DFSG NEW review for golang-github-hashicorp-go-getter version 1.8.9-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 53 found (2 not listed by the scan, so not checked)

Licensing

debian/copyright is DEP-5 1.0. Files: * gives IBM Corp. and MPL-2.0, which matches LICENSE and every file header; debian/* gives the packagers and GPL-3+ or MPL-2.0. Both short names have their text or a pointer to an existing /usr/share/common-licenses file, and MPL-2.0 is DFSG-free. No other holder, no non-free clause, no vendored third-party code and no built files: the archives and Mercurial files the scan listed are test fixtures.

Packaging

Modern packaging: compat 14, dpkg-build-api 1, dh-go with the golang build system and addon, a DEP-3 patch for CVE-2026-19585, autopkgtest-pkg-go and salsa-ci, with correct <!nocheck> build-dependencies. Two dependency defects remain: a Build-Depends/Depends on golang-github-hashicorp-aws-sdk-go-base-v2-dev that no archive or NEW upload provides, although get_s3.go imports it, and an oauth2 dependency that names the -google package while only golang.org/x/oauth2 is imported.

Issues

1. [minor] [packaging] Build-Depends and Depends name golang-github-hashicorp-aws-sdk-go-base-v2-dev, which no archive or NEW upload provides

• Files: debian/control:12, debian/control:34, get_s3.go:21
• Basis: checked, in the package or with a reference tool
• Evidence: golang-github-hashicorp-aws-sdk-go-base-v2-dev in both fields; get_s3.go imports github.com/hashicorp/aws-sdk-go-base/v2/endpoints. apt-cache: There is no binary package named golang-github-hashicorp-aws-sdk-go-base-v2-dev in these lists, and nothing provides it. Nor is it a binary of this package or of any upload waiting in the NEW queues (the list on ftp-master.debian.org as of 2026-10-30T00:07:58Z).
• Problem: The dependency cannot be satisfied, so the source package cannot be built and the -dev package cannot be installed from the archive. The package lists can lag a few days, so a recheck against a fresh apt update is warranted, but on today's unstable, experimental and NEW lists the name does not exist.
• Fix: Ensure the aws-sdk-go-base v2 package is accepted first (or correct the name if it is a typo) and verify that apt-cache show golang-github-hashicorp-aws-sdk-go-base-v2-dev resolves, in Build-Depends and in the -dev Depends.

2. [minor] [packaging] Depends and Build-Depends name golang-golang-x-oauth2-google-dev, but only golang.org/x/oauth2 is imported

• Files: debian/control:18, debian/control:41, get_gcs.go:16
• Basis: checked, in the package or with a reference tool
• Evidence: get_gcs.go:16 imports golang.org/x/oauth2; no file imports golang.org/x/oauth2/google. apt-cache: golang-golang-x-oauth2-google-dev Depends: golang-golang-x-oauth2-dev (= 0.37.0-1).
• Problem: The direct dependency is not the package that provides the imported module; it works only because the -google package pulls in golang-golang-x-oauth2-dev, and it forces an unneeded package (and its google-cloud-compute-metadata-dev dependency) on every consumer of the library.
• Fix: Replace golang-golang-x-oauth2-google-dev with golang-golang-x-oauth2-dev in both the Build-Depends and the Depends field.

Verified

• All of debian/ was read in full apart from debian/watch (out of scope): control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata, patches/series and the patch, and the two binary lintian override files. There are no maintainer scripts, no .install/.dirs/.links/.maintscript files and no debian/tests directory.
• debian/copyright is DEP-5 1.0 with Files: * (Copyright: IBM Corp. 2015, 2026, License: MPL-2.0) and Files: debian/* (2016-2020 Dmitry Smirnov, 2026 Juan Manuel Méndez Rey, GPL-3+ or MPL-2.0); the stand-alone GPL-3+ and MPL-2.0 paragraphs point to /usr/share/common-licenses/GPL-3 and /usr/share/common-licenses/MPL-2.0, both present.
• Grepped the whole tree with gitignore: false for copyright/(C)/©/SPDX-License-Identifier/Licensed under/All rights reserved/public domain/non-commercial/Permission is hereby granted. Every header is Copyright IBM Corp. 2015, 2025 (newer files 2015, 2026) plus SPDX-License-Identifier: MPL-2.0; the only other copyright wording is inside the MPL-2.0 text itself. The holder the scan flagged, IBM Corp. 2015, 2025 in .github/dependabot.yaml, .goreleaser.yml, client.go and 84 more files, is the same holder already named in Files: *; the 2025/2026 difference is year drift, not a missing holder.
• The only licence file is the top-level LICENSE (MPL-2.0, Copyright IBM Corp. 2015, 2026); there is no second LICENSE/COPYING/NOTICE/AUTHORS anywhere and no vendor/ directory, so nothing is an embedded copy of a library Debian also ships.
• The 42 archives are test fixtures, read by decompress_*_test.go via filepath.Join("./testdata", ...) and by decompress_tar_test.go/decompress_zip_test.go from ./test-fixtures/; they hold trivial fixture files and are not built artefacts: test-fixtures/decompress-tar/bad.tar, test-fixtures/decompress-tar/permissions.tar, test-fixtures/decompress-zip/permissions.zip, testdata/archive.tar.gz, testdata/archive-rooted/archive.tar.gz, testdata/archive-rooted-multi/archive.tar.gz, testdata/basic-file-archive/archive.tar.gz, testdata/decompress-bz2/single.bz2, testdata/decompress-gz/single.gz, testdata/decompress-tar/extended_header.tar, testdata/decompress-tar/implied_dir.tar, testdata/decompress-tar/unix_time_0.tar, testdata/decompress-tbz2/empty.tar.bz2, testdata/decompress-tbz2/multiple.tar.bz2, testdata/decompress-tbz2/ordering.tar.bz2, testdata/decompress-tbz2/single.tar.bz2, testdata/decompress-tgz/empty.tar.gz, testdata/decompress-tgz/multiple.tar.gz, testdata/decompress-tgz/multiple_dir.tar.gz, testdata/decompress-tgz/ordering.tar.gz, testdata/decompress-tgz/outside_parent.tar.gz, testdata/decompress-tgz/single.tar.gz, testdata/decompress-txz/empty.tar.xz, testdata/decompress-txz/multiple.tar.xz, testdata/decompress-txz/multiple_dir.tar.xz, testdata/decompress-txz/ordering.tar.xz, testdata/decompress-txz/single.tar.xz, testdata/decompress-tzst/empty.tar.zst, testdata/decompress-tzst/multiple.tar.zst, testdata/decompress-tzst/multiple_dir.tar.zst, testdata/decompress-tzst/ordering.tar.zst, testdata/decompress-tzst/outside_parent.tar.zst, testdata/decompress-tzst/single.tar.zst, testdata/decompress-xz/single.xz, testdata/decompress-zip/empty.zip, testdata/decompress-zip/multiple.zip, testdata/decompress-zip/outside_parent.zip, testdata/decompress-zip/single.zip, testdata/decompress-zip/subdir.zip, testdata/decompress-zip/subdir_empty.zip, testdata/decompress-zip/subdir_missing_dir.zip, testdata/decompress-zst/single.zst (the last two are the ones the scan left unlisted).
• The 11 unrecognised binaries are the Mercurial repository fixture read by get_hg_test.go (test data, not a program), shipped in the -dev package and covered by the package-contains-vcs-control-dir lintian override: testdata/basic-hg/.hg/00changelog.i, testdata/basic-hg/.hg/cache/rbc-revs-v1, testdata/basic-hg/.hg/dirstate, testdata/basic-hg/.hg/store/00changelog.i, testdata/basic-hg/.hg/store/00manifest.i, testdata/basic-hg/.hg/store/data/foo.txt.i, testdata/basic-hg/.hg/store/data/main.tf.i, testdata/basic-hg/.hg/store/data/main__branch.tf.i, testdata/basic-hg/.hg/store/undo, testdata/basic-hg/.hg/store/undo.backupfiles, testdata/basic-hg/.hg/undo.dirstate.
• The only patch has full DEP-3 headers (Description, Origin commit URL, Applied-Upstream: 1.8.10, Author, Last-Update), is the sole series entry, and is applied: get_gcs.go and get_s3.go call containsDotDot, which is defined at decompress.go:72, and both files already import fmt.
• At compat 14 dh skips every override of dh_auto_test when DEB_BUILD_OPTIONS contains nocheck (debhelper tool, dh_auto_test/nocheck), so override_dh_auto_test without its own nocheck check is not a fault; git <!nocheck> and mercurial <!nocheck> are right, as the git and hg tests need them.
• dpkg-build-api (= 1) is the documented way to declare the level (dpkg-build-api(7)) and is provided by dpkg-dev 1.23.11 (= 1); Standards-Version 4.7.4 is current against policy 4.7.4.1; omitting Priority is allowed (policy 2.5); the ${misc:Depends} substvar is present although compat 14 would add it.
• apt-cache: dh-go 1.69 exists (Conflicts: dh-golang, Commands: dh_golang, dh_golang_autopkgtest), as do golang-github-aws-aws-sdk-go-v2-dev, golang-golang-x-oauth2-google-dev, golang-google-api-dev, golang-google-cloud-dev, golang-gopkg-cheggaaa-pb.v1-dev and golang-github-ulikunitz-xz-dev; the package under review is not yet in the archive, as expected.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.8.10, packaged 1.8.9), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3, MPL-2.0).

Not confirmed

• dh-go is not installed on the reviewing system (dh-golang is, and they conflict), so dh-go 1.69's buildsystem module and dh_golang_autopkgtest could not be read. The installed dh-golang helper computes the build directory as the buildsystem default (_build at compat 14) and its generated override_dh_auto_configure fills that directory, while debian/rules builds in debian/_build. If dh-go's helper still behaves that way, debian/rules build under the autopkgtest would run go in an empty debian/_build; an autopkgtest run would show whether that is the case.
• DH_GOLANG_MODULE_MAPPINGS (debian/rules:6) has no counterpart in the installed dh-golang buildsystem (no MODULE_MAPPINGS anywhere under /usr/share/perl5/Debian); whether dh-go 1.69 implements it could not be checked. If it does not, cmd/go-getter's github.com/cheggaaa/pb import would not resolve in GOPATH mode, since Debian ships that code as gopkg.in/cheggaaa/pb.v1.

Proposed changes

None.