DFSG NEW review for golang-github-hashicorp-aws-sdk-go-base version 2.0.0~beta74-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every upstream file is under MPL-2.0. 104 files carry SPDX-License-Identifier: MPL-2.0 with Copyright IBM Corp. 2015, 2025 or 2015, 2026; the root LICENSE is the MPL-2.0 text with Copyright (c) 2019 HashiCorp, Inc.. No other licence text, holder, or non-free term appears anywhere in the tree, and the remaining files (README.md, CHANGELOG.md, GNUmakefile, go.mod/go.sum/go.work, .semgrepignore, .github templates, the tools and awsv1shim module files) are covered by the root LICENSE and by Files: *. debian/copyright is DEP-5, names both holders with matching years, has a stanza for debian/*, and points to the MPL-2.0 text in /usr/share/common-licenses, which is all MPL-2.0 requires. The generated endpoints/endpoints_gen.go has its generator and template in the package and its data was generated from AWS's endpoints.json, so there is no missing source and no DFSG problem.

Packaging

Clean, current pkg-go packaging: debhelper compat 14 with the new module-aware dh-go add-on (whose missing dh-sequence-golang is explained in a justified lintian override), dpkg-build-api (= 1), Standards-Version 4.7.4 against Policy 4.7.4.1, every Build-Depends/Depends entry exists in the archive and every third-party package the shipped source imports is in the matching -dev package, and the two nested modules (tools, v2/awsv1shim) are kept out of /usr/share/gocode by DH_GOLANG_EXCLUDES. Changelog (2.0.0~beta74-1, unstable, ITP closure), gbp.conf, salsa-ci.yml, upstream/metadata and the autopkgtest-pkg-go testsuite are all in order; there are no maintainer scripts and no patches to review.

Issues

None.

Verified

• debian/: read all fifteen files in full (changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata; watch not reviewed).
• debian/copyright is already machine-readable (DEP-5) with a correct Format URL, two Files stanzas and one stand-alone MPL-2.0 paragraph; no Files-Excluded; /usr/share/common-licenses/MPL-2.0 is the right pointer.
• Upstream tree (119 files, excluding debian/): every file with licence wording carries MPL-2.0 SPDX headings and an IBM Corp. notice; the root LICENSE is MPL-2.0 with Copyright (c) 2019 HashiCorp, Inc.; greps for GPL/LGPL/Apache/MIT/BSD/public-domain wording and for non-commercial, no-modification, field-of-use or Commons-Clause text found nothing but incidental prose in the MPL text itself.
• Files without a per-file notice (README.md, CHANGELOG.md, GNUmakefile, go.mod, go.sum, go.work, .semgrepignore, .github/CODEOWNERS, .github/PULL_REQUEST_TEMPLATE.md, .github/ISSUE_TEMPLATE/{Bug_Report,Feature_Request}.md, .github/workflows/pull_request.yml, tools/go.{mod,sum}, v2/awsv1shim/go.{mod,sum}) fall under the repository LICENSE and Files: *; no third-party code or vendored library is present.
• endpoints/endpoints_gen.go is generated code whose generator (internal/generate/endpoints/main.go), template (output.go.gtpl) and helper package (internal/generate/common) are all shipped; the input endpoints.json is fetched from the aws-sdk-go-v2 repository only when go generate is run (the generator has //go:build generate), never during a build, so the Go file is its own build source.
• servicemocks/pem_file.go embeds a self-signed test certificate ("Testing ROOT CA", valid 2017-2027) as test data, not a key and not third-party copyrightable material; test/plain data only, no built artifacts, binaries, fonts or images in the tree.
• Compared the unpacked tree with the shipped original tarball (root hashicorp-aws-sdk-go-base-4703a60/, same file set) and with the debian tarball (contains only debian/); source format is 3.0 (quilt) with no debian/patches, and no upstream file was added or removed.
• Dependencies checked with apt-cache: dh-go 1.69 exists, provides the golang addon, ships dh_golang_autopkgtest and Conflicts with dh-golang (so the lintian override in debian/source/lintian-overrides is justified); dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11; golang-github-aws-aws-sdk-go-v2-dev 1.41.7, golang-github-aws-smithy-go-dev 1.25.1, golang-github-hashicorp-go-hclog-dev 1.6.3 (satisfies the >= 1.6.3), golang-github-hashicorp-terraform-plugin-log-dev 0.11.0, golang-golang-x-net-dev 0.61.0, golang-opentelemetry-otel-dev 1.46.0 and golang-opentelemetry-contrib-dev 1.46.0 all exist; the binary package itself is new to Debian and comes from this upload.
• Every import of the shipped source (aws-sdk-go-v2 aws/defaults, aws/ratelimit, aws/arn, aws/transport/http, credentials/ec2rolecreds, credentials/stscreds, feature/ec2/imds, config, service/{dynamodb,iam,s3,sqs,sso,sts}, service/{s3,sts}/types; smithy-go middleware/logging/transport/http; otelaws; otel attribute+semconv v1.17.0/v1.20.0; x/net/http/httpproxy; x/text; go-cmp; hclog; go-multierror; go-homedir) is present in the corresponding -dev package installed on the reviewing system, and the -dev package's Depends list matches those importers.
• dh-go is the new module-aware replacement for dh-golang (announced in dh-golang 1.66's changelog, installed here as 1.67); with module-aware builds the nested modules tools/ and v2/awsv1shim (both have their own go.mod) are outside the main module, and DH_GOLANG_EXCLUDES ^tools(/|$) ^v2(/|$) additionally matches their relative paths in dh's install step, so neither ends up in /usr/share/gocode.
• Standards-Version 4.7.4 and the policy tool reports Policy 4.7.4.1, so it is current; compat 14, Architecture: all, Multi-Arch: foreign, Section golang, no Rules-Requires-Root needed at dpkg-build-api 1.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.0.0~beta76, packaged 2.0.0~beta74), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (MPL-2.0).

Not confirmed

• No build was run (read-only review). go.mod requires aws-sdk-go-v2 v1.43.1, smithy-go v1.27.5 and terraform-plugin-log v0.10.1-0.20260721164921-2f73dc013b2c, while the archive has 1.41.7, 1.25.1 and 0.11.0; dh-go's module-aware build is meant to reconcile this (that is why dh-go rather than dh-golang is used), but the reconcile itself was not observed.
• dh-go 1.69 is not installed on the reviewing system (dh-golang 1.67 is), so its exact build system was not read; the conclusion that the nested modules stay out of the build targets rests on dh-go's module-aware operation described in dh-golang 1.66's changelog.

Proposed changes

None.