DFSG NEW review for golang-github-gotify-location version 0.0~git20170722.03bc4ad-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and matches the tree exactly. The only copyright notice anywhere is LICENSE:3 Copyright (c) 2016 Brad Rydzewski, and Files: * names that holder under Expat; the stand-alone License: Expat paragraph reproduces the full MIT text, so nothing is deferred to /usr/share/common-licenses and no separate notice file is needed. Files: debian/* gives the packaging its own holder and the same licence. The 9 upstream files (config.go, location.go, location_test.go, README.md, LICENSE, .gitignore, .travis.yml, example/default/example.go, example/custom/example.go) contain no other holders, no SPDX tags and no other licence wording; there is no vendored, generated, minified or binary content. MIT/Expat is DFSG-free and compatible with the packaging licence.

Packaging

Standard Debian Go team packaging and it is consistent throughout: debhelper compat 13 with dh-sequence-golang and the golang build system in debian/rules; a single library binary split correctly as Architecture: all / Multi-Arch: foreign; Depends on the only runtime import (gin), with the test-only testify correctly kept in Build-Depends under <!nocheck>; Testsuite: autopkgtest-pkg-go, for which autodep8 supplies the test from Build-Depends, so no debian/tests/control is needed; Standards-Version 4.7.4 against Policy 4.7.4.1; 3.0 (quilt) with no patches; a clean initial changelog entry for unstable. The example/ exclusion is deliberate and necessary (the examples import github.com/gin-contrib/location, which this package does not provide) and at compat 12+ also keeps them out of the installed source. I found no packaging fault worth reporting.

Issues

None.

Verified

• Read every upstream file in the tree and every file under debian/ except debian/watch (out of scope). Tree inventory: .gitignore, .travis.yml, LICENSE, README.md, config.go, location.go, location_test.go, example/default/example.go, example/custom/example.go; debian/{changelog,control,copyright,gbp.conf,rules,salsa-ci.yml,source/format,upstream/metadata}.
• Prescan holder check reports every holder found is named in debian/copyright; the only notice in the tree is LICENSE:3 Copyright (c) 2016 Brad Rydzewski, which Files: * names.
• debian/copyright is machine-readable (Format .../copyright-format/1.0/), stanzas are ordered Files: * then Files: debian/* so the packaging stanza overrides the catch-all (copyright-format 6.9), and the full Expat text is present in the stand-alone Licence paragraph.
• LICENSE is the unmodified MIT text (MIT License, Copyright (c) 2016 Brad Rydzewski) and README.md:107 states MIT; Expat is the correct short name for it.
• No compiled objects, bytecode, minified code, archives, PDFs, fonts or images in the tree; nothing is generated at build time from absent inputs; no vendored third-party sources. The .orig.tar.xz contains exactly the nine upstream files (checked via its archive listing); the .debian.tar.xz contains only debian/ and no patches.
• Build-Depends all resolve: golang-any 2:1.27~1, golang-github-gin-gonic-gin-dev 1.8.1-4, golang-github-stretchr-testify-dev 1.11.1-2, and the virtual dh-sequence-golang provided by dh-golang (apt-cache). gin is the only non-stdlib import of the shipped package, so Depends: golang-github-gin-gonic-gin-dev is complete; testify is used only by location_test.go and so belongs under <!nocheck> (checked against location_test.go:11).
• debhelper 14.5 is installed and confirms via the debhelper tool that at compat 13 substvars are not added automatically, so the explicit ${misc:Depends} is required and present; and that from compat 13 dh skips override/hook targets of dh_auto_test under nocheck, so no nocheck guard is missing in debian/rules.
• Testsuite: autopkgtest-pkg-go is backed by autodep8: /usr/share/autodep8/support/go/detect matches the golang-any build dependency and /usr/share/autodep8/support/go/generate supplies Test-Command: /usr/bin/dh_golang_autopkgtest with Depends: @, @builddeps@; testify is a Build-Depends, so no debian/tests/control is required.
• The golang build system honours DH_GOLANG_EXCLUDES for the build and, from compat 12 (DH_GOLANG_EXCLUDES_ALL default true), for install, so export DH_GOLANG_EXCLUDES := example/ keeps the two example programs out of both build and package.
• Standards-Version 4.7.4; the policy tool gives Policy 4.7.4.1, so the first two components match and it is current.
• debian/changelog has one entry, 0.0~git20170722.03bc4ad-1, distribution unstable, urgency medium, signed off by the listed Uploader and closing the ITP; debian/source/format is 3.0 (quilt) with an empty series; debian/upstream/metadata uses valid DEP-12 fields.
• No files of unclear provenance and nothing in the package asks the reader to fetch anything outside it.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20170722.03bc4ad, packaged 0.0~git20170722.03bc4ad).

Not confirmed

• Whether autopkgtest's @builddeps@ expansion keeps the <!nocheck>-marked testify dependency could not be checked here (autopkgtest's documentation is not installed on the reviewing system). The pattern is the standard go-team one and the autopkgtest result in the archive would show it.

Proposed changes

None.