golang-github-pb33f-go-yaml 0.1.1-1

Package Information

Description	pb33f fork of go.yaml.in/yaml/v4 (library) The yaml package enables Go programs to very comfortably encode and decode YAML values. It was developed within Canonical as part of the juju project, and is based on a pure Go port of the well-known libyaml C library to parse and generate YAML data quickly and reliably. This library is an incompatible fork of go.yaml.in/yaml/v4 used by several of pb33f's projects.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Mathias Gibbens <gibmat@debian.org>
Sponsor	gibmat@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-pb33f-go-yaml.git (browse)
Closes	#1153359
Tracker	https://tracker.debian.org/pkg/golang-github-pb33f-go-yaml
Uploaded	2 hours ago

New Package Report

.changes◂

Date	Mon, 09 Nov 2026 02:11:23 +0000
Source	golang-github-pb33f-go-yaml
Version	0.1.1-1
Changed-By	Mathias Gibbens <gibmat@debian.org>
Architecture	source all
Distribution	unstable

Changelog◂

golang-github-pb33f-go-yaml (0.1.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1153359)

.dsc◂

Priority	optional
Component	main
Package-List	golang-github-pb33f-go-yaml-dev deb golang optional arch=all
Section	golang

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/pb33f/go-yaml
Upstream-Name: go-yaml

Files: *
Copyright:
 2025-2026 The go-yaml Project Contributors
 2026 Princess Beef Heavy Industries
License: Apache-2.0

Files:
 internal/libyaml/composer.go
 internal/libyaml/constructor.go
 internal/libyaml/node.go
 internal/libyaml/representer.go
 internal/libyaml/resolver.go
 internal/libyaml/serializer.go
 internal/libyaml/structmeta.go
 node_test.go
 yaml.go
 yaml_test.go
Copyright:
 2011-2019 Canonical Ltd
 2025-2026 The go-yaml Project Contributors
License: Apache-2.0

Files:
 internal/libyaml/emitter.go
 internal/libyaml/parser.go
 internal/libyaml/reader.go
 internal/libyaml/scanner.go
 internal/libyaml/writer.go
 internal/libyaml/yaml.go
Copyright:
 2006-2010 Kirill Simonov
 2011-2019 Canonical Ltd
 2025-2026 The go-yaml Project Contributors
License: Apache-2.0 and Expat
Comment:
 These files were ported to Go from C files of libyaml, and thus are
 still covered by their original MIT license, with the additional
 copyright starting in 2011 when the project was ported over.

Files: debian/*
Copyright: 2026 Mathias Gibbens
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for golang-github-pb33f-go-yaml version 0.1.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 1 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is DFSG-free: it is Apache-2.0 except six internal/libyaml files ported from libyaml, which are Apache-2.0 AND MIT. The Files stanzas match the per-file SPDX headers and NOTICE exactly, and every holder found (Kirill Simonov, Canonical Ltd, The go-yaml Project Contributors) is named. The one defect is in debian/copyright itself: the Expat licence text stops mid-sentence, so the copyright file does not reproduce that licence in full.

Packaging

Clean team packaging: debhelper compat 13 driven by dh with --buildsystem=golang, dh-sequence-golang and golang-any, dpkg-build-api (= 1), Standards-Version 4.7.4 (= current Policy 4.7.4.1 for the first two components), a single Architecture: all -dev package with Multi-Arch: foreign, and a well-formed DEP-3 patch that turns the YAML Test Suite failure into a skip when the network-downloaded test data is absent. The main module has no external Go dependencies, and the nested plugin/example modules are excluded from both build and install. No packaging issues found.

Issues

important licensing 1. debian/copyright quotes an incomplete Expat licence: the text stops at "IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY," ◂

Files: debian/copyright lines 64-77 (the end of the file; the License: Expat paragraph)
Basis: checked, in the package or with a reference tool
Evidence: The paragraph ends at the last line of the file with THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR / IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,; the rest of the standard Expat text (FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ... OR OTHER DEALINGS IN THE SOFTWARE.) is nowhere in the package.
Problem: The six ported files (internal/libyaml/emitter.go, parser.go, reader.go, scanner.go, writer.go, yaml.go) carry only SPDX-License-Identifier: Apache-2.0 AND MIT, and debian/copyright is the only place their MIT permission notice is reproduced. It is not one of the licences in /usr/share/common-licenses, so the full notice must be given there; as shipped, the warranty disclaimer and liability clause are cut off, so the copyright file misstates the licence it claims.
Fix: Complete the License: Expat paragraph with the missing text up to ... OR OTHER DEALINGS IN THE SOFTWARE.

minor packaging 2. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

All 189 upstream files (excluding .pc/ and debian/) were inventoried and their headers checked: every Go, YAML, Markdown, workflow and config file carries an SPDX header, Apache-2.0, except internal/libyaml/emitter.go, parser.go, reader.go, scanner.go, writer.go and yaml.go, which carry Apache-2.0 AND MIT.
The two override stanzas match the headers exactly: the 10 files with Copyright 2011-2019 Canonical Ltd only (7 in internal/libyaml plus node_test.go, yaml.go, yaml_test.go) are in the Apache-2.0 stanza, and the six files with the Kirill Simonov notice are exactly those in the Apache-2.0 and Expat stanza.
internal/libyaml/README and NOTICE describe the libyaml C-to-Go port; the files api.go and yamlprivate.go named in NOTICE no longer exist in the tree, so their absence from debian/copyright is correct.
LICENSE is the full Apache-2.0 text and NOTICE is shipped in the -dev package through debian/golang-github-pb33f-go-yaml-dev.docs, satisfying Apache-2.0 attribution alongside the /usr/share/common-licenses/Apache-2.0 reference in debian/copyright.
The prescan's holder check reports every holder found as named in debian/copyright; 2026 Princess Beef Heavy Industries appears only in debian/copyright (no file notice), which is not a licensing defect.
No non-free wording (non-commercial, no-modification, field-of-use, CC-NC/ND) anywhere in the tree; the only third-party lineage is the libyaml port, which is the package's own upstream history, and no other code is vendored (single-module go.mod with no require lines; the plugin/json-comments, plugin/parser/reference and example/* modules contain only their own go.mod/go.sum).
No built artefacts, minified code, PDFs, fonts or other binaries in the tree; docs/dev/.mmd are Mermaid text sources and all testdata/.yaml are plain SPDX-tagged fixtures. The absent yts test data is downloaded by upstream's GNUmakefile, which the Debian build does not run.
Packaging files read in full: debian/control, rules, changelog, source/format, patches/series and the patch, .docs, gbp.conf, upstream/metadata, salsa-ci.yml and gitlab-ci.yml. The patch has DEP-3 headers (From, Date, Subject, Forwarded: not-needed) and changes t.Fatalf to t.Skipf only.
Debian-specific checks: dpkg-build-api (= 1) is provided by dpkg-dev (apt-cache); debhelper 14.5 supports compat 13 and dpkg-build-api level 1; ${misc:Depends} is declared (compat 13, and no shlibs dependency applies to a pure-Go package); Standards-Version 4.7.4 against Policy 4.7.4.1 is current; a single Architecture: all Multi-Arch: foreign -dev package with XS-Go-Import-Path matching the module path is the Go team's standard shape, and Testsuite: autopkgtest-pkg-go needs no debian/tests.
DH_GOLANG_EXCLUDES (cmd/ example/ plugin/json-comments plugin/parser/reference util/build-cli) matches the dh-golang documentation: whitespace-separated patterns applied to both build targets and installed sources, so no binaries or unbuildable nested modules end up in the -dev package.
uscan found the packaged version as the newest upstream release (upstream 0.1.1, packaged 0.1.1).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

None.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Template: Github
Dist: https://github.com/pb33f/go-yaml
Uversionmangle: s/(\d)[_\.\-\+]?(RC|rc|pre|dev|beta|alpha)[.]?(\d*)$/$1~$2$3/

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-10 03:09 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package