DFSG NEW review for golang-github-google-licensecheck version 0.3.1+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 209 found (53 not listed by the scan, so not checked)

Licensing

DFSG-free, and debian/copyright describes the tree correctly apart from one wording nit. Everything outside debian/ is upstream's work: every Go source carries // Copyright 2019/2020 The Go Authors ... BSD-style, the repo LICENSE is BSD-3-clause (Copyright 2019 The Go Authors), and Files: * matches it; Files: debian/* covers the packaging, by the uploader. The non-free wording the scan found (CC-BY-NC/ND, the JSON 'Good, not Evil' clause, CAL-1.0, SSPL, Commons Clause, LPPL/LGPLLR, the AFL/OSL 'no trademark rights' paragraphs) occurs only inside licenses/*.lre and the data generated from them: those files are the scanner's licence-detection patterns, so the text is the licence each pattern recognises, not the licence of the file. The non-free licence texts that such a check really objects to were removed from the tarball (testdata/ and old/testdata/ are absent and named in Files-Excluded), and no generated-but-sourceless artefact is shipped: data.gen.go is generated from licenses/*.lre by the gen_data.go that is in the tree. Answer 'yes' with one minor exception: the stand-alone License: BSD-3-clause paragraph (debian/copyright:40) paraphrases clause 3 of LICENSE as 'the developer(s)' where the licence itself names 'Google Inc.' — same licence and same obligations, but the notice is not reproduced as given.

Packaging

Clean, small, modern packaging I would sponsor as it stands: debhelper compat 14 with dh-go (which exists in the archive and conflicted out dh-golang, so the lintian override is right), dpkg-build-api (= 1) giving R³: no and the full debian/rules target set, source format 3.0 (quilt), Standards-Version 4.7.4 against current Policy 4.7.4.1, a single Architecture: all library package with Multi-Arch: foreign as the Go team ships Go -dev packages, consistent Vcs-*/Homepage/XS-Go-Import-Path and debian/upstream/metadata, a justified debian/source/lintian-overrides, salsa CI, and debian/lrc.config is a legitimate licenserecon suppression file rather than clutter. The legacy old/ copy is kept out of both the build and the installed gocode tree (DH_GOLANG_EXCLUDES := old); because the test corpora were removed, the build-time tests are narrowed to -run 'TestScan|TestType|TestURL', which is defensible and explained in debian/rules, though it means TestTestdata, the actual corpus test, never runs (and the TestScan alternative matches no test in this tree). No packaging issue found; the only open question, the autopkgtest helper's build directory, is under Not confirmed.

Issues

1. [minor] [licensing] debian/copyright's stand-alone BSD-3-clause text paraphrases clause 3 ('the developer(s)') instead of reproducing LICENSE's 'Google Inc.'

• Files: debian/copyright:40, LICENSE:13
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright:40 * Neither the name of the developer(s) nor the names of its vs LICENSE:13 * Neither the name of Google Inc. nor the names of its
• Problem: The stand-alone License: BSD-3-clause paragraph is the licence text of the package, and clause 3 of it is operative: it says whose name may not be used for endorsement. The file substitutes a generic 'the developer(s)' for the holder the licence names, so the notice as given by the copyright holder is not reproduced (Policy 12.5); the same paragraph is the text for both the upstream and the debian/* stanzas. It is still recognisably BSD-3-Clause and nothing about the DFSG status of the package turns on this.
• Fix: Paste the clause verbatim from LICENSE: * Neither the name of Google Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. (the Files: * Comment already explains that the copyright line says The Go Authors while clause 3 names Google Inc.).

Verified

• Whole tree inventoried, .pc/ aside: root 13 files, internal/match/ 9, old/ 9, licenses/ 405, debian/ 13 (changelog, control, copyright, gbp.conf, lrc.config, rules, salsa-ci.yml, watch, source/format, source/lintian-overrides, upstream/metadata). No testdata/ or old/testdata/ anywhere, so Files-Excluded: testdata / old/testdata matches the tree.
• Every Go file outside licenses/ carries // Copyright 2019 The Go Authors ... BSD-style (license.go, scan.go, urls.go, gen_data.go, license_test.go, type_test.go, url_test.go, internal/match/.go, old/.go); licenses/getspdx.go and licenses/getcc.go carry // Copyright 2020 The Go Authors. Years 2019/2020 under Copyright: 2019 The Go Authors are not a discrepancy.
• licenses/ is a directory of licence-detection patterns, one per licence the scanner recognises. Each file the scan lists — licenses/AFL-2.0.lre, licenses/AFL-2.1.lre, licenses/AFL-3.0.lre, licenses/AMPAS.lre, licenses/APL-1.0.lre, licenses/APSL-1.2.lre, licenses/APSL-2.0.lre, licenses/Aladdin-9.lre, licenses/Aladdin.lre, licenses/BSD-Protection.lre, licenses/BSD.lre, licenses/Barr.lre, licenses/BitTorrent-1.0.lre, licenses/BitTorrent-1.1.lre, licenses/CAL-1.0.lre, licenses/CATOSL-1.1.lre, licenses/CC-BY-1.0.lre, licenses/CC-BY-2.0.lre, licenses/CC-BY-2.5.lre, licenses/CC-BY-NC-1.0.lre, licenses/CC-BY-NC-2.0.lre, licenses/CC-BY-NC-2.5.lre, licenses/CC-BY-NC-3.0.lre, licenses/CC-BY-NC-4.0.lre, licenses/CC-BY-NC-ND-1.0.lre, licenses/CC-BY-NC-ND-2.0.lre, licenses/CC-BY-NC-ND-2.5.lre, licenses/CC-BY-NC-ND-3.0-IGO.lre, licenses/CC-BY-NC-ND-3.0.lre, licenses/CC-BY-NC-ND-4.0.lre, licenses/CC-BY-NC-SA-1.0.lre, licenses/CC-BY-NC-SA-2.0.lre, licenses/CC-BY-NC-SA-2.5.lre, licenses/CC-BY-NC-SA-3.0-US.lre, licenses/CC-BY-NC-SA-3.0.lre, licenses/CC-BY-NC-SA-4.0.lre, licenses/CC-BY-ND-1.0.lre, licenses/CC-BY-ND-2.0.lre, licenses/CC-BY-ND-2.5.lre, licenses/CC-BY-ND-3.0.lre, licenses/CC-BY-ND-4.0.lre, licenses/CC-BY-SA-1.0.lre, licenses/CC-BY-SA-2.0.lre, licenses/CC-BY-SA-2.5.lre, licenses/CC-PDDC.lre, licenses/CDLA-Sharing-1.0.lre, licenses/CERN-OHL-1.1.lre, licenses/CERN-OHL-1.2.lre, licenses/CERN-OHL-P-2.0.lre, licenses/CERN-OHL-S-2.0.lre, licenses/CERN-OHL-W-2.0.lre, licenses/CPOL-1.02.lre, licenses/Condor-1.1.lre, licenses/DOC.lre, licenses/EUDatagrid.lre, licenses/GFDL-1.1.lre, licenses/IJG.lre, licenses/IPA.lre, licenses/JSON.lre, licenses/LGPLLR.lre, licenses/LPPL-1.0.lre, licenses/LPPL-1.1.lre, licenses/LPPL-1.2.lre, licenses/Leptonica.lre, licenses/Motosoto.lre, licenses/NCGL-UK-2.0.lre, licenses/NGPL.lre, licenses/NPOSL-3.0.lre, licenses/Noweb.lre, licenses/OCLC-2.0.lre, licenses/OSL-1.0.lre, licenses/OSL-1.1.lre, licenses/OSL-2.0.lre, licenses/OSL-2.1.lre, licenses/OSL-3.0.lre, licenses/Sleepycat.lre — opens with a comment naming the licence it detects plus that licence's SPDX/OSI links, and then reproduces that licence's text with LRE markup, e.g. licenses/JSON.lre lines 1-4 followed by the JSON text with ((shall || should rather)), licenses/CAL-1.0.lre lines 1-6, licenses/Sleepycat.lre lines 1-5, licenses/Aladdin.lre's 'non-commercial media' paragraph, licenses/AFL-3.0.lre's patent paragraph, licenses/APSL-1.2.lre's Personal Use definition. That is a description of a licence, not a grant under it: none of these files is licensed by the licence it recognises, and all of them are upstream's own BSD-3-clause work covered by Files: *.
• data.gen.go (3.3 MB) begins // Code generated by gen_data.go; DO NOT EDIT.; its generator gen_data.go is in the tree (invoked by the go:generate comment in license.go) and its inputs are licenses/*.lre, so it is a generated file whose generator input ships. The lines the scan quotes in it (data.gen.go:78-80 CC-BY-NC IDs, data.gen.go:10934/10940 CAL-1.0, data.gen.go:608/1069/1288) are the embedded pattern texts.
• old/data.gen.go — the one text file over 4 MiB, which the scan could only read in part — is the same kind of file for the legacy v0.1.0 copy under old/ (// Code generated by gen_data.go; DO NOT EDIT., plain licence texts such as license_AGPL_3_0 and LRE text such as the CAL-1.0 lines at old/data.gen.go:23060/23066). old/ is excluded from build and install by DH_GOLANG_EXCLUDES := old (debian/rules:6; DH_GOLANG_EXCLUDES_ALL defaults true at compat >= 12), so it does not reach the binary package.
• debian/lrc.config is licenserecon's per-package suppression file, not a stray artifact: /usr/share/doc/licenserecon/ReadMe.en documents debian/lrc.config for suppressing false positives; its lines are .lre file names, and the licence names at lrc.config:84-86 (CC-BY-NC-, CC-BY-NC-ND-) are such file names.
• license.go:145-147 is package documentation of the scanner's license-type classification ('NonCommercial indicates that commercial use of the software is disallowed ... CommonsClause, CC-BY-NC-4.0, Prosperity 3.0.0'); it describes a license type, not a term of licensecheck's own licence.
• debian/copyright:11 is inside the Comment of the Files-Excluded header, explaining that the removed corpora contained the JSON licence text and GFDL-1.1-with-invariants texts.
• The 64 holders the author check lists are holders named by the licences being recognised, not holders of this package: they appear inside the licence texts/templates of licenses/ and data.gen.go (Free Software Foundation, Affero Inc, Amazon Digital Services, Apple/Apple Computer Inc, BULL/Bull SAS, Cambridge Broadband, Carnegie Mellon, Cisco, Condor Team, David Turner, Eric Young, Ericsson Utvecklings AB, Glenn Randers-Pehrson, Guy Eric Schalnat, Hans-Hermann Bode, Henry Spencer, iMatix, Julian Seward, Lawrence Rosen, Lucent, MIT and Honeywell, MongoDB, Netscape, Networks Associates, Nigel Tzeng, Proofpoint, Red Hat, Richard M. Stallman, Rob Braun, Robert A. van Engelen, ScienceLogic, Sendmail, OCLC/OCLC Online Computer Library, Andreas Digger, Charlie Poole, Gerd Neugebauer) or are test strings ('Gopher(R) copyright' at internal/match/dict_test.go:145-147, and old/normalize_test.go's embedded Apache-2.0 text). None is a missing copyright holder of the package.
• debian/copyright is DEP-5 with the correct Format: URL, Files-Excluded in the header, a Files: * stanza, a later Files: debian/* stanza for the packaging, and a stand-alone paragraph for each short name used; * patterns reach into subdirectories, so Files: * covers the whole tree. No replacement file is needed.
• Build-Depends named in debian/control resolve: dh-go 1.69 (Debian Go Packaging Team, Conflicts: dh-golang) provides the golang sequence addon, the golang buildsystem and dh_golang, as debian/control and debian/source/lintian-overrides say; golang-any is provided by golang-defaults; dpkg-build-api (= 1) is the form dpkg-build-api(7) documents, provided by dpkg-dev 1.23.11.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (the current version per the policy tool): first two components match, not an issue.
• Depends: ${misc:Depends}, in debian/control is not a broken field: with the substvar empty the field becomes empty and dpkg-gencontrol deletes it ('# Delete empty field. delete $fields->{$field} unless $fields->{$field};', /usr/bin/dpkg-gencontrol), and at compat 14 dh_gencontrol adds relationship substvars itself anyway.
• dist = DEP14 in debian/gbp.conf is a valid git-buildpackage setting (gbp/scripts/buildpackage.py:212 handles options.pbuilder_dist == 'DEP-14' or 'DEP14').
• The autopkgtest runs the package's own debian/rules: autodep8's go generator emits Test-Command: /usr/bin/dh_golang_autopkgtest, and that script copies the source tree and runs make -f debian/rules build, so the override_dh_auto_test filter applies in autopkgtest too.
• Coverage: debian/ read in full; the tree listed in full; all hand-written sources read; the two generated data files sampled at their heads and at the lines the scan named rather than line by line. No images, fonts, archives, .so/.jar/.class/.pyc or other binary files in the tree.
• uscan found the packaged version as the newest upstream release (upstream 0.3.1, packaged 0.3.1+ds).

Not confirmed

• autopkgtest build directory: the generated test runs /usr/bin/dh_golang_autopkgtest, which (in the dh-golang copy installed here, the only copy I could read — the package Build-Depends on dh-go, which is not installed) computes the Go build directory itself as _build and adds its own override_dh_auto_configure populating that path, while debian/rules builds with --builddirectory=debian/_build. If dh-go 1.69 works the same way, that override fills a directory the build does not use and the autopkgtest build may fail or test the source copy instead of the installed one; running the autopkgtest would show it.
• SPDX provenance of the patterns: licenses/getspdx.go ('Getspdx converts SPDX license definitions into license regular expressions (LREs)', expecting the SPDX license-list-data database checked out in _spdx) and licenses/README.md ('Many of the license definitions ... have been converted from the SPDX regular expressions into LRE patterns') show the .lre files derive from SPDX license-list-data. If that data is itself under CC-BY-3.0 (my recollection; I could not verify it from the package or from anything under /usr or /etc), an attribution stanza would belong in debian/copyright; not reported as an issue.
• No build and no test was run (read-only review), so no build or test result is reported; the source is a pure-Go module with no external imports and no go.sum to satisfy.

Proposed changes

None.