golang-github-gpustack-gguf-parser-go 0.26.3-1

Package Information

Description	parse GGUF model files and estimate memory usage (library) A Go library for parsing GGUF files, the binary model format used by GGML and llama.cpp. It reads a model's metadata and tensor layout, estimates the memory required to run it, and can predict maximum tokens per second from supplied device metrics. Because it reads remote files in chunks, it can inspect a model hosted on Hugging Face, ModelScope or an Ollama registry without downloading it in full. It also classifies what a GGUF file is for, distinguishing embedding, reranking, LoRA and diffusion models.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-gpustack-gguf-parser-go.git (browse)
Closes	#1148632
Tracker	https://tracker.debian.org/pkg/golang-github-gpustack-gguf-parser-go
Uploaded	4 hours ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Tue, 22 Sep 2026 03:47:08 +0200
Source	golang-github-gpustack-gguf-parser-go
Version	0.26.3-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>

Changelog◂

golang-github-gpustack-gguf-parser-go (0.26.3-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148632)
   * Do not ship cmd/gguf-parser: it is a nested module for upstream's
     CLI, not built or tested here, and its requirements are not
     packaged.

.dsc◂

Package-List	golang-github-gpustack-gguf-parser-go-dev deb golang optional arch=all
Section	golang
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/gpustack/gguf-parser-go
Upstream-Name: gguf-parser-go
Upstream-Contact: https://github.com/gpustack/gguf-parser-go/issues

Files: *
Copyright: 2024 gguf-parser-go authors
License: Expat
Comment: "gguf-parser-go authors" is the literal wording of the LICENSE and is
 not expanded anywhere upstream; there is no AUTHORS file.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

Files: util/osx/*
Copyright: 2017-2022 The Prometheus Authors
License: Apache-2.0
Comment: These memory-mapping helpers are copied from the Prometheus project
 and carry their own Apache-2.0 headers, unlike the rest of the tree.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for golang-github-gpustack-gguf-parser-go version 0.26.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is DFSG-free: the root LICENSE is MIT/Expat and is declared as Files: *, and the only third-party files, the memory-mapping helpers under util/osx, are under Apache-2.0 whose notice and a pointer to /usr/share/common-licenses/Apache-2.0 are given. The one defect is accuracy: the Files: util/osx/* stanza is broader than the evidence, naming The Prometheus Authors and Apache-2.0 for three files (env.go, file.go, homedir.go) that carry no such notice and that the stanza's own Comment excludes ("memory-mapping helpers ... unlike the rest of the tree"). No binary, compiled, minified or generated-without-input file exists, and every generated zz_generated.*.go has its generator in the tree.

Packaging

Compatible with current Policy and normal pkg-go practice: debhelper-compat 14, dh-go's golang buildsystem, dpkg-build-api (= 1), Standards-Version 4.7.4 (current), Vcs-* and XS-Go-Import-Path set, Architecture: all with Multi-Arch: foreign, and a complete Build-Depends/Depends set matching the actual imports. The network-fetching tests are skipped in override_dh_auto_test, and dh_golang_autopkgtest runs that same build target, so they are skipped under autopkgtest too. The nested cmd/gguf-parser module is correctly not built and is removed after dh_auto_install.

Issues

1. [important] [licensing] Files: util/osx/* names The Prometheus Authors and Apache-2.0 for env.go, file.go and homedir.go, which carry no such notice

Files: debian/copyright:36-40, util/osx/env.go, util/osx/file.go, util/osx/homedir.go, util/osx/file_mmap.go:1
Basis: inferred from what was read, not seen directly
Evidence: Stanza: Files: util/osx/* / Copyright: 2017-2022 The Prometheus Authors / License: Apache-2.0 / Comment: These memory-mapping helpers are copied from the Prometheus project and carry their own Apache-2.0 headers, unlike the rest of the tree. Only file_mmap.go, file_mmap_js.go, file_mmap_unix.go, file_mmap_windows_386.go and file_mmap_windows_non386.go begin with // Copyright <year> The Prometheus Authors / // Licensed under the Apache License, Version 2.0; env.go (ExistEnv/Getenv/ExpandEnv), file.go (InlineTilde/Exists*/WriteFile) and homedir.go (UserHomeDir) have no copyright or licence header.
Problem: A Files pattern is anchored at the tree root and * matches /, so Files: util/osx/* (copyright-format 6.9) applies to every file under util/osx, not just the memory-mapping helpers. It therefore assigns the copyright of The Prometheus Authors and the Apache-2.0 licence to util/osx/env.go, util/osx/file.go and util/osx/homedir.go, which carry no such notice and which the stanza's own Comment places with "the rest of the tree" (the MIT Files: * stanza). Naming a holder and a licence the files' notices do not support makes debian/copyright inaccurate for them, which is what the licensing question asks about; it does not make anything non-free (Policy 12.5 / copyright-format 6.9, 5.2).
Fix: Narrow the stanza to the files that actually carry the Apache-2.0 notice, e.g. Files: util/osx/file_mmap*.go, so env.go, file.go and homedir.go fall back to the MIT Files: * stanza; or, if they really are Prometheus-derived, say so and keep the wider pattern.

Verified

debian/copyright is DEP-5 (correct Format: URL) with Files: * (Expat/MIT, holder "2024 gguf-parser-go authors", matching LICENSE), Files: debian/* (2026 Juan Manuel Mendez Rey, Expat), Files: util/osx/* (Apache-2.0), and stand-alone License paragraphs; Expat text is complete and Apache-2.0 points to /usr/share/common-licenses/Apache-2.0.
Only one LICENSE/COPYING-style file exists (top-level LICENSE, MIT); a grep of the whole tree for Copyright/(C)/(c)/SPDX/Licensed under/GNU/Apache/Mozilla/public domain/All rights reserved found notices only in LICENSE and util/osx/file_mmap*.go, so the prescan's author check (every holder named) matches the package.
No binary, compiled, minified or otherwise non-preferred-form files: a glob for .png/.jpg/.pdf/.zip/.tar/.jar/.so/.dll/.exe/.class/.js/.css/.woff/.ttf/.gguf/.bin/.o/*.a returned nothing, and no testdata directory exists.
Generated files have their generators present: zz_generated.*.stringer.go come from gen.stringer.go's //go:generate stringer directives and zz_generated.diffusion_model_memory_usage.regression.go from gen.regression.go (both //go:build-gated, so gonum and golang.org/x/tools are legitimately absent from Build-Depends/Depends).
Imports of the root module are golang.org/x/{exp,crypto,sync,sys}, github.com/{davecgh/go-spew,henvic/httpretty,json-iterator/go,smallnest/ringbuffer,stretchr/testify} plus test-only testify/assert and go-spew; all are listed in both Build-Depends and Depends and every one exists in the archive, except golang-github-smallnest-ringbuffer-dev, which the ftp-master NEW queue shows as source golang-github-smallnest-ringbuffer 0.0~git20241116.4613814-1 (not a fault).
debian/rules: override_dh_auto_test passes -skip '<SKIP_NET>'; the golang buildsystem's test method runs go test -vet=off -v -p N <args> <targets>, so -skip reaches go test, and the named tests are the ones that fetch models from huggingface.co/modelscope.cn/Ollama.
/usr/bin/dh_golang_autopkgtest calls make -f debian/rules build, i.e. the same build sequence with the same override, so the network tests are skipped under Testsuite: autopkgtest-pkg-go as well.
The removal path in execute_after_dh_auto_install matches the buildsystem's install layout: golang.pm install copies $builddir/src/$DH_GOPKG to $destdir/usr/share/gocode/src/$DH_GOPKG, with DH_GOPKG = the XS-Go-Import-Path value.
Build deps exist and dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11; debhelper compat 14 via debhelper-compat; Standards-Version 4.7.4 has the current first two components; Vcs-Git/Vcs-Browser/Homepage/upstream metadata consistent; changelog is an initial release to unstable closing #1148632.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.27.0, packaged 0.26.3), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

The true origin of util/osx/env.go, util/osx/file.go and util/osx/homedir.go. They carry no notice and no provenance comment, so beyond the absence of a Prometheus header I cannot say what project, if any, they were taken from.
Whether util/osx/file_mmap*.go are byte-for-byte from a particular Prometheus file (no network access to compare); the notice they carry is taken at face value.

Proposed changes

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-10-27 02:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package