DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: golang-github-nikolalohinski-gonja 2.9.1-1

Package Information

Descriptionpure go implementation of the Jinja template engine (library)

gonja is a pure go implementation of the Jinja template engine. It aims to be as compatible as possible with the original python implementation.

MaintainerDebian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed ByJuan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsortsimonq2@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/go-team/packages/golang-github-nikolalohinski-gonja.git (browse)
Closes#1152506
Trackerhttps://tracker.debian.org/pkg/golang-github-nikolalohinski-gonja
Uploaded1 day ago

New Package Report

.changes◂
DateFri, 30 Oct 2026 11:35:19 +0100
Sourcegolang-github-nikolalohinski-gonja
Version2.9.1-1
Changed-ByJuan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecturesource all
Distributionunstable
Changelog◂
golang-github-nikolalohinski-gonja (2.9.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152506)
.dsc◂
Sectiongolang
Priorityoptional
Componentmain
Package-Listgolang-github-nikolalohinski-gonja-v2-dev deb golang optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/nikolalohinski/gonja
Upstream-Name: gonja
Upstream-Contact: https://github.com/nikolalohinski/gonja/issues

Files: *
Copyright: 2013-2014 Florian Schlachter
           2019 Axel Haustant
           2022-2026 NikolaLohinski
           2024-2026 Burak Karakan
           2024 Mikael Rapp
           2025 Jerzy Drozdz
           2026 William Kennedy
License: Expat
Comment: LICENSE names Florian Schlachter (gonja started as a fork of pongo2);
 the other holders are the main authors in the upstream history.

Files: builtins/methods/pystring/*
Copyright: 2024 Mikael Rapp
           2001 Python Software Foundation
License: Expat and PSF-2.0
Comment: Imported from https://github.com/Zatte/gopylibs (MIT, same author)
 in upstream commit 111d76b. The doc comments of the str_*.go files quote
 the Python documentation of the str methods (PSF-2.0).

Files: nodes/nodes.go nodes/walk.go tokens/lexer.go tokens/position.go
Copyright: 2009-2011 The Go Authors
           2019 Axel Haustant
           2022-2025 NikolaLohinski
           2025 Jerzy Drozdz
           2026 Burak Karakan
           2026 William Kennedy
License: Expat and BSD-3-Clause~Go
Comment: Parts come from the Go standard library: Position from
 go/token/position.go, the node overview comment and Inspect from go/ast, and
 lexer helpers from text/template/parse/lex.go.

Files: utils/lorem.go
Copyright: 2007 Pallets
           2019-2023 Axel Haustant, NikolaLohinski
           2026 William Kennedy
License: Expat and BSD-3-Clause
Comment: The word list comes from LOREM_IPSUM_WORDS in Jinja's
 src/jinja2/constants.py.

Files: docs/*.md
Copyright: 2019-2026 NikolaLohinski, Axel Haustant, Burak Karakan, Mikael Rapp
           2007 Pallets
           2001 Python Software Foundation
License: Expat and BSD-3-Clause and PSF-2.0
Comment: Parts of the text are copied from the Jinja documentation
 (BSD-3-Clause) and the Python documentation (PSF-2.0). Not installed.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
 1.  Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
 .
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
 .
 3.  Neither the name of the copyright holder nor the names of its
     contributors may be used to endorse or promote products derived from
     this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
 TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: PSF-2.0
 PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
 .
 1. This LICENSE AGREEMENT is between the Python Software Foundation
 ("PSF"), and the Individual or Organization ("Licensee") accessing and
 otherwise using this software ("Python") in source or binary form and
 its associated documentation.
 .
 2. Subject to the terms and conditions of this License Agreement, PSF hereby
 grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,
 analyze, test, perform and/or display publicly, prepare derivative works,
 distribute, and otherwise use Python alone or in any derivative version,
 provided, however, that PSF's License Agreement and PSF's notice of copyright,
 i.e., "Copyright (c) 2001 Python Software Foundation; All Rights Reserved"
 are retained in Python alone or in any derivative version prepared by Licensee.
 .
 3. In the event Licensee prepares a derivative work that is based on
 or incorporates Python or any part thereof, and wants to make
 the derivative work available to others as provided herein, then
 Licensee hereby agrees to include in any such work a brief summary of
 the changes made to Python.
 .
 4. PSF is making Python available to Licensee on an "AS IS"
 basis.  PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
 IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
 DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
 FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
 INFRINGE ANY THIRD PARTY RIGHTS.
 .
 5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
 A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
 OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
 .
 6. This License Agreement will automatically terminate upon a material
 breach of its terms and conditions.
 .
 7. Nothing in this License Agreement shall be deemed to create any
 relationship of agency, partnership, or joint venture between PSF and
 Licensee.  This License Agreement does not grant permission to use PSF
 trademarks or trade name in a trademark sense to endorse or promote
 products or services of Licensee, or any third party.
 .
 8. By copying, installing or otherwise using Python, Licensee
 agrees to be bound by the terms and conditions of this License
 Agreement.

License: BSD-3-Clause~Go
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
    * Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
    * Neither the name of Google LLC nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for golang-github-nikolalohinski-gonja version 2.9.1-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and covers the whole tree: a catch-all Expat stanza plus separate stanzas for the gopylibs-derived pystring code (Expat and PSF-2.0), the four files carrying Go standard-library material (Expat and BSD-3-ClauseGo), utils/lorem.go (Expat and BSD-3-Clause from Jinja's word list) and docs/*.md (Jinja and Python documentation text). The full texts of Expat, BSD-3-Clause, BSD-3-ClauseGo and PSF-2.0 are included; all are DFSG-free and mutually compatible. No file carries a copyright or licence notice that the file omits, no non-free terms appear anywhere in the tree, and the single prescan hit is an HTML template example, not a holder.

Packaging

The packaging follows current Go-team practice: debhelper-compat 14 with dpkg-build-api 1, dh-go's golang buildsystem, one arch:all -dev package with XS-Go-Import-Path for the /v2 module, Multi-Arch: foreign, correct and complete Depends, test-only build dependencies marked <!nocheck>, autopkgtest-pkg-go, 3.0 (quilt) with no patches needed, and a sane initial changelog. All declared dependencies exist in unstable and match the actual imports; the tests/legacy exclusion is justified because github.com/yargevad/filepathx is not in the archive, and the i386 test workaround is documented. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1.

Issues

None.

Verified ◂
  • Prescan hit docs/control_structures.md:146: <a href="http://domain.invalid/">you</a> is part of an HTML child-template example quoted from the Jinja documentation, not a copyright holder; the file is covered by the Files: docs/*.md stanza (Pallets/PSF named, BSD-3-Clause and PSF-2.0 texts included).
  • debian/copyright is DEP-5 with no Files-Excluded; stanzas are ordered general to specific, Files: * is the catch-all, and every license short name used has a matching stand-alone License paragraph with full text (nothing needed from /usr/share/common-licenses).
  • Grep of the whole tree (including .md, .tpl, .yml, .mod/.sum, git/ and .github/) for Copyright/(C)/©/SPDX/Licensed under/GNU/Apache/MPL/public domain/All rights reserved found notices only in LICENSE (MIT, Florian Schlachter 2013-2014) and debian/copyright; no non-free wording anywhere.
  • builtins/methods/pystring/: no per-file notices; the stanza records the import from Zatte/gopylibs (MIT) with 2024 Mikael Rapp and PSF-2.0 for the Python documentation quoted in the str_.go doc comments; Expat and PSF-2.0 full texts are present.
  • nodes/nodes.go, nodes/walk.go, tokens/lexer.go, tokens/position.go: node/Inspect comments and the position and lexer code come from go/ast, go/token and text/template/parse; the stanza names The Go Authors and includes the BSD-3-Clause~Go text. No other file in the tree mentions Go standard-library provenance.
  • utils/lorem.go: LOREM_IPSUM_WORDS is Jinja's constants.py word list; the stanza names 2007 Pallets and includes the BSD-3-Clause text.
  • docs/*.md: quoted Jinja and Python documentation, Pallets and PSF named, Expat and BSD-3-Clause and PSF-2.0 declared; the stanza correctly notes the documentation is not installed.
  • docs/logo.png (binary, 55 KiB) and docs/logo.svg (365 KiB Inkscape source, includes text and one base64 PNG): the project logo referenced by README.md, source artwork shipped, no separate notice, covered by the Files: * Expat stanza.
  • tests/legacy/testcases/*.tpl and .tpl.out: template inputs and expected outputs (test data) from the pongo2-derived suite; no notices, covered by Files: * with Florian Schlachter named.
  • No generated-code markers (Code generated / DO NOT EDIT / go:generate) and no built binaries, minified code, PDFs or vendored copies in the tree; go.sum is normal committed module metadata.
  • debian/control Depends and Build-Depends checked against imports: humanize (exec/varargs.go), json-iterator (builtins/filters.go), logrus, pkg/errors, golang.org/x/exp/utf8string and golang.org/x/text are binary dependencies; heredoc, gotextdiff, ginkgo and gomega are used only by tests and are correctly marked <!nocheck>. apt-cache confirms every named package exists in unstable, including dh-go, dpkg-build-api (= 1), golang-any and golang-golang-x-exp-dev (which still ships utf8string). github.com/yargevad/filepathx has no Debian package, so excluding tests/legacy is justified.
  • debhelper tool confirms that at compat 14 dh skips override_dh_auto_test under DEB_BUILD_OPTIONS=nocheck, so the rules override needs no nocheck check of its own.
  • debian/copyright top-level Source/Upstream-Name/Upstream-Contact, debian/control Homepage and Vcs-* fields are consistent with the .dsc; changelog is 2.9.1-1 to unstable, closing #1152506.
  • Read debian/ in full (changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, source/format, upstream/metadata), all non-iconic upstream metadata files, the .dsc and the debian tarball listing; sampled Go file headers across every package and grepped the whole tree for licence notices.
  • uscan found the packaged version as the newest upstream release (upstream 2.9.1, packaged 2.9.1).
Not confirmed ◂
  • The actual license text of https://github.com/Zatte/gopylibs, from which builtins/methods/pystring was imported, could not be fetched; the Expat claim rests on the Comment in debian/copyright.
  • The base64-embedded PNG inside docs/logo.svg (line 207) was not decoded (binary); its origin cannot be established beyond the SVG being the project logo.
  • Minor year drift between the holder lists of the specific stanzas and Files: * was not treated as an issue; file-level notices are absent, so exact authorship of individual edits cannot be checked.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 23 hours ago.

Review Information

accepted — allocated to awm 17 hours ago, started 17 hours ago, completed 17 hours ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.9.1-1 407fd84b… 2026-11-06 08:26 2026-11-06 08:26 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package