DFSG NEW review for golang-github-lann-builder version 0.0~git20180802.47ae307-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All upstream files (builder.go, builder_test.go, example_test.go, reflect.go, registry.go, README.md, .travis.yml, .gitignore) carry the single MIT/Expat licence of Lann Martin in LICENSE; no other holder or licence wording appears anywhere in the tree (grep for Copyright/(c)/©/SPDX/permission/GNU/Apache/MPL/public domain matched only LICENSE and debian/copyright). debian/copyright is DEP-5, its Files: * stanza names Lann Martin 2014-2015 with Expat, its debian/* stanza names the packager, and the full Expat text (not in common-licenses) is reproduced. No third-party or vendored code, no generated or built files, no fonts or images.

Packaging

The packaging itself is idiomatic Go-team style: compat 13 with dpkg-build-api 1, dh-sequence-golang, a one-line dh rules file, arch:all -dev package, Multi-Arch: foreign, DEP-5 copyright, gbp/upstream metadata and Testsuite: autopkgtest-pkg-go. Two things need fixing: the sole non-trivial Build-Depends (golang-github-lann-ps-dev) does not exist in Debian at all, and debian/salsa-ci.yml works around that by adding a third-party apt repository with [trusted=yes], which disables apt's authentication and pulls unreviewed binaries into the CI chroot.

Issues

important packaging 1. debian/salsa-ci.yml adds the packager's private apt repository with [trusted=yes] ◂

• Files: debian/salsa-ci.yml:12-13
• Basis: checked, in the package or with a reference tool
• Evidence: SALSA_CI_EXTRA_REPOSITORY: >- / deb [trusted=yes] https://packaging.hermesrodriguez.com/apt unstable main; sources.list(5): The value yes tells APT always to consider this source as trusted, even if it doesn't pass authentication checks. It disables parts of apt-secure(8)
• Problem: The CI pipeline installs packages from a repository outside the archive whose contents are owned and changed by the uploader, and switches off apt signature verification for it, so unauthenticated, unreviewed binaries are pulled into the build/test chroot. Nothing shipped by this package needs it once its dependency is in Debian, and it will keep running on every pipeline after that.
• Fix: Drop SALSA_CI_EXTRA_REPOSITORY (and the now-unneeded SALSA_CI_MMDEBSTRAP_EXTRA_ARGS ca-certificates workaround) and build against the archive once golang-github-lann-ps is accepted; if a temporary workaround is unavoidable for local testing, keep it out of debian/.

minor packaging 2. Build-Depends golang-github-lann-ps-dev exists nowhere: not in unstable and not in NEW ◂

• Files: debian/control:8
• Basis: checked, in the package or with a reference tool
• Evidence: golang-github-lann-ps-dev; apt-cache: No packages found ... Nor is it a binary of this package or of any upload waiting in the NEW queues
• Problem: Upstream imports github.com/lann/ps (builder.go:5) and the binary package depends on it, so the package cannot be built or installed from the archive until that source is uploaded and accepted; debian/salsa-ci.yml admits this ("staging apt until golang-github-lann-ps is in sid").
• Fix: Upload golang-github-lann-ps first and let this one build against the archive; if it is already in NEW, this goes away by itself.

minor packaging 3. debian/watch is in the old version 4 format ◂

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

• Reviewed every upstream file (builder.go, builder_test.go, example_test.go, reflect.go, registry.go, README.md, LICENSE, .travis.yml, .gitignore); all are MIT/Expat, Lann Martin 2014-2015, matching debian/copyright's Files: * stanza and COPYING text in LICENSE.
• Prescan listed no copyright holder outside debian/copyright and no suspicious files; the tree has no vendored code, no binaries, no generated sources, no patches (debian/patches absent, so 3.0 (quilt) is consistent), no maintainer scripts, no debian/tests (Testsuite: autopkgtest-pkg-go, as is standard for the Go team).
• .pc/ and debian/cargo-checksum.json ignored as instructed; debian/watch not reviewed.
• Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 (first two components), so it is current.
• dpkg-build-api (= 1) is the recommended level from dpkg 1.22.0 and compatible with debhelper compat 13; ${misc:Depends} is present, so no substvar issue at compat 13.
• gbp.conf's dist = DEP14 only affects local git-pbuilder builds (gbp-buildpackage --git-dist), not the package contents; not reported.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20180802.47ae307, packaged 0.0~git20180802.47ae307).

Not confirmed ◂

• The apt lists used by apt-cache may be some days old; golang-github-lann-ps-dev could have been accepted since, which would resolve the missing Build-Depends by itself.