DFSG NEW review for golang-github-nix-community-go-nix version 0.0~git20250101.4bdde67+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is Apache-2.0 throughout: LICENSE is the Apache 2.0 text with its appendix filled in as 'Copyright 2020 NumTide Ltd and contributors', and no other copyright or licence notice appears in any file. debian/copyright is DEP-5 with two stanzas (upstream tree, debian/*), the right holders, and the Apache-2.0 short name pointing at /usr/share/common-licenses. The one DFSG problem in the tree, a prebuilt x86-64 ELF and the NAR wrapping it in test/testdata, is documented under Files-Excluded and both files are genuinely absent; the two tests that read them are skipped.

Packaging

Clean, current packaging: debhelper compat 14 with dh-go named explicitly (with an override explaining why not dh-golang), dpkg-build-api 1, Standards-Version 4.7.4 (current), a machine-readable copyright with a documented repack, DEP-3 patches whose badger v4 bump matches the archive's 4.8.0, install/manpages files that match what dh_golang produces, the Built-Using and Static-Built-Using substvars that dh_golang populates, and an autopkgtest-pkg-go test that runs through the same rules override. The only defect found is in the Debian-written man page, which describes one option's behaviour incorrectly.

Issues

1. [minor] [packaging] gonix(1) says badger:// always opens an in-memory store, but the code calls the persistent-store constructor

• Files: debian/gonix.1:50-52, pkg/derivation/store/uri.go:25-26, pkg/derivation/store/badger.go:22-31

• Basis: checked, in the package or with a reference tool

• Evidence:

  gonix.1: and \fBbadger://\fR, which opens an in-memory store. Note that upstream documents \fBbadger:///\fIPATH\fR as an on-disk store, but the code ignores the path and always opens the store in memory.
  uri.go: case "badger": return NewBadgerStore("")
  badger.go: func NewBadgerStore(path string) calls badger.Open(buildDefaultBadgerOptions(path)); the in-memory store is a separate NewBadgerMemoryStore() that adds .WithInMemory(true).

• Problem: The manual page states that badger:// yields an in-memory store, but the code calls the persistent constructor with an empty path; that the empty-path constructor is not the in-memory one is shown by the package's own NewBadgerMemoryStore adding WithInMemory(true). A user following the page therefore gets something other than an in-memory store (with badger's default persistent options an empty path is not a memory store), for an option Debian documents itself.

• Fix: Either make uri.go return NewBadgerMemoryStore() for badger:// (and keep the page, forwarding the path-ignoring bug upstream), or correct gonix.1 to describe what the code does.

Verified

• Read all of debian/: control, rules, changelog, copyright, all three patches and series, the .install/.manpages files, both lintian overrides, gbp.conf, upstream/metadata, salsa-ci.yml, source/format.
• All upstream files (excluding .pc/ and debian/) were inventoried; the only copyright/licence statement in the tree is the Apache-2.0 appendix in LICENSE (Copyright 2020 NumTide Ltd and contributors). A tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, GNU ... General Public, Apache License, Mozilla Public, public domain and All rights reserved matched nothing else (the remaining hits are byte(c) in tests and texlive-copyrightbox inside big.narinfo).
• debian/copyright is DEP-5 with the exact Format URL; Files: * names NumTide Ltd, Files: debian/* names the uploader, and the Apache-2.0 stand-alone paragraph refers to /usr/share/common-licenses/Apache-2.0, which exists.
• Files-Excluded: test/testdata/nar_1094wph9...-qd7d.nar and its .nar_bin_arp companion are absent from the tree; the only tests reading them are TestReaderSmoketest (pkg/nar/reader_test.go:135) and TestWriterSmoketest (pkg/nar/writer_test.go:102), both skipped by debian/rules:10.
• test/testdata/*.drv and .drv.json are plain-text fixtures generated from the .nix files beside them by test/testdata/build-fixtures.go with nix-instantiate; cp1252.nix and latin1.nix are deliberately non-UTF-8 sources, covered by the lintian override. No built binaries were found in the tree.
• pkg/sqlite/*/query.sql.go are sqlc output (// Code generated by sqlc. DO NOT EDIT., source: query.sql), and query.sql and schema.sql for each subpackage are shipped, so the generator input is present.
• Prescan author check: no copyright holder found in the tree that debian/copyright does not name.
• Build-Depends checked against the archive: dh-go 1.69 (provides the golang addon; dh-golang conflicts), golang-github-dgraph-io-badger-dev 4.8.0 (matching patch 0002), and dpkg-build-api (= 1), provided by dpkg-dev 1.23.11 and confirmed by dpkg-build-api(7) as the way to declare API level 1.
• Patches: 0001 and 0003 drop pkg/derivation/json_test.go and its nsf/jsondiff require (jsondiff is not packaged); with GO111MODULE=off the go.mod edits are inert, and 0002's badger v3→v4 import and require match Debian's badger 4.8.0. All three carry DEP-3 headers.
• compat 14: dh_auto_install installs into debian/tmp and the two .install files cover usr/bin/gonix and usr/share/gocode; dh_golang (read at /usr/bin/dh_golang) adds misc:Built-Using and misc:Static-Built-Using, so both fields declared in the gonix stanza are populated. dh_golang runs go test with arguments before the targets, so -skip in debian/rules takes effect.
• autopkgtest: autodep8's go generator runs /usr/bin/dh_golang_autopkgtest, whose make -f debian/rules build goes through the override_dh_auto_test that skips the removed fixtures, so Files-Excluded does not break the test.
• Standards-Version 4.7.4 has the first two components of the reviewing system's Policy 4.7.4.1, so it is current.
• gbp.conf's dist = DEP14 is a valid git-buildpackage setting: gbp's config default is dist, buildpackage maps it to pbuilder_dist, and buildpackage.py accepts 'DEP14'.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20250101.4bdde67, packaged 0.0~git20250101.4bdde67+ds).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• pkg/sqlite/nix_v10/schema.sql (and the other schema.sql files) contain comments identical to Nix's own schema source, e.g. -- if not null, an assertion that the path is content-addressed; see ValidPathInfo and -- base16 representation. That suggests they were copied from Nix (LGPL-2.1-or-later, copyright Eelco Dolstra and contributors) without attribution; I could not check Nix's source or licence from the review system, so I did not report it as a copyright inaccuracy under the Apache-2.0 Files: * stanza.
• Whether kong accepts the drv command's --drv-store flag after the show subcommand, as gonix.1's synopsis shows it, could not be tested: kong is not installed on the reviewing system and the package cannot be run.

Proposed changes

None.