Review: golang-github-glebarez-sqlite 1.11.0-1

Package Information

Description	pure Go SQLite driver for GORM (library) This package provides a SQLite dialector for GORM, the object-relational mapper for Go: sqlite.Open takes a file path or ":memory:" as data source name and returns a gorm.Dialector for gorm.Open. It also implements GORM's schema migrator for SQLite, rebuilding tables where SQLite's ALTER TABLE cannot change a column or constraint, and translates SQLite constraint errors into GORM errors. It is a fork of the standard GORM SQLite driver (gorm.io/driver/sqlite) that uses the pure Go database/sql driver github.com/glebarez/go-sqlite instead of the cgo-based github.com/mattn/go-sqlite3, so it needs neither cgo nor a system SQLite library.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-glebarez-sqlite.git (browse)
Closes	#1148990
Tracker	https://tracker.debian.org/pkg/golang-github-glebarez-sqlite
Uploaded	12 days ago

New Package Report

.changes◂

Version	1.11.0-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Sat, 26 Sep 2026 12:00:00 +0200
Source	golang-github-glebarez-sqlite

Changelog◂

golang-github-glebarez-sqlite (1.11.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148990)

.dsc◂

Package-List	golang-github-glebarez-sqlite-dev deb golang optional arch=all
Section	golang
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: sqlite
Upstream-Contact: Gleb Sakhnov <gleb.sakhnov@gmail.com>
Source: https://github.com/glebarez/sqlite

Files: *
Copyright: 2013-2024 Jinzhu <wosmvp@gmail.com>
License: Expat
Comment: The License file reads "Copyright (c) 2013-NOW  Jinzhu"; 2024 is
 the year of the packaged release (v1.11.0). The code is a fork of
 github.com/go-gorm/sqlite; Gleb Sakhnov's fork changes carry no notice.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 12 days ago.

Report◂

DFSG NEW review for golang-github-glebarez-sqlite version 1.11.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole tree is MIT/Expat: the only notice in it is upstream License ("Copyright (c) 2013-NOW Jinzhu wosmvp@gmail.com", MIT text), and no other file carries a licence header, a conflicting grant or a third-party copy. debian/copyright is DEP-5, has a Files: * catch-all and a debian/* stanza, uses the correct short name Expat with the full text (Expat is not in /usr/share/common-licenses, so the text must be and is present), and its comment explains the year drift between the Copyright: 2013-2024 Jinzhu field and the "2013-NOW" of the notice. The one gap is that the fork's author Gleb Sakhnov, who wrote files present in the tree, is not named as a copyright holder.

Packaging

Tidy, small, modern packaging: compat 14 + dpkg-build-api (= 1), a two-line rules using the golang buildsystem, Architecture: all / Multi-Arch: foreign for a -dev package, dependencies that match go.mod's direct requirements, Testsuite: autopkgtest-pkg-go, Vcs-* fields, a sane initial changelog and DEP-14 gbp.conf. Standards-Version: 4.7.4 matches current Policy 4.7.4.1. The lintian override for the dh addon dependency is justified: dh-go 1.69 provides no dh-sequence-golang, and it conflicts with dh-golang.

Issues

minor licensing 1. Files: * names only Jinzhu although the fork author Gleb Sakhnov holds copyright in files shipped here ◂

Files: debian/copyright:7-11, README.md, sqlite.go, sqlite_version_test.go, .github/workflows/ci.yml
Basis: inferred from what was read, not seen directly
Evidence: Copyright: 2013-2024 Jinzhu <wosmvp@gmail.com>; the stanza's own Comment: ... The code is a fork of github.com/go-gorm/sqlite; Gleb Sakhnov's fork changes carry no notice.
Problem: This source is the glebarez/sqlite fork; README.md, the .github workflows, sqlite_version_test.go and the rewritten sqlite.go are the fork's own additions/modifications, whose author (the package's Upstream-Contact) holds copyright in them. copyright-format 5.2 makes Copyright a required field naming the holders of the files in the stanza, so naming only the original author leaves the field incomplete, even though no notice from the fork author exists to copy.
Fix: Add the fork author to the field, e.g. Copyright: 2013-2024 Jinzhu <wosmvp@gmail.com>, 2021-2024 Gleb Sakhnov <gleb.sakhnov@gmail.com>, keeping the existing comment.

Verified ◂

The scan before the review listed no files for investigation ("every holder found is named in debian/copyright"); nothing had to be accounted for.
Upstream inventory: 17 files, all text - License, README.md, .gitignore, go.mod, go.sum, ddlmod.go, errors.go, migrator.go, sqlite.go, the four *_test.go files, .vscode/settings.json, .github/dependabot.yml and the four .github/workflows/*.yml. No binaries, minified files, generated code or vendored third-party copies anywhere; go.mod/go.sum carry no notices and need none.
grep for Copyright, (C)/©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU ..., Apache License, Mozilla Public, public domain, All rights reserved over the whole tree (excluding .pc/) returns hits only in License and debian/copyright; the .go files have no headers, so Files: * Expat covers them correctly.
License is the unmodified MIT text ("The MIT License (MIT)", "Copyright (c) 2013-NOW Jinzhu wosmvp@gmail.com") and matches the Expat short name and the text reproduced in debian/copyright; the Comment explaining the 2024 year is accurate about the drift.
sqlite.go:10-11 imports github.com/glebarez/go-sqlite and modernc.org/sqlite/lib, and the test files import both; the three go.mod direct requirements (glebarez/go-sqlite, gorm.io/gorm, modernc.org/sqlite) are all present in the binary Depends, so no dependency is missing or superfluous.
debian/control: compat 14 build-dependencies, correct golang-any, source and binary Section: golang, Multi-Arch: foreign, Depends: ${misc:Depends} (dh_gencontrol adds relationship substvars itself at compat 14).
dpkg-build-api (= 1) is valid (provided by dpkg-dev 1.23.11, per apt-cache and dpkg-build-api(7)) and is what makes Rules-Requires-Root: no the default, so the absent field is correct.
The debian/source/lintian-overrides justification holds: apt-cache show dh-go lists Conflicts: dh-golang and no Provides: dh-sequence-golang, so --with=golang plus Build-Depends: dh-go is the only correct combination and the lintian tag is a false positive.
golang-gorm-gorm-dev (1.31.1-2) and golang-modernc-sqlite-dev (1.40.0+dfsg-2) exist in the archive; dh-go is at 1.69.
debian/copyright is DEP-5 with the current Format URL, valid field names (Comment is allowed in Files stanzas, copyright-format 5.2) and stanzas in the right order (debian/* after *); no Files-Excluded is needed since nothing was repacked.
debian/rules names only existing inputs (the golang buildsystem and its addon), debian/patches is absent and no patches are needed; debian/changelog closes #1148990, is unstable, and Standards-Version: 4.7.4 matches Policy 4.7.4.1 (policy).
uscan found the packaged version as the newest upstream release (upstream 1.11.0, packaged 1.11.0).

Not confirmed ◂

golang-github-glebarez-go-sqlite-dev is not in the package lists or in ftp-master's NEW queues as of 2026-10-26; it is probably built by an upload accepted since, so no issue is raised from its absence.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Fixed in:

https://salsa.debian.org/go-team/packages/golang-github-glebarez-sqlite/-/merge_requests/1

git blame shows more than 30 identities, so I name Jinzhu, Gleb and correct the rest.

Upstream keeps no AUTHORS file and only Jinzhu wrote a notice.

One thing the review couldn't see: debian/rules passes
--builddirectory=debian/_build while dh_golang_autopkgtest computes the
default _build, so the autopkgtest rebuilds the source tree instead of the
installed -dev sources. It's the same defect the moby-api review found. That
fix is going into the same merge request.
fault, which is a tidy-up, not a fix.

— Juan Manuel Méndez Rey (mendezr), 12 days ago

Review Information

rejected — allocated to dfsg-uploader 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.11.0-1	b7b51be8…	2026-10-28 01:56	2026-10-28 01:56	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package