DFSG NEW review for golang-github-hashicorp-terraform-plugin-log version 0.11.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is entirely MPL-2.0 (a DFSG-free licence), which is in /usr/share/common-licenses and is pointed to by the stand-alone License paragraph. debian/copyright is DEP-5 with the exact Format URL, a Files: * stanza, a Files: debian/* stanza and a License: MPL-2.0 paragraph with the Exhibit A notice; the holders it names (HashiCorp, IBM Corp., the uploader for debian/*) cover everything the tree states. No other licence, holder, SPDX identifier or embedded third-party code exists. The prescan's author check found no unnamed holder.

Packaging

Small, conventional Debian Go library package: debhelper compat 13 with dpkg-build-api 1, dh-go's golang buildsystem, all Build-Depends/Depends present in the archive and matching the imports, Standards-Version 4.7.4 (Policy 4.7.4.1), Multi-Arch: foreign dev package, Testsuite: autopkgtest-pkg-go, sensible changelog for an initial release. No patches, maintainer scripts or binary artefacts; nothing in debian/ is wrong or missing. Only cosmetic excrescences remain (a trailing comma after Uploaders, the dh-make-golang '(library)' suffix), which a reviewer would not require changed.

Issues

None.

Verified

• Read all of debian/ in full: changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, watch (not judged), source/format (3.0 (quilt)), upstream/metadata. There is no debian/patches, no .install/.links/.docs/.dirs, no maintainer scripts, no debian/tests.
• debian/copyright is DEP-5 with Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/; Files: * gives Copyright: 2021 HashiCorp / 2021, 2026 IBM Corp. and License: MPL-2.0; Files: debian/* gives 2026 Jani Heikkinen under MPL-2.0; the stand-alone License: MPL-2.0 paragraph carries the Exhibit A notice and points to /usr/share/common-licenses/MPL-2.0, which exists on the system.
• All 50 Go files in the tree start with // Copyright IBM Corp. 2021, 2026 and // SPDX-License-Identifier: MPL-2.0; LICENSE:1 reads Copyright IBM Corp. 2021, 2026 and contains the full MPL 2.0 text; README.md:19 and .copywrite.hcl:4 name MPL-2.0. The same headers are in the .orig.tar.gz members checked (tflog/doc.go, LICENSE).
• Grep for MIT/Apache/GNU/BSD/permission-is-hereby-granted/public-domain/All-rights-reserved found nothing but the MPL text's own references to Secondary Licenses; grep for copied from|adapted from|vendored found no third-party provenance; there is no vendor/ directory or bundled library.
• Prescan listed no files: its author check found every holder in the tree named in debian/copyright. The additional 2021 HashiCorp line names upstream's former owner and omits no holder; every file's own notice (IBM Corp. 2021, 2026) is present in the stanza.
• No built or binary artefacts: the tree is Go sources, Markdown/YAML configuration, the LICENSE and go.mod/go.sum; nothing minified, compressed or a PDF, and no .pc/ or debian/cargo-checksum.json content was read (no Rust here).
• Upstream-only noise accounted for: .github/ workflows and templates, .changes/ and .changie.yaml, META.d/_summary.yaml, .copywrite.hcl, Makefile and tools/ (a separate module tools holding the copywrite generator, guarded by //go:build generate) are prose/CI/config, covered by Files: * at MPL-2.0 and not installed as buildable code.
• Packaging metadata is consistent with the .dsc: source golang-github-hashicorp-terraform-plugin-log, one -dev binary, Architecture: all, Multi-Arch: foreign, XS-Go-Import-Path matching go.mod's module path.
• Every relationship resolves in the archive (xd://apt-cache): golang-github-google-go-cmp-dev 0.7.0-1, golang-github-hashicorp-go-hclog-dev 1.6.3-1, golang-github-mitchellh-go-testing-interface-dev 1.14.1-1, dh-go 1.69 (provides the golang buildsystem and dh_golang), golang-any 2:1.27~1; dpkg-build-api is provided by dpkg-dev 1.23.11 (= 1), as dpkg-build-api(7) documents. The dependencies match the imports found by grep (go-cmp only in _test.go files, go-hclog in library code, go-testing-interface in internal/loggertest).
• Standards-Version 4.7.4 against the system Policy 4.7.4.1 (xd://policy): first two components match, no issue. debhelper compat 13 (debhelper-compat (= 13)) with dpkg-build-api (= 1) is coherent: the API level only changes dpkg's own behaviour and makes Rules-Requires-Root default to no, which the package correctly does not override.
• debian/rules is just dh $@ --builddirectory=debian/_build --buildsystem=golang; the golang sequence addon is not enabled (no dh-sequence-golang build-dependency and no --with=golang), so dh_golang and the addon's remove_command('dh_dwz') do not run. That has no effect here: the source has no package main (grepped), the binary package is Architecture: all and built only in binary-indep, so there are no ELF objects for dh_dwz/dh_strip and no misc:Static-Built-Using to generate.
• changelog: 0.11.0-1, distribution unstable, urgency medium, initial release closing ITP #1148780, dated Wed, 23 Sep 2026 (a Wednesday), version consistent with the .orig.tar.gz 0.11.0.
• The debian tarball beside the tree holds the same eight debian/ files as the unpacked debian/ and no debian/patches, so no patch content is missing from the tree (the .pc/ directory was ignored as instructed and not read).
• go.mod requires go 1.25.0 and README says Go 1.25+, satisfied by the default golang-any (Go 1.27) in unstable.
• uscan found the packaged version as the newest upstream release (upstream 0.11.0, packaged 0.11.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (MPL-2.0).

Not confirmed

• No build or test run was made (none is possible here); per the review method the package is taken to build and pass its tests in a clean chroot.
• autopkgtest is not installed on the reviewing system, so the Testsuite: autopkgtest-pkg-go runner could not be inspected; /usr/bin/dh_golang_autopkgtest is present and only needs debian/rules and XS-Go-Import-Path, both provided.

Proposed changes

None.