DFSG NEW review for golang-github-hashicorp-aws-sdk-go-base version 2.0.0~beta74-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All upstream files carry an IBM Corp. 2015-2026 MPL-2.0 header; LICENSE is HashiCorp's MPL-2.0 text. debian/copyright is DEP-5, names both holders, matches the licence (MPL-2.0 is in /usr/share/common-licenses, and the stanza points there), and covers debian/* separately. No non-free terms, no unlicensed file, no third-party code, no binary blobs. The prescan found no unnamed holder.

Packaging

Mostly clean: compat 14, dh-go with the golang buildsystem, current Standards-Version 4.7.4, Vcs-* fields, gbp.conf, salsa-ci, upstream metadata, autopkgtest-pkg-go, a correct initial-release changelog and resolvable build dependencies (terraform-plugin-log is queued in NEW). One structural fault: the tree contains a second Go module, v2/awsv1shim, which is neither excluded from the build nor supplied with the dependencies it imports, and which dh-golang installs at a path no consumer can import.

Issues

1. [important] [packaging] Second module v2/awsv1shim is shipped at an unimportable path with its dependencies (aws-sdk-go v1, go-cleanhttp) in neither Build-Depends nor Depends

• Files: v2/awsv1shim/session.go:12-21, v2/awsv1shim/credentials.go:13, v2/awsv1shim/http_client.go:10, v2/awsv1shim/go.mod:1, debian/control, debian/rules
• Basis: checked, in the package or with a reference tool
• Evidence: v2/awsv1shim/go.mod declares module github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2; session.go imports github.com/aws/aws-sdk-go/aws, .../aws/session and its own github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr, http_client.go imports github.com/hashicorp/go-cleanhttp. debian/control lists neither golang-github-aws-aws-sdk-go-dev nor golang-github-hashicorp-go-cleanhttp-dev in Build-Depends or Depends, and debian/rules has no DH_GOLANG_EXCLUDES. The README states the project publishes two modules; the .dsc lists one binary. dh-golang copies every .go file under the source root to _build/src/$DH_GOPKG/ and installs the whole tree, so these sources land in /usr/share/gocode/src/github.com/hashicorp/aws-sdk-go-base/v2/v2/awsv1shim, while the module's own path would require .../aws-sdk-go-base/v2/awsv1shim/v2.
• Problem: The -dev package ships a Go module whose import path does not exist in the installed layout, whose internal imports (.../awsv1shim/v2/tfawserr, .../awsv1shim/v2/mockdata) therefore cannot resolve, and whose external imports are not declared in Depends. Consumers of the published awsv1shim module cannot build against the package, and the default dh-golang build (DH_GOLANG_BUILDPKG = $DH_GOPKG/...) also tries to compile these packages, for which no source of github.com/aws/aws-sdk-go is installed at build time.
• Fix: Either drop the second module from the source package (export DH_GOLANG_EXCLUDES := v2/ in debian/rules, and better repack it out so debian/copyright/Files need not cover it), or package it as its own binary package with golang-github-aws-aws-sdk-go-dev and golang-github-hashicorp-go-cleanhttp-dev in Build-Depends and Depends and an install layout matching v2/awsv1shim/v2.

Verified

• debian/copyright read in full: DEP-5 with the exact Format URL, Files: * (2019 HashiCorp, Inc.; 2015-2026 IBM Corp., MPL-2.0) and Files: debian/* (2026 Juan Manuel Mendez Rey, MPL-2.0), plus an MPL-2.0 stand-alone stanza pointing at /usr/share/common-licenses/MPL-2.0, which exists on this system.
• All 119 files scanned by the prescan are covered: every .go/.yml/.yaml file carries // Copyright IBM Corp. 2015, 2025/2026 with SPDX-License-Identifier: MPL-2.0; LICENSE is Copyright (c) 2019 HashiCorp, Inc. + MPL-2.0. Both holders are named. README.md, CHANGELOG.md, go.mod/go.sum, go.work, GNUmakefile, .semgrepignore, .github/CODEOWNERS and .github/PULL_REQUEST_TEMPLATE.md have no header but fall under Files: *.
• endpoints/endpoints_gen.go (66.6 KB) is generated (Code generated by internal/generate/endpoints/main.go); the generator and its template are shipped at internal/generate/endpoints/main.go and internal/generate/endpoints/output.go.gtpl. Its input JSON is fetched from the aws-sdk-go-v2 repository by the go:generate URL; generation is not run by dh-golang (DH_GOLANG_GO_GENERATE unset), so the build uses the committed output.
• servicemocks/pem_file.go embeds a self-signed test certificate (Testing ROOT CA, C=GO, valid 2017-2027) used by TLS mocks: test fixture, not third-party code, and not a provenance problem.
• No images, fonts, PDFs, archives, bytecode, minified code or other binary files in the upstream tree.
• No third-party or vendored code in the tree; no separate COPYING/NOTICE/AUTHORS files; no other licence wording anywhere (no GPL/LGPL/Apache/BSD/MIT code, no non-commercial or no-modification terms).
• debian/control: debhelper-compat 14, dh-go 1.69 and --with=golang, dpkg-build-api (= 1), multiarch-safe arch:all -dev package, $misc:Depends irrelevant at compat 14. Standards-Version 4.7.4 against Policy 4.7.4.1 is current; Vcs-Git, Vcs-Browser, Homepage, Testsuite: autopkgtest-pkg-go and upstream/metadata all present.
• Build-dependency names all resolve: aws-sdk-go-v2-dev 1.41.7-2 ships aws/defaults, service/{sso,iam,sts,s3,sqs,dynamodb,signin} and smithy-go; otelaws exists in golang-opentelemetry-contrib-dev 1.46.0-1 and semconv/v1.17.0 in golang-opentelemetry-otel-dev; golang-github-hashicorp-terraform-plugin-log-dev is not yet in the archive but is built by the 0.11.0-1 upload in NEW; golang-any is 1.27, above the go 1.25 in go.mod.
• Depends omits golang-golang-x-net-dev, golang-golang-x-text-dev and golang-github-google-go-cmp-dev although internal/config, logging and configtesting import them; all three are pulled in transitively by the declared golang-github-aws-aws-sdk-go-v2-dev and golang-opentelemetry-otel-dev Depends, so reverse builds are not broken today, and I did not report it.
• debian/changelog: initial release 2.0.0~beta74-1 to unstable, closing #1148134, with a syntactically valid date; version scheme matches upstream v2.0.0-beta.74; gbp.conf uses debian/sid, upstream, pristine-tar; salsa-ci.yml uses the standard recipe; source format 3.0 (quilt) with no debian/patches needed.
• The orig tarball contains the same tree as unpacked (v2/, tools/ and all source files present); .pc/ and debian/cargo-checksum.json were skipped as instructed.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.0.0~beta76, packaged 2.0.0~beta74), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (MPL-2.0).

Not confirmed

• Whether a clean sbuild run really fails: dh-golang's default DH_GOLANG_BUILDPKG is $DH_GOPKG/... and GO111MODULE defaults to off, so go list -e should include .../v2/v2/awsv1shim and go install should then fail on github.com/aws/aws-sdk-go/..., which is not installed by any Build-Depends. The package's own files show no exclusion, so I expect FTBFS there; a build would show the failing package path.

Proposed changes

None.