DFSG NEW review for golang-github-moby-moby-client version 0.6.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is Apache-2.0: LICENSE is the verbatim Apache License 2.0 text, no other licence file or notice exists anywhere in the tree, and no file carries restrictive wording. debian/copyright is DEP-5, with a Files: * stanza (Docker, Inc., Apache-2.0) and a debian/* stanza (the packager, Apache-2.0), plus one stand-alone Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0, which Policy 12.5 explicitly prefers. Because the shipped subtree carries no copyright notice at all, the holder is taken from the moby/moby repository's top-level LICENSE/NOTICE, which are outside client/; the header Comment says so and explains the repack, the year range and the test data, so the file describes the provenance of every file honestly.

Packaging

Textbook Go library packaging: source format 3.0 (quilt), debhelper compat 14 with dpkg-build-api 1, dh-go's golang buildsystem built out of source, one documented DEP-3 patch, complete Build-Depends/Depends matching the actual imports, autopkgtest via autopkgtest-pkg-go, current Standards-Version, clean changelog that closes the ITP, and a README.source that explains the unusual points (interim package, module-mode vs. Debian's GOPATH-mode build, go-connections 0.4, the single skipped subtest). The one subtest skipped in debian/rules exists under exactly that name and the skip is applied in autopkgtest too, since dh_golang_autopkgtest runs make -f debian/rules build.

Issues

None.

Verified

• Prescan listed no files: its only output was the author check (279 files, every holder found is named in debian/copyright); I re-grepped the tree for Copyright, (C), ©, SPDX-License-Identifier, 'Licensed under', 'Permission is hereby granted', GNU/Apache/MPL/public-domain wording and found matches only in LICENSE (the licence text itself) and debian/copyright.
• debian/copyright read in full: DEP-5, correct Format line, Files: * (2012-2018 Docker, Inc., Apache-2.0), Files: debian/* (2026 Juan Manuel Méndez Rey, Apache-2.0), one stand-alone Apache-2.0 paragraph with the boilerplate and a pointer to /usr/share/common-licenses/Apache-2.0 (Policy 12.5 says packages under Apache-2.0 should refer there rather than quote).
• LICENSE (202 lines) is the verbatim Apache-2.0 text; its appendix still reads Copyright [yyyy] [name of copyright owner], so no holder is hidden in the source files themselves; the copyright file's Comment explains that the holder and years come from the repository's top-level LICENSE (2013-2018) and NOTICE (2012-2017), which are outside the shipped client/ subtree.
• Original tarball compared with the unpacked tree: identical file set, client/ at the root, no NOTICE, AUTHORS or extra LICENSE, no generated or built files, no vendored code (grep for 'Code generated', 'DO NOT EDIT', 'go:generate', 'vendor/', 'third-party' finds nothing but licence wording and Go doc prose).
• testdata/ca.pem, testdata/cert.pem and testdata/key.pem are test data: cert.pem is a certificate issued by O=vincent valid 2016-03-24 to 2019-03-09, exactly as the copyright Comment describes; they are used only by client_options_test.go.
• Dependencies match the imports: non-test imports of github.com/moby/moby/api, docker/go-connections, distribution/reference, opencontainers/{go-digest,image-spec}, moby/term, docker/go-units, containerd/errdefs (and errdefs/pkg/errhttp), otelhttp and otel/trace, golang.org/x/time all have a binary package in Depends/Build-Depends; go-cmp and gotest.tools are test-only and correctly only in Build-Depends; the Microsoft/go-winio import is in client_windows.go only and needs nothing on Linux.
• debian/rules: dh $@ --builddirectory=debian/_build --buildsystem=golang --with=golang; dh-go 1.69 provides the golang addon but no longer Provides dh-sequence-golang (apt-cache), so the explicit --with=golang is required, and debian/source/lintian-overrides explains the corresponding lintian tag.
• debian/patches/0001-require-go-connections-0.4-deps.patch carries DEP-3 headers (Description, Author, Forwarded: not-needed, Last-Update) and touches only go.mod; go.sum has no entries for the two modules it adds, which does not affect the build because the golang buildsystem sets GO111MODULE=off (checked in /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm, _set_go111module), so go.mod/go.sum are never consulted.
• The test skipped in debian/rules corresponds to a real subtest: client_test.go:44 has doc: "invalid cert path", which go test turns into TestNewClientWithOpsFromEnv/invalid_cert_path, and the pattern ^TestNewClientWithOpsFromEnv$/^invalid_cert_path$ matches it. At compat 14 dh itself skips the override under nocheck.
• Autopkgtest: Testsuite: autopkgtest-pkg-go is served by dh-go's dh_golang_autopkgtest (listed among dh-go's Commands), which copies the source, appends an apt-print- helper and make -f debian/rules build, so the same -skip applies in the test run.
• debian/changelog: 0.6.0-1, unstable, urgency medium, initial release closing a bug, date Sat 26 Sep 2026 consistent with the calendar; Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 in its first two components.
• debian/gbp.conf checked against gbp: dist = DEP14 is valid, gbp's buildpackage.py accepts both 'DEP-14' and 'DEP14'; debian-branch, upstream-branch, pristine-tar and ignore-branch are ordinary keys.
• debian/upstream/metadata has Bug-Database, Bug-Submit, Repository, Repository-Browse and Security-Contact; debian/source/format is 3.0 (quilt); no maintainer scripts or .maintscript files exist; the only lintian overrides are the two documented ones.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.6.2, packaged 0.6.0), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• golang-github-moby-moby-api-dev (>= 1.56.0), a Build-Depends and Depends, is in neither the archive lists nor ftp-master's NEW queue (apt-cache as of 2026-10-28); its companion source package is presumably still being prepared or queued, and the lists may be some days old.
• Could not inspect the file list of golang-github-containerd-errdefs-dev 1.0.0-1 (no gocode tree is installed here) to confirm it ships the separate github.com/containerd/errdefs/pkg module that errors.go and internal/jsonmessages.go import; the build, which needs it, is taken to succeed.

Proposed changes

None.