Review: golang-github-dvyukov-go-fuzz 0.0~git20240924.e577bee+ds2-1

Package Information

Description	Randomized testing for Go (library) Go-fuzz is a coverage-guided fuzzing solution (http://en.wikipedia.org/wiki/Fuzz_testing) for testing of Go packages. Fuzzing is mainly applicable to packages that parse complex inputs (both text and binary), and is especially useful for hardening of systems that parse inputs from potentially malicious users (e.g. anything accepted over a network). This package provides the go source code for development using dvyukov/go-fuzz.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Drew Parsons <dparsons@debian.org>
Sponsor	dparsons@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-dvyukov-go-fuzz.git (browse)
Closes	#1150708
Tracker	https://tracker.debian.org/pkg/golang-github-dvyukov-go-fuzz
Uploaded	22 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Fri, 16 Oct 2026 14:45:41 +0200
Source	golang-github-dvyukov-go-fuzz
Version	0.0~git20240924.e577bee+ds2-1
Changed-By	Drew Parsons <dparsons@debian.org>
Architecture	source amd64 all

Changelog◂

golang-github-dvyukov-go-fuzz (0.0~git20240924.e577bee+ds2-1) unstable; urgency=medium
 .
   * debian patch use_system_js.patch patches go-fuzz/assets/stats.html
     to use system bootstrap and jquery scripts. Add go-fuzz/assets
     scripts to Files-Exluded in debian/copright.
     Depends: libjs-bootstrap, libjs-jquery
   * debian/copyright: acknowledge Twitter contribution to
     go-fuzz/assets/stats.html (IE10 viewport workaround)
     so License: Apache-2.0 and MIT
   * update no_nonexisting_vendored.patch to reference unvendored
     github.com/elazarl/go-bindata-assetfs/go-bindata-assetfs
 .
 golang-github-dvyukov-go-fuzz (0.0~git20240924.e577bee+ds-1) unstable; urgency=medium
 .
   * add Depends: golang-golang-x-tools-dev
   * update debian/copyright
     - acknowledge go-fuzz project authors along with Dmitry Vyukov for
       main project (2015-2019 Apache-2.0)
     - go-fuzz/assets/bootstrap* and stats.html
       2011-2015 Twitter, Inc., MIT licence
       from Bootstrap v3.3.5 (http://getbootstrap.com)
     -  bootstrap.min.css contains normalize.css v3.0.3
       (github.com/necolas/normalize.css), also MIT licensed.
       © 2015 Nicolas Gallagher and Jonathan Neal
     - go-fuzz/assets/jquery.min.js
       2005, 2015 jQuery Foundation, Inc. MIT licence.
       jQuery v1.11.3, see jquery.org/license
   * add description to no_nonexisting_vendored.patch
     Upstream's copy of the nonexisting module was removed by
     Files-Excluded in debian/copyright
   * add Repack rules to debian/watch (use suffix +ds)
     since vendor directories are removed from the upstream tarball
     (Files-Excluded in debian/copyright)
 .
 golang-github-dvyukov-go-fuzz (0.0~git20240924.e577bee-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1150708)
     - golang-github-dvyukov-go-fuzz-dev provides the dev Go source
     - the go-fuzz package provides the go-fuzz and go-fuzz-build binary
       executables. Man pages generated via help2man (see README.Debian)
   * debian patch no_nonexisting_vendored.patch removes nonexisting
     vendored module from tests. See upstream Issue#235.

.dsc◂

Package-List	go-fuzz deb golang optional arch=any golang-github-dvyukov-go-fuzz-dev deb golang optional arch=all
Section	golang
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/dvyukov/go-fuzz
Upstream-Name: go-fuzz
Upstream-Contact: Dmitry Vyukov <dvyukov@google.com>
Files-Excluded:
  go-fuzz/vendor
  test/vendor
  go-fuzz/assets/bootstrap*
  go-fuzz/assets/jquery.min.js

Files: *
Copyright: 2015-2019 Dmitry Vyukov and go-fuzz project authors
License: Apache-2.0

Files: go-fuzz/assets/stats.html
Copyright: 2015-2019 go-fuzz project authors,
 2014-2015 Twitter, Inc. (IE10 viewport workaround)
License: Apache-2.0 and MIT

Files: debian/*
Copyright: 2026 Drew Parsons <dparsons@debian.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 21 days ago.

Report◂

DFSG NEW review for golang-github-dvyukov-go-fuzz version 0.0~git20240924.e577bee+ds2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is Apache-2.0 throughout (LICENSE holds the full text, every Go file carries the 'go-fuzz project authors ... Apache 2 LICENSE' header), with one MIT-attributed block in go-fuzz/assets/stats.html that debian/copyright matches with a dedicated stanza ('Apache-2.0 and MIT') and a reproduced MIT text. debian/copyright is DEP-5, has a correct Format, covers debian/* and the whole upstream tree, names the holders found, has no stale or wrong Files-Excluded entries (the excluded bootstrap*/jquery assets are absent), and both licences are DFSG-free and compatible. The prescan's author check found all source authors declared.

Packaging

The skeleton is sound for the Go team: compat 14, dh-sequence-golang, dpkg-build-api 1, current Standards-Version 4.7.4 with Policy at 4.7.4.1, Vcs-* fields, autopkgtest-pkg-go, a sane version and unstable changelog, correct dependency on the three imported Go libraries, and two binary packages split correctly. But the Debian-specific use_system_js.patch has been hand-applied to the generated go-fuzz/bindata_assetfs.go in a way that leaves the embedded statistics HTML pointing at files that no longer exist or at URLs the go-fuzz HTTP server cannot serve, so the documented -http statistics page loses its CSS and JavaScript; the package also puts the libjs-* dependencies in the -dev package instead of go-fuzz. That functional defect and the missing DEP-3 header on that patch are what a sponsor would have fixed.

Issues

important packaging 1. use_system_js.patch breaks go-fuzz's HTTP statistics page ◂

Files: debian/patches/use_system_js.patch:5-16, debian/patches/use_system_js.patch:40-124, go-fuzz/assets/stats.html:3-4, go-fuzz/assets/stats.html:65-66, go-fuzz/bindata_assetfs.go:3, go-fuzz/bindata_assetfs.go:74, go-fuzz/bindata_assetfs.go:89, go-fuzz/bindata_assetfs.go:185, go-fuzz/coordinator.go:132-134, debian/control:27-28, debian/control:43
Basis: checked, in the package or with a reference tool
Evidence: -<link rel="stylesheet" href="/bootstrap.min.css"> becomes +<link rel="stylesheet" href="file:///usr/share/javascript/bootstrap/css/bootstrap.min.css">, and -<script src="/jquery.min.js"></script> becomes +<script src="/usr/share/javascript/jquery/jquery.min.js"></script>. The bindata hunk @@ -75,86 +71,6 @@ deletes _assetsBootstrapThemeMinCss, _assetsBootstrapMinCss, _assetsBootstrapMinJs and _assetsJqueryMinJs, but leaves var _assetsStatsHtml = []byte("\x1f\x8b...") (line 124) as unchanged context, and its metadata is still size: 3868 ... modTime: time.Unix(1550787301, 0). go-fuzz/coordinator.go serves the page with r.URL.Path = "/stats.html" and http.FileServer(assetFS()).ServeHTTP(w, r).
Problem: The go-fuzz binary serves stats.html from the gzip blob embedded in bindata_assetfs.go, not from the patched file on disk, so the patch to the HTML has no effect on the program: the running server still sends the original page whose /bootstrap.min.css, /bootstrap-theme.min.css, /bootstrap.min.js and /jquery.min.js links address assets that the same patch has just deleted from the embedded filesystem. Every one of them therefore returns 404, jQuery is never defined, the EventSource handler fails, and the statistics page documented in README.md (-http flag) is unusable. Even the patched HTML could not work: an http-served page cannot load file:///usr/share/javascript/... subresources, and the scheme-less /usr/share/javascript/jquery/jquery.min.js is a request to the go-fuzz server itself, whose only asset is stats.html. The libjs-bootstrap and libjs-jquery dependencies are also in the wrong package: they are in golang-github-dvyukov-go-fuzz-dev (debian/control:27-28), while it is go-fuzz (debian/control:43) that would need them at runtime.
Fix: Do not hand-edit the generated bindata file. Either keep upstream's embedded bootstrap and jQuery and drop use_system_js.patch (both are MIT and already accounted for, and nothing in them is DFSG-problematic), or serve the system files deliberately, e.g. add an http handler rooted at /usr/share/javascript and keep the page's URLs matching it, add libjs-bootstrap and libjs-jquery to the go-fuzz package's Depends (not the -dev package), and regenerate go-fuzz/bindata_assetfs.go with its //go:generate command so the embedded HTML matches the source.

minor packaging 2. use_system_js.patch has no DEP-3 header ◂

Files: debian/patches/use_system_js.patch:1
Basis: checked, in the package or with a reference tool
Evidence: The file starts directly with Index: golang-github-dvyukov-go-fuzz/go-fuzz/assets/stats.html; unlike no_nonexisting_vendored.patch, it has no Description:, Author:, Origin: or Forwarded: field.
Problem: DEP-3 headers are the established way to record a patch's purpose, author and upstream status, and the second patch in the series has them. A Debian-specific patch that rewrites generated code needs at least a description and a Forwarded status so that a later maintainer knows why it exists and whether it has been sent upstream.
Fix: Add a DEP-3 header, e.g. Description: explaining the system-JS intent, Author:/Origin: as appropriate, and Forwarded: (not-needed or no, with the reason).

Verified ◂

The prescan's copyright-holder check reported all source authors declared (57 files scanned); it listed no other files needing individual explanation.
debian/copyright is DEP-5 with the correct Format, a Files: * stanza (2015-2019 Dmitry Vyukov and go-fuzz project authors, Apache-2.0), a go-fuzz/assets/stats.html stanza (go-fuzz project authors and 2014-2015 Twitter, Inc., Apache-2.0 and MIT) and a debian/* stanza (2026 Drew Parsons, Apache-2.0); the MIT text is reproduced in full and Apache-2.0 is pointed at /usr/share/common-licenses/Apache-2.0.
LICENSE is the full Apache-2.0 text. Every .go file under go-fuzz/, go-fuzz-build/, go-fuzz-defs/, go-fuzz-dep/, gen/, internal/, test/ and slides/ that was sampled carries Copyright 20xx go-fuzz project authors. All rights reserved. and Use of this source code is governed by Apache 2 LICENSE.
grep across the tree for BSD, GPL/LGPL, MPL, ISC, CC/CC0, 'public domain', 'non-commercial', 'no modification' and 'All rights reserved' found no licence terms other than Apache-2.0 and the MIT block in go-fuzz/assets/stats.html; slides/crash.go, slides/gob.go and slides/regexp.go have no header of their own but are covered by the Files: * stanza.
go-fuzz/assets/stats.html lines 80-81 contain only // Copyright 2014-2015 Twitter, Inc. / // Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE), which the dedicated stanza represents.
No .js, .css, .min.*, .jar, .so, .pdf or .pyc files remain in the tree; the only generated file is go-fuzz/bindata_assetfs.go, whose generator and input are named in go-fuzz/main.go's //go:generate lines and go-fuzz/assets/ (the staleness of the embedded blob is reported above, not a missing source).
slides/algo.png, slides/bugs.png and slides/go-fuzz.png are upstream presentation images; not opened, judged from slides/README.md and the .slide files; covered by Files: *. test/corpus/0, test/corpus/1 and test/corpus/2 are test corpus data, likewise covered by Files: *.
debian/control: compat 14 with dpkg-build-api 1 and dh-sequence-golang; golang-github-elazarl-go-bindata-assetfs-dev, golang-github-stephens2424-writerset-dev and golang-golang-x-tools-dev are imported by the source; Standards-Version 4.7.4 is current against Policy 4.7.4.1; Vcs-Browser/Vcs-Git and Testsuite: autopkgtest-pkg-go are present; the changelog is for unstable with a well-formed version and an initial-release bug closure.
Built-Using: ${misc:Built-Using} is not an undefined substvar: /usr/bin/dh_golang sets misc:Built-Using (optionally, alongside misc:Static-Built-Using) at build time.
debian/rules is the standard Go-team dh $@ --buildsystem=golang with a build directory, the install files match the two main packages (gen/main.go is package gen and test/test.go is package test, so they produce no binaries), and the debian/.install and debian/.manpages files cover the binaries, the Go source tree and the two man pages.
/usr/share/common-licenses/Apache-2.0 and the installed dh_golang were consulted for the substvar and licence-text claims.
uscan found the packaged version as the newest upstream release (upstream 0.0~git20240924.e577bee, packaged 0.0~git20240924.e577bee+ds2).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

No build or autopkgtest was run. In particular, the trailing comma in Depends: ${misc:Depends}, ${shlibs:Depends}, (debian/control:43) is malformed-looking; whether dpkg-deb's control parser rejects it can only be settled by a build.
Whether the installed go-fuzz binary's statistics page was ever exercised by hand; the breakage reported above is inferred from the generated file and coordinator code, not from running the server.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 21 days ago, started 21 days ago, completed 21 days ago.

Final Comment

Hi,

Thanks for making the changes. The LLM suggests that the changes to use system-wide bootstrap/jquery might have a bug, but I'm sure you'll fix that if it is really the case.

Thanks!

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.0~git20240924.e577bee+ds-1	4894e9cd…	2026-10-16 01:18	2026-10-16 02:36	awm	rejected	VIEW
0.0~git20240924.e577bee-1	3821b704…	2026-10-14 22:51	2026-10-15 07:10	awm	rejected	VIEW

Back to Dashboard | View all reviews for this package