DFSG NEW review for golang-github-piprate-json-gold version 0.7.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and accounts for the whole tree. Files: * is Apache-2.0 with copyright 2015-2017 Piprate Limited living only in the Go file headers (the shipped LICENSE is the Apache text with its appendix left as a template, which the file's Comment explains), and later stanzas cover the three Siemens 2025 files, the govalidator regex in ld/rdf_dataset.go (Apache-2.0 and Expat), the Cyberphone jsoncanonicalizer copy (WebPKI.org), ld/json_canonicalizer_test.go (SecureKey) and the W3C JSON-LD test suite (BSD-3-clause), including normalization/ and the schema.org context data (CC-BY-SA-3.0). I read every copyright line in the tree: each is matched by the correct, later-overriding stanza, the short names match the notices and their versions, and the licences not in /usr/share/common-licenses (the W3C 3-clause BSD and Expat) are reproduced in full, so the notices are preserved. The W3C test suite's dual licence is correctly resolved in favour of its BSD option and that choice is documented. No non-free or field-of-use terms, no binaries, fonts, minified files or code without its generator, and Debian ships no library that the embedded sources duplicate.

Packaging

Ordinary, competently done Go team packaging: debhelper compat 14 with dh-go's golang addon and buildsystem and dpkg-build-api (= 1), cachecontrol in Depends because ld/document_loader.go imports it at runtime and testify in Build-Depends because only _test.go files import it, the GOSRC path in debian/rules matching where the golang buildsystem installs, Testsuite: autopkgtest-pkg-go (autodep8's go support and dh-go's /usr/bin/dh_golang_autopkgtest both exist), a DEP-3 patch that applies, gbp.conf, upstream/metadata, salsa-ci.yml and a justified lintian override, Standards-Version 4.7.4 against Policy 4.7.4.1, and a changelog closing the ITP. export CI := true makes the tests use ld/testdata instead of the network, and the autopkgtest rebuilds through debian/rules so it gets that too. The one defect is a fragile rm in debian/rules that makes a DEB_BUILD_OPTIONS=nocheck build fail.

Issues

1. [minor] [packaging] debian/rules removes the test-generated ld/earl.jsonld with plain rm, so a DEB_BUILD_OPTIONS=nocheck build fails

• Files: debian/rules:21, ld/processor_test.go:584, .gitignore:30
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules: rm $(GOSRC)/ld/testdata/mk_vocab.rb \ ... $(GOSRC)/ld/earl.jsonld (no -f); ld/processor_test.go:584 earlReport.write("earl.jsonld"); .gitignore:30 earl.jsonld
• Problem: ld/earl.jsonld is not in the tarball (.gitignore:30) — the test suite writes it into the package directory of the build workspace, and the golang buildsystem's install step copies every file it finds there (sub install in /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm copies all of $builddir/src/$DH_GOPKG), which is why the rules deletes it. From debhelper compat 13, dh skips dh_auto_test when DEB_BUILD_OPTIONS contains nocheck (debhelper tool, dh_auto_test/nocheck, applies at compat 14), so the file is never created and the rm of a nonexistent path fails, aborting the build in dh_auto_install. The same would happen if upstream ever drops ld/testdata/mk_vocab.rb.
• Fix: Use rm -f for ld/earl.jsonld (or move its removal out of the dh_auto_test-dependent path, e.g. rm -f $(GOSRC)/ld/earl.jsonld and keep the plain rm only for the files that are always in the tarball).

Verified

• The pre-scan listed no files to account for: its only output is the author check, which reports that every copyright holder it detected is named in debian/copyright. I found none missing either.
• debian/copyright read in full (DEP-5, so no proposed replacement): Files: * Apache-2.0 / 2015-2017 Piprate Limited; ld/api_compact.go, ld/api_expand.go, ld/context.go add 2025 Siemens AG; ld/rdf_dataset.go Apache-2.0 and Expat; ld/internal/jsoncanonicalizer/* Apache-2.0 / 2006-2019 WebPKI.org; ld/json_canonicalizer_test.go Apache-2.0 / SecureKey; ld/testdata/* BSD-3-clause / W3C; ld/testdata/normalization/* BSD-3-clause / 2015 W3C; ld/testdata/schema.org/* CC-BY-SA-3.0; debian/* Apache-2.0 / 2026 Juan Manuel Méndez Rey.
• Headers of all Go sources read via grep: the only holders in the tree are Piprate Limited, Siemens AG, WebPKI.org, SecureKey Technologies Inc. and (as a comment, for the borrowed regex) 2014 Alex Saskevich; the five Go files with no header are exactly those the Files: * Comment names (ld/context_test.go, ld/errors_test.go, ld/options_test.go, ld/rdf_compare_test.go, ld/skip_test.go).
• LICENSE is the Apache-2.0 text whose appendix is still the template (Copyright [yyyy] [name of copyright owner]), so it names no holder; there is no NOTICE file. LICENSE.md in ld/testdata states the suite's dual licensing, README.md and the *-manifest.html pages and template.haml name only the W3C Test Suite License, normalization/index.html and normalization/template.haml say "both", and composer.json declares CC0-1.0 — all four cases are recorded in the Comments of the ld/testdata stanzas, and the grammar is allowed by copyright-format 1.0 (Comment, and License: A and B in a Files stanza).
• ld/internal/jsoncanonicalizer/{jsoncanonicalizer.go,es6numfmt.go} carry WebPKI.org's Apache-2.0 header and the directory README.md says they are copied from the Cyberphone JSON Canonicalization Go library; ld/rdf_dataset.go:335 records the govalidator (Expat) origin of its URL regexes. The corresponding stanza and the Expat text are in debian/copyright.
• conformance_report.jsonld (524 KB) is a data file, not built code: Makefile generate-report copies it from ld/earl.jsonld, which the tests write (ld/processor_test.go:584); the generator input (the test suite and the library) is in the package, so it is not a missing-source case. Its "foaf:name": "Stan Nazarenko" is the EARL assertor, not a copyright claim; CONTRIBUTORS.md lists contributors and nicknames, not copyright notices, so neither adds a holder the copyright file must name.
• No binary or pre-built files in the tree: a glob for png/jpg/gif/pdf/jar/so/a/class/exe/dll/min.js/min.css/woff/ttf/zip/ico/pyc/o found nothing. Grep for non-free wording (non-commercial, no derivative, field of use, "Good, not Evil", research only, ...) found nothing; ld/testdata/remote-doc/.htaccess is the suite's own Apache config, matched by the ld/testdata stanza.
• Packaging read in full: control, rules, changelog, gbp.conf, lrc.config, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata, patches/series and the patch (DEP-3 headers, Forwarded: no, and ld/skip_test.go:62 in the tree does contain the added "#tpr25").
• dh-go 1.69 (apt-cache) provides the sequence addon golang, the buildsystem golang, /usr/bin/dh_golang and /usr/bin/dh_golang_autopkgtest, and does not Provide dh-sequence-golang (dh-golang 1.67, which Conflicts with it, does) — so --with=golang, the dh-go build-dependency and the first lintian override are right. autodep8's go support matches this control file, so Testsuite: autopkgtest-pkg-go is served, and its generated test uses @builddeps@, so testify needs no place in it.
• The GOSRC path in debian/rules is exactly the golang buildsystem's install destination ($destdir/usr/share/gocode/src/$DH_GOPKG), and the files it deletes (ld/testdata/mk_vocab.rb, ld/testdata/normalization/mk_vocab.rb, ld/testdata/normalization/mk_manifest.rb, ld/earl.jsonld) are exactly what that step copies — the .rb files are in the tarball, ld/earl.jsonld is written by the tests; the second lintian override is about examples/, whose seven .go files are //go:build ignore programs that configure() copies as source.
• dpkg-build-api (= 1) is the documented opt-in (man dpkg-build-api, SYNOPSIS) and its Rules-Requires-Root default of no suits this package; Priority may be omitted (deb-src-control: "When omitted, the priority defaults to optional (since dpkg 1.22.13)"). Standards-Version 4.7.4 against Policy 4.7.4.1 is current enough.
• Dependency direction checked against the sources: github.com/pquerna/cachecontrol is imported by ld/document_loader.go (non-test) so the Depends is right, github.com/stretchr/testify only by _test.go files so Build-Depends is right (its own deps come transitively, as golang-github-stretchr-testify-dev Depends on them). go.mod asks for a newer cachecontrol commit than Debian's 0.0~git20171018, but the golang buildsystem sets GO111MODULE=off and GOPROXY=off with GOPATH the build dir, so the build uses Debian's version in GOPATH mode and the version requirement is not consulted.
• The build-time network dependency is handled: ld/example_test.go:29 installs a mocked http.DefaultTransport for w3c.github.io and schema.org when CI=true, and debian/rules exports CI := true; /usr/bin/dh_golang_autopkgtest runs make -f debian/rules build in a copy of the tree, so the autopkgtest gets the same export.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.9.1, packaged 0.7.0), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, CC-BY-SA-3.0).

Not confirmed

• Not built or run (read-only review): I did not verify that the test suite passes, that the tests write ld/earl.jsonld into the build workspace rather than somewhere else, that the two mocked domains are the only ones the suite reaches, or that the four paths in the debian/rules rm all exist at that point of a normal build.
• The claim that the schema.org context data is under CC-BY-SA-3.0 rests on debian/copyright's quotation of https://schema.org/docs/terms.html; the files themselves carry no licence statement and I have no network access to confirm it. It is the best-supported reading, and the alternative (no terms) would be worse, not better.
• autopkgtest was not run, so I cannot confirm that dh_golang_autopkgtest passes on the installed sources without the removed .rb files.

Proposed changes

None.