DFSG NEW review for golang-github-quic-go-quic-go version 0.64.1-2

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The licensing is fully DFSG-compliant (everything is MIT/Expat or BSD-3-Clause, both free and compatible), but debian/copyright is inaccurate for one file. The whole tree is covered by Files: * as Expat, yet internal/utils/linkedlist/linkedlist.go carries the Go standard library's header // Copyright 2009 The Go Authors with a BSD-style licence and is a derivative of Go's container/list; it is therefore BSD-3-Clause, not Expat, and that licence's text is not reproduced anywhere (the only LICENSE in the tree is the top-level MIT one). Everything else matches. Q1 answered 'no' only because of this single inaccuracy; the licensing itself is DFSG-compliant.

Packaging

Packaging is of good quality: compat 14 with dh-sequence-golang, correct Build-Depends/Depends on the qpack/prometheus/golang-x deps, Standards-Version 4.7.4 (current Policy 4.7.4.1), Vcs-* and Homepage set, M-A: foreign on the all-arch -dev package, autopkgtest via dh-golang, clear changelog with bug closures. Only minor nits: two patches lack the DEP-3 Forwarded: field, and a stray find|grep debug line sits in debian/rules.

Issues

1. [blocker] [licensing] internal/utils/linkedlist/linkedlist.go is BSD-3-Clause but covered by debian/copyright's Expat Files: *

• Files: internal/utils/linkedlist/linkedlist.go:1, debian/copyright (Files: * stanza)
• Basis: checked, in the package or with a reference tool
• Evidence: // Copyright 2009 The Go Authors. All rights reserved. / // Use of this source code is governed by a BSD-style license that can be found in the LICENSE file.
• Problem: The file is a derivative of Go's standard library container/list and is licensed under the Go authors' BSD-3-Clause, but debian/copyright's catch-all Files: * stanza assigns it License: Expat. The BSD-3-Clause text is not reproduced anywhere in the tree (the top-level LICENSE is MIT only, so the notice's reference to 'the LICENSE file' is unmet). debian/copyright therefore does not accurately describe this file's licence or holder (policy §12.5 / copyright-format 6.2).
• Fix: Add a Files: internal/utils/linkedlist/linkedlist.go stanza with Copyright: 2009 The Go Authors and License: BSD-3-clause, and add the BSD-3-clause text or reference /usr/share/common-licenses/BSD.

2. [minor] [packaging] Patches 0002 and 0003 lack the mandatory DEP-3 Forwarded field

• Files: debian/patches/0002-Disable-testing-of-postquantum-handshake.patch, debian/patches/0003-Disable-TestHandshakePacketBuffering.patch
• Basis: checked, in the package or with a reference tool
• Evidence: Patches have From:/Date:/Subject: but no Forwarded: (only 0004 has Forwarded: https://github.com/quic-go/quic-go/issues/4997).
• Problem: DEP-3 requires a Forwarded: field (or Not-Forwarded) on every patch so maintainers can see which fixes need sending upstream.
• Fix: Add Forwarded: (e.g. an upstream issue/PR URL) to both patches.

3. [minor] [packaging] Stray debug command left in debian/rules

• Files: debian/rules (execute_before_dh_auto_build)
• Basis: checked, in the package or with a reference tool
• Evidence: First line of the target is find|grep frame_sorter_test.go, immediately followed by the intended rm -fv ... of test files.
• Problem: A leftover maintainer debug probe that prints matching paths and does nothing; dead weight in the build.
• Fix: Remove the find|grep frame_sorter_test.go line.

Verified

• Read debian/copyright in full; it is DEP-5 machine-readable with Format: 1.0, Files: * (Expat), Files: debian/* (Expat) and one License: Expat paragraph matching the top-level LICENSE (MIT).
• Grepped the whole tree (gitignore off, .pc/ and debian/ excluded) for GPL/LGPL/Apache/MPL/SPDX/public-domain/non-commercial wording: none found; only the top-level LICENSE and the linkedlist.go header carry copyright/licence text.
• Only one LICENSE/COPYING/NOTICE/AUTHORS file exists (top-level LICENSE); no vendored third-party subdirectories with their own licences.
• No binary/generated/minified files (.so/.o/.class/.jar/.exe/.min.js/.pyc) found; quic-go is pure Go source using go modules (go.sum), all deps external.
• Read all debian/ files and patches: control, rules, changelog, source/format (3.0 quilt), gbp.conf, upstream/metadata, salsa-ci.yml, .install; controls/Depends/Build-Depends consistent; Standards-Version 4.7.4 vs current Policy 4.7.4.1 fine; autopkgtest via dh-sequence-golang.
• Scan candidate linkedlist.go is the only file debian/copyright may not name; confirmed and reported as an issue.
• uscan found the packaged version as the newest upstream release (upstream 0.64.1, packaged 0.64.1).

Not confirmed

• Could not run a build or the autopkgtest suite; no build failure suspected from the tree.

Proposed changes

None.