golang-github-oneregex-revera 0.0~git20261014.64b07f9-1

Package Information

Description	A POSIX.1-2024 ERE engine One POSIX regex engine in Go, Rust, Zig, C, C++ and TypeScript, cross- checked for one behavior and backed by machine-checked Lean semantics and proofs. Revera is a clean-room implementation of the POSIX.1-2024 Extended Regular Expression language. The engine is written once, in Vego, a strict Go subset built for mechanical translation. A compiler exports it as Vego IR, and printers turn that IR into the Rust, Zig, C++, C and TypeScript engines.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Eric Dorland <eric@debian.org>
Sponsor	eric@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-oneregex-revera.git (browse)
Closes	#1153701
Tracker	https://tracker.debian.org/pkg/golang-github-oneregex-revera
Uploaded	2 hours ago

New Package Report

.changes◂

Changed-By	Eric Dorland <eric@debian.org>
Architecture	source all
Distribution	unstable
Date	Wed, 11 Nov 2026 01:22:37 -0500
Source	golang-github-oneregex-revera
Version	0.0~git20261014.64b07f9-1

Changelog◂

golang-github-oneregex-revera (0.0~git20261014.64b07f9-1) unstable; urgency=medium
 .
   * Initial release (Closes: 1153701)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-oneregex-revera-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/oneregex/revera
Upstream-Name: revera
Upstream-Contact: Frank Denis <github@pureftpd.org>


Files: *
Copyright: 2026 Frank Denis <github@pureftpd.org>
License: Expat

Files: go/data.bin
Copyright: 2019-2025 Unicode, Inc.
License: Unicode-DFS-2016

Files: debian/*
Copyright: 2026 Eric Dorland <eric@debian.org>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: Unicode-DFS-2016
 NOTICE TO USER: Carefully read the following legal agreement. BY
 DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
 SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
 TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
 DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
 .
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of data files and any associated documentation (the "Data Files") or
 software and any associated documentation (the "Software") to deal in the
 Data Files or Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, and/or sell
 copies of the Data Files or Software, and to permit persons to whom the
 Data Files or Software are furnished to do so, provided that either (a)
 this copyright and permission notice appear with all copies of the Data
 Files or Software, or (b) this copyright and permission notice appear in
 associated Documentation.
 .
 THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
 KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
 THIRD PARTY RIGHTS.
 .
 IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
 BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
 OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
 WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
 ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
 FILES OR SOFTWARE.
 .
 Except as contained in this notice, the name of a copyright holder shall
 not be used in advertising or otherwise to promote the sale, use or other
 dealings in these Data Files or Software without prior written
 authorization of the copyright holder.

DFSG Assistant LLM REVIEW

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for golang-github-oneregex-revera version 0.0~git20261014.64b07f9-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 1 blocker, 1 important, 3 minor; 1 more from the model's own knowledge, under Not confirmed
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: 8 found

Licensing

Nothing in the tree is non-free: the engine and tooling are Expat/MIT (Frank Denis, 2026) and the embedded CLDR/Unicode tables are under the Unicode License v3, whose full text ships in LICENSES/Unicode-3.0.txt and its per-package copies. debian/copyright is DEP-5 and gets the main stanza right, but its Files: * catch-all describes eight files that carry Unicode-3.0 data as Frank Denis' Expat work: the six data.bin copies outside go/, locale/rv_locale_data.inc and lean/data/localedata.hex. The one stanza that does cover Unicode data names the licence Unicode-DFS-2016 although the notice shipped and quoted is Unicode License v3.

Packaging

The packaging follows Go team practice (dh-sequence-golang, XS-Go-Import-Path, gbp.conf, autodep8 test, current Standards-Version, dpkg-build-api 1) and needs no patches. But DH_GOPKG-derived paths install the module one directory too deep: upstream's module lives in go/ (go/go.mod, module github.com/oneregex/revera/go, no go.mod at the tree root), so dh-golang copies go/*.go to $builddir/src//go/ and installs it at /usr/share/gocode/src/github.com/oneregex/revera/go/go/, where import "github.com/oneregex/revera/go" finds no Go files. The nonstandard --builddirectory=debian/_build also makes the declared autopkgtest build in a directory that dh_golang_autopkgtest never fills.

Issues

blocker licensing 1. Files: * claims Expat/Frank Denis for the six non-Go data.bin copies, locale/rv_locale_data.inc and lean/data/localedata.hex, which are Unicode License v3 data ◂

Files: debian/copyright:7-9, debian/copyright:11-13, dev/internal/reference/locale/data.bin, native/c/data.bin, native/cpp/data.bin, rust/src/data.bin, ts/src/data.bin, zig/src/data.bin, locale/rv_locale_data.inc:1-2, lean/data/localedata.hex
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright: Files: * / Copyright: 2026 Frank Denis <github@pureftpd.org> / License: Expat, and the only Unicode stanza is Files: go/data.bin. Upstream says otherwise: locale/README.md "The generated CLDR and Unicode tables use the Unicode License v3 in ../LICENSES/Unicode-3.0.txt"; go/README.md "data.bin is the CLDR locale blob ... Seven copies of it exist in the repository"; locale/rv_locale_data.inc:1 /* Generated by locale/tools/GenerateLocaleData.java from CLDR 48.2. */; lean/README.md:365 xxd -p ../go/data.bin | tr -d '\n' > ../lean/data/localedata.hex.
Problem: Eight files that are CLDR/Unicode data, or a direct hexdump of it (lean/data/localedata.hex is xxd -p of go/data.bin), are described as upstream's own Expat code under the wrong holder. A wrong licence is not confined to what a binary package ships: the source package is distributed too, and Policy 2.3 and copyright-format 5.3 require debian/copyright to state each file's copyright and licence. Only go/data.bin is installed in the -dev package (via DH_GOLANG_INSTALL_EXTRA), so the Unicode notice for the installed copy is covered; the other seven copies are described wrongly in the file that accompanies the source package.
Fix: Add a Files stanza for these paths alongside the existing one, e.g. Files: */data.bin locale/rv_locale_data.inc lean/data/localedata.hex with Copyright: 2019-2025 Unicode, Inc. and License: Unicode-3.0, so that Files: * keeps only the Expat material and go/data.bin keeps its own stanza.

important packaging 2. the -dev package installs the module's sources at /usr/share/gocode/src/github.com/oneregex/revera/go/go/, one directory below the import path ◂

Files: debian/control:18, debian/rules:5, go/go.mod:1
Basis: checked, in the package or with a reference tool
Evidence: debian/control XS-Go-Import-Path: github.com/oneregex/revera/go; go/go.mod module github.com/oneregex/revera/go; the tree has no go.mod at its root, only go.work. dh-golang's Buildsystem/golang.pm copies each source file with my $dest = "$builddir/src/$ENV{DH_GOPKG}/$source"; where $source is the file's path relative to the source root (go/locale.go -> .../revera/go/go/locale.go), and its install stage copies $builddir/src/$ENV{DH_GOPKG} to $destdir/usr/share/gocode/src/$ENV{DH_GOPKG}.
Problem: The installed tree becomes /usr/share/gocode/src/github.com/oneregex/revera/go/go/*.go, so a consumer's import "github.com/oneregex/revera/go" resolves to a directory holding only the nested go/ subdirectory and no Go files, and the package cannot be used at all. The build and the tests do not notice, because go list $DH_GOPKG/... simply finds and tests the nested package github.com/oneregex/revera/go/go. The DH_GOLANG_EXCLUDES := vego/ dev/ in rules only excludes anything when DH_GOPKG is the parent path, which is a further sign that this is the intended layout.
Fix: Set XS-Go-Import-Path: github.com/oneregex/revera (or export DH_GOPKG := github.com/oneregex/revera in debian/rules), keeping DH_GOLANG_EXCLUDES := vego/ dev/, so that go/*.go is installed at /usr/share/gocode/src/github.com/oneregex/revera/go/ and the build targets are github.com/oneregex/revera/go/... .

minor licensing 3. the Unicode stanza names Unicode-DFS-2016 although the licence shipped and quoted is Unicode License v3 ◂

Files: debian/copyright:11-13, debian/copyright:45-46, LICENSES/Unicode-3.0.txt:1-5
Basis: checked, in the package or with a reference tool
Evidence: LICENSES/Unicode-3.0.txt:1 UNICODE LICENSE V3, :41 SPDX-License-Identifier: Unicode-3.0, :5 Copyright © 2019-2025 Unicode, Inc.; the text under debian/copyright's License: Unicode-DFS-2016 is the v3 wording (Permission is hereby granted, free of charge, to any person obtaining a copy of data files and any associated documentation ...), not the 2016 wording, which speaks of "the Unicode data files" and "Unicode software".
Problem: The short name identifies a different, older version of the licence than the one upstream applies and ships. Both are free, and the notice text reproduced is the v3 one, so this is an accuracy problem rather than a DFSG one: the License: field must name the licence whose text is given (copyright-format 6.7, 7.1).
Fix: Rename the short name to Unicode-3.0 (or to whatever the DFSG database's identifier for this text is) in the License: field of the go/data.bin stanza and in the stand-alone License: Unicode-DFS-2016 paragraph.

minor packaging 4. --builddirectory=debian/_build makes the declared autopkgtest build in a directory dh_golang_autopkgtest never fills ◂

Files: debian/rules:2-4
Basis: inferred from what was read, not seen directly
Evidence: debian/rules dh $@ --builddirectory=debian/_build --buildsystem=golang. /usr/bin/dh_golang_autopkgtest adds APT_BDIR := $(shell env --unset=DH_VERBOSE perl ... load_buildsystem("golang")->get_builddir()) and override_dh_auto_configure: mkdir -p "${APT_BDIR}"; cp -a /usr/share/gocode/src "${APT_BDIR}", replacing the golang build system's configure, which is what normally runs mkdir_builddir; with no --builddirectory on its own command line the helper gets Buildsystem.pm's my $builddir=shift || $this->DEFAULT_BUILD_DIRECTORY; = "obj-" . dpkg_architecture_value("DEB_HOST_GNU_TYPE") (the golang class uses the parent default at compat 13).
Problem: The autodep8 test generated by Testsuite: autopkgtest-pkg-go fills obj- from the installed package and then runs make -f debian/rules build, whose dh invokes dh_auto_build in debian/_build; that directory is never created, and doit_in_builddir chdirs there, so the autopkgtest fails for a reason the maintainer's sbuild build cannot show.
Fix: Drop --builddirectory=debian/_build from debian/rules: at compat 13 the golang build system then uses obj-$DEB_HOST_GNU_TYPE, the directory dh_golang_autopkgtest pre-fills. Moving to debhelper compat 14 with a plain dh $@ would also make the two agree.

minor packaging 5. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

Read debian/ in full: changelog, control, copyright, gbp.conf, gitlab-ci.yml, rules, salsa-ci.yml, source/format, upstream/metadata; there are no patches, install/link/docs files, maintainer scripts or debian/tests.
Tree-wide greps for Copyright, (C), ©, SPDX-License-Identifier, All rights reserved, GPL/LGPL/Apache/MPL/CC wording, Licensed under, public domain and commercial-use restrictions found only two licences: MIT/Expat (Frank Denis, 2026) in LICENSE and the five copies under go/, native/, rust/, ts/, zig/, and Unicode License v3 (Unicode, Inc., 2019-2025) in LICENSES/Unicode-3.0.txt and its copies. No non-free terms anywhere.
All seven data.bin files (go/data.bin, dev/internal/reference/locale/data.bin, native/c/data.bin, native/cpp/data.bin, rust/src/data.bin, ts/src/data.bin, zig/src/data.bin) are generated blobs: dev/internal/genlocale compiles locale/rv_locale_data.inc into them, and that .inc is produced by locale/tools/GenerateLocaleData.java from pinned CLDR 48.2 and Unicode 17.0.0 artifacts (both generators and the pinned hashes are in the tree), so the preferred form for modification is present.
go/testdata/locale-expected.tsv.gz is gzip-compressed test data: the reference engine's locale answers, regenerated by dev/internal/differential/locale_expected_test.go -update (locale_expected_test.go:19-22); its generator is in the tree.
revera.vego.json is generated from go/ by vegoc export, and rust/src/engine.rs, zig/src/engine.zig, ts/src/engine.ts, native/c/engine.[ch] and native/cpp/engine.{hpp,cpp} by vegoc emit; the compiler and printers are in vego/. lean/data/localedata.hex is xxd -p ../go/data.bin, and lean/data/corpus.tsv and probe.expected are written by the conformance kit's lean-data step (dev/internal/conformance).
docs/POSIX-1-2024-ERE-SPECIFICATION.md, TRE-POSIX-ERE-DIVERGENCES.md and ERE-IMPLEMENTATION-TECHNIQUES.md are upstream's own prose, explicitly "a paraphrase and synthesis" of Issue 8 with links to the Open Group pages; no IEEE/Open Group or TRE/RE2 text is reproduced, and nothing from them is compiled in.
The third_party/ TRE, RE2 and MinRX submodules named in .gitmodules are absent from the tarball; no vendored third-party code was found. rust/Cargo.toml, rust/Cargo.lock (203 bytes), zig/build.zig.zon (dependencies = .{}) and ts/package.json declare no run-time dependencies.
logo.png (root, 979.5 KB) and www/assets/logo.png are images with no licence notice of their own, covered by the upstream Expat stanza and holder; the root copy is referenced by no file in the tree, and the website copy is only used by www/, which is not installed.
www/index.html loads Google Fonts over the network at run time and ships no font files; www/ is not part of any binary package.
locale/rv_locale_data.inc, the 6.1 MB file the scan read only to 4 MiB, was read at its head and tail: lines 1-2 are the generated-file comments and the tail is numeric table rows (static const uint32_t rv_locale_types_count = 4660;), with no notices beyond that.
autodep8 supports the declared test: /usr/share/autodep8/support/go/detect matches golang-any in Build-Depends and its generator emits Test-Command: /usr/bin/dh_golang_autopkgtest.
golang-go in the archive is 2:1.27~1, so go.mod's go 1.27.0 is satisfiable with golang-any.
Coverage: all 302 files at directory-listing level, every licence, documentation and packaging file read in full, and targeted greps; the Go, Lean, Rust, Zig and TypeScript sources were not read line by line.
uscan found the packaged version as the newest upstream release (upstream 0.0~git20261014.64b07f9, packaged 0.0~git20261014.64b07f9).

Not confirmed ◂

Whether the orig tarball matches upstream commit 64b07f9: no network access.
Whether the seven data.bin copies are byte-identical: no way to hash files here; the conformance kit's generated step checks it.
Whether Debian bug #1153701 is the ITP this upload closes.
Whether this is a fault: debian/gitlab-ci.yml is invalid YAML: its sequence entry is indented with a tab. The model reported it as a minor packaging issue from its own knowledge of something outside the package, which it did not check with a tool, so it is not counted among the issues. Files: debian/gitlab-ci.yml:3-4.
Evidence: include: followed by a line that begins with a literal tab, \t- local: '/debian/salsa-ci.yml' (a grep for ^\t matches line 4).
Problem: YAML forbids tabs as indentation, so this file cannot be parsed by anything reading it; the file exists only as the backwards-compatible spelling of debian/salsa-ci.yml, but as shipped it is broken.
Fix: Replace the tab with two spaces, or delete debian/gitlab-ci.yml now that debian/salsa-ci.yml carries the include.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Source: https://github.com/oneregex/revera.git
Matching-Pattern: HEAD
Mode: git
Pgpmode: none

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-15 21:15 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package