DFSG NEW review for golang-github-facebookincubator-nvdtools version 0.1.5+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The source is Apache-2.0 throughout: every .go file carries the uniform Facebook Apache-2.0 header, the top-level LICENSE is the stock Apache-2.0 text, and the only differently-licensed file (vulndb/sqlutil/b64schema/lint.go, which also carries The Go Authors' BSD-3-clause header) has its own stanza in debian/copyright with the full BSD-3-clause text reproduced. The file is DEP-5, the header's Files-Excluded: debian matches the shipped tarballs (the orig tarball has no debian/, the debian tarball adds only debian/), no non-free terms or built/binary files exist anywhere in the tree, and the holders named in the file notices (Facebook, Inc. and its affiliates; 2013 The Go Authors; the maintainer for debian/*) are all declared.

Packaging

The packaging is modern and mostly careful: debhelper compat 14, dpkg-build-api (= 1), dh-go with a justified lintian override, a documented decision to ship only the subset of nvdtools that builds against packaged dependencies, autopkgtest via autodep8, and an empty patch series. Two things would be raised before upload: the binary package's Description advertises command-line tools and NVD feed parsing that the package deliberately does not contain, and the Depends (and Build-Depends) list nine packages of which only testify is imported by anything that is shipped.

Issues

1. [important] [packaging] Binary Description advertises the command-line tools and NVD feed parsing that debian/rules excludes from the package

• Files: debian/control:32-40, debian/rules:17
• Basis: checked, in the package or with a reference tool
• Evidence: Description of golang-github-facebookincubator-nvdtools-dev: "NVD Tools is a collection of Go libraries and command-line utilities ... The libraries implement ... parsing of NVD JSON and XML feeds. The command-line tools convert third-party vendor advisories into the NVD JSON format, match CPEs against CVE feeds, and maintain a local vulnerability database." versus debian/rules: export DH_GOLANG_EXCLUDES := cmd cvefeed providers vulndb stats, with DH_GOLANG_EXCLUDES_ALL defaulting to true at compat >= 12 so those trees are excluded from the -dev package as well. cmd/ holds every command-line tool and cvefeed/ is the NVD JSON/XML feed parser; the only binary package is the Architecture: all -dev package, which ships no /usr/bin files.
• Problem: The package ships neither the command-line utilities nor the NVD JSON/XML feed parsing the description promises, so apt show/apt search misdescribe the package to users and to reverse-dependency authors. Policy 3.4 requires the Description to describe the package it is attached to.
• Fix: Rewrite the long description to describe what is actually shipped (WFN parsing/matching/conversion, CVSS v2/v3 scoring, the CPE dictionary and rpm label handling) and say that the remaining upstream tools and feed parsers are not built because their dependencies are not in Debian; or ship the tools.

2. [minor] [packaging] Depends and Build-Depends list eight packages that only the excluded directories need

• Files: debian/control:11-22, debian/control:41-50, debian/rules:17
• Basis: checked, in the package or with a reference tool
• Evidence: Both Build-Depends and Depends name golang-github-andreyvit-diff-dev, golang-github-go-sql-driver-mysql-dev, golang-github-pkg-errors-dev, golang-github-spf13-cobra-dev, golang-github-spf13-pflag-dev, golang-golang-x-oauth2-google-dev, golang-golang-x-sync-dev and golang-github-burntsushi-toml-dev. The packages that are actually shipped (cpedict/, cvss2/, cvss3/, rpm/, wfn/; cmd cvefeed providers vulndb stats are excluded from install, DH_GOLANG_EXCLUDES_ALL being true by default at compat >= 12) import only the standard library, github.com/facebookincubator/nvdtools/wfn, and in test files github.com/stretchr/testify/assert.
• Problem: Eight of the nine dependencies are needed only by the excluded code (andreyvit/diff by cvefeed, go-sql-driver/mysql and BurntSushi/toml by vulndb, cobra/pflag by cmd, oauth2/sync by providers); testify is imported by the shipped test files. Over-declared Depends hand every reverse dependency a wrong build set and inflate the Go dependency/transition graph for a package that ships five small library packages.
• Fix: Drop the eight unused entries from Depends (keep golang-github-stretchr-testify-dev for the shipped tests) and from Build-Depends, or state why they are kept.

Verified

• Prescan: its author check scanned all 230 files and found every copyright holder already named in debian/copyright; it listed no built/binary file and no rare non-free licence wording, so there was no scan finding to account for.
• debian/copyright is DEP-5 (Format: .../copyright-format/1.0/); stanzas are Files: * (Apache-2.0, Facebook, Inc. and its affiliates), debian/* (Apache-2.0, 2026 Juan Manuel Mendez Rey), and the later vulndb/sqlutil/b64schema/lint.go stanza (Apache-2.0 and BSD-3-clause), with the BSD-3-clause text reproduced in full; the Apache-2.0 paragraph points at /usr/share/common-licenses/Apache-2.0, which exists.
• All 209 files matched by copyright/licence greps (copyright, (C), Licensed under, Apache License, Redistribution and use, GNU, LGPL, Mozilla Public, Permission is hereby granted, public domain, SPDX-License-Identifier) carry the same Facebook Apache-2.0 header or are covered by it; the only second header in the tree is the Go Authors' BSD-style one in vulndb/sqlutil/b64schema/lint.go, which the copyright file declares.
• LICENSE is stock Apache-2.0 (appendix placeholder unfilled, so it names no holder), which is why the holder is taken from the per-file headers; README.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md and nvdtools.spec claim Apache-2.0 or Apache License 2.0 for the same project.
• Files-Excluded: debian in the copyright header matches the shipped tarballs: golang-github-facebookincubator-nvdtools_0.1.5+ds.orig.tar.xz contains nvdtools-0.1.5/ with no debian/ entry, and the .debian.tar.xz adds only debian/.
• No raster/vector images, fonts, archives, .jar/.class/.so/.dll/.pyc, minified JS/CSS or PDFs exist anywhere under the tree (glob over those extensions returned nothing).
• Generated code has its generator and input in the tree: providers/idefense/schema/schema.go is produced by providers/idefense/schema/gen.go from the file providers/idefense/schema/schema via script.sed, all three shipped; vulndb/sqlutil/b64schema/lint.go is a copy of golang/lint's file, declared as such.
• debian/source/format is 3.0 (quilt) with an empty quilt series and no debian/patches directory; the debian tarball contains exactly the twelve debian/ files present in the tree.
• Packaging mechanics checked against the package's own level: debhelper compat 14, dpkg-build-api (= 1) makes Rules-Requires-Root default to no (dpkg-build-api(1)), dh-go 1.69 is in the archive and neither Provides dh-sequence-golang nor conflicts with the use of --with=golang (apt-cache show dh-go), which is what debian/source/lintian-overrides documents; Testsuite: autopkgtest-pkg-go is served by autodep8's go template (/usr/share/autodep8/support/go/{detect,generate}), whose detect matches golang-any in Build-Depends, and /usr/bin/dh_golang_autopkgtest rebuilds against /usr/share/gocode/src and runs go test on the shipped packages.
• Every package named in Build-Depends and Depends exists in the archive (golang-github-andreyvit-diff-dev, golang-github-go-sql-driver-mysql-dev, golang-github-pkg-errors-dev, golang-github-spf13-cobra-dev, golang-github-spf13-pflag-dev, golang-github-stretchr-testify-dev, golang-golang-x-oauth2-google-dev, golang-github-burntsushi-toml-dev, dh-go, golang-any via apt-cache).
• debian/lrc.config is a real licenserecon configuration file (syntax documented in /usr/share/lrc/lrc.config), its d/copyright name | licensecheck name mapping is in the right order, and it documents the dual-licence file accurately.
• No patch files, maintainer scripts, tests/control, install/links/dirs/docs files or *.maintscript are present, and none is needed for a single arch:all -dev package.
• I read file headers across the tree by targeted greps and reads rather than reading all 230 files line by line.
• Files-Excluded removes only upstream's own debian/ directory, which the Debian packaging replaces anyway, so that alone calls for no repack suffix.
• uscan found the packaged version as the newest upstream release (upstream 0.1.5, packaged 0.1.5+ds).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• I could not build or run anything, so the build and autopkgtest results are reasoned from debian/rules, the golang debhelper buildsystem source and the autodep8/dh-go scripts, not observed.

Proposed changes

None.