Review: golang-github-google-licenseclassifier 2.0.0+ds2-1
Package Information
| Description | analyze text to determine what type of license it contains (library) The license classifier is a library and set of tools that can analyze text to determine what type of license it contains. It searches for license texts in a file and compares them to an archive of known licenses. These files could be, e.g., LICENSE files with a single or multiple licenses in it, or source code files with the license text in a comment. A "confidence level" is associated with each result indicating how close the match was. A confidence level of 1.0 indicates an exact match, while a confidence level of 0.0 indicates that no license was able to match the text. This is a substantial revision of the license classifier with a focus on improved accuracy and performance. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-google-licenseclassifier.git (browse) |
| Closes | #1152499 |
| Tracker | https://tracker.debian.org/pkg/golang-github-google-licenseclassifier |
| Uploaded | 1 day ago |
New Package Report
.changes
| Date | Fri, 30 Oct 2026 05:41:19 +0100 |
|---|---|
| Source | golang-github-google-licenseclassifier |
| Version | 2.0.0+ds2-1 |
| Changed-By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Architecture | source all |
| Distribution | unstable |
Changelog
golang-github-google-licenseclassifier (2.0.0+ds2-1) unstable; urgency=medium . * Initial release (Closes: #1152499)
.dsc
| Section | golang |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | golang-github-google-licenseclassifier-v2-dev deb golang optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/google/licenseclassifier
Upstream-Name: licenseclassifier
Upstream-Contact: https://github.com/google/licenseclassifier/issues
Files-Excluded:
classifier.go
classifier_test.go
commentparser
file_system_resources.go
forbidden.go
go.mod
go.sum
internal
licenses
license_type.go
serializer
stringclassifier
tools
Comment: The top level is the v1 module, which nothing in Debian uses; only
the v2 module in v2/ is packaged.
Files: *
Copyright: 2017-2022 Google Inc.
License: Apache-2.0
Files: v2/assets/* v2/scenarios/*
Copyright: 2017-2022 Google Inc. (selection and arrangement)
1988-2007 Free Software Foundation, Inc.
1982-1993 The Regents of the University of California
1988 Richard M. Stallman
1989 Carnegie Mellon
1989 M. Stephenson
1990-1999 Sleepycat Software
1990-2005 Info-ZIP
1991-1992 RSA Data Security, Inc.
1991-1995 Stichting Mathematisch Centrum Amsterdam, The Netherlands
1991-2013 Thomas G. Lane, Guido Vollbeding
1991-2014 Unicode, Inc.
1992-2013 The University of Tennessee and The University of Tennessee Research Foundation
1994 Anthony Dekker
1994-2002 World Wide Web Consortium (Massachusetts Institute of Technology, European Research Consortium for Informatics and Mathematics, Keio University)
1995-1996 Guy Eric Schalnat, Group 42, Inc.
1995-1996 The President and Fellows of Harvard University
1995-1998 Eric Young (eay@cryptsoft.com)
1995-1999 The Apache Group
1995-2001 Corporation for National Research Initiatives
1995-2010 International Business Machines Corporation and others
1995-2011 Fredrik Lundh
1995-2019 The PNG Reference Library Authors
1995-1997 Autodesk, Inc.
1996-1997 Andreas Dilger
1996-1997 Andreas Digger
1996 Chih-Hao Tsai @ Beckman Institute
1996 X Consortium
1996-1997 Original Reusable Objects, Inc.
1996-2006 David Turner, Robert Wilhelm, and Werner Lemberg
1996-2019 Julian R Seward
1996-2022 Daniel Stenberg, <daniel@haxx.se>, and many contributors
1997 Gregory Pietsch
1997-1999 Kenji Hiranabe, Eiwa System Management, Inc.
1997-2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)
1997-2011 Secret Labs AB
1997-2014 Sam Lantinga <slouken@libsdl.org>
1997-2015 University of Cambridge
1998-1999 Netscape
1998-2002 Lucent Technologies Inc. and others
1998-2005 Julian Smart, Robert Roebling et al
1998-2006 The Board of Trustees of the University of Illinois
1998-2008 The OpenSSL Project
1998-2004 Sendmail, Inc.
1998-2018 Glenn Randers-Pehrson
1999 The Apache Software Foundation
1999-2000 Image Power, Inc.
1999-2000 The University of British Columbia
1999-2003 The OpenLDAP Foundation, Redwood City, California, USA
1999-2005 Trolltech AS, Norway
1999-2007 Apple Inc. (Apple Computer, Inc.)
1999-2008 LaTeX3 Project
1999-2012 The PHP Group
1999-2002 Zend Technologies Ltd.
1999-2017 Intel Corporation
1999-2021 ImageMagick Studio LLC
2000 Wizards of the Coast, Inc.
2000-2002 Alan Cox <alan@redhat.com>
2000-2002 Philip A. Craig
2000-2006 The Perl Foundation
2000-2008 Vovida Networks, Inc.
2000-2011 INRIA, France Telecom
2000-2012 Jason Hunter & Brett McLaughlin
2000-2013 Oracle and/or its affiliates
2000-2013 The University of California Berkeley
2000-2017 Todd M. Helfter
2001 Rice University
2001-2006 Python Software Foundation
2001-2006 Michael David Adams
2001-2007 The Flex Project
2001-2004 The OpenSymphony Group
2001-2003 Sun Microsystems, Inc.
2002 Affero Inc.
2002 Douglas Crockford (www.crockford.com)
2002-2004 James W. Newkirk, Michael C. Two, Alexei A. Vorontsov
2002-2007 Charlie Poole
2002-2005 Lawrence E. Rosen
2002-2017 Jean Delvare <jdelvare@suse.de>
2003 Bitstream, Inc.
2003 The Regents of the University of California, through Lawrence Berkeley National Laboratory
2004 Sam Hocevar <sam@hocevar.net>
2004 the University Corporation for Atmospheric Research ("UCAR")
2004 USAGI/WIDE Project
2005 M. Y. Name
2005-2011 David Schultz <das@FreeBSD.ORG>
2005-2016 Puppet, Inc.
2006 Academy of Motion Picture Arts and Sciences
2006 Princeton University
2006-2011 Erin Catto http://www.box2d.org
2006-2013 The University of Colorado Denver
2006-2018 The HDF Group
2007 Geospatial Information Authority of Japan
2008-2011 AQR Capital Management, LLC
2008-2011 Ken Lauer
2009 Jan Friesse <jfriesse@gmail.com>
2009 Tensilica Inc.
2009-2011 Mozilla Foundation and contributors
2009-2019 Joachim Metz <joachim.metz@gmail.com>
2010 Nokia Corporation and/or its subsidiary(-ies)
2010 Ronnie Sahlberg <ronniesahlberg@gmail.com>
2010-2013 TJ Holowaychuk <tj@vision-media.ca>
2010-2014 Emscripten authors
2010-2015 Zoltan Herczeg
2011 Mathijs Mohlmann
2011 Red Hat, Inc.
2012 Lee Duncan <lee@gonzoleeman.net>
2012 Mihai Bazon <mihai.bazon@gmail.com>
2012 The Chromium Authors
2013 International Business Machines Corporation
2013 Julien Pommier ( pommier@modartt.com )
2013 Lattice Semiconductor Corporation
2013 Linaro Limited
2013-2017 Denis Bardadym <bardadymchik@gmail.com>
2015 Digia Plc and/or its subsidiary(-ies)
2015-2016 Decentral
2016 Contributing Member(s) of Distributed Management Task Force
2016 The Khronos Group Inc.
2017 MariaDB Corporation Ab
2018 J. Alexander Branham (alex DOT branham AT gmail DOT com)
2018 MongoDB, Inc.
2018-2019 Cosmin Truta
2019 Waymo LLC
2019 "WebGPU native" developers
Joyent, Inc. and other Node contributors
1993-1996 OpenVision Technologies, Inc.
1994-2006 Copyright Holders of the Geant4 Collaboration
1995-2013 Jean-loup Gailly and Mark Adler
1996-2007 Julian Seward
2012-2016 IBM Corp. and others
2013 Mark Jason Dominus <mjd@cpan.org>
2018-2022 Google LLC
2020 CERN
Christoph Martin, Kurt Roeckx, Sebastian Andrzej Siewior
KUKA Roboter GmbH
Silicon Graphics, Inc.
The OpenSSL Project Authors
UNIX System Laboratories, Inc.
W3C (MIT, ERCIM, Keio, Beihang)
Zope Corporation
Lambda Foundry, Inc. and PyData Development Team
License: Apache-2.0 and licence-texts
Comment: The classifier's corpus. Google's selection and arrangement is
Apache-2.0; each text keeps its own author, listed above as found in the
texts. Licence templates such as Apache-2.0 ("Copyright [yyyy] [name of
copyright owner]") or BSD-2-Clause ("Copyright (c) <year> <owner>") carry a
placeholder, not a holder. See debian/README.source.
Files: v2/assets/embed.go v2/scenarios/README.md
Copyright: 2017-2022 Google Inc.
License: Apache-2.0
Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
License: licence-texts
Each file is a verbatim copy of a licence text, a licence header or a
copyright notice, kept as the corpus the classifier matches against. Debian
distributes each one under the permission it gives for verbatim copies of
itself where it has one ("Everyone is permitted to copy and distribute
verbatim copies of this license document"), and otherwise as a licence text
reproduced so that the licence can be identified, on the reasoning in
https://lists.debian.org/debian-legal/2026/10/msg00043.html . The terms in
these texts do not apply to the software in this package, and some of them
are not free licences.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Comment:
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW 1 blocker, 1 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 day ago.
Report
DFSG NEW review for golang-github-google-licenseclassifier version 2.0.0+ds2-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 1 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 136 found
Licensing
The Apache-2.0 software side is described correctly: debian/copyright is DEP-5, all Go sources carry 'Copyright 20xx Google Inc.' under Apache-2.0, and the corpus stanzas are in the right order with the right patterns. But the package ships, and the binary package installs, ~130 licence texts and EULAs under terms that forbid what the DFSG requires: CC-BY-NC/ND and SSPL/Elastic/BSL/Commons-Clause texts exclude commercial use, several forbid modification, and some forbid reproduction outright (MediaTek, Waymo 'Contains Trade Secrets', IDA/Hex-Rays). The stand-alone 'licence-texts' paragraph grants nothing and itself states that 'some of them are not free licences'; a fair-use rationale is not a licence Debian can distribute under, and the two lintian tags that name two of these texts were overridden rather than resolved. The copyright list of holders is also incomplete: MediaTek Inc. and the Qhull holder are named in the texts but not in debian/copyright.
Packaging
The packaging is competent: debhelper compat 14 with dpkg-build-api (= 1) via the dpkg-dev-provided virtual package, dh-go's golang buildsystem with the corpus installed through DH_GOLANG_INSTALL_EXTRA and the v2 module named as DH_GOLANG_BUILDPKG, go-spew/go-diff in Depends matching the non-test imports and go-cmp correctly <!nocheck>. Multi-Arch: foreign matches other golang-*-dev packages, there are no maintainer scripts or patches to get wrong, Standards-Version 4.7.4 is current, and the autopkgtest-pkg-go run (which re-runs make build from debian/rules) works with the import path chosen. Only the licensing of the corpus, reported separately, stands in the way.
Issues
blocker licensing 1. v2/assets ships non-free licence texts and EULAs (MTK, Waymo, IDA, CC-BY-NC-ND, JSON, Unicode TOU) that do not permit redistribution, modification or commercial use ◂
- Files:
debian/copyright,debian/source/lintian-overrides:2,v2/assets/License/MTK/pristine.txt:1-8,v2/assets/License/Waymo1P/notice.txt:1-14,v2/assets/License/IDA/license.txt:48-54,v2/assets/License/CC-BY-NC-ND-4.0/license.txt:1-6,v2/assets/License/JSON/license.txt:7,v2/assets/License/unicode_org/pristine.txt:19-21,v2/assets/License/SSPL-1.0/license.txt,v2/assets/License/Elastic-2.0/license.txt,v2/assets/License/Business-Source-License-1.1/license.txt,v2/assets/License/Android-SDK/20161209.txt,v2/assets/License/BCL/license.txt,v2/assets/License/Xcode/license.txt,v2/assets/License/Windows-SDK-10/license.txt,v2/assets/License/AdColony-SDK/license.txt,v2/assets/License/Facebook-Examples/license.txt,v2/assets/License/OROMatcher/license.txt,v2/assets/License/RCSB-PDB/license.txt,v2/assets/License/Sflow/license.txt,v2/assets/License/Autodesk-3D-Studio-File-Toolkit/license.txt:29-33 - Basis: checked, in the package or with a reference tool
- Evidence: MTK:
any reproduction, modification, use or disclosure of MediaTek Software, and information contained herein, in whole or in part, shall be strictly prohibited.Waymo:Waymo Proprietary and Confidential - Contains Trade Secrets ... may only be used, duplicated, modified or distributed pursuant to the terms and conditions of a separate, written license agreement. IDA:You may not distribute copies of the software to another party ... You may not modify, adapt, translate, rent, lease, resell, distribute, or create derivative works. debian/copyright, License: licence-texts:Debian distributes each one under the permission it gives for verbatim copies of itself where it has one ... and otherwise as a licence text reproduced so that the licence can be identified, on the reasoning in https://lists.debian.org/debian-legal/2026/10/msg00043.html ... some of them are not free licences.debian/source/lintian-overrides:license-problem-json-evil [v2/assets/License/JSON/license.txt]andlicense-problem-old-unicode [...]. - Problem: Policy 2.1 (DFSG): a licence in main may not restrict sale of the work (DFSG 1), must allow derived works (DFSG 3), and may not discriminate by field of endeavour (DFSG 6). CC-BY-NC/ND, SSPL-1.0, Elastic-2.0, BSL-1.1, the Commons Clause, the JSON 'Good, not Evil' clause, the Unicode Terms of Use and the SDK EULAs fail at least one of these, and MediaTek and Waymo forbid reproduction of the text itself. 'Fair use' (README.source) is a defence available to a quoter, not a permission Debian can pass on to its mirrors, CD vendors and derivatives, and the 'licence-texts' short name in debian/copyright is not a licence at all (it grants nothing), so ~130 files the package ships have no free licence: the package is not DFSG-free and debian/copyright does not describe a free licence for them. The two lintian overrides suppress exactly the non-free-licence tags instead of resolving them.
- Fix: Either get written permission (or an explicit ftp-master/debian-legal decision that these texts may be redistributed) for every text that is not under a free licence, or drop those files from the orig tarball (extend Files-Excluded, then remove their go:embed corpus entries, their lines in debian/lrc.config and the classification tests that need them), keeping only texts whose licences permit redistribution and modification. Whichever route is taken, record the result in debian/copyright and drop the license-problem-* overrides.
important licensing 2. debian/copyright's corpus stanza names 138 holders but omits MediaTek Inc. and C.B. Barber/The Geometry Center (Qhull) ◂
- Files:
debian/copyright:29-165,v2/assets/License/MTK/pristine.txt:8,v2/assets/License/MTK/a.txt:4,v2/assets/Header/MTK/header.txt,v2/assets/License/Qhull/license.txt:1-14 - Basis: checked, in the package or with a reference tool
- Evidence:
MediaTek Inc. (C) 2018. All rights reserved.(MTK/pristine.txt:8) andpermission of MediaTek Inc. (C) 2009(MTK/a.txt:4);Qhull, Copyright (c) 1993-2019 / C.B. Barber / Arlington, MA / and / The National Science and Technology Research Center for Computation and Visualization of Geometric Structures / (The Geometry Center) / University of Minnesota. - Problem: The stanza
Files: v2/assets/* v2/scenarios/*is the only place these holders can be named (the earlierFiles: *names only Google), and it does not name either of these, so debian/copyright does not describe the copyright of v2/assets/License/MTK/* and v2/assets/License/Qhull/license.txt (Policy 12.5, copyright-format 6.5). Every other holder with an explicit notice in the corpus is named, which makes the two omissions plainly accidental. - Fix: Add
MediaTek Inc.andC.B. Barber/The Geometry Center, University of Minnesotato the Copyright list of that stanza (or give the two files their own Files paragraphs).
Verified ◂
- Inventory: 501 files. Upstream non-debian files are .travis.yml, CHANGELOG, CONTRIBUTING.md, LICENSE, README.md at the top level, the v2/ Go module (19 .go files, go.mod, go.sum, README.md, tools/) and the corpus v2/assets/ (Header/, License/, Supplement/) plus v2/scenarios/ (41 files). The orig tarball contains none of the Files-Excluded top-level v1 paths.
- All Go sources carry
// Copyright 2020 Google Inc.(2017 in v2/tools/), v2/assets/embed.go 2022; all are Apache-2.0 and covered byFiles: *or the embed.go/README stanza. The copyright stanza order is correct (Files: *, then the corpus, then embed.go/scenarios/README.md); patterns reach into subdirectories so every corpus file is matched; the headerFormat:is the current 1.0 URL, so no replacement file is needed. - Wording flagged by the scan (134 hits) is the corpus itself, not the package's licence terms; these files are all verbatim licence texts or notices declared by
Files: v2/assets/* v2/scenarios/*: v2/assets/Header/Elastic-2.0/header.txt, v2/assets/Header/MTK/header.txt, v2/assets/Header/SSPL-1.0/header.txt, v2/assets/License/AFL-2.0/license.txt, v2/assets/License/AFL-2.1/license.txt, v2/assets/License/AFL-3.0/license.txt, v2/assets/License/AMPAS/license.txt, v2/assets/License/APSL-1.2/license.txt, v2/assets/License/APSL-2.0/license.txt, v2/assets/License/AdColony-SDK/license.txt, v2/assets/License/Android-SDK/20090410.txt, v2/assets/License/Android-SDK/20161209.txt, v2/assets/License/BCL/license.txt, v2/assets/License/BSD-Protection/license.txt, v2/assets/License/BSD-Rice/license.txt, v2/assets/License/BitTorrent-1.1/license.txt, v2/assets/License/Business-Source-License-1.1/license.txt, v2/assets/License/CC-BY-1.0/license.txt, v2/assets/License/CC-BY-2.0/license.txt, v2/assets/License/CC-BY-2.5/license.txt, v2/assets/License/CC-BY-NC-1.0/license.txt, v2/assets/License/CC-BY-NC-2.0/license.txt, v2/assets/License/CC-BY-NC-2.5/license.txt, v2/assets/License/CC-BY-NC-3.0/license.txt, v2/assets/License/CC-BY-NC-4.0/license.txt, v2/assets/License/CC-BY-NC-ND-1.0/license.txt, v2/assets/License/CC-BY-NC-ND-2.0/license.txt, v2/assets/License/CC-BY-NC-ND-2.5/license.txt, v2/assets/License/CC-BY-NC-ND-3.0/license.txt, v2/assets/License/CC-BY-NC-ND-4.0/license.txt, v2/assets/License/CC-BY-NC-SA-1.0/license.txt, v2/assets/License/CC-BY-NC-SA-2.0/license.txt, v2/assets/License/CC-BY-NC-SA-2.5/license.txt, v2/assets/License/CC-BY-NC-SA-3.0/license.txt, v2/assets/License/CC-BY-NC-SA-4.0/license.txt, v2/assets/License/CC-BY-ND-1.0/license.txt, v2/assets/License/CC-BY-ND-2.0/license.txt, v2/assets/License/CC-BY-ND-2.5/license.txt, v2/assets/License/CC-BY-SA-1.0/license.txt, v2/assets/License/CC-BY-SA-2.0/license.txt, v2/assets/License/CC-BY-SA-2.5/license.txt, v2/assets/License/CERN-OHL-WR-v2/license.txt, v2/assets/License/CERN-OHL-v1.2/license.txt, v2/assets/License/Commons-Clause/license.txt, v2/assets/License/Elastic-2.0/license.txt, v2/assets/License/Facebook-Examples/license.txt, v2/assets/License/IDA/license.txt, v2/assets/License/IJG/license.txt, v2/assets/License/JSON/license.txt, v2/assets/License/LGPLLR/license.txt, v2/assets/License/LZMA/license.txt, v2/assets/License/LicenseRef-iccjpeg/license.txt, v2/assets/License/MTK/pristine.txt, v2/assets/License/NGPL/license.txt, v2/assets/License/OROMatcher/license.txt, v2/assets/License/OSL-1.0/license.txt, v2/assets/License/OSL-1.1/license.txt, v2/assets/License/OSL-2.0/license.txt, v2/assets/License/OSL-2.1/license.txt, v2/assets/License/OSL-3.0/license.txt, v2/assets/License/OpenSSL/license.txt, v2/assets/License/RCSB-PDB/license.txt, v2/assets/License/SGI-B-1.0/license.txt, v2/assets/License/SSPL-1.0/license.txt, v2/assets/License/Sflow/license.txt, v2/assets/License/Unicode-TOU/license.txt, v2/assets/License/Unlicense/license.txt, v2/assets/License/Waymo1P/notice.txt, v2/assets/License/Windows-SDK-10/license.txt, v2/assets/License/Xcode/license.txt, v2/assets/License/geant4/license.txt, v2/assets/Supplement/CC-BY-NC-4.0/preface.txt, v2/assets/Supplement/CC-BY-NC-ND-4.0/preface.txt, v2/assets/Supplement/CC-BY-NC-SA-4.0/preface.txt, v2/scenarios/151151704. Of these, the 'commercial or non-commercial' and 'proprietary' hits are permission grants or boilerplate disclaimers/trademark clauses (LZMA, Unlicense, OpenSSL, BSD-Rice, AFL, APSL-2.0, BitTorrent-1.1, CERN-OHL, geant4, IJG, SGI-B-1.0, AMPAS); the texts that really do restrict are the licensing blocker above. - v2/assets/License/CAL-1.0/license.txt (the two DFSG-database hits) is the CAL-1.0 and CAL-1.0-Combined-Work-Exception text itself; both strings are its title lines, and it belongs to the same corpus blocker.
- debian/lrc.config:162-164 are lines of a list of corpus file names (CC-BY-NC paths), not licence terms; v2/tokenizer.go:401 is the
"non commercial": "noncommercial"entry of the tokenizer's normalisation table; v2/tokenizer_test.go:93Copyright 1996-2002, 2006 by A. Developeris a synthetic input string in a Go test table, not a real holder. - Holders the scan could not match are accounted for: Autodesk (v2/assets/License/Autodesk-3D-Studio-File-Toolkit/license.txt:8,
(C) Copyright 1997 by Autodesk, Inc., listed as 1995-1997), Sun (v2/assets/License/SISSL-1.2/license.txt:227, listed as 2001-2003 Sun Microsystems, Inc.), W3C (v2/assets/License/W3C-19980720/license.txt:3, listed as World Wide Web Consortium and W3C (MIT, ERCIM, Keio, Beihang)), Charlie Poole, Emscripten authors, FSF, Glenn Randers-Pehrson, ImageMagick Studio LLC, Ken Lauer, Richard M. Stallman and RSA Data Security, all named in that stanza. - Holder coverage was checked over all 148 explicit copyright/(C)/© notice lines in v2/assets and v2/scenarios, not only those the scan listed; only MediaTek and Qhull came out missing (reported).
- Every corpus file sits at exactly three path components below v2/assets, so
//go:embed */*/*in v2/assets/embed.go covers all of them, and DH_GOLANG_INSTALL_EXTRA installs v2/assets and v2/scenarios into the build tree and the -dev package. - Packaging checks done: dpkg-build-api (= 1) is the documented Build-Depends form (dpkg-dev
Provides: dpkg-build-api (= 1), dpkg-build-api(7)); DH_GOLANG_BUILDPKG/EXCLUDES/INSTALL_EXTRA behave as debian/rules assumes when read in /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm (toolsas a regex drops v2/tools from both build and install, since EXCLUDES_ALL defaults to true from compat 12); /usr/bin/dh_golang_autopkgtest takes DH_GOPKG from debian/control and re-runsmake buildfrom debian/rules, so the autopkgtest-pkg-go run uses the v2 build target; go-spew and go-diff are non-test imports (scoring.go, searchset.go, diff.go) and go-cmp is test-only, matching the Depends and the <!nocheck> build-dependency; no debian/tests, maintainer scripts, patches or .maintscript exist, and Multi-Arch: foreign is what other golang--dev packages use (golang-github-google-go-cmp-dev); Standards-Version 4.7.4 is current. - The two remaining lintian overrides are justified as data: national-encoding for v2/assets/Supplement/Apache-2.0/openssl.txt (kept byte for byte, matched as is) and the executable-bit chmod in debian/rules' execute_after_dh_install.
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream2.0.0-pre.2, packaged2.0.0+ds2), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- The debian-legal message cited by debian/copyright and debian/README.source (lists.debian.org/debian-legal/2026/10/msg00043.html) cannot be read from here; whether it actually addresses redistribution of these texts is unverified, so the maintainer's rationale rests on something I could not check.
- File modes in the orig tarball could not be inspected, so I could not confirm that the corpus text carrying an executable bit upstream is a *.txt file that the find/chmod in debian/rules actually reaches.
Proposed changes ◂
None.
Uploader's response to the LLM review
Yes. I verified that. Consider this rationale:
The holders are right: MediaTek Inc. and C.B. Barber, The Geometry Center are added for the next revision, https://salsa.debian.org/go-team/packages/golang-github-google-licenseclassifier/-/commit/65a08818c5626a50b890adbbb60c71d6ccde8e9a . The licence texts are the classifier's reference corpus, kept on purpose after
https://lists.debian.org/debian-legal/2026/10/msg00043.html ,
see debian/README.source.
Please accept this upload.
— Juan Manuel Méndez Rey (mendezr), 23 hours ago
Review Information
accepted — allocated to mechtilde 8 hours ago, started 8 hours ago, completed 8 hours ago.
Final Comment
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 2.0.0+ds2-1 | f7634cd3… | 2026-11-06 09:07 | 2026-11-06 09:07 | dfsg-uploader | rejected | VIEW |