Review: golang-github-glebarez-sqlite 1.11.0-1
Package Information
| Description | pure Go SQLite driver for GORM (library) This package provides a SQLite dialector for GORM, the object-relational mapper for Go: sqlite.Open takes a file path or ":memory:" as data source name and returns a gorm.Dialector for gorm.Open. It also implements GORM's schema migrator for SQLite, rebuilding tables where SQLite's ALTER TABLE cannot change a column or constraint, and translates SQLite constraint errors into GORM errors. It is a fork of the standard GORM SQLite driver (gorm.io/driver/sqlite) that uses the pure Go database/sql driver github.com/glebarez/go-sqlite instead of the cgo-based github.com/mattn/go-sqlite3, so it needs neither cgo nor a system SQLite library. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-glebarez-sqlite.git (browse) |
| Closes | #1148990 |
| Tracker | https://tracker.debian.org/pkg/golang-github-glebarez-sqlite |
| Uploaded | 11 days ago |
New Package Report
.changes
| Date | Sat, 26 Sep 2026 12:00:00 +0200 |
|---|---|
| Source | golang-github-glebarez-sqlite |
| Version | 1.11.0-1 |
| Changed-By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Architecture | source all |
| Distribution | unstable |
Changelog
golang-github-glebarez-sqlite (1.11.0-1) unstable; urgency=medium . * Initial release (Closes: #1148990)
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | golang-github-glebarez-sqlite-dev deb golang optional arch=all |
| Section | golang |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: sqlite Upstream-Contact: Gleb Sakhnov <gleb.sakhnov@gmail.com> Source: https://github.com/glebarez/sqlite Files: * Copyright: 2013-2024 Jinzhu <wosmvp@gmail.com> 2021-2024 Gleb Sakhnov <gleb.sakhnov@gmail.com> 2013-2024 the go-gorm/sqlite and glebarez/sqlite contributors License: Expat Comment: The License file names only "Copyright (c) 2013-NOW Jinzhu", and no file in the tree carries a header of its own. This is the glebarez/sqlite fork of github.com/go-gorm/sqlite, so the fork author holds copyright in what he added, sqlite_version_test.go and most of README.md among it. git blame on the packaged tag attributes the shipped lines to 34 identities in all, which is why the third line collects them. Upstream keeps no AUTHORS file and only Jinzhu wrote a notice. 2024 is the year of the packaged release, v1.11.0. Files: debian/* Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me> License: Expat Comment: Debian packaging is licensed under the same terms as upstream License: Expat Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: . The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 11 days ago.
Report
DFSG NEW review for golang-github-glebarez-sqlite version 1.11.0-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
Every upstream file is under the MIT/Expat licence: the single License file (Jinzhu, 2013-NOW) is the only copyright notice in the tree, and no other licence text, SPDX header or third-party notice exists anywhere. debian/copyright is DEP-5, has a correct Format header, a Files: * stanza naming Jinzhu, Gleb Sakhnov and the go-gorm/glebarez contributors, a Files: debian/* stanza, and reproduces the full Expat text. The prescan's author check over all 17 upstream files found every holder named. Nothing non-free, nothing without a licence, no built or generated files, no fonts, images or embedded third-party code.
Packaging
Clean Go library packaging: one arch:all -dev package, debhelper compat 14 with dh-go's golang buildsystem/addon, dpkg-build-api 1, correct dependency split (sqlite.go imports both github.com/glebarez/go-sqlite and modernc.org/sqlite/lib, so both -dev packages plus gorm are real Depends), a DEP-5 copyright, upstream metadata, gbp config and salsa-ci, autopkgtest-pkg-go, and an initial-release changelog for unstable. Standards-Version 4.7.4 is current against Policy 4.7.4.1. No patches, no maintainer scripts, no obsolete fields. All build and runtime dependencies were found in the archive or in NEW.
Issues
None.
Verified ◂
- Licensing: read License, README.md, go.mod, go.sum and all .go files; the only copyright/licence notice in the whole tree is License:1-20 ('Copyright (c) 2013-NOW Jinzhu', MIT/Expat text).
- Grep for Copyright, (C), ©, SPDX-License-Identifier, 'Licensed under', 'Permission is hereby granted', GPL/LGPL/Apache/MPL, 'public domain' and 'All rights reserved' over the whole tree found matches only in License and debian/copyright; .github/workflows/{ci,gorm-tests,badge-gorm-tests,badge-sqlite-version}.yml, .github/dependabot.yml, .vscode/settings.json, .gitignore, go.mod and go.sum carry no separate notice and are ordinary upstream files under the project's Expat licence.
- Prescan dfzg-author-check: 'Scanned 17 files ... every holder found is named in debian/copyright' - no file listed as unnamed, and my own inventory of the 17 upstream files matches the tarball listing.
- debian/copyright: DEP-5 Format header is the canonical 1.0 URL; Files: * has Copyright for Jinzhu, Gleb Sakhnov and the go-gorm/glebarez contributors, with a Comment explaining the fork and that only License carries a notice; Files: debian/* covers every packaging file including debian/source/format, debian/source/lintian-overrides and debian/upstream/metadata (the patterns match at any depth).
- Expat text is reproduced in full in a stand-alone License paragraph; Expat is not in /usr/share/common-licenses, so the full text is required and present. Upstream-Name/Source/Upstream-Contact present.
- No DFSG problem: no non-commercial, no-modification or field-of-use terms; no generated/compiled artefacts, minified code, PDFs, fonts or images in the tree; the only binary-ish content is go.sum checksums, which are not copyrightable.
- No vendored third-party code: sqlite.go imports github.com/glebarez/go-sqlite, modernc.org/sqlite/lib and gorm.io/gorm from Debian's golang-github-glebarez-go-sqlite-dev, golang-modernc-sqlite-dev and golang-gorm-gorm-dev rather than bundling them.
- Packaging: debian/rules is the standard 'dh $@ --buildsystem=golang --with=golang'; with debhelper-compat 14, --with=golang is required because dh-go provides no dh-sequence-golang (apt-cache: dh-go 1.69 Provides none and Conflicts dh-golang), so debian/source/lintian-overrides is a justified override of missing-build-dependency-for-dh-addon golang.
- Build dependencies all exist: dh-go 1.69 (provides the golang addon and /usr/bin/dh_golang_autopkgtest), dpkg-build-api (= 1) (dpkg-dev 1.23.11; level 1 is the recommended level per dpkg-build-api(7)), golang-github-glebarez-go-sqlite-dev 1.23.0, golang-gorm-gorm-dev 1.31.1, golang-modernc-sqlite-dev 1.40.0.
- Binary Depends is correct and complete: sqlite.go:11-12 imports 'github.com/glebarez/go-sqlite' and 'modernc.org/sqlite/lib', and all files import gorm.io/gorm, so the three -dev packages are genuine runtime/build deps; ${misc:Depends} present; Multi-Arch: foreign and Architecture: all are the Go team convention for a pure-Go library.
- autopkgtest-pkg-go is usable: /usr/share/autodep8/support/go/detect matches 'golang-any' in Build-Depends and generate emits 'Test-Command: /usr/bin/dh_golang_autopkgtest', which dh-go ships; no debian/tests is needed.
- Changelog: version 1.11.0-1 matches upstream and the .dsc, distribution unstable, urgency medium, closes an ITP; gbp.conf's 'dist = DEP14' is accepted by gbp (buildpackage.py accepts both DEP-14 and DEP14) and ignore-branch/pristine-tar are valid options.
- Standards-Version 4.7.4 against Policy 4.7.4.1 is current (first two components match); compat 14 is debhelper's recommended level; debian/source/format is 3.0 (quilt); the .dsc's fields match debian/control (dpkg normalises the trailing comma in Uploaders away, so it is harmless).
- No debian/patches and no maintainer scripts; no missing Vcs-* or Homepage fields; debian/upstream/metadata uses valid DEP-12 fields.
- Ignored as instructed: .pc/ (quilt bookkeeping; not part of the .dsc or orig tarball) and debian/cargo-checksum.json is absent.
- Coverage: the entire upstream tree is 17 files, all read or grepped; the whole of debian/ was read (changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata); the .dsc, orig tarball and debian tarball listings were compared and match the tree.
- uscan found the packaged version as the newest upstream release (upstream
1.11.0, packaged1.11.0).
Not confirmed ◂
- The package was not built or run (not possible here). Debian's gorm 1.31.1 and modernc sqlite 1.40.0 are newer than the go.mod requirements (1.25.7 / 1.23.1); whether the tests still compile against gorm's utils/tests package is only knowable from a build, and nothing in the package shows they do not.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 11 days ago.
Review Information
accepted — allocated to awm 11 days ago, started 11 days ago, completed 11 days ago.