DFSG NEW review for golang-github-pebbe-zmq4 version 1.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 ("Format:" 1.0 URL) with a Files: * stanza and a debian/* stanza, both BSD-2-clause, and one stand-alone license paragraph whose 2-clause text matches LICENSE.txt exactly (no advertising/endorsement clause). Only LICENSE.txt (top level) carries a copyright notice - 2013-2018 Peter Kleiweg - and the prescan confirmed every holder found is named in debian/copyright. No non-free terms, no binary/minified/generated artifacts, no fonts/images, no embedded third-party code, and no files lacking a license (all covered by the catch-all). draft/, examples/ and examples_security/ are upstream Go source under the same top-level BSD-2-clause, correctly covered by Files: *. Licensing is DFSG-compliant and fully and accurately described.

Packaging

Packaging is clean and conventional for a Debian Go package. Build-Depends (debhelper-compat 13, dh-sequence-golang, dpkg-build-api 1, golang-any, pkgconf, libzmq3-dev) are appropriate for a cgo binding; compat 13 means the explicitly-listed ${misc:Depends} and ${shlibs:Depends} are correct. Architecture all with Multi-Arch foreign, section golang, XS-Go-Import-Path present. Rules exports DH_GOLANG_EXCLUDES to skip examples/ and draft/ (draft needs a non-Debian build of libzmq with drafts enabled; examples are standalone mains), and installs examples via the .examples file. Standards-Version 4.7.4 matches current Policy 4.7.4.1; changelog (1.4.0-1, unstable, Closes: #1148145) is sane; source format 3.0 (quilt), no patches, no maintainer scripts needed; autopkgtest via pkg-go. No issues.

Issues

1. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• debian/copyright read in full: DEP-5, Format URL 1.0, Files: * and Files: debian/* both BSD-2-clause, license text matches top-level LICENSE.txt (two clauses, no (C) advertising clause).
• Prescan (dfsg-author-check, 155 files) found every copyright holder already named in debian/copyright; only Peter Kleiweg appears.
• Grep across the whole tree (gitignore:false) for copyright/licence markers found only LICENSE.txt and debian/copyright; no SPDX, no (C)/©, no other LICENSE/COPYING/NOTICE/AUTHORS files.
• Glob for built artifacts (*.min.js, *.jar, *.class, *.so, *.dll, *.exe, *.pyc, *.o, *.a, *.pdf, *.zip, *.gz) found none; tree is pure Go/C source plus text.
• draft/, examples/, examples_security/ are upstream source (Go + headers) covered by the Files: * stanza; correctly excluded from the build in rules.
• debian/control, rules, changelog, source/format (3.0 quilt), upstream/metadata, gbp.conf, .examples reviewed; no patches, no maintainer scripts.
• Standards-Version 4.7.4 equals current Policy 4.7.4.1 (first two components match).
• Build-Depends (debhelper-compat 13, dh-sequence-golang, dpkg-build-api 1, golang-any, pkgconf, libzmq3-dev) all standard archive packages; compat 13 requires explicit substvars, which Depends lists.
• License short name BSD-2-clause is in /usr/share/common-licenses; BSD-2-clause chosen correctly (text has no third clause).
• uscan found the packaged version as the newest upstream release (upstream 1.4.0, packaged 1.4.0).

Not confirmed

None.