DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: golang-github-google-licenseclassifier 2.0.0+ds2-1

Package Information

Descriptionanalyze text to determine what type of license it contains (library)

The license classifier is a library and set of tools that can analyze text to determine what type of license it contains. It searches for license texts in a file and compares them to an archive of known licenses. These files could be, e.g., LICENSE files with a single or multiple licenses in it, or source code files with the license text in a comment.

A "confidence level" is associated with each result indicating how close the match was. A confidence level of 1.0 indicates an exact match, while a confidence level of 0.0 indicates that no license was able to match the text.

This is a substantial revision of the license classifier with a focus on improved accuracy and performance.

MaintainerDebian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed ByJuan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsortsimonq2@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/go-team/packages/golang-github-google-licenseclassifier.git (browse)
Closes#1152499
Trackerhttps://tracker.debian.org/pkg/golang-github-google-licenseclassifier
Uploaded1 day ago

New Package Report

.changes◂
Changed-ByJuan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecturesource all
Distributionunstable
DateFri, 30 Oct 2026 05:41:19 +0100
Sourcegolang-github-google-licenseclassifier
Version2.0.0+ds2-1
Changelog◂
golang-github-google-licenseclassifier (2.0.0+ds2-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152499)
.dsc◂
Sectiongolang
Priorityoptional
Componentmain
Package-Listgolang-github-google-licenseclassifier-v2-dev deb golang optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/google/licenseclassifier
Upstream-Name: licenseclassifier
Upstream-Contact: https://github.com/google/licenseclassifier/issues
Files-Excluded:
 classifier.go
 classifier_test.go
 commentparser
 file_system_resources.go
 forbidden.go
 go.mod
 go.sum
 internal
 licenses
 license_type.go
 serializer
 stringclassifier
 tools
Comment: The top level is the v1 module, which nothing in Debian uses; only
 the v2 module in v2/ is packaged.

Files: *
Copyright: 2017-2022 Google Inc.
License: Apache-2.0

Files: v2/assets/* v2/scenarios/*
Copyright: 2017-2022 Google Inc. (selection and arrangement)
           1988-2007 Free Software Foundation, Inc.
           1982-1993 The Regents of the University of California
           1988 Richard M. Stallman
           1989 Carnegie Mellon
           1989 M. Stephenson
           1990-1999 Sleepycat Software
           1990-2005 Info-ZIP
           1991-1992 RSA Data Security, Inc.
           1991-1995 Stichting Mathematisch Centrum Amsterdam, The Netherlands
           1991-2013 Thomas G. Lane, Guido Vollbeding
           1991-2014 Unicode, Inc.
           1992-2013 The University of Tennessee and The University of Tennessee Research Foundation
           1994 Anthony Dekker
           1994-2002 World Wide Web Consortium (Massachusetts Institute of Technology, European Research Consortium for Informatics and Mathematics, Keio University)
           1995-1996 Guy Eric Schalnat, Group 42, Inc.
           1995-1996 The President and Fellows of Harvard University
           1995-1998 Eric Young (eay@cryptsoft.com)
           1995-1999 The Apache Group
           1995-2001 Corporation for National Research Initiatives
           1995-2010 International Business Machines Corporation and others
           1995-2011 Fredrik Lundh
           1995-2019 The PNG Reference Library Authors
           1995-1997 Autodesk, Inc.
           1996-1997 Andreas Dilger
           1996-1997 Andreas Digger
           1996 Chih-Hao Tsai @ Beckman Institute
           1996 X Consortium
           1996-1997 Original Reusable Objects, Inc.
           1996-2006 David Turner, Robert Wilhelm, and Werner Lemberg
           1996-2019 Julian R Seward
           1996-2022 Daniel Stenberg, <daniel@haxx.se>, and many contributors
           1997 Gregory Pietsch
           1997-1999 Kenji Hiranabe, Eiwa System Management, Inc.
           1997-2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)
           1997-2011 Secret Labs AB
           1997-2014 Sam Lantinga <slouken@libsdl.org>
           1997-2015 University of Cambridge
           1998-1999 Netscape
           1998-2002 Lucent Technologies Inc. and others
           1998-2005 Julian Smart, Robert Roebling et al
           1998-2006 The Board of Trustees of the University of Illinois
           1998-2008 The OpenSSL Project
           1998-2004 Sendmail, Inc.
           1998-2018 Glenn Randers-Pehrson
           1999 The Apache Software Foundation
           1999-2000 Image Power, Inc.
           1999-2000 The University of British Columbia
           1999-2003 The OpenLDAP Foundation, Redwood City, California, USA
           1999-2005 Trolltech AS, Norway
           1999-2007 Apple Inc. (Apple Computer, Inc.)
           1999-2008 LaTeX3 Project
           1999-2012 The PHP Group
           1999-2002 Zend Technologies Ltd.
           1999-2017 Intel Corporation
           1999-2021 ImageMagick Studio LLC
           2000 Wizards of the Coast, Inc.
           2000-2002 Alan Cox <alan@redhat.com>
           2000-2002 Philip A. Craig
           2000-2006 The Perl Foundation
           2000-2008 Vovida Networks, Inc.
           2000-2011 INRIA, France Telecom
           2000-2012 Jason Hunter & Brett McLaughlin
           2000-2013 Oracle and/or its affiliates
           2000-2013 The University of California Berkeley
           2000-2017 Todd M. Helfter
           2001 Rice University
           2001-2006 Python Software Foundation
           2001-2006 Michael David Adams
           2001-2007 The Flex Project
           2001-2004 The OpenSymphony Group
           2001-2003 Sun Microsystems, Inc.
           2002 Affero Inc.
           2002 Douglas Crockford (www.crockford.com)
           2002-2004 James W. Newkirk, Michael C. Two, Alexei A. Vorontsov
           2002-2007 Charlie Poole
           2002-2005 Lawrence E. Rosen
           2002-2017 Jean Delvare <jdelvare@suse.de>
           2003 Bitstream, Inc.
           2003 The Regents of the University of California, through Lawrence Berkeley National Laboratory
           2004 Sam Hocevar <sam@hocevar.net>
           2004 the University Corporation for Atmospheric Research ("UCAR")
           2004 USAGI/WIDE Project
           2005 M. Y. Name
           2005-2011 David Schultz <das@FreeBSD.ORG>
           2005-2016 Puppet, Inc.
           2006 Academy of Motion Picture Arts and Sciences
           2006 Princeton University
           2006-2011 Erin Catto http://www.box2d.org
           2006-2013 The University of Colorado Denver
           2006-2018 The HDF Group
           2007 Geospatial Information Authority of Japan
           2008-2011 AQR Capital Management, LLC
           2008-2011 Ken Lauer
           2009 Jan Friesse <jfriesse@gmail.com>
           2009 Tensilica Inc.
           2009-2011 Mozilla Foundation and contributors
           2009-2019 Joachim Metz <joachim.metz@gmail.com>
           2010 Nokia Corporation and/or its subsidiary(-ies)
           2010 Ronnie Sahlberg <ronniesahlberg@gmail.com>
           2010-2013 TJ Holowaychuk <tj@vision-media.ca>
           2010-2014 Emscripten authors
           2010-2015 Zoltan Herczeg
           2011 Mathijs Mohlmann
           2011 Red Hat, Inc.
           2012 Lee Duncan <lee@gonzoleeman.net>
           2012 Mihai Bazon <mihai.bazon@gmail.com>
           2012 The Chromium Authors
           2013 International Business Machines Corporation
           2013 Julien Pommier ( pommier@modartt.com )
           2013 Lattice Semiconductor Corporation
           2013 Linaro Limited
           2013-2017 Denis Bardadym <bardadymchik@gmail.com>
           2015 Digia Plc and/or its subsidiary(-ies)
           2015-2016 Decentral
           2016 Contributing Member(s) of Distributed Management Task Force
           2016 The Khronos Group Inc.
           2017 MariaDB Corporation Ab
           2018 J. Alexander Branham (alex DOT branham AT gmail DOT com)
           2018 MongoDB, Inc.
           2018-2019 Cosmin Truta
           2019 Waymo LLC
           2019 "WebGPU native" developers
           Joyent, Inc. and other Node contributors
           1993-1996 OpenVision Technologies, Inc.
           1994-2006 Copyright Holders of the Geant4 Collaboration
           1995-2013 Jean-loup Gailly and Mark Adler
           1996-2007 Julian Seward
           2012-2016 IBM Corp. and others
           2013 Mark Jason Dominus <mjd@cpan.org>
           2018-2022 Google LLC
           2020 CERN
           Christoph Martin, Kurt Roeckx, Sebastian Andrzej Siewior
           KUKA Roboter GmbH
           Silicon Graphics, Inc.
           The OpenSSL Project Authors
           UNIX System Laboratories, Inc.
           W3C (MIT, ERCIM, Keio, Beihang)
           Zope Corporation
           Lambda Foundry, Inc. and PyData Development Team
License: Apache-2.0 and licence-texts
Comment: The classifier's corpus. Google's selection and arrangement is
 Apache-2.0; each text keeps its own author, listed above as found in the
 texts. Licence templates such as Apache-2.0 ("Copyright [yyyy] [name of
 copyright owner]") or BSD-2-Clause ("Copyright (c) <year> <owner>") carry a
 placeholder, not a holder. See debian/README.source.

Files: v2/assets/embed.go v2/scenarios/README.md
Copyright: 2017-2022 Google Inc.
License: Apache-2.0

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0

License: licence-texts
 Each file is a verbatim copy of a licence text, a licence header or a
 copyright notice, kept as the corpus the classifier matches against. Debian
 distributes each one under the permission it gives for verbatim copies of
 itself where it has one ("Everyone is permitted to copy and distribute
 verbatim copies of this license document"), and otherwise as a licence text
 reproduced so that the licence can be identified, on the reasoning in
 https://lists.debian.org/debian-legal/2026/10/msg00043.html . The terms in
 these texts do not apply to the software in this package, and some of them
 are not free licences.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for golang-github-google-licenseclassifier version 2.0.0+ds2-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 1 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 136 found

Licensing

The Apache-2.0 software side is described correctly: debian/copyright is DEP-5, all Go sources carry 'Copyright 20xx Google Inc.' under Apache-2.0, and the corpus stanzas are in the right order with the right patterns. But the package ships, and the binary package installs, ~130 licence texts and EULAs under terms that forbid what the DFSG requires: CC-BY-NC/ND and SSPL/Elastic/BSL/Commons-Clause texts exclude commercial use, several forbid modification, and some forbid reproduction outright (MediaTek, Waymo 'Contains Trade Secrets', IDA/Hex-Rays). The stand-alone 'licence-texts' paragraph grants nothing and itself states that 'some of them are not free licences'; a fair-use rationale is not a licence Debian can distribute under, and the two lintian tags that name two of these texts were overridden rather than resolved. The copyright list of holders is also incomplete: MediaTek Inc. and the Qhull holder are named in the texts but not in debian/copyright.

Packaging

The packaging is competent: debhelper compat 14 with dpkg-build-api (= 1) via the dpkg-dev-provided virtual package, dh-go's golang buildsystem with the corpus installed through DH_GOLANG_INSTALL_EXTRA and the v2 module named as DH_GOLANG_BUILDPKG, go-spew/go-diff in Depends matching the non-test imports and go-cmp correctly <!nocheck>. Multi-Arch: foreign matches other golang-*-dev packages, there are no maintainer scripts or patches to get wrong, Standards-Version 4.7.4 is current, and the autopkgtest-pkg-go run (which re-runs make build from debian/rules) works with the import path chosen. Only the licensing of the corpus, reported separately, stands in the way.

Issues

blocker licensing 1. v2/assets ships non-free licence texts and EULAs (MTK, Waymo, IDA, CC-BY-NC-ND, JSON, Unicode TOU) that do not permit redistribution, modification or commercial use ◂
  • Files: debian/copyright, debian/source/lintian-overrides:2, v2/assets/License/MTK/pristine.txt:1-8, v2/assets/License/Waymo1P/notice.txt:1-14, v2/assets/License/IDA/license.txt:48-54, v2/assets/License/CC-BY-NC-ND-4.0/license.txt:1-6, v2/assets/License/JSON/license.txt:7, v2/assets/License/unicode_org/pristine.txt:19-21, v2/assets/License/SSPL-1.0/license.txt, v2/assets/License/Elastic-2.0/license.txt, v2/assets/License/Business-Source-License-1.1/license.txt, v2/assets/License/Android-SDK/20161209.txt, v2/assets/License/BCL/license.txt, v2/assets/License/Xcode/license.txt, v2/assets/License/Windows-SDK-10/license.txt, v2/assets/License/AdColony-SDK/license.txt, v2/assets/License/Facebook-Examples/license.txt, v2/assets/License/OROMatcher/license.txt, v2/assets/License/RCSB-PDB/license.txt, v2/assets/License/Sflow/license.txt, v2/assets/License/Autodesk-3D-Studio-File-Toolkit/license.txt:29-33
  • Basis: checked, in the package or with a reference tool
  • Evidence: MTK: any reproduction, modification, use or disclosure of MediaTek Software, and information contained herein, in whole or in part, shall be strictly prohibited. Waymo: Waymo Proprietary and Confidential - Contains Trade Secrets ... may only be used, duplicated, modified or distributed pursuant to the terms and conditions of a separate, written license agreement. IDA: You may not distribute copies of the software to another party ... You may not modify, adapt, translate, rent, lease, resell, distribute, or create derivative works. debian/copyright, License: licence-texts: Debian distributes each one under the permission it gives for verbatim copies of itself where it has one ... and otherwise as a licence text reproduced so that the licence can be identified, on the reasoning in https://lists.debian.org/debian-legal/2026/10/msg00043.html ... some of them are not free licences. debian/source/lintian-overrides: license-problem-json-evil [v2/assets/License/JSON/license.txt] and license-problem-old-unicode [...].
  • Problem: Policy 2.1 (DFSG): a licence in main may not restrict sale of the work (DFSG 1), must allow derived works (DFSG 3), and may not discriminate by field of endeavour (DFSG 6). CC-BY-NC/ND, SSPL-1.0, Elastic-2.0, BSL-1.1, the Commons Clause, the JSON 'Good, not Evil' clause, the Unicode Terms of Use and the SDK EULAs fail at least one of these, and MediaTek and Waymo forbid reproduction of the text itself. 'Fair use' (README.source) is a defence available to a quoter, not a permission Debian can pass on to its mirrors, CD vendors and derivatives, and the 'licence-texts' short name in debian/copyright is not a licence at all (it grants nothing), so ~130 files the package ships have no free licence: the package is not DFSG-free and debian/copyright does not describe a free licence for them. The two lintian overrides suppress exactly the non-free-licence tags instead of resolving them.
  • Fix: Either get written permission (or an explicit ftp-master/debian-legal decision that these texts may be redistributed) for every text that is not under a free licence, or drop those files from the orig tarball (extend Files-Excluded, then remove their go:embed corpus entries, their lines in debian/lrc.config and the classification tests that need them), keeping only texts whose licences permit redistribution and modification. Whichever route is taken, record the result in debian/copyright and drop the license-problem-* overrides.
important licensing 2. debian/copyright's corpus stanza names 138 holders but omits MediaTek Inc. and C.B. Barber/The Geometry Center (Qhull) ◂
  • Files: debian/copyright:29-165, v2/assets/License/MTK/pristine.txt:8, v2/assets/License/MTK/a.txt:4, v2/assets/Header/MTK/header.txt, v2/assets/License/Qhull/license.txt:1-14
  • Basis: checked, in the package or with a reference tool
  • Evidence: MediaTek Inc. (C) 2018. All rights reserved. (MTK/pristine.txt:8) and permission of MediaTek Inc. (C) 2009 (MTK/a.txt:4); Qhull, Copyright (c) 1993-2019 / C.B. Barber / Arlington, MA / and / The National Science and Technology Research Center for Computation and Visualization of Geometric Structures / (The Geometry Center) / University of Minnesota.
  • Problem: The stanza Files: v2/assets/* v2/scenarios/* is the only place these holders can be named (the earlier Files: * names only Google), and it does not name either of these, so debian/copyright does not describe the copyright of v2/assets/License/MTK/* and v2/assets/License/Qhull/license.txt (Policy 12.5, copyright-format 6.5). Every other holder with an explicit notice in the corpus is named, which makes the two omissions plainly accidental.
  • Fix: Add MediaTek Inc. and C.B. Barber / The Geometry Center, University of Minnesota to the Copyright list of that stanza (or give the two files their own Files paragraphs).
Verified ◂
  • Inventory: 501 files. Upstream non-debian files are .travis.yml, CHANGELOG, CONTRIBUTING.md, LICENSE, README.md at the top level, the v2/ Go module (19 .go files, go.mod, go.sum, README.md, tools/) and the corpus v2/assets/ (Header/, License/, Supplement/) plus v2/scenarios/ (41 files). The orig tarball contains none of the Files-Excluded top-level v1 paths.
  • All Go sources carry // Copyright 2020 Google Inc. (2017 in v2/tools/), v2/assets/embed.go 2022; all are Apache-2.0 and covered by Files: * or the embed.go/README stanza. The copyright stanza order is correct (Files: *, then the corpus, then embed.go/scenarios/README.md); patterns reach into subdirectories so every corpus file is matched; the header Format: is the current 1.0 URL, so no replacement file is needed.
  • Wording flagged by the scan (134 hits) is the corpus itself, not the package's licence terms; these files are all verbatim licence texts or notices declared by Files: v2/assets/* v2/scenarios/*: v2/assets/Header/Elastic-2.0/header.txt, v2/assets/Header/MTK/header.txt, v2/assets/Header/SSPL-1.0/header.txt, v2/assets/License/AFL-2.0/license.txt, v2/assets/License/AFL-2.1/license.txt, v2/assets/License/AFL-3.0/license.txt, v2/assets/License/AMPAS/license.txt, v2/assets/License/APSL-1.2/license.txt, v2/assets/License/APSL-2.0/license.txt, v2/assets/License/AdColony-SDK/license.txt, v2/assets/License/Android-SDK/20090410.txt, v2/assets/License/Android-SDK/20161209.txt, v2/assets/License/BCL/license.txt, v2/assets/License/BSD-Protection/license.txt, v2/assets/License/BSD-Rice/license.txt, v2/assets/License/BitTorrent-1.1/license.txt, v2/assets/License/Business-Source-License-1.1/license.txt, v2/assets/License/CC-BY-1.0/license.txt, v2/assets/License/CC-BY-2.0/license.txt, v2/assets/License/CC-BY-2.5/license.txt, v2/assets/License/CC-BY-NC-1.0/license.txt, v2/assets/License/CC-BY-NC-2.0/license.txt, v2/assets/License/CC-BY-NC-2.5/license.txt, v2/assets/License/CC-BY-NC-3.0/license.txt, v2/assets/License/CC-BY-NC-4.0/license.txt, v2/assets/License/CC-BY-NC-ND-1.0/license.txt, v2/assets/License/CC-BY-NC-ND-2.0/license.txt, v2/assets/License/CC-BY-NC-ND-2.5/license.txt, v2/assets/License/CC-BY-NC-ND-3.0/license.txt, v2/assets/License/CC-BY-NC-ND-4.0/license.txt, v2/assets/License/CC-BY-NC-SA-1.0/license.txt, v2/assets/License/CC-BY-NC-SA-2.0/license.txt, v2/assets/License/CC-BY-NC-SA-2.5/license.txt, v2/assets/License/CC-BY-NC-SA-3.0/license.txt, v2/assets/License/CC-BY-NC-SA-4.0/license.txt, v2/assets/License/CC-BY-ND-1.0/license.txt, v2/assets/License/CC-BY-ND-2.0/license.txt, v2/assets/License/CC-BY-ND-2.5/license.txt, v2/assets/License/CC-BY-SA-1.0/license.txt, v2/assets/License/CC-BY-SA-2.0/license.txt, v2/assets/License/CC-BY-SA-2.5/license.txt, v2/assets/License/CERN-OHL-WR-v2/license.txt, v2/assets/License/CERN-OHL-v1.2/license.txt, v2/assets/License/Commons-Clause/license.txt, v2/assets/License/Elastic-2.0/license.txt, v2/assets/License/Facebook-Examples/license.txt, v2/assets/License/IDA/license.txt, v2/assets/License/IJG/license.txt, v2/assets/License/JSON/license.txt, v2/assets/License/LGPLLR/license.txt, v2/assets/License/LZMA/license.txt, v2/assets/License/LicenseRef-iccjpeg/license.txt, v2/assets/License/MTK/pristine.txt, v2/assets/License/NGPL/license.txt, v2/assets/License/OROMatcher/license.txt, v2/assets/License/OSL-1.0/license.txt, v2/assets/License/OSL-1.1/license.txt, v2/assets/License/OSL-2.0/license.txt, v2/assets/License/OSL-2.1/license.txt, v2/assets/License/OSL-3.0/license.txt, v2/assets/License/OpenSSL/license.txt, v2/assets/License/RCSB-PDB/license.txt, v2/assets/License/SGI-B-1.0/license.txt, v2/assets/License/SSPL-1.0/license.txt, v2/assets/License/Sflow/license.txt, v2/assets/License/Unicode-TOU/license.txt, v2/assets/License/Unlicense/license.txt, v2/assets/License/Waymo1P/notice.txt, v2/assets/License/Windows-SDK-10/license.txt, v2/assets/License/Xcode/license.txt, v2/assets/License/geant4/license.txt, v2/assets/Supplement/CC-BY-NC-4.0/preface.txt, v2/assets/Supplement/CC-BY-NC-ND-4.0/preface.txt, v2/assets/Supplement/CC-BY-NC-SA-4.0/preface.txt, v2/scenarios/151151704. Of these, the 'commercial or non-commercial' and 'proprietary' hits are permission grants or boilerplate disclaimers/trademark clauses (LZMA, Unlicense, OpenSSL, BSD-Rice, AFL, APSL-2.0, BitTorrent-1.1, CERN-OHL, geant4, IJG, SGI-B-1.0, AMPAS); the texts that really do restrict are the licensing blocker above.
  • v2/assets/License/CAL-1.0/license.txt (the two DFSG-database hits) is the CAL-1.0 and CAL-1.0-Combined-Work-Exception text itself; both strings are its title lines, and it belongs to the same corpus blocker.
  • debian/lrc.config:162-164 are lines of a list of corpus file names (CC-BY-NC paths), not licence terms; v2/tokenizer.go:401 is the "non commercial": "noncommercial" entry of the tokenizer's normalisation table; v2/tokenizer_test.go:93 Copyright 1996-2002, 2006 by A. Developer is a synthetic input string in a Go test table, not a real holder.
  • Holders the scan could not match are accounted for: Autodesk (v2/assets/License/Autodesk-3D-Studio-File-Toolkit/license.txt:8, (C) Copyright 1997 by Autodesk, Inc., listed as 1995-1997), Sun (v2/assets/License/SISSL-1.2/license.txt:227, listed as 2001-2003 Sun Microsystems, Inc.), W3C (v2/assets/License/W3C-19980720/license.txt:3, listed as World Wide Web Consortium and W3C (MIT, ERCIM, Keio, Beihang)), Charlie Poole, Emscripten authors, FSF, Glenn Randers-Pehrson, ImageMagick Studio LLC, Ken Lauer, Richard M. Stallman and RSA Data Security, all named in that stanza.
  • Holder coverage was checked over all 148 explicit copyright/(C)/© notice lines in v2/assets and v2/scenarios, not only those the scan listed; only MediaTek and Qhull came out missing (reported).
  • Every corpus file sits at exactly three path components below v2/assets, so //go:embed */*/* in v2/assets/embed.go covers all of them, and DH_GOLANG_INSTALL_EXTRA installs v2/assets and v2/scenarios into the build tree and the -dev package.
  • Packaging checks done: dpkg-build-api (= 1) is the documented Build-Depends form (dpkg-dev Provides: dpkg-build-api (= 1), dpkg-build-api(7)); DH_GOLANG_BUILDPKG/EXCLUDES/INSTALL_EXTRA behave as debian/rules assumes when read in /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm (tools as a regex drops v2/tools from both build and install, since EXCLUDES_ALL defaults to true from compat 12); /usr/bin/dh_golang_autopkgtest takes DH_GOPKG from debian/control and re-runs make build from debian/rules, so the autopkgtest-pkg-go run uses the v2 build target; go-spew and go-diff are non-test imports (scoring.go, searchset.go, diff.go) and go-cmp is test-only, matching the Depends and the <!nocheck> build-dependency; no debian/tests, maintainer scripts, patches or .maintscript exist, and Multi-Arch: foreign is what other golang--dev packages use (golang-github-google-go-cmp-dev); Standards-Version 4.7.4 is current.
  • The two remaining lintian overrides are justified as data: national-encoding for v2/assets/Supplement/Apache-2.0/openssl.txt (kept byte for byte, matched as is) and the executable-bit chmod in debian/rules' execute_after_dh_install.
  • uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.0.0-pre.2, packaged 2.0.0+ds2), which is not a fault of the package.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
  • The debian-legal message cited by debian/copyright and debian/README.source (lists.debian.org/debian-legal/2026/10/msg00043.html) cannot be read from here; whether it actually addresses redistribution of these texts is unverified, so the maintainer's rationale rests on something I could not check.
  • File modes in the orig tarball could not be inspected, so I could not confirm that the corpus text carrying an executable bit upstream is a *.txt file that the find/chmod in debian/rules actually reaches.
Proposed changes ◂

None.

Uploader's response to the LLM review

Yes. I verified that. Consider this rationale:

The holders are right: MediaTek Inc. and C.B. Barber, The Geometry Center are added for the next revision, https://salsa.debian.org/go-team/packages/golang-github-google-licenseclassifier/-/commit/65a08818c5626a50b890adbbb60c71d6ccde8e9a . The licence texts are the classifier's reference corpus, kept on purpose after

https://lists.debian.org/debian-legal/2026/10/msg00043.html ,

see debian/README.source.

Please accept this upload.

— Juan Manuel Méndez Rey (mendezr), 23 hours ago

Review Information

accepted — allocated to mechtilde 8 hours ago, started 8 hours ago, completed 8 hours ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.0.0+ds2-1 f7634cd3… 2026-11-06 09:07 2026-11-06 09:07 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package