DFSG NEW review for golang-github-gomodules-jsonpatch version 2.5.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is entirely Apache-2.0: LICENSE is the unmodified Apache License 2.0 text (no extra or non-free clauses), and Files: * covers every upstream file. debian/copyright is valid DEP-5, names the holder the prescan found (AppsCode Inc. and Contributors), and points to /usr/share/common-licenses/Apache-2.0. There is no vendored third-party code, no file without a licence, and no generated or minified file whose source is missing.

Packaging

Conventional current Go packaging: compat 13 with dh-sequence-golang, dpkg-build-api (= 1), DEP-5 copyright, autopkgtest-pkg-go, upstream/metadata, salsa CI and a valid gbp.conf; XS-Go-Import-Path: gomodules.xyz/jsonpatch correctly matches the tree's v2/ module layout. One minor gap: the -dev package ships upstream's *_test.go files, whose testify import is not in Depends, although the equally test-only evanphx import is.

Issues

minor packaging 1. Depends omits golang-github-stretchr-testify-dev, which the shipped test files import ◂

• Files: debian/control:21-22, v2/fuzz_test.go:9, v2/jsonpatch_test.go:8, v2/jsonpatch_json_test.go:6

• Basis: checked, in the package or with a reference tool

• Evidence:

  Depends: golang-github-evanphx-json-patch-dev,
  ${misc:Depends},
  and in the tests "github.com/stretchr/testify/assert".

• Problem: dh-golang copies every .go file, test files included, into the built source tree and installs that tree, so the -dev package ships v2/*_test.go; those files cannot compile without testify. golang-github-evanphx-json-patch-dev, which is imported only by the same test files (v2/fuzz_test.go:8, v2/jsonpatch_test.go:7), is listed, so the omission is an inconsistency. Debian Go team packages list test-only imports in Depends (e.g. golang-go.uber-multierr-dev, whose only Depends is golang-github-stretchr-testify-dev, has testify in its tests only).

• Fix: Add golang-github-stretchr-testify-dev to the -dev package's Depends alongside golang-github-evanphx-json-patch-dev.

minor packaging 2. debian/watch is in the old version 4 format ◂

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

• Read all 13 upstream files: LICENSE, README.md, CHANGELOG.md, .gitignore, .github/workflows/ci.yml, v2/*.go, v2/go.mod and v2/go.sum. LICENSE is the unmodified Apache-2.0 text ending in the standard appendix; no other licence, notice or copyright line exists anywhere in the tree.
• debian/copyright is DEP-5 with the exact 1.0 Format URL, two Files stanzas (* and debian/*) and one stand-alone License stanza for Apache-2.0; DEP-5 patterns match /, so Files: * covers every upstream path at any depth and Files: debian/* the packaging.
• The prescan listed no files and its holder check found no holder missing from debian/copyright; the only holder in the tree is the one Files: * names.
• No generated, minified, binary, image or PDF files: v2/go.sum is a module checksum list, and the tree holds only Go sources, Markdown, the licence and CI/config files.
• Read every file under debian/: changelog, control, rules, copyright, gbp.conf, gitlab-ci.yml, salsa-ci.yml, source/format, upstream/metadata. dist = DEP14 in gbp.conf is valid (gbp-buildpackage(1) documents the DEP-14 value of --git-dist); dpkg-build-api (= 1) requires dpkg 1.22.0, as dpkg-build-api(7) says.
• Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 (same first two components), so it is current.
• XS-Go-Import-Path gomodules.xyz/jsonpatch is consistent with the v2/ module layout: dh-golang copies sources to $builddir/src/$DH_GOPKG, so v2/ lands at /usr/share/gocode/src/gomodules.xyz/jsonpatch/v2 (read /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm).
• The autodep8 test for Testsuite: autopkgtest-pkg-go runs /usr/bin/dh_golang_autopkgtest with Depends: @, @builddeps@, so the test imports are available from Build-Depends (read /usr/share/autodep8/support/go/generate).
• Maintainer scripts, patches and tests directories do not exist and are not needed; .pc/ contains no applied patches (.quilt_series with an empty applied-patches list), and the debian tarball holds exactly the files present in debian/.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

• uscan got no usable answer from the upstream site (unreachable, or refusing the request), so debian/watch is untested:

  In watchfile debian/watch, reading webpage
    https://github.com/gomodules/jsonpatch/tags failed: 500 read timeout