Review: golang-github-expr-lang-expr 1.17.8-1
Package Information
| Description | Expression language and expression evaluation for Go (library) Expr is a Go-centric expression language for evaluating dynamic expressions and configurations with a focus on accuracy, safety, and speed. It combines a simple, C-like syntax with an optimizing compiler and a bytecode virtual machine. Expr is memory-safe, side-effect-free, and always terminating, so untrusted expressions can be evaluated safely. It is statically typed, catching type errors at compile time and reporting user-friendly error messages, integrates directly with Go types without needing to redefine them, and ships with built-in functions such as all, any, none, one, filter, and map. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Arthur Diniz <arthurbd@debian.org> |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-expr-lang-expr.git (browse) |
| Closes | #1150237 |
| Tracker | https://tracker.debian.org/pkg/golang-github-expr-lang-expr |
| Uploaded | 1 month, 1 day ago |
New Package Report
.changes
| Source | golang-github-expr-lang-expr |
|---|---|
| Version | 1.17.8-1 |
| Changed-By | Arthur Diniz <arthurbd@debian.org> |
| Architecture | source all |
| Distribution | unstable |
| Date | Wed, 07 Oct 2026 14:51:13 +0100 |
Changelog
golang-github-expr-lang-expr (1.17.8-1) unstable; urgency=medium . * Initial release (Closes: #1150237)
.dsc
| Section | golang |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | golang-github-expr-lang-expr-dev deb golang optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Source: https://github.com/expr-lang/expr Upstream-Name: expr Upstream-Contact: https://github.com/expr-lang/expr/issues Files: * Copyright: 2018 Anton Medvedev License: Expat Files: internal/spew/* Copyright: 2013-2016 Dave Collins <dave@davec.name> License: Expat Files: debian/* Copyright: 2026 Arthur Diniz <arthurbd@debian.org> License: Expat Comment: Debian packaging is licensed under the same terms as upstream License: Expat Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: . The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Review Information
rejected — allocated to awm 1 month, 1 day ago, started 1 month, 1 day ago, completed 1 month, 1 day ago.
Final Comment
Hi,
Licensing Issues
- internal/spew/* — wrong licence short name (Expat ≠ actual text).
debian/copyright:10–12 labels this stanza License: Expat, but every header is ISC, e.g. internal/spew/doc.go:2–11: "Copyright (c) 2013-2016 Dave Collins dave@davec.name … Permission to use, copy, modify, and distribute this software for any purpose with or without fee … THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES … IN NO EVENT SHALL THE AUTHOR BE LIABLE …". That is the ISC template (same wording the golang-github-davecgh-go-spew package uses), not the Expat/MIT "AUTHORS OR COPYRIGHT HOLDERS" text. The Invariant: change the stanza to License: ISC (text already in /usr/share/common-licenses). Holder is correct.
- internal/difflib/* — vendored pmezard/go-difflib (BSD-3-Clause), not covered.
internal/difflib/difflib.go:1–14 is the verbatim pmezard doc header: "Package difflib is a partial port of Python difflib module … SequenceMatcher … unified_diff … context_diff"; no copyright notice was carried over. It falls into the Files: * catch-all as "Anton Medvedev, MIT", which is wrong on both holder and licence. Fix: add a specific stanza, e.g. Files: internal/difflib/*, Copyright: 2013-2021 Patrick Mezard, License: BSD-3-clause, with the BSD-3 text included (not in common-licenses).
- internal/testify/* — vendored stretchr/testify (MIT), not covered.
Verbatim testify code with testify's generators (e.g. internal/testify/assert/assertions.go:25 //go:generate … ../_codegen/_codegen …, .tmpl files) and no copyright lines. Also falls under the catch-all as "Anton Medvedev". Fix: add Files: internal/testify/* with the testify holder (e.g. Copyright: 2012-2020 Mat Ryer/expr-lang vendored copy) and License: Expat; the Expat paragraph already carries the full MIT text.
This is not academic: DH_GOLANG_EXCLUDES only drops test/examples, so all of internal/* (including these three vendored trees) is installed into the -dev package.
Minor Packaging Issue
Patch should be forwarded (minor). debian/patches/0001-*.patch is a genuine upstream bug (tests fail to compile on 32-bit — hardcoded 64-bit literals in builtin/builtin_test.go, expr_test.go), is DEP-3 formatted, and the runtime-computed bitushr() helper is a sound fix. Forwarded: no is present; it should be forwarded to expr-lang/expr or a bug note added.
Thanks!