Review: golang-github-masahiro331-go-vmdk-parser 0.1.3+git20260423.08305fa-1
Package Information
| Description | VMDK parser for Virtual Machine Image (library) VMDK parser for Virtual Machine Image. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-masahiro331-go-vmdk-parser.git (browse) |
| Closes | #1152504 |
| Tracker | https://tracker.debian.org/pkg/golang-github-masahiro331-go-vmdk-parser |
| Uploaded | 2 days ago |
New Package Report
.changes
| Source | golang-github-masahiro331-go-vmdk-parser |
|---|---|
| Version | 0.1.3+git20260423.08305fa-1 |
| Changed-By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Architecture | source all |
| Distribution | unstable |
| Date | Fri, 30 Oct 2026 04:56:15 +0100 |
Changelog
golang-github-masahiro331-go-vmdk-parser (0.1.3+git20260423.08305fa-1) unstable; urgency=medium . * Initial release (Closes: #1152504)
.dsc
| Package-List | golang-github-masahiro331-go-vmdk-parser-dev deb golang optional arch=all |
|---|---|
| Section | golang |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/masahiro331/go-vmdk-parser
Upstream-Name: go-vmdk-parser
Upstream-Contact: https://github.com/masahiro331/go-vmdk-parser/issues
Files: *
Copyright: 2020-2022 Masahiro Fujimura (masahiro331) <m_fujimura@r.recruit.co.jp>
2026 yusuke-koyoshi
2026 Frederic M
License: Apache-2.0
Comment: Upstream has no copyright notice (LICENSE carries the unfilled
Apache-2.0 appendix and no file has a header). The holders are the authors
of the commits in the upstream history. pkg/virtualization/vmdk/testdata/
holds VMDK headers of empty disks.
Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Comment:
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 day ago.
Report
DFSG NEW review for golang-github-masahiro331-go-vmdk-parser version 0.1.3+git20260423.08305fa-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 3 found
Licensing
The whole tree is Apache-2.0: LICENSE carries the full Apache License 2.0 text, no source file or data file carries terms of its own, and the only third-party code referenced (golang.org/x/xerrors, in go.mod/go.sum) is not vendored but taken from a separate Debian package. debian/copyright is DEP-5, has a Files: * stanza, a later Files: debian/* stanza, and a stand-alone License: Apache-2.0 paragraph whose short form plus pointer to /usr/share/common-licenses/Apache-2.0 is complete because the full text is there. The holders it names are the only ones derivable from the package, and its comment correctly explains why no in-file notices exist; the three test images are generated empty-disk fixtures with no creative content. No non-free terms, no missing licence, no generated or minified code without its input.
Packaging
Textbook current Debian Go team packaging: debhelper-compat 14 with dh-go and --with=golang, dpkg-build-api (= 1) (so Rules-Requires-Root need not be set), golang-any plus the one needed -dev build dependency, Testsuite: autopkgtest-pkg-go with XS-Go-Import-Path set for the runner, correct Vcs-* and Homepage, Standards-Version 4.7.4 (current policy is 4.7.4.1), a single Architecture: all Multi-Arch: foreign -dev package, no patches, and a clean initial changelog closing the ITP. Only the extended description is a defect: it merely repeats the synopsis.
Issues
minor packaging 1. Extended description only repeats the synopsis, adding no information for the user ◂
-
Files:
debian/control:22-23 -
Basis: checked, in the package or with a reference tool
-
Evidence:
Description: VMDK parser for Virtual Machine Image (library)
VMDK parser for Virtual Machine Image. -
Problem: Policy 3.4 requires the extended description to describe the package to someone who has not met it before, and Policy 3.4.2 says not to continue the synopsis into it; here it is the synopsis with the '(library)' suffix removed, so it says nothing about what the parser reads (monolithicSparse/streamOptimized extents), what its API gives back (an io.SectionReader for the disk contents) or who would want the package.
-
Fix: Replace the extended description with one or two sentences taken from the package itself, e.g. what VMDK is, which disk subformats Open() supports and that the package provides Go source for other programs to build against.
Verified ◂
- pkg/virtualization/vmdk/testdata/vmdk-monolith.img: a 64.0 KiB monolithicSparse image whose generation command is quoted in the test that uses it (vmdk_test.go:41,
qemu-img create -f vmdk vmdk-monolith.img 65536); an empty disk, structural data only, so no licence notice is needed and none is missing. - pkg/virtualization/vmdk/testdata/vmdk-streamoptimized.img: a 64.0 KiB streamOptimized image, generated with the qemu-img command quoted at vmdk_test.go:20; same reasoning, empty-disk test fixture without creative content.
- pkg/virtualization/vmdk/testdata/vmdk-invalid.img: a 63.7 KiB header-only VMDK used as the 'invalid descriptor' case at vmdk_test.go:61; generated/edited binary test data with no creative content, consistent with the debian/copyright comment that testdata holds VMDK headers of empty disks. Sizes taken from the orig tarball listing.
- LICENSE holds the complete, unmodified Apache License 2.0 (terms plus the unfilled appendix); debian/copyright's comment that upstream added no per-file notices is accurate.
- A tree-wide grep for Copyright/(C)/©/SPDX/Licensed under/permission notices/GNU/Apache/Mozilla/public domain/All rights reserved found matches only in LICENSE and debian/copyright; no upstream file declares a different licence or another holder.
- Coverage: all of debian/ (control, copyright, rules, changelog, source/format, gbp.conf, salsa-ci.yml, upstream/metadata), LICENSE, README.md, go.mod, go.sum, .gitignore, both .github/workflows files, vmdk_test.go in full and the .go sources read through; no debian/patches, debian/tests or maintainer scripts exist.
- go.mod/go.sum reference exactly one module, golang.org/x/xerrors, which Debian ships as golang-golang-x-xerrors-dev; nothing is vendored and there is no embedded copy of another library.
- The three copyright holders named in debian/copyright are the only ones the package yields; no file notice names anyone else (the upstream-author check also found no unnamed holder).
- dh-go 1.69 is in the archive, provides the 'golang' debhelper addon/buildsystem (apt-cache) and dh_golang_autopkgtest, so --with=golang and Testsuite: autopkgtest-pkg-go both work; the golang buildsystem installs testdata and go.mod/go.sum into the -dev package by default, so the installed-source autopkgtest still has its fixtures.
- dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11 and makes Rules-Requires-Root default to 'no' (dpkg-build-api(1)), so the missing field is correct rather than an omission.
- Standards-Version 4.7.4 has the same first two components as the installed policy (4.7.4.1), so it is current.
- Multi-Arch: foreign on the Architecture: all -dev package matches Debian Go team practice (e.g. golang-github-google-go-cmp-dev).
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream0.1.3+git20261019.b5e948e, packaged0.1.3+git20260423.08305fa), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- Whether the three holders in debian/copyright (including the two 2026 contributors) match the upstream git history: the source ships no VCS metadata and no file notices, so the holder list can be neither confirmed nor refuted from the package.
- The ITP number in the changelog (Closes: #1152504) could not be checked, as no URL or bug tracker is reachable from here.
- The two unused .github/workflows files are covered by Files: * like the rest; being YAML they contain no licence notice of their own, which is expected.
Proposed changes ◂
None.
Uploader's response to the LLM review
Agreed. Upstream's README is that one sentence. The next upload (-2) has a description written from the code: the two VMDK types it supports (monolithicSparse and streamOptimized) and the io.SectionReader it returns. It is committed in debian/sid.
Please, accept in the meanwhile.
— Juan Manuel Méndez Rey (mendezr), 1 day ago
Review Information
accepted — allocated to mechtilde 1 day ago, started 1 day ago, completed 1 day ago.