Review: golang-github-nikolalohinski-gonja 2.9.1-1

Package Information

Description	pure go implementation of the Jinja template engine (library) gonja is a pure go implementation of the Jinja template engine. It aims to be as compatible as possible with the original python implementation.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-nikolalohinski-gonja.git (browse)
Closes	#1152506
Tracker	https://tracker.debian.org/pkg/golang-github-nikolalohinski-gonja
Uploaded	2 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Fri, 30 Oct 2026 11:35:19 +0100
Source	golang-github-nikolalohinski-gonja
Version	2.9.1-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all

Changelog◂

golang-github-nikolalohinski-gonja (2.9.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152506)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-nikolalohinski-gonja-v2-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/nikolalohinski/gonja
Upstream-Name: gonja
Upstream-Contact: https://github.com/nikolalohinski/gonja/issues

Files: *
Copyright: 2013-2014 Florian Schlachter
           2019 Axel Haustant
           2022-2026 NikolaLohinski
           2024-2026 Burak Karakan
           2024 Mikael Rapp
License: Expat
Comment: LICENSE names Florian Schlachter (gonja started as a fork of pongo2);
 the other holders are the main authors in the upstream history.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for golang-github-nikolalohinski-gonja version 2.9.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 1 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The project's own code is Expat-licensed and the licence text in debian/copyright is complete, but debian/copyright does not describe the whole tree. builtins/methods/pystring is a separate, stand-alone library vendored into the module with no copyright or licence statement of any kind, and docs/*.md reproduce Jinja's manual (and, in methods.md, CPython's) without their notices, while Files: * attributes everything to the five gonja holders under Expat. Neither defect is a non-free term; both make debian/copyright inaccurate.

Packaging

Packaging follows current pkg-go practice: DEP-5 copyright, debhelper compat 14 with dh-go's golang addon, dpkg-build-api 1, dependencies that match the actual imports with test-only ones marked <!nocheck>, autopkgtest-pkg-go, salsa-ci, gbp.conf and Standards-Version 4.7.4 (Policy 4.7.4.1). No patches, no maintainer scripts, changelog sane. Its only weaknesses are the copyright-file problems, reported under licensing.

Issues

blocker licensing 1. builtins/methods/pystring is a vendored copy of the separate PyString library with no licence or copyright notice ◂

Files: builtins/methods/pystring/Readme.md, builtins/methods/pystring/str_captitalize.go, builtins/methods/pystring/dialect.go, builtins/methods/pystring/dialect_formatter_spec.go, debian/copyright:6-13
Basis: inferred from what was read, not seen directly
Evidence: builtins/methods/pystring/Readme.md:1-3 # PyString / An attempt to get as similar behavior as possible that exists in python. / Source reference: https://docs.python.org/3/library/string.html#string.Formatter -- a stand-alone project README with its own scope, TODO list and dialect rationale, not gonja documentation. A tree-wide grep for Copyright, (C), (c), SPDX-License-Identifier, Licensed under finds nothing in any of the ~100 files of that directory. debian/copyright's Files: * names only Florian Schlachter, Axel Haustant, NikolaLohinski, Burak Karakan and Mikael Rapp and licenses all of it Expat.
Problem: The directory is not gonja code: it is the PyString project (github.com/Elvenson/pystring) merged verbatim into gonja's module path (its package, README and layouts are unchanged). Nothing in the package states who holds its copyright or under what terms it may be copied. If upstream PyString has no licence, neither gonja nor Debian has permission to distribute the code, which fails DFSG points 2 and 3; if it has one, the holder and terms are missing from debian/copyright and the Expat claim over these files is wrong. Policy 12.5 requires debian/copyright to record the copyright and distribution licence of the package's contents.
Fix: Establish PyString's origin and licence, add a Files: builtins/methods/pystring/* stanza naming its copyright holder and licence (with the licence text if it is not in /usr/share/common-licenses), and forward the missing notice upstream. If the upstream project has no licence, the copy must be removed or permission obtained before upload.

important licensing 2. docs/*.md reproduce Jinja's and CPython's documentation without their copyright notices ◂

Files: docs/control_structures.md:3, docs/control_structures.md:129-146, docs/control_structures.md:200-210, docs/global_functions.md:80-140, docs/tests.md, docs/filters.md, docs/methods.md:20-33
Basis: inferred from what was read, not seen directly
Evidence: docs/control_structures.md:129 The most powerful part of Jinja is template inheritance. Template inheritance allows you to build a base “skeleton” template ... followed by the Jinja manual's base.html example ending © Copyright 2008 by <a href="http://domain.invalid/">you</a>.; docs/global_functions.md A tiny helper that can be used to “join” multiple sections.; docs/methods.md Return the number of bits necessary to represent an integer in binary, excluding the sign and leading zeros. (CPython int.bit_length). debian/copyright names no Jinja or Python Documentation holder; the files are under Files: * / Expat.
Problem: Large parts of these files are verbatim prose from the Jinja template documentation (BSD-3-Clause, copyright Pallets and Armin Ronacher) and from the CPython standard-library documentation (PSF-2.0), both of which require their notice to be reproduced when the text is redistributed. The package ships them in the source tarball with an Expat-only copyright, so debian/copyright is inaccurate. (The golang buildsystem installs only .go, go.mod/go.sum and testdata files, so the docs do not reach the binary package; the source package still distributes them.) Policy 12.5.
Fix: Add a Files: docs/* stanza naming the Jinja/Pallets holder under BSD-3-Clause and the Python Software Foundation under PSF-2.0, with the licence texts, or ask upstream to rewrite the passages that are copied verbatim.

Verified ◂

Read every file of debian/ (control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, upstream/metadata); debian/watch deliberately not reviewed; .pc/ and debian/cargo-checksum.json ignored.
Inventoried the tree directory by directory: 482 files, all Go sources, templates/fixtures, Markdown, README/AUTHORS/CONTRIBUTING/LICENSE, .github/workflows/build.yml, git/hooks/pre-push, docs/logo.png and docs/logo.svg. The tree-wide grep for copyright/licence wording matches only LICENSE, debian/copyright and an HTML example in docs (see below). No other LICENSE/COPYING/NOTICE file exists in the tree, including in subdirectories.
LICENSE is Expat (MIT) naming Florian Schlachter 2013-2014; the License: Expat paragraph in debian/copyright reproduces it exactly, so the project's own files are correctly licensed and the DEP-5 file is well-formed (correct Format URL, Source, Upstream-Name/Contact, debian/* stanza).
The prescan's only unnamed holder, docs/control_structures.md:146 (© Copyright 2008 by <a href="http://domain.invalid/">you</a>), is an HTML example inside the copied Jinja template-inheritance snippet, not a copyright holder; it needs no copyright entry of its own (it is covered by the docs issue above).
Dependencies match the imports: non-test code imports github.com/dustin/go-humanize (exec/varargs.go), json-iterator (builtins/filters.go), pkg/errors, sirupsen/logrus (builtins/control_structures/if.go), golang.org/x/exp (pystring) and golang.org/x/text, all of which are in the binary Depends; heredoc, gotextdiff, ginkgo and gomega are used only in _test.go files and are in Build-Depends with <!nocheck>.
golang-github-yargevad-filepathx is imported only by tests/legacy, which debian/rules excludes (DH_GOLANG_EXCLUDES := examples tests/legacy), and the golang buildsystem applies DH_GOLANG_EXCLUDES to both build and test target lists, so its absence from Build-Depends is consistent.
Build-Depends exist in unstable: dh-go 1.69 (dh-go ships the golang debhelper addon, buildsystem and dh_golang_autopkgtest, and Conflicts with dh-golang, so --with=golang needs no dh-golang); dpkg-build-api is provided by dpkg-dev 1.23.11 (= 1); ginkgo 2.28.1, gomega 1.39.1, gotextdiff 1.0.3 and heredoc 1.0.0 are all packaged. /usr/share/gocode/src/golang.org/x/exp/utf8string exists on this system, so the x/exp import is satisfiable.
Binary package name golang-github-nikolalohinski-gonja-v2-dev matches archive practice for /v2 modules (cf. golang-github-go-git-go-git-v5-dev from source golang-github-go-git-go-git) and matches XS-Go-Import-Path github.com/nikolalohinski/gonja/v2.
Standards-Version 4.7.4 against Policy 4.7.4.1: same major/minor, current.
Autopkgtest-pkg-go: autodep8's generated test runs /usr/bin/dh_golang_autopkgtest with Depends: @, @builddeps@, and that helper re-runs make -f debian/rules build, so the i386 exclusion in the rules override applies to autopkgtest as well.
The i386 override uses DEB_HOST_ARCH from /usr/share/dpkg/architecture.mk, included at parse time, and sets DH_GOLANG_EXCLUDES only for that one dh_auto_test invocation.
debian/patches does not exist and there are no quilt patches; the source is 3.0 (quilt) with no repack, and no Files-Excluded is needed.
docs/logo.png (55 kB) and docs/logo.svg (366 kB, Inkscape-generated, text left as text in the font "Small Dot Digital-7", no font files shipped) are the project logo referenced from README.md; no separate licence statement found and they are covered by Files: *.
tests/legacy/testcases/**/*.tpl and *.tpl.out are template fixtures and expected outputs used by the (excluded) legacy test package; no third-party notices in them, covered by Files: * with Florian Schlachter (author of the pongo2 code they descend from).
uscan found the packaged version as the newest upstream release (upstream 2.9.1, packaged 2.9.1).

Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 1 day ago, started 1 day ago, completed 1 day ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

The uploader said:

One correction to the LLM review:

pystring is not unlicensed. Upstream commit 111d76b says "import pystring from zatte/gopylibs". That is https://github.com/Zatte/gopylibs , MIT, "Copyright 2024 Mikael Rapp", and Mikael Rapp is the gonja author who imported it. He is already a holder under Files: * (Expat). debian/copyright will get a Files: builtins/methods/pystring/* stanza that names that origin.
Agreed. The copied Jinja and Python documentation is free, so the orig stays as it is, and debian/copyright will list docs/ under BSD-3-Clause (Pallets) and PSF-2.0 as well. I will also ask upstream to add the notices.

I will fix on a reupload.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
2.9.1-1	beba0735…	2026-11-07 09:58	2026-11-07 09:58	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package