Review: golang-github-moby-moby-api 1.56.0-1

Package Information

Description	Go types of the Docker Engine API (library) The Engine API is the HTTP API that the docker command-line client uses to talk to the daemon; other programs can use it to control the daemon too. This package provides the github.com/moby/moby/api Go module: the types shared by the API client and server, which represent the objects, options and responses of the API (containers, images, networks, volumes, swarm services and more), plus small helpers to demultiplex the stdout/stderr stream of a container (stdcopy) and to encode registry credentials for the X-Registry-Auth header (authconfig). This is an interim package, to be taken over by the docker.io source once it is updated to the upstream 29.x series, which contains this module.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-moby-moby-api.git (browse)
Closes	#1149066
Tracker	https://tracker.debian.org/pkg/golang-github-moby-moby-api
Uploaded	11 days ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Sat, 26 Sep 2026 03:05:33 +0200
Source	golang-github-moby-moby-api
Version	1.56.0-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>

Changelog◂

golang-github-moby-moby-api (1.56.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1149066)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-moby-moby-api-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: moby (api module)
Upstream-Contact: https://github.com/moby/moby/issues
Source: https://github.com/moby/moby/tree/api/v1.56.0/api
Comment: The orig tarball holds only the api/ subdirectory of the moby/moby
 repository at tag api/v1.56.0 (see debian/get-orig-source.sh). No file in
 it carries a copyright notice; api/LICENSE is the plain Apache-2.0 text. The
 holder below is the one named by the repository's top-level LICENSE
 ("Copyright 2013-2018 Docker, Inc.") and NOTICE ("Copyright 2012-2017
 Docker, Inc."), which are outside the api/ module. Individual contributors
 are listed in the repository's top-level AUTHORS file.
 .
 The years are copied from those two notices as written; they are not
 derived from the history. In the repository, the first commit touching
 api/ is from 2014-01-29 and the last one before the tag from 2026-09-03.
 .
 licensecheck reports "GPL" for swagger.yaml and for 39 files in docs/:
 the API examples use the container label com.example.license: "GPL" as
 sample data. The files are not under the GPL; Files: * covers them.

Files: *
Copyright: 2012-2018 Docker, Inc.
License: Apache-2.0

Files: templates/*
Copyright: go-swagger maintainers
           2012-2018 Docker, Inc.
License: Apache-2.0
Comment: The three templates are modified copies of go-swagger v0.33.1
 templates; each names its original in its header, e.g.
 https://github.com/go-swagger/go-swagger/blob/v0.33.1/generator/templates/schema.gotmpl
 go-swagger is Apache-2.0 and its LICENSE names no holder; its Go sources
 say "Copyright 2015 go-swagger maintainers". The template files carry no
 notice, so no year is given for them. They are read only when the API
 types are regenerated with go-swagger, not by the Go build.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 11 days ago.

Report◂

DFSG NEW review for golang-github-moby-moby-api version 1.56.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is the api/ module of moby/moby and is Apache-2.0 throughout (LICENSE at the root, no per-file notices, which debian/copyright states and explains). debian/copyright is DEP-5 with the correct Format URL, three Files stanzas (*, templates/*, debian/*), every stanza carrying License:, and a stand-alone Apache-2.0 paragraph pointing to /usr/share/common-licenses/Apache-2.0. The three go-swagger templates are correctly given their own stanza with go-swagger's holder and Apache-2.0, which is compatible with Docker's terms. No non-free wording, no binaries, no minified or built files, and the generator input for the 44 swagger-generated Go files is shipped. The scan's author check found no holder missing from debian/copyright.

Packaging

Conventional, careful Go-team packaging: Build-Depends and Depends match the four modules imported by non-test code, with pgregory.net/rapid correctly build-only because dh_auto_test runs the test suite (types/plugin/capability_test.go is its only user). Every name exists in unstable: dh-go 1.69 provides the golang buildsystem and addon that --buildsystem=golang --with=golang select and does not Provide dh-sequence-golang, so the lintian override is right; dpkg-build-api (= 1) is the documented deb-src-control syntax and is provided by dpkg-dev 1.23.11; golang-any is 1.27. Compat 14, no patches, no maintainer scripts, no overrides, Testsuite: autopkgtest-pkg-go, Standards-Version 4.7.4 against Policy 4.7.4.1, Vcs-* and upstream/metadata present, and README.source documents both the api/-only repack and the package's interim nature.

Issues

None.

Verified ◂

debian/copyright read in full: DEP-5, correct Format line, Files: * / Files: templates/* / Files: debian/* in the right order (later stanzas override earlier), each with Copyright and License, plus one stand-alone License: Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0.
Grep over the whole tree (.pc/ and debian/cargo-checksum.json excluded, gitignore off) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public, GNU Lesser, Apache License, Mozilla Public, public domain, All rights reserved, Redistribution and use, MIT License: the only notices are the Apache-2.0 text in LICENSE and the orignal template ... go-swagger ... v0.33.1 attribution headers of the three templates. No file carries a per-file copyright notice, as debian/copyright's Files: * Comment says.
The GPL wording is the sample container label in the API examples, not a licence: swagger.yaml:5838 and swagger.yaml:8482 com.example.license: "GPL", and the same label in the docs/.md and docs/.yaml version documents (e.g. docs/v1.18.md:64). debian/copyright's header Comment already says so.
templates/schema.gotmpl, templates/structfield.gotmpl and templates/server/operation.gotmpl each name their go-swagger v0.33.1 original in a header comment; the Files: templates/* stanza names both the go-swagger maintainers and Docker, Inc. and inherits Apache-2.0 (compatible).
No binary, minified or built artifacts: glob for png/jpg/gif/pdf/zip/tar/gz/xz/jar/exe/dll/so/class/pyc/woff/ttf/min.js/map found nothing; the tree is .go, .md, .yaml, .gotmpl, .sh, .toml, .mod, .sum, .gitignore and debian files only.
The 44 // Code generated by go-swagger; DO NOT EDIT. files under types/ have their generator input in the package: swagger.yaml, swagger-gen.yaml, templates/ and scripts/generate-swagger-api.sh (plus scripts/validate-swagger-gen.sh, which regenerates and diffs them).
Dependencies match the imports: github.com/docker/go-units, github.com/moby/docker-image-spec, github.com/opencontainers/go-digest and github.com/opencontainers/image-spec are imported by non-test code and are both Build-Depends and Depends; pgregory.net/rapid is imported only by types/plugin/capability_test.go and is in Build-Depends only.
apt-cache: golang-github-docker-go-units-dev 0.5.0-1, golang-github-moby-docker-image-spec-dev 1.3.1-2, golang-github-opencontainers-go-digest-dev 1.0.0-2, golang-github-opencontainers-image-spec-dev 1.1.1-3, golang-pgregory-rapid-dev 1.3.0-5, golang-any 1.27~1, dh-go 1.69 and dpkg-dev 1.23.11 (Provides: dpkg-build-api (= 1)) all exist in unstable; the Debian versions satisfy the go.mod requirements.
dh-go's buildsystem runs in GOPATH mode (GO111MODULE=off, read in /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm), so go.mod's pgregory.net/rapid v1.2.0 against Debian's 1.3.0 does not matter; the same source shows install copies only .go, testdata and go.mod/go.sum into /usr/share/gocode, so docs/, swagger.yaml, Dockerfile, Makefile and scripts/ are not shipped in the binary package.
debian/source/lintian-overrides is justified: dh-go 1.69 Conflicts with dh-golang and does not Provide dh-sequence-golang, so --with=golang is needed in debian/rules and lintian's dh-addon mapping to dh-golang cannot be satisfied.
Build-Depends: dpkg-build-api (= 1) is the syntax deb-src-control documents (read via the man tool, [EXAMPLE] section), and at that API level Rules-Requires-Root defaults to no, which is what this package needs.
Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components match, so not an issue.
No debian/patches and no series file, consistent with the empty quilt series in .pc/ (ignored otherwise); no maintainer scripts, no maintscripts, no .install/.links/.docs files, which is right for a Go -dev package installed by the golang buildsystem.
changelog: 1.56.0-1, distribution unstable, initial release closing #1149066, date Sat 26 Sep 2026 (a Saturday) consistent with the changelog format.
The orig tarball's root listing (doc.go, Dockerfile, docs/, go.mod, go.sum, LICENSE, Makefile, pkg/, README.md, releases/, scripts/, swagger-gen.yaml, swagger.yaml, templates/, types/, validate/) matches the working tree, and debian.tar.xz lists exactly the debian/ files present, so Debian adds nothing outside debian/.
debian/README.source, debian/gbp.conf, debian/upstream/metadata, debian/salsa-ci.yml, debian/get-orig-source.sh and both lintian-overrides files read; they are consistent with each other and with the repacked-subdirectory orig tarball.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.56.1, packaged 1.56.0), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

go-swagger is not in the Debian archive and not under /usr/share/gocode here, so the Copyright: go-swagger maintainers line in the templates stanza could only be checked against debian/copyright's own statement that go-swagger's sources carry Copyright 2015 go-swagger maintainers.
The package could not be built or its tests run; nothing in debian/rules or the Build-Depends names a file or package that is absent, so no build failure is predictable from the package itself.
swagger.yaml (462 KB) and the 69 files under docs/ were not read in full; the licence and holder search covered all of them by grep.
The ITP bug number in the changelog (#1149066) could not be checked, as the BTS is not reachable from here.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 11 days ago.

Review Information

accepted — allocated to awm 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.56.0-1	10495338…	2026-10-27 18:06	2026-10-27 18:06	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package