golang-github-fluxcd-cli-utils 1.2.2-1

Package Information

Description	Flux kstatus, a hard fork of kubernetes-sigs/cli-utils (library) This repository is a hard fork of kubernetes-sigs/cli-utils reducing it to the kstatus package and adding extensions for Flux's use cases.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-fluxcd-cli-utils.git (browse)
Closes	#1152906
Tracker	https://tracker.debian.org/pkg/golang-github-fluxcd-cli-utils
Uploaded	2 hours ago

New Package Report

.changes◂

Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Fri, 30 Oct 2026 15:28:48 +0100
Source	golang-github-fluxcd-cli-utils
Version	1.2.2-1

Changelog◂

golang-github-fluxcd-cli-utils (1.2.2-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152906)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-fluxcd-cli-utils-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/fluxcd/cli-utils
Upstream-Name: cli-utils
Upstream-Contact: https://github.com/fluxcd/cli-utils/issues

Files: *
Copyright: 2019-2022 The Kubernetes Authors.
           2026 The Flux Authors.
License: Apache-2.0

Files: DCO
Copyright: 2004, 2006 The Linux Foundation and its contributors.
License: DCO-1.1
Comment: Developer Certificate of Origin text, not code.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: DCO-1.1
 Everyone is permitted to copy and distribute verbatim copies of this
 license document, but changing it is not allowed.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for golang-github-fluxcd-cli-utils version 1.2.2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole tree is Apache-2.0 except the Developer Certificate of Origin text. Every one of the 76 first-party Go files carries Copyright <year> The Kubernetes Authors. (2019-2022) or Copyright 2026 The Flux Authors. with SPDX-License-Identifier: Apache-2.0, LICENSE is the Apache License 2.0, and debian/copyright is DEP-5 with Files: * naming both holders, a separate Files: DCO stanza for the Linux Foundation text and debian/* for the packaging; the Apache-2.0 text is referenced to /usr/share/common-licenses/Apache-2.0 as Policy 12.5 allows. No non-free clause, field-of-use or no-modification term applies to any code, and there is no vendored third-party source in the tree (go.sum lists checksums only).

Packaging

Standard Debian Go packaging: source format 3.0 (quilt) with no patches, debhelper compat 14 with dh-go, dpkg-build-api 1, a single Architecture: all Multi-Arch: foreign -dev package built by dh_golang, test-only dependencies marked <!nocheck>, Testsuite: autopkgtest-pkg-go, correct Vcs-*/Homepage/XS-Go-Import-Path, an initial-release changelog closing the ITP, and salsa-ci. Standards-Version 4.7.4 against Policy 4.7.4.1 is current. The only defect is one minor Build-Depends gap: debian/rules reads source from three Go packages that it does not declare and that are installed only transitively; the elaborate go.work workaround in rules is otherwise reasonable but rests on dh-go internals I could not confirm (see Not confirmed).

Issues

minor packaging 1. debian/rules uses the sources of golang-github-peterbourgon-diskv-dev, golang-github-evanphx-json-patch-dev and cel-go, none of which is in Build-Depends ◂

Files: debian/rules:48-58, debian/control:7-22
Basis: checked, in the package or with a reference tool
Evidence: ln -s /usr/share/gocode/src/github.com/peterbourgon/diskv/*.go . and sed ... /usr/share/gocode/src/github.com/peterbourgon/diskv/go.mod > go.mod; go mod edit -require=github.com/evanphx/json-patch/v5@v5.7.0 -require=cel.dev/cel-go@v0.32.0 ... plus replace github.com/evanphx/json-patch/v5 => ./src/github.com/evanphx/json-patch/v5. Build-Depends names none of golang-github-peterbourgon-diskv-dev, golang-github-evanphx-json-patch-dev, golang-github-google-cel-go-dev; apt-cache show golang-k8s-client-go-dev shows the first two only as its own Depends.
Problem: The build reads files of packages it does not declare. They happen to be in the chroot today only because golang-k8s-client-go-dev and golang-k8s-kubectl-dev pull them in as Depends, so a future dependency change in kubernetes/client-go silently removes the diskv source or the json-patch v5 tree and the build dies in fix-go-work with a shell error that says nothing about the cause. Policy 7.7 makes Build-Depends the declaration of what debian/rules needs, and a build must not rely on another package's dependency graph.
Fix: Add golang-github-peterbourgon-diskv-dev, golang-github-evanphx-json-patch-dev and the package providing cel.dev/cel-go (golang-github-google-cel-go-dev) to Build-Depends, and consider pinning dh-go (>= 1.69) since rules calls its private buildsystem methods.

Verified ◂

Read all of debian/ (control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, upstream/metadata); there is no debian/patches directory and no maintainer scripts.
Listed and inventoried the entire upstream tree (about 91 files): 76 Go files, LICENSE, DCO, Makefile, go.mod, go.sum, README.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, MAINTAINERS, .golangci.yml, .gitignore, .github/dependabot.yaml and .github/workflows/{test,scan}.yml, plus pkg/kstatus/README.md.
Every Go file but the two generated ones has Copyright <year> The Kubernetes Authors. (2019-2022) or Copyright 2026 The Flux Authors. and SPDX-License-Identifier: Apache-2.0; debian/copyright Files: * names both holders, so no holder is missing (dfsg-author-check found none either).
Generated files pkg/kstatus/polling/event/type_string.go and pkg/kstatus/watcher/restscopestrategy_string.go are Code generated by "stringer" output; their input is in the package as the Type/RESTScopeStrategy consts with //go:generate stringer ... in pkg/kstatus/polling/event/event.go:17 and pkg/kstatus/watcher/watcher.go:31, so the preferred form for modification is present; they carry no header but are covered by Files: *.
DCO is the Developer Certificate of Origin 1.1 text, whose only restriction is changing it is not allowed, the same wording the GPL's own text carries; it is a licence document, not part of the built library, and debian/copyright gives it its own stanza with the correct Linux Foundation holder.
LICENSE is the unmodified Apache License 2.0; debian/copyright refers Apache-2.0 to /usr/share/common-licenses/Apache-2.0, as Policy 12.5 permits.
No further licence wording anywhere in the tree: a case-insensitive search for copyright, (C), ©, Licensed under, Permission is hereby granted, GNU ... General Public, Apache License, Mozilla Public, public domain, All rights reserved, MIT, BSD, ISC, non-commercial, field of use found only the Apache-2.0 headers, LICENSE, DCO and Makefile header.
No vendored third-party code: there is no vendor/ or third_party/ directory; go.sum contains module checksums only.
Build-dependency packages checked with apt-cache: golang-go is 1.27 (go.mod's go 1.26.0 is satisfied), golang-k8s-client-go-dev 0.36.4, golang-k8s-kubectl-dev 1.36.4, golang-k8s-sigs-kustomize-kyaml-dev 0.21.1, golang-gomega-dev 1.39.1, golang-github-evanphx-json-patch-dev 5.7.0 (matching the v5.7.0 require), golang-github-peterbourgon-diskv-dev 3.0.0, golang-github-google-cel-go-dev 0.30.0; dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11.
golang-k8s-sigs-controller-runtime-dev is not in the archive yet; it is built by golang-k8s-sigs-controller-runtime 0.24.1-1, waiting in NEW, so it is not a fault.
{misc:Depends} is the only substvar needed at compat 14, and the < !nocheck > marking of go-cmp/testify/gomega is correct because dh skips dh_auto_test for nocheck from compat 13 on.
Debian revisions: source format 3.0 (quilt) with an empty patch series, changelog 1.2.2-1 to unstable closing the ITP, Testsuite: autopkgtest-pkg-go with the test dependencies in Build-Depends, Standards-Version 4.7.4 (Policy 4.7.4.1, so current).
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.4.0, packaged 1.2.2), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

debian/rules:26-31 builds go.work by calling dh-go's private methods _setup_module_mappings, _construct_modules and _create_go_work_file, but the golang buildsystem module installed here (/usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm, the one dh-go provides) defines none of them and contains no go.work code at all, so on a chroot whose dh-go matches this module the write-go-work step would die with Can't locate object method; either the archive's dh-go 1.69 differs from this copy (the rules comment names that version) or the build fails. A build on a clean unstable chroot would settle it.
debian/rules:49 appends replace github.com/evanphx/json-patch/v5 => ... to go.work; if dh-go's own mapping already wrote a replace for that module, the go command rejects the duplicate (replacement ... appears multiple times). The comment says dh-go fails to map that module, which I could not check without running dh-go.

Proposed changes ◂

None.

Uploader's response to the LLM review

Good catch LLM, I am on it! that is for the next revision, please FTP Master, accept this upload.

— Juan Manuel Méndez Rey (mendezr), 1 hour ago

fixed in the next revision: https://salsa.debian.org/go-team/packages/golang-github-fluxcd-cli-utils/-/commit/30953b2 adds diskv, json-patch and cel-go to Build-Depends. Please accept.

— Juan Manuel Méndez Rey (mendezr), 0 hours ago

Back to Dashboard | View all reviews for this package