DFSG NEW review for golang-github-glebarez-go-sqlite version 1.23.0+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

debian/copyright is DEP-5 with Format 1.0, names every holder in the tree, and matches the evidence. The tree is BSD-3-clause ("The Sqlite Authors": headers on every upstream file, LICENSE), except the concurrentBenchmark block in all_test.go, which carries Jim Kalafut's MIT notice and is covered by the "BSD-3-clause and Expat" stanza, and SQLITE-LICENSE, which is the SQLite public-domain statement (a grant, not a restriction) and is correctly not claimed as a licence of this source. No non-free terms, no file without a licence, no binaries or generated blobs, and everything shipped is covered by the three licences in the file.

Packaging

Compatible debhelper 14 packaging for a library-only Go module: dh-go's golang addon is named explicitly (dh-go 1.69 no longer Provides: dh-sequence-golang, as the lintian override explains), dpkg-build-api (= 1) is valid and the rules supports all required targets, the Build-Depends match exactly what the build and its tests import, sqlite3 is a <!nocheck> dependency for the pre-test hook, Standards-Version 4.7.4 is current, and autopkgtest-pkg-go's generated test works because debian/rules recreates the excluded test databases in the build tree. The only observation worth a line is that the +ds repack leaves the installed test files unable to compile; Debian's own test path is unaffected.

Issues

1. [minor] [packaging] Installed dev package ships all_test.go referencing embed.db/embed2.db, which the +ds repack removed and no file in the package provides

• Files: all_test.go:2702, all_test.go:2705, debian/rules:29-34, debian/copyright
• Basis: checked, in the package or with a reference tool
• Evidence: all_test.go: //go:embed embed.db and //go:embed embed2.db (TestVFS); debian/copyright Files-Excluded: embed.db embed2.db; debian/rules execute_after_dh_auto_test: rm -f $(foreach db,$(TEST_DBS),$(TEST_DB_DIR)/$(db).db), which runs before dh_auto_install, while /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm sub install copies every file under the build directory's src/, *_test.go included.
• Problem: The two databases exist only inside the build tree between dh_auto_test and dh_auto_install, so /usr/share/gocode/src/github.com/glebarez/go-sqlite/ gets all_test.go without them, and go test (or go vet) run in the installed directory fails to compile with "pattern embed.db: no matching files found". The package's own tests are unaffected: autopkgtest-pkg-go runs /usr/bin/dh_golang_autopkgtest, which copies the installed sources into the build directory and runs debian/rules build, and the execute_before_dh_auto_test hook recreates the databases first (autodep8 adds sqlite3 through @builddeps@). The divergence is visible only to someone running the tests by hand from /usr/share/gocode, but it is a shipped Go file that cannot be compiled.
• Fix: Either keep the two files in the tarball instead of excluding them (they are upstream's own test data, 8 KiB each, and dropping the repack would also remove the sqlite3 build dependency and both rules hooks), or add a patch that drops the embed-based TestVFS from the installed copy, or at least state the limitation in debian/README.source next to the explanation of the repack.

Verified

• Prescan, SQLITE-LICENSE:9 and debian/copyright:98 "...for any purpose, commercial or non-commercial...": this is the SQLite public-domain dedication, which grants rights ("Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original SQLite code ... for any purpose, commercial or non-commercial, and by any means") and restricts nothing. The file is not a licence of this package and the Files: SQLITE-LICENSE stanza says so; the phrasing is not a DFSG problem.
• Read debian/copyright in full: DEP-5, Format 1.0, Files-Excluded: embed.db embed2.db, four Files stanzas (*, all_test.go, SQLITE-LICENSE, debian/*) and three stand-alone licences (BSD-3-clause, Expat, public-domain), all with full text; later stanzas correctly override *.
• Every holder in the tree is named: all upstream files carry Copyright <year> The Sqlite Authors with the BSD-style reference to LICENSE (LICENSE: Copyright (c) 2017 The Sqlite Authors. All rights reserved.), and all_test.go:2826-2846 carries Copyright (c) 2022 Jim Kalafut and the MIT text for concurrentBenchmark. Files: * (The Sqlite Authors) and the all_test.go stanza (The Sqlite Authors, Jim Kalafut; BSD-3-clause and Expat) match. AUTHORS/CONTRIBUTORS are name lists, not notices.
• No file is left uncovered: outside debian/, every path (AUTHORS, CONTRIBUTORS, LICENSE, README.md, SQLITE-LICENSE, the ten root .go files, go.mod/go.sum, benchmark/, compat/, examples/example1/, functest/, .github/) is matched by Files: * or by an overriding stanza, and debian/ by debian/*.
• No binaries and no preferred-form-for-modification problems: the only non-.go files are Markdown, YAML (.github), go.mod/go.sum, name lists and three SQL/statement files; no .db (the two excluded ones are absent from the tree and from the .orig.tar.xz), no .so/.a/.jar/.class/image/font/PDF. Minified code or vendored third-party copies: none (benchmark/bench_test.go imports mattn/go-sqlite3 but vendors nothing).
• Licence evidence collected by grepping the whole tree for Copyright/(C)/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/Mozilla/public domain/All rights reserved: only the two holders above and the three licences in debian/copyright appear; no non-commercial, no-modification or field-of-use wording anywhere beyond the SQLite grant quoted above.
• sqlite.go:5 //go:generate go run generator.go -full-path-comments names a file upstream does not ship (it is absent from the tree and from the .orig.tar.xz, which has addport.go but no generator.go). It is only a directive: DH_GOLANG_GO_GENERATE is unset, so go generate is never run and nothing is generated in the build.
• Packaging read in full: debian/{changelog,control,copyright,gbp.conf,golang-github-glebarez-go-sqlite-dev.examples,rules,README.source,salsa-ci.yml,source/format,source/lintian-overrides,testdata/embed.sql,testdata/embed2.sql,upstream/metadata}. No debian/patches, no maintainer scripts, no debian/tests (autodep8 generates one for Testsuite: autopkgtest-pkg-go: /usr/share/autodep8/support/go/generate runs /usr/bin/dh_golang_autopkgtest with Depends: @, @builddeps@).
• Build-Depends cover exactly what is compiled: non-test code imports modernc.org/libc, modernc.org/sqlite/lib and golang.org/x/sys/unix (matching Depends), while github.com/google/pprof/profile and modernc.org/mathutil are imported only by all_test.go, so Build-Depends (not Depends) is right, dh_auto_test running as part of build at compat 14.
• sqlite3 <!nocheck> matches debian/rules: dh skips override/hook targets of dh_auto_test under nocheck from compat 13, so the test databases are not created in a nocheck build and sqlite3 is not needed there.
• debian/rules' TEST_DB_DIR := debian/_build/src/github.com/glebarez/go-sqlite is the right path: Buildsystem/golang.pm sub configure copies sources to $builddir/src/$DH_GOPKG, get_builddir() returns the --builddirectory value relative to the top directory, and dh_golang_autopkgtest's override computes APT_BDIR the same way before cp -a /usr/share/gocode/src "$APT_BDIR".
• functest/ contains only func_test.go; Buildsystem/golang.pm's get_targets drops such packages from the build ("contains no non-test Go files, removing it from build"), so it cannot break go install.
• dh-go 1.69 (apt-cache) has no Provides: dh-sequence-golang and Conflicts: dh-golang, and debian/rules passes --with=golang explicitly, so debian/source/lintian-overrides' missing-build-dependency-for-dh-addon override is justified. dpkg-build-api (= 1) is a virtual package provided by dpkg-dev (= 1) (dpkg-build-api(7): level 1 is the recommended level, from dpkg 1.22), and dh supplies all targets it requires. Standards-Version 4.7.4 against Policy 4.7.4.1 is current.
• debian/gbp.conf dist = DEP14 is accepted: gbp's get_pbuilder_dist tests options.pbuilder_dist == 'DEP-14' or options.pbuilder_dist == 'DEP14' (gbp/scripts/buildpackage.py:212).
• changelog sanity: 1.23.0+ds-1, unstable, initial release closing #1148989, maintainer/uploader matching debian/control, and debian/* copyright years (2026) matching.
• uscan found the packaged version as the newest upstream release (upstream 1.23.0, packaged 1.23.0+ds).

Not confirmed

• The recreated test databases could not be compared with upstream's: the excluded embed.db/embed2.db are in neither the tree nor the .orig.tar.xz, so I could not see whether debian/testdata/*.sql reproduces them exactly. debian/README.source says TestVFS only compares rows and the bytes (SQLite version stamp) do not matter; a build would show it.
• I could not run a build or the test suite (read-only; nothing here may be executed), so the behaviour of the debian/rules hooks and of dh_golang_autopkgtest rests on reading debian/rules, the golang buildsystem module and /usr/bin/dh_golang_autopkgtest.

Proposed changes

None.