Review: golang-github-google-licenseclassifier 2.0.0+ds2-1

Package Information

Description	analyze text to determine what type of license it contains (library) The license classifier is a library and set of tools that can analyze text to determine what type of license it contains. It searches for license texts in a file and compares them to an archive of known licenses. These files could be, e.g., LICENSE files with a single or multiple licenses in it, or source code files with the license text in a comment. A "confidence level" is associated with each result indicating how close the match was. A confidence level of 1.0 indicates an exact match, while a confidence level of 0.0 indicates that no license was able to match the text. This is a substantial revision of the license classifier with a focus on improved accuracy and performance.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-google-licenseclassifier.git (browse)
Closes	#1152499
Tracker	https://tracker.debian.org/pkg/golang-github-google-licenseclassifier
Uploaded	2 days ago

New Package Report

.changes◂

Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Fri, 30 Oct 2026 05:41:19 +0100
Source	golang-github-google-licenseclassifier
Version	2.0.0+ds2-1

Changelog◂

golang-github-google-licenseclassifier (2.0.0+ds2-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152499)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-google-licenseclassifier-v2-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/google/licenseclassifier
Upstream-Name: licenseclassifier
Upstream-Contact: https://github.com/google/licenseclassifier/issues
Files-Excluded:
 classifier.go
 classifier_test.go
 commentparser
 file_system_resources.go
 forbidden.go
 go.mod
 go.sum
 internal
 licenses
 license_type.go
 serializer
 stringclassifier
 tools
Comment: The top level is the v1 module, which nothing in Debian uses; only
 the v2 module in v2/ is packaged.

Files: *
Copyright: 2017-2022 Google Inc.
License: Apache-2.0

Files: v2/assets/* v2/scenarios/*
Copyright: The holders named in each text
License: licence-texts
Comment: See debian/README.source.

Files: v2/assets/embed.go
Copyright: 2022 Google Inc.
License: Apache-2.0

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0

License: licence-texts
 Verbatim copies of licence texts, headers and notices (one licence per
 directory, the directory named after it), used as the corpus the classifier
 matches against. They are data for detecting those licences, not terms
 under which this package is distributed. They include texts of non-free
 licences and proprietary agreements, shipped as detection data (see
 debian/README.source).

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for golang-github-google-licenseclassifier version 2.0.0+ds2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 1 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 133 found

Licensing

The program itself is Apache-2.0 (Google Inc., 2017-2022) and is recorded correctly. The several hundred files under v2/assets/ and the scenarios under v2/scenarios/ are licence texts and notices used as detection data, which Debian may reproduce verbatim (debian/README.source records the debian-legal answer), so shipping them is not itself a DFSG restriction. But debian/copyright describes those files neither accurately nor completely: its stanza for them declares them unlicensed (License: licence-texts), and its Copyright: field names no holder, although the files carry (or are) texts of 130 third parties.

Packaging

Modern and correct: debhelper compat 14 with dpkg-build-api (= 1) and the current dh-go 1.69, --buildsystem=golang with DH_GOLANG_BUILDPKG/EXCLUDES/INSTALL_EXTRA used as intended, test-only go-cmp behind <!nocheck>, runtime Go dependencies in Depends, Multi-Arch: foreign as in the rest of the archive's Go library packages, no patches, debian/README.source documenting the repack, autopkgtest through Testsuite: autopkgtest-pkg-go. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1. I found no packaging fault.

Issues

blocker licensing 1. Files: v2/assets/* v2/scenarios/* records no licence at all for the classifier corpus and the scenarios ◂

Files: debian/copyright:23-26, debian/copyright:35-41, v2/scenarios/README.md, v2/assets/Supplement/Apache-2.0/openssl_debian.txt
Basis: checked, in the package or with a reference tool

Evidence:

Files: v2/assets/* v2/scenarios/*
Copyright: The holders named in each text
License: licence-texts

and the stand-alone paragraph it points to:

License: licence-texts
 Verbatim copies of licence texts, headers and notices ... They are data for
 detecting those licences, not terms under which this package is distributed.

Problem: DEP-5 6.7 requires the License field of a Files stanza to give the licensing terms of the files it lists; the only entry for 265 licence directories under v2/assets/License (plus v2/assets/Header, v2/assets/Supplement and the corpus files listed in the report's verified section) and the 41 scenarios says they are not distributed under any terms. Policy 12.5 requires a verbatim copy of the package's distribution licence(s), so as written these several hundred files, all of which debian/rules installs into the -dev package through DH_GOLANG_INSTALL_EXTRA, are placed outside the package's licensing. The same stanza also catches Google's own prose, v2/scenarios/README.md (no licence text in it; the file is upstream's and Apache-2.0), and v2/assets/Supplement/Apache-2.0/openssl_debian.txt, a Debian copyright stanza whose recorded licence is Apache-2.0.
Fix: State a licence for these files rather than disclaiming one: upstream's LICENSE is Apache-2.0 and covers the whole repository, so record License: Apache-2.0 (Copyright 2017-2022 Google Inc.) for the corpus and keep the explanation of what the texts are and why their own wording does not apply to the package in a Comment:; alternatively reproduce the terms of each text and say what Debian relies on. Give v2/scenarios/README.md Apache-2.0.

important licensing 2. Copyright: The holders named in each text names no holder, though the corpus reproduces texts of 130 third parties ◂

Files: debian/copyright:24, v2/assets/Header/APSL-1.0/header.txt:1, v2/assets/Header/Apache-2.0/header.txt:1, v2/assets/License/BSD-2-Clause/pristine.txt:1, v2/assets/License/Business-Source-License-1.1/license.txt:1, v2/assets/License/SSPL-1.0/license.txt:1, v2/assets/License/Waymo1P/notice.txt:2
Basis: checked, in the package or with a reference tool
Evidence: Copyright: The holders named in each text; the prescan's author check lists 130 holders present in v2/assets/ and v2/scenarios/ but absent from debian/copyright (e.g. v2/assets/Header/APSL-1.0/header.txt:1 Apple Inc., v2/assets/License/SSPL-1.0/license.txt:1 MongoDB, Inc., v2/assets/License/Business-Source-License-1.1/license.txt:1 MariaDB Corporation Ab, v2/assets/License/Waymo1P/notice.txt:2 Waymo LLC, v2/assets/License/AMPAS/license.txt:1 A.M.P.A.S.). For some texts no holder exists at all to be deferred to: v2/assets/Header/Apache-2.0/header.txt:1 is Copyright [yyyy] [name of copyright owner] and v2/assets/License/BSD-2-Clause/pristine.txt:1 is Copyright (c) <year> <owner>.
Problem: DEP-5 6.8 says the Copyright field collects the copyright notices that apply to the files of the stanza, and that it must not sacrifice information. A cross-reference into the file bodies is not a copyright statement, it is false for the placeholder-only licences, and the holder cannot be recovered from a file that has none. These files are shipped in the binary package, so /usr/share/doc/golang-github-google-licenseclassifier-v2-dev/copyright omits every third-party holder in it.
Fix: List the holders, grouped per licence family or per directory so the file stays readable, and state explicitly for the texts that carry only placeholders (Apache-2.0, BSD-2-Clause, GPL appendix, ...) that no holder is named and what that means. The holder of the compilation, Google Inc., should be recorded alongside.

Verified ◂

All 131 rare-wording hits from the scan are lines of verbatim licence and notice texts that the classifier matches against. The files are: v2/assets/Header/Elastic-2.0/header.txt, v2/assets/Header/MTK/header.txt, v2/assets/Header/SSPL-1.0/header.txt, v2/assets/License/AFL-2.0/license.txt, v2/assets/License/AFL-2.1/license.txt, v2/assets/License/AFL-3.0/license.txt, v2/assets/License/AMPAS/license.txt, v2/assets/License/APSL-1.2/license.txt, v2/assets/License/APSL-2.0/license.txt, v2/assets/License/AdColony-SDK/license.txt, v2/assets/License/Android-SDK/20090410.txt, v2/assets/License/Android-SDK/20161209.txt, v2/assets/License/BCL/license.txt, v2/assets/License/BSD-Protection/license.txt, v2/assets/License/BSD-Rice/license.txt, v2/assets/License/BitTorrent-1.1/license.txt, v2/assets/License/Business-Source-License-1.1/license.txt, v2/assets/License/CC-BY-1.0/license.txt, v2/assets/License/CC-BY-2.0/license.txt, v2/assets/License/CC-BY-2.5/license.txt, v2/assets/License/CC-BY-NC-1.0/license.txt, v2/assets/License/CC-BY-NC-2.0/license.txt, v2/assets/License/CC-BY-NC-2.5/license.txt, v2/assets/License/CC-BY-NC-3.0/license.txt, v2/assets/License/CC-BY-NC-4.0/license.txt, v2/assets/License/CC-BY-NC-ND-1.0/license.txt, v2/assets/License/CC-BY-NC-ND-2.0/license.txt, v2/assets/License/CC-BY-NC-ND-2.5/license.txt, v2/assets/License/CC-BY-NC-ND-3.0/license.txt, v2/assets/License/CC-BY-NC-ND-4.0/license.txt, v2/assets/License/CC-BY-NC-SA-1.0/license.txt, v2/assets/License/CC-BY-NC-SA-2.0/license.txt, v2/assets/License/CC-BY-NC-SA-2.5/license.txt, v2/assets/License/CC-BY-NC-SA-3.0/license.txt, v2/assets/License/CC-BY-NC-SA-4.0/license.txt, v2/assets/License/CC-BY-ND-1.0/license.txt, v2/assets/License/CC-BY-ND-2.0/license.txt, v2/assets/License/CC-BY-ND-2.5/license.txt, v2/assets/License/CC-BY-SA-1.0/license.txt, v2/assets/License/CC-BY-SA-2.0/license.txt, v2/assets/License/CC-BY-SA-2.5/license.txt, v2/assets/License/CERN-OHL-WR-v2/license.txt, v2/assets/License/CERN-OHL-v1.2/license.txt, v2/assets/License/Commons-Clause/license.txt, v2/assets/License/Elastic-2.0/license.txt, v2/assets/License/Facebook-Examples/license.txt, v2/assets/License/IDA/license.txt, v2/assets/License/IJG/license.txt, v2/assets/License/JSON/license.txt, v2/assets/License/LGPLLR/license.txt, v2/assets/License/LZMA/license.txt, v2/assets/License/LicenseRef-iccjpeg/license.txt, v2/assets/License/MTK/pristine.txt, v2/assets/License/NGPL/license.txt, v2/assets/License/OROMatcher/license.txt, v2/assets/License/OSL-1.0/license.txt, v2/assets/License/OSL-1.1/license.txt, v2/assets/License/OSL-2.0/license.txt, v2/assets/License/OSL-2.1/license.txt, v2/assets/License/OSL-3.0/license.txt, v2/assets/License/OpenSSL/license.txt, v2/assets/License/RCSB-PDB/license.txt, v2/assets/License/SGI-B-1.0/license.txt, v2/assets/License/SSPL-1.0/license.txt, v2/assets/License/Sflow/license.txt, v2/assets/License/Unicode-TOU/license.txt, v2/assets/License/Unlicense/license.txt, v2/assets/License/Waymo1P/notice.txt, v2/assets/License/Windows-SDK-10/license.txt, v2/assets/License/Xcode/license.txt, v2/assets/License/geant4/license.txt, v2/assets/Supplement/CC-BY-NC-4.0/preface.txt, v2/assets/Supplement/CC-BY-NC-ND-4.0/preface.txt, v2/assets/Supplement/CC-BY-NC-SA-4.0/preface.txt, and v2/scenarios/151151704. They are the licences the tool detects, not terms on this package; no program code is under any of them.
Several of those hits are permissions rather than restrictions, which is why they are not non-free: v2/assets/License/Unlicense/license.txt ('for any purpose, commercial or non-commercial'), v2/assets/License/LZMA/license.txt, v2/assets/License/OpenSSL/license.txt and v2/assets/License/BSD-Rice/license.txt say the same, and the v2/assets/License/BSD-Protection/license.txt lines are explanatory prose.
v2/assets/License/CAL-1.0/license.txt: the text the DFSG database marks unsettled (CAL-1.0, User Autonomy obligations) is detection data only.
v2/assets/License/Unicode-TOU/license.txt ('Modification is not permitted with respect to this document') and v2/assets/License/unicode_org/pristine.txt (old Unicode terms, redistribution 'as long as this notice remains attached') are licence texts reproduced verbatim; both are the files debian/source/lintian-overrides names, and shipping licence texts verbatim is established practice (the GPL text in /usr/share/common-licenses itself says 'changing it is not allowed').
v2/tokenizer.go:401: the scan's 'commercial use' hit is the token-map entry "non commercial": "noncommercial" in a normaliser, not licence wording.
v2/scenarios/ holds 41 scenario files plus README.md; I read the README, every EXPECTED: line and sampled 151151704, 157091836, 159475529_2, 187845184 and 211020120. They reproduce licence headers or whole licence texts (GPL, LGPL, MPL, MIT, BSD, Unlicense, Emscripten) and no program code; all are permissive or licence texts.
Author check: the 130 holders it lists are all inside v2/assets/ and v2/scenarios/ text, except v2/tokenizer_test.go:93,277, where 'A. Developer' and 'David Turner, Robert Wilhelm, and Werner Lemberg' are quoted copyright lines in test fixtures of that Google file, not its copyright.
Inventory: top-level .travis.yml, CHANGELOG, CONTRIBUTING.md, LICENSE, README.md and v2/ (13 Go files Copyright 2020 Google Inc., v2/tools/identify_license/*.go Copyright 2017 Google Inc., v2/assets/embed.go Copyright 2022 Google Inc.); there is no AUTHORS, NOTICE or other COPYING anywhere, and the only licence file is the Apache-2.0 LICENSE, which Files: * records correctly.
No built, generated, minified, binary or PDF file in the tree: everything that is not Go or Markdown is plain-text licence corpus, and no file needs a source that is missing. Files-Excluded in debian/copyright lists exactly the v1 files absent from the unpacked tree.
Coverage: I read all of debian/ in full, all top-level and v2/ documentation, the Go file headers, and the licence-exception files; the remaining corpus files were judged from the scan's content list, their names and sizes, and a sample of about ten read in full.
Packaging: dh-go 1.69 exists and provides the golang sequence and dh_golang_autopkgtest; dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11; golang-any, golang-github-davecgh-go-spew-dev, golang-github-sergi-go-diff-dev and golang-github-google-go-cmp-dev are all in the archive.
XS-Go-Import-Path: github.com/google/licenseclassifier fits the v2/ layout: dh-go's configure copies the tree to _build/src/github.com/google/licenseclassifier/, so v2/go.mod lands at .../licenseclassifier/v2/ and v2/assets, v2/scenarios are installed where embed.go and the tests expect them (read /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm).
scoring.go and searchset.go import go-spew and diff.go/scoring.go import go-diff, so both are runtime Depends; go-cmp is imported only in *_test.go and is correctly a test-only Build-Depends with <!nocheck>.
debian/rules: compat 14, golang buildsystem, DH_GOLANG_BUILDPKG set for the v2 module, execute_after_dh_install only strips the executable bit from corpus .txt files; there are no patches, no maintainer scripts and no debian/tests/control (the Go team's Testsuite: autopkgtest-pkg-go supplies it).
debian/watch is out of scope here; debian/changelog (2.0.0+ds2-1, unstable, initial release closing #1152499), debian/upstream/metadata, gbp.conf and salsa-ci.yml are sane.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.0.0-pre.2, packaged 2.0.0+ds2), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 1 day ago, started 1 day ago, completed 1 day ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

The uploader said:

I will reupload with the fixed changes

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
2.0.0+ds2-1	1e655887…	2026-11-07 18:43	2026-11-07 18:50	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package