian/copyright is DEP-5 in the right form: upstream Go and asm sources are Apache-2.0 (Copyright <year> go-fuzz project authors, root LICENSE is the Apache-2.0 text), and the assets under go-fuzz/assets/ are genuinely MIT with the full MIT text reproduced. Two faults remain. The four assets (bootstrap, bootstrap-theme, jquery) are shipped only in minified form, so their preferred form for modification is absent from the source package even though they are distributed both in the -dev tree and embedded in the go-fuzz binary (Policy 4.16 / DFSG 2); and the stats.html stanza attributes the whole of that file, most of which is upstream's own Apache-2.0 dashboard code, to Twitter under MIT. Everything else in debian/copyright matches the files.

Packaging

Conventional, careful Go-team packaging: 3.0 (quilt), debhelper-compat 14 with dh-sequence-golang and dpkg-build-api 1, correct split between the arch:all -dev package and the arch:any go-fuzz binaries with Built-Using, Source/Homepage/Vcs-*/XS-Go-Import-Path/upstream metadata all present, Standards-Version 4.7.4 (current Policy 4.7.4.1), every Build-Depends and binary Depends resolvable, a DEP-3 patch with the upstream issue link for the removed vendored module, a sane changelog with the +ds repack documented, man pages generated by help2man and documented in README.Debian. The only defect worth fixing is a leftover go:generate directive that points into the vendor directory the repack removes.

Issues

blocker licensing 1. Bootstrap and jQuery assets are shipped only minified, without their sources ◂

Files: go-fuzz/assets/bootstrap.min.css, go-fuzz/assets/bootstrap-theme.min.css, go-fuzz/assets/bootstrap.min.js, go-fuzz/assets/jquery.min.js, go-fuzz/bindata_assetfs.go:1-7, go-fuzz/coordinator.go:131-134
Evidence: minified one-liners with headers only: /*! jQuery v1.11.3 | (c) 2005, 2015 jQuery Foundation, Inc. | jquery.org/license */ followed by //# sourceMappingURL=jquery.min.map; * Bootstrap v3.3.5 (http://getbootstrap.com) / * Copyright 2011-2015 Twitter, Inc.; /*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */; and // sources: assets/bootstrap-theme.min.css (23.357kB) ... assets/jquery.min.js (95.992kB) in the generated go-fuzz/bindata_assetfs.go, which coordinator.go serves with http.FileServer(assetFS()).
Problem: These are built (minified) files: Bootstrap 3.3.5's Less/JS sources, normalize.css 3.0.3 and the unminified jquery.js 1.11.3 are nowhere in the source package, and the jquery.min.map the file points at is absent too. The files are distributed anyway - in /usr/share/gocode/.../go-fuzz/assets/ via the -dev package and embedded in the go-fuzz binary's HTTP dashboard - so the package does not carry the preferred form for modification of files it distributes. Policy 4.16 requires, for main (or contrib), either repacking the upstream tarball to include those sources or shipping them in debian/missing-sources.
Fix: Repack the tarball so the sources come with it (Bootstrap 3.3.5 less/ and js/, normalize.css 3.0.3, jQuery 1.11.3 jquery.js), or place them under debian/missing-sources/go-fuzz/assets/ (e.g. bootstrap.min.css from the unminified bootstrap.css, jquery.min.js from jquery.js); regenerating bindata_assetfs.go from Debian's own libjs-bootstrap/libjs-jquery sources would be equivalent. Ask upstream to ship the unminified assets in go-fuzz/assets/ in the longer term. The MIT stanzas themselves stay valid.

minor licensing 2. stats.html attributed wholly to Twitter/MIT although most of it is upstream's Apache-2.0 code ◂

Files: debian/copyright:13-20, go-fuzz/assets/stats.html:79-81
Evidence: stanza Files: go-fuzz/assets/bootstrap* / go-fuzz/assets/stats.html with Copyright: 2011-2015 Twitter, Inc. and License: MIT; the only Twitter text in the file is the IE10 viewport workaround: // Copyright 2014-2015 Twitter, Inc. / // Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). The rest of the file (the rowFmt table code, the new EventSource("/eventsource") handler, the dashboard markup) is upstream's own.
Problem: This stanza overrides the Files: * catch-all, so the whole of stats.html is declared to be Twitter's MIT work, when most of it is go-fuzz project authors, Apache-2.0. debian/copyright therefore misdescribes that file's copyright and licence.
Fix: Give stats.html its own stanza, e.g. Copyright: 2015-2019 go-fuzz project authors plus 2014-2015 Twitter, Inc. (IE10 viewport workaround) with License: Apache-2.0 and MIT, or keep the MIT stanza for the three bootstrap files and note the embedded snippet in a Comment on the Files: * stanza covering stats.html.

minor packaging 3. go:generate directives still point into the vendor directory removed by the repack ◂

Files: go-fuzz/main.go:23-26, debian/copyright:5-7
Evidence: //go:generate go build github.com/dvyukov/go-fuzz/go-fuzz/vendor/github.com/elazarl/go-bindata-assetfs/go-bindata-assetfs and //go:generate ./go-bindata-assetfs assets/..., while Files-Excluded: go-fuzz/vendor (and the +ds repack) removes go-fuzz/vendor.
Problem: The documented way of regenerating the generated go-fuzz/bindata_assetfs.go cannot work in the Debian source package any more, the same problem that forced debian/patches/no_nonexisting_vendored.patch for test/test.go; bindata_assetfs.go itself imports github.com/elazarl/go-bindata-assetfs, which Debian ships as golang-github-elazarl-go-bindata-assetfs-dev. Upstream's own tree keeps the vendor copy, so the directive is correct upstream and wrong here.
Fix: Adjust the directive to the import path actually used (github.com/elazarl/go-bindata-assetfs/go-bindata-assetfs, or $(go env GOPATH)/bin/go-bindata-assetfs) and forward that upstream, or drop the two vendor-specific lines and document in debian/README.Debian how to regenerate the file with the packaged library.

Verified ◂

Read debian/copyright in full: DEP-5, Format: exactly the copyright-format/1.0 URL, Source/Upstream-Name/Upstream-Contact, Files-Excluded: go-fuzz/vendor, test/vendor, four Files: stanzas and stand-alone License: paragraphs for Apache-2.0 (with pointer to /usr/share/common-licenses/Apache-2.0, which exists) and MIT.
Tree-wide grep (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved) over the whole tree excluding .pc/: every .go/.s file outside go-fuzz/assets/ carries Copyright <2015|2016|2018|2019> go-fuzz project authors. All rights reserved. + Apache 2 LICENSE; the exceptions are the two generated files, go-fuzz-dep/doc.go and the three tiny slides/*.go examples, whose only licence is the root LICENSE. Root LICENSE is the Apache-2.0 text.
MIT short name and version match the files, and the full MIT text is reproduced in debian/copyright (it is not in /usr/share/common-licenses, so it must be).
Asset holders as declared are the ones in the files: Copyright 2011-2015 Twitter, Inc. in the three bootstrap* files (Bootstrap v3.3.5), 2015 Nicolas Gallagher and Jonathan Neal via the normalize.css v3.0.3 banner inside bootstrap.min.css, (c) 2005, 2015 jQuery Foundation, Inc. in jquery.min.js.
Generated files have their inputs in the tree: go-fuzz/bindata_assetfs.go from go-fuzz/assets/* (go:generate line 24; header lists all five assets), go-fuzz/exectype_string.go from type execType in go-fuzz/worker.go:25-27.
Test data and CI text with no separate licence, covered by Files: *: test/corpus/0, 1, 2, test/internal/test/test.go, test/testdep/testdep.go, testscripts/*.txt (6), .travis.yml, .gitignore, README.md, slides/*.slide, slides/README.md.
slides/algo.png, slides/bugs.png, slides/go-fuzz.png are the illustrations of the two talks whose .slide sources sit beside them, covered by the repo-wide Apache-2.0 LICENSE; recorded by name, not opened.
Files-Excluded names go-fuzz/vendor and test/vendor; neither is in the unpacked tree nor in golang-...e577bee+ds.orig.tar.xz (checked inside the archive), and the vendored github.com/elazarl/go-bindata-assetfs is Debian's golang-github-elazarl-go-bindata-assetfs-dev, so no embedded code copy is used (Policy 4.13).
No non-free licence wording in the tree (grep for non-commercial, no-modification, no-derivatives, research-only, good-not-evil and similar matched only Apache-2.0 patent/attribution text in LICENSE).
Dependencies checked against the archive: golang-any, golang-github-elazarl-go-bindata-assetfs-dev (1.0.0-1.1), golang-github-stephens2424-writerset-dev (1.0.2-1) and golang-golang-x-tools-dev (1:0.52.0+ds-1) all exist and are used by go-fuzz-build/main.go (x/tools), go-fuzz/sonar.go (writerset) and go-fuzz/bindata_assetfs.go (go-bindata-assetfs); dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11 and debhelper-compat (= 14) by debhelper 14.5; Standards-Version 4.7.4 has the current Policy version's first two components (Policy 4.7.4.1).
Read every other file under debian/: control, rules, changelog, gbp.conf, salsa-ci.yml, gitlab-ci.yml, README.Debian, go-fuzz.1, go-fuzz-build.1, go-fuzz.manpages, the two .install files, source/format (3.0 quilt), upstream/metadata, patches/series and patches/no_nonexisting_vendored.patch (DEP-3 header with Forwarded: no and the upstream issue 235 URL; the patch is applied in the tree). No maintainer scripts and no debian/tests/ - Testsuite: autopkgtest-pkg-go is the Go team's generated-test convention.
uscan found the packaged version as the newest upstream release (upstream 0.0~git20240924.e577bee, packaged 0.0~git20240924.e577bee+ds).

Not confirmed ◂

Whether the packaged go-fuzz-build can find github.com/dvyukov/go-fuzz/go-fuzz-dep (loaded by import path in go-fuzz-build/main.go:301) on a machine with no network and without golang-github-dvyukov-go-fuzz-dev installed; the go-fuzz package declares no such dependency and upstream relies on the Go module machinery. A build or run of go-fuzz-build would settle it.
The pixels of slides/algo.png, slides/bugs.png, slides/go-fuzz.png were not inspected (binary images); their provenance rests on the repository-wide Apache-2.0 LICENSE.

Proposed changes ◂

None.

Review Information

rejected — allocated to awm 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Hi,

Thanks for fixing the licensing and other issues... but...

The bootstrap.min.js and jquery.min.js still need their sources. While the exact versions aren't in Debian, that matters little since stats.html is the only page that needs these and it uses Bootstrap for grid and table classes only and never uses Bootstrap's JS. It uses jQuery only for $(...).text() and .prepend(), which haven't changed between 1.11 (whqat is here) and 3.7 (what is in Debian). Bootstrap 3.4.1 supports jQuery 3.

Ways out, roughly from least to most work:

Put the matching unminified upstream files (jquery-1.11.3.js, bootstrap 3.3.5 css/js) in debian/missing-sources/. No code changes.
At build time, replace the assets with the files from libjs-bootstrap and libjs-jquery and regenerate bindata_assetfs.go. The tools are in the archive, but the go:generate lines in go-fuzz/main.go point into the excluded vendor/ directory and would need patching. Debian's go-bindata is from 2015, and bindata_assetfs.go looks like it came from a newer one, so this needs a test build.
Patch go-fuzz to serve the assets from /usr/share/javascript and add Depends: on the libjs-* packages. This is the cleanest Debian approach but needs a code patch.

Other issues highlighted in the LLM-based review are also confirmed valid (and minor - see link below), though also relatively little work.

If you disagree with the analysis, please reply with your own thoughts on all of this.

Thanks!

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.0~git20240924.e577bee+ds2-1	1d06fdf7…	2026-10-17 10:01	2026-10-17 10:07	awm	accepted	VIEW
0.0~git20240924.e577bee-1	3821b704…	2026-10-14 22:51	2026-10-15 07:10	awm	rejected	VIEW

Back to Dashboard | View all reviews for this package