Review: golang-github-gpustack-gguf-parser-go 0.26.3-2
Package Information
| Description | parse GGUF model files and estimate memory usage (library) A Go library for parsing GGUF files, the binary model format used by GGML and llama.cpp. It reads a model's metadata and tensor layout, estimates the memory required to run it, and can predict maximum tokens per second from supplied device metrics. Because it reads remote files in chunks, it can inspect a model hosted on Hugging Face, ModelScope or an Ollama registry without downloading it in full. It also classifies what a GGUF file is for, distinguishing embedding, reranking, LoRA and diffusion models. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-gpustack-gguf-parser-go.git (browse) |
| Closes | #1148632 |
| Tracker | https://tracker.debian.org/pkg/golang-github-gpustack-gguf-parser-go |
| Uploaded | 17 hours ago |
| Supersedes | 0.26.3-1 |
New Package Report
.changes
| Source | golang-github-gpustack-gguf-parser-go |
|---|---|
| Version | 0.26.3-2 |
| Changed-By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Architecture | source all |
| Distribution | unstable |
| Date | Sat, 31 Oct 2026 17:03:07 +0100 |
Changelog
golang-github-gpustack-gguf-parser-go (0.26.3-2) unstable; urgency=medium . * Initial release (Closes: #1148632)
.dsc
| Package-List | golang-github-gpustack-gguf-parser-go-dev deb golang optional arch=all |
|---|---|
| Section | golang |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/gpustack/gguf-parser-go
Upstream-Name: gguf-parser-go
Upstream-Contact: https://github.com/gpustack/gguf-parser-go/issues
Files: *
Copyright: 2024 gguf-parser-go authors
License: Expat
Comment: "gguf-parser-go authors" is the literal wording of the LICENSE and is
not expanded anywhere upstream; there is no AUTHORS file.
Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Files: util/osx/file_mmap.go
util/osx/file_mmap_js.go
util/osx/file_mmap_unix.go
util/osx/file_mmap_windows_386.go
util/osx/file_mmap_windows_non386.go
Copyright: 2017-2022 The Prometheus Authors
License: Apache-2.0
Comment: These memory-mapping helpers come from the Prometheus project and carry
its Apache-2.0 headers, with years 2017, 2018 and 2022. The other four files in
util/osx, env.go, file.go, homedir.go and file_mmap_windows.go, carry no notice
of their own and are upstream's own code under Expat, like the rest of the tree.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License Version 2.0
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 16 hours ago.
Report
DFSG NEW review for golang-github-gpustack-gguf-parser-go version 0.26.3-2
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The tree is MIT (Expat) apart from five memory-mapping helpers in util/osx (file_mmap.go, file_mmap_js.go, file_mmap_unix.go, file_mmap_windows_386.go, file_mmap_windows_non386.go) which carry 'Copyright 2017/2018/2022 The Prometheus Authors' and the Apache-2.0 header. debian/copyright is DEP-5, has a Files: * Expat stanza, a later Files stanza for exactly those five files with the Prometheus holder and an Apache-2.0 paragraph pointing at /usr/share/common-licenses/Apache-2.0, and a Files: debian/* stanza for the packaging. The four remaining util/osx files (env.go, file.go, homedir.go, file_mmap_windows.go) do carry no notice, as the copyright file says, and are upstream's own Expat code. MIT and Apache-2.0 are compatible in the single -dev package. No non-free terms, no unclear provenance, no licence text that has to be reproduced beyond what is there.
Packaging
Single Architecture: all -dev package, debhelper compat 14 with dpkg-build-api 1, dh $@ --buildsystem=golang --with=golang, dh-go in Build-Depends and the matching lintian override for the addon name. Depends and Build-Depends carry every module imported by the tree (go-spew, testify, x/exp, x/sync, x/crypto, x/sys, httpretty, json-iterator, ringbuffer); golang.org/x/tools and gonum.org/v1/gonum appear only in gen.stringer.go and gen.regression.go, which are behind //go:build stringer and //go:build regression, so they are correctly absent. Network-only tests are skipped by name in override_dh_auto_test; the -skip regexps are unanchored, so the 'TestGGUFFile_Architecture' and 'TestGGUFFile_EstimateLLaMACppRun' alternatives cover those whole families and no test that fails offline is left running. Standards-Version 4.7.4 is current against Policy 4.7.4.1; Vcs-*, Homepage, XS-Go-Import-Path, upstream/metadata and salsa-ci.yml are in place; the changelog closes the ITP. The nested cmd/gguf-parser module (own go.mod, needs urfave/cli/v2 and jedib0t/go-pretty/v6) is removed from the installed tree after dh_auto_install, which is consistent with not shipping or depending on it.
Issues
None.
Verified
- Prescan: its author check scanned 89 files and found every copyright holder it saw named in debian/copyright; it listed no built files, no non-free wording and no per-file entries to account for.
- LICENSE is the MIT text with 'Copyright (c) 2024 gguf-parser-go authors'; debian/copyright's Files: * names the same holder, literal wording included, as its Comment says.
- grep for Copyright, (C), (c), SPDX-License-Identifier, 'Licensed under', 'Permission is hereby granted', GNU GPL/LGPL, Apache License, Mozilla Public, 'public domain' and 'All rights reserved' over the whole tree: the only notices are the five Prometheus Apache-2.0 headers in util/osx and the two debian/copyright stanzas, which match them exactly.
- The Files: stanza for util/osx lists the five files with headers; debian/copyright's Comment also accounts for env.go, file.go, homedir.go and file_mmap_windows.go, which I read and confirm carry no notice of their own.
- zz_generated.ggmltype.stringer.go and the four other zz_generated.*.stringer.go are produced by the //go:generate stringer lines in gen.stringer.go, which is shipped; zz_generated.diffusion_model_memory_usage.regression.go is produced by gen.regression.go, which is shipped and embeds the regression input data in its template. Both generators sit behind //go:build tags, so neither is compiled.
- debian/rules' SKIP_NET: -skip is an unanchored Go regexp, so 'TestGGUFFile_Architecture' covers the six Hugging Face tests in that family and 'TestGGUFFile_EstimateLLaMACppRun' covers its nineteen; TestParseGGUFFile and the benchmarks skip themselves when TEST_MODEL_PATH is unset; TestParseGGUFFileFromHuggingFace_Refuses is not skipped but only fails if no error is returned, so it passes offline.
- The collateral of the unanchored regexp is TestGGUFArchitecture_memoryKindOfLayer, which is a local table test and so is not run; a reasonable sponsor would not hold the upload for that.
- Every import path in the library and its tests is provided by a package in Depends/Build-Depends: go-spew and testify (tests), x/exp (file.go, util/anyx, util/ptr), x/sync (ollama_model.go), x/sys/unix (util/osx/file_mmap_unix.go), x/crypto/ssh (ollama_registry_authenticate.go), httpretty, json-iterator and ringbuffer (util/httpx, util/json).
- cmd/gguf-parser/go.mod's requires (urfave/cli/v2, jedib0t/go-pretty/v6, go-md2man, and their indirect deps) are not build-dependencies, in line with the directory being removed from the installed tree.
- dpkg-build-api (= 1) is a build-API declaration, not a package; at compat 14 dh provides the build/build-indep/binary-indep targets it requires, and man dpkg-build-api shows Rules-Requires-Root defaulting to no, which the golang buildsystem does not need.
- debian/copyright is already machine-readable (correct Format: URL), so no replacement is proposed; its /usr/share/common-licenses/Apache-2.0 pointer is the real file name.
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream0.28.1, packaged0.26.3), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed
- dh-go 1.69 is not installed on the reviewing system, so I could not read its golang buildsystem; the installed one is dh-golang 1.67. If dh-go still sets GO111MODULE=off as dh-golang does, go list github.com/gpustack/gguf-parser-go/... would enumerate cmd/gguf-parser and go install would fail on the unpackaged urfave/cli/v2 and jedib0t/go-pretty/v6 imports. The rules comment and a clean build imply dh-go is module-aware and skips the nested module; a build log would settle it.
- Whether go.mod's direct requirements golang.org/x/tools and gonum.org/v1/gonum need to be build-dependencies for the same reason: in module mode with GOPROXY=off go can need a required module's go.mod even when no package imports it. Package names would be golang-golang-x-tools-dev and golang-gonum-v1-gonum-dev.
Proposed changes
None.
Uploader's response to the LLM review
The uploader was emailed about the review 16 hours ago.
Review Information
accepted — allocated to mechtilde 12 hours ago, started 12 hours ago, completed 12 hours ago.