Review: golang-github-intevation-jsonpath 0.2.1-1
Package Information
| Description | JSONPath implementation for Go based on gval (library) A complete implementation of Stefan Goessner's JSONPath query language for JSON documents in Go. It has no script language of its own: filter and script expressions are evaluated with the gval expression language, and JSONPath can be combined with other gval-based languages to add features such as arithmetic, length or regular expressions. This is Intevation's fork of github.com/PaesslerAG/jsonpath, published under its own module path and built on Intevation's fork of gval. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-intevation-jsonpath.git (browse) |
| Closes | #1148987 |
| Tracker | https://tracker.debian.org/pkg/golang-github-intevation-jsonpath |
| Uploaded | 11 days ago |
New Package Report
.changes
| Date | Sat, 26 Sep 2026 00:05:00 +0200 |
|---|---|
| Source | golang-github-intevation-jsonpath |
| Version | 0.2.1-1 |
| Changed-By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Architecture | source all |
| Distribution | unstable |
Changelog
golang-github-intevation-jsonpath (0.2.1-1) unstable; urgency=medium . * Initial release (Closes: #1148987)
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | golang-github-intevation-jsonpath-dev deb golang optional arch=all |
| Section | golang |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: jsonpath
Upstream-Contact: Sascha L. Teichmann <sascha.teichmann@intevation.de>
Source: https://github.com/Intevation/jsonpath
Files: *
Copyright: 2017 Paessler AG <support@paessler.com>
License: BSD-3-clause
Comment: The holder and year are those of LICENSE, the only project notice
in the tree; this repository is Intevation's fork of PaesslerAG/jsonpath.
The fork's own changes (2023) add no copyright notice.
Files: quote.go
scanner.go
Copyright: 2009 The Go Authors
License: BSD-3-clause-Google
Comment: Adapted from the Go standard library (src/strconv/quote.go and
src/text/scanner/scanner.go at go1.21.0), as each file's header says. The
licence text is Go's LICENSE file.
Files: testdata/regression_suite.yaml
Copyright: 2019-2023 Christoph Burgmer <christoph.burgmer@gmail.com> and the
json-path-comparison contributors
License: GPL-3
Comment: Consensus regression suite of
https://github.com/cburgmer/json-path-comparison, as the file's header and
testdata/README.md state. The file itself carries no licence; that
project's LICENSE is the GPL, version 3. It is byte-identical to
regression_suite/regression_suite.yaml at commit 7477628a (2023-03-07) of
that project, where the file was first added in 2019. Used only by the
test suite.
Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: BSD-3-clause
Comment: Debian packaging is licensed under the same terms as upstream
License: BSD-3-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
3. Neither the name of the copyright holder nor the names of its
contributors may be used to endorse or promote products derived from this
software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
License: BSD-3-clause-Google
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
.
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
* Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: GPL-3
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License version 3 as
published by the Free Software Foundation.
.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
On Debian systems, the complete text of the GNU General Public License
version 3 can be found in "/usr/share/common-licenses/GPL-3".
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 11 days ago.
Report
DFSG NEW review for golang-github-intevation-jsonpath version 0.2.1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
debian/copyright is DEP-5 (copyright-format 1.0), and its four Files stanzas match the tree: Files: * (2017 Paessler AG, BSD-3-clause, the holder of the only project notice, LICENSE), Files: quote.go scanner.go (2009 The Go Authors, BSD-3-clause-Google, the files' own headers), Files: testdata/regression_suite.yaml (2019-2023 Christoph Burgmer and contributors, GPL-3) and Files: debian/* (2026 Juan Manuel Mendez Rey, BSD-3-clause), with later stanzas correctly overriding the catch-all. Full licence texts are reproduced for the two BSD variants and the GPL-3 text is referenced in /usr/share/common-licenses/GPL-3. No non-free terms, no unlicensed file, no binary or minified file: the tree is 20 upstream text files and the packaging. A scan found every copyright holder named.
Packaging
Conventional Debian Go library packaging: single arch:all -dev package, debhelper compat 14 with dh-go's golang addon (dh $@ --builddirectory=debian/_build --buildsystem=golang --with=golang), dpkg-build-api (= 1) (which makes Rules-Requires-Root default to no), golang-any and only the needed Build-Depends, Testsuite: autopkgtest-pkg-go, Vcs-* and XS-Go-Import-Path set, upstream/metadata present, salsa-ci and gbp.conf sane, changelog well-formed. Standards-Version 4.7.4 matches the current Policy 4.7.4.1. No maintainer scripts, no patches, nothing that would break a build or an upgrade.
Issues
None.
Verified ◂
- Read debian/copyright in full: DEP-5 header plus four Files stanzas and three stand-alone License stanzas (BSD-3-clause, BSD-3-clause-Google, GPL-3); the GPL-3 paragraph points to /usr/share/common-licenses/GPL-3, the other two carry their text inline as required.
- Covered the whole tree (20 upstream files: LICENSE, README.md, .travis.yml, .gitignore, go.mod, go.sum, test.sh, nine .go files, testdata/README.md, testdata/regression_suite.yaml, plus debian/); a case-insensitive grep for copyright/licence wording matched only LICENSE:1 (
Copyright (c) 2017, Paessler AG <support@paessler.com>), quote.go:3 and scanner.go:3 (Copyright 2009 The Go Authors. All rights reserved. ... BSD-style license), all three named in the right stanza. - quote.go:8-10 and scanner.go:8-10 say they are taken from go1.21.0
src/strconv/quote.goandsrc/text/scanner/scanner.go; theFiles: quote.go scanner.gostanza applies the Go licence, and its text in debian/copyright is Go's BSD-3-clause (condition 3 naming Google Inc.). - testdata/regression_suite.yaml is test-only data, loaded by test-suite_test.go:62 via
os.ReadFile("testdata/regression_suite.yaml"); its header names cburgmer/json-path-comparison and testdata/README.md links there. GPL-3 is DFSG-free, is in /usr/share/common-licenses, and the data file is not combined into a single work with the BSD-3 code, so the mixed licensing is fine. - No binaries, archives, minified or generated programs in the tree: every file is text (.go, .md, .sh, .yml, .mod, .sum, LICENSE, .gitignore).
.pc/is quilt's record and was excluded from every search; debian/cargo-checksum.json does not exist (not a Rust package).- debian/control: Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool TOC) - first two components equal, no issue;
dpkg-build-api (= 1)is a real virtual package provided by dpkg-dev 1.23.11 (apt-cache), and dpkg-build-api(7) confirms level v1 makes dpkg-buildpackage default Rules-Requires-Root to no, so its absence from debian/control is correct. - Build-Depends checkable against the archive: golang-gopkg-yaml.v3-dev (3.0.5-1) and golang-github-google-go-cmp-dev (0.7.0-1) exist (apt-cache) and are exactly the test-only imports of test-suite_test.go and jsonpath-struct_test.go; golang-any, debhelper-compat, dh-go (1.69) exist.
- The --with=golang addon is correct: dh-go ships /usr/share/perl5/Debian/Debhelper/Sequence/golang.pm and, per apt-cache, dh-go 1.69 has
Conflicts: dh-golangbut noProvides: dh-sequence-golang, so debian/source/lintian-overrides' justification for the missing-build-dependency-for-dh-addon override is accurate. - debian/rules' build directory is safe: golang.pm's configure() drops
debian(and .pc, .git, and the build directory) from the top level before copying, so a build directory below debian/ cannot be copied into itself. - debian/changelog:
golang-github-intevation-jsonpath (0.2.1-1) unstable, initial release closing #1148987, date Sat, 26 Sep 2026 - consistent with the version and the maintainer's date. - debian files read in full: control, rules, copyright, changelog, gbp.conf, salsa-ci.yml, watch (not reviewed), source/format (3.0 (quilt)), source/lintian-overrides, upstream/metadata. No debian/tests/, no patches, no maintainer scripts - consistent with Testsuite: autopkgtest-pkg-go.
- uscan found the packaged version as the newest upstream release (upstream
0.2.1, packaged0.2.1). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (GPL-3).
Not confirmed ◂
- Build-Depends
golang-github-intevation-gval-dev(needed: go.mod requires github.com/Intevation/gval v1.3.0, imported by scanner.go and others) is not in the reviewing system's package lists and is not among the binaries of this package or of any upload in ftp-master's NEW queues as of 2026-10-26; the same is true of the alternativesgolang-intevation-gval-devandgolang-github-intevation-gval(all checked with apt-cache). Since the lists can lag an accepted upload, this is not reported as an issue, but if the fork of gval was not uploaded alongside this package, the build will fail on an unsatisfiable Build-Depends. - testdata/README.md's wording (a pointer to cburgmer/json-path-comparison's regression_suite.yaml) suggests it was copied from that project, in which case
Files: *would give it the wrong holder and it belongs in the GPL-3 stanza with regression_suite.yaml. Its provenance cannot be established from the package, which contains neither that file's original nor its history. - debian/copyright's attribution of testdata/regression_suite.yaml to the GPL-3 of cburgmer/json-path-comparison rests on that external project's LICENSE, which cannot be fetched from here; the file itself carries no licence notice, only the header naming the generating script and repository.
- debian/control's
Uploaders: Juan Manuel Mendez Rey <juan.mendezr@proton.me>,ends with a trailing comma; dpkg is expected to ignore the empty entry, but this was not exercised.
Proposed changes ◂
None.
Uploader's response to the LLM review
Unrelated to this, I've sent
https://salsa.debian.org/go-team/packages/golang-github-intevation-jsonpath/-/merge_requests/1,
dropping the redundant build directory override
— Juan Manuel Méndez Rey (mendezr), 11 days ago
Review Information
accepted — allocated to siretart 10 days ago, started 10 days ago, completed 10 days ago.