Review: golang-github-quic-go-quic-go 0.64.1-2

Package Information

Description	QUIC golang library quic-go is an implementation of the QUIC (https://en.wikipedia.org/wiki/QUIC) protocol in Go. It roughly implements the IETF QUIC draft (https://github.com/quicwg/base-drafts), although it doesn't fully support any of the draft versions at the moment. Version compatibility Since quic-go is under active development, there's no guarantee that two builds of different commits are interoperable. The QUIC version used in the master branch is just a placeholder, and should not be considered stable.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Simon Josefsson <simon@josefsson.org>
Sponsor	simon@josefsson.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-quic-go-quic-go.git (browse)
Closes	#1151513
Tracker	https://tracker.debian.org/pkg/golang-github-quic-go-quic-go
Uploaded	16 days ago

New Package Report

.changes◂

Version	0.64.1-2
Changed-By	Simon Josefsson <simon@josefsson.org>
Architecture	source all
Distribution	unstable
Date	Wed, 21 Oct 2026 10:24:21 +0200
Source	golang-github-quic-go-quic-go

Changelog◂

golang-github-quic-go-quic-go (0.64.1-2) unstable; urgency=medium
 .
   * Initial release (Closes: #1151513)

.dsc◂

Priority	optional
Component	main
Package-List	golang-github-quic-go-quic-go-dev deb golang optional arch=all
Section	golang

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: quic-go
Upstream-Contact: Lucas Clemente <github@clemente.io>
Source: https://github.com/quic-go/quic-go

Files: *
Copyright:
 2016 the quic-go authors & Google, Inc.
License: Expat
Comment: Lucas Clemente, Marten Seemann, et al

Files: debian/*
Copyright: 2020-2022 Roger Shimizu <rosh@debian.org>
           2026 Simon Josefsson <simon@josefsson.org>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 16 days ago.

Report◂

DFSG NEW review for golang-github-quic-go-quic-go version 0.64.1-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The licensing is fully DFSG-compliant (everything is MIT/Expat or BSD-3-Clause, both free and compatible), but debian/copyright is inaccurate for one file. The whole tree is covered by Files: * as Expat, yet internal/utils/linkedlist/linkedlist.go carries the Go standard library's header // Copyright 2009 The Go Authors with a BSD-style licence and is a derivative of Go's container/list; it is therefore BSD-3-Clause, not Expat, and that licence's text is not reproduced anywhere (the only LICENSE in the tree is the top-level MIT one). Everything else matches. Q1 answered 'no' only because of this single inaccuracy; the licensing itself is DFSG-compliant.

Packaging

Packaging is of good quality: compat 14 with dh-sequence-golang, correct Build-Depends/Depends on the qpack/prometheus/golang-x deps, Standards-Version 4.7.4 (current Policy 4.7.4.1), Vcs-* and Homepage set, M-A: foreign on the all-arch -dev package, autopkgtest via dh-golang, clear changelog with bug closures. Only minor nits: two patches lack the DEP-3 Forwarded: field, and a stray find|grep debug line sits in debian/rules.

Issues

blocker licensing 1. internal/utils/linkedlist/linkedlist.go is BSD-3-Clause but covered by debian/copyright's Expat Files: * ◂

Files: internal/utils/linkedlist/linkedlist.go:1, debian/copyright (Files: * stanza)
Basis: checked, in the package or with a reference tool
Evidence: // Copyright 2009 The Go Authors. All rights reserved. / // Use of this source code is governed by a BSD-style license that can be found in the LICENSE file.
Problem: The file is a derivative of Go's standard library container/list and is licensed under the Go authors' BSD-3-Clause, but debian/copyright's catch-all Files: * stanza assigns it License: Expat. The BSD-3-Clause text is not reproduced anywhere in the tree (the top-level LICENSE is MIT only, so the notice's reference to 'the LICENSE file' is unmet). debian/copyright therefore does not accurately describe this file's licence or holder (policy §12.5 / copyright-format 6.2).
Fix: Add a Files: internal/utils/linkedlist/linkedlist.go stanza with Copyright: 2009 The Go Authors and License: BSD-3-clause, and add the BSD-3-clause text or reference /usr/share/common-licenses/BSD.

minor packaging 2. Patches 0002 and 0003 lack the mandatory DEP-3 Forwarded field ◂

Files: debian/patches/0002-Disable-testing-of-postquantum-handshake.patch, debian/patches/0003-Disable-TestHandshakePacketBuffering.patch
Basis: checked, in the package or with a reference tool
Evidence: Patches have From:/Date:/Subject: but no Forwarded: (only 0004 has Forwarded: https://github.com/quic-go/quic-go/issues/4997).
Problem: DEP-3 requires a Forwarded: field (or Not-Forwarded) on every patch so maintainers can see which fixes need sending upstream.
Fix: Add Forwarded: (e.g. an upstream issue/PR URL) to both patches.

minor packaging 3. Stray debug command left in debian/rules ◂

Files: debian/rules (execute_before_dh_auto_build)
Basis: checked, in the package or with a reference tool
Evidence: First line of the target is find|grep frame_sorter_test.go, immediately followed by the intended rm -fv ... of test files.
Problem: A leftover maintainer debug probe that prints matching paths and does nothing; dead weight in the build.
Fix: Remove the find|grep frame_sorter_test.go line.

Verified ◂

Read debian/copyright in full; it is DEP-5 machine-readable with Format: 1.0, Files: * (Expat), Files: debian/* (Expat) and one License: Expat paragraph matching the top-level LICENSE (MIT).
Grepped the whole tree (gitignore off, .pc/ and debian/ excluded) for GPL/LGPL/Apache/MPL/SPDX/public-domain/non-commercial wording: none found; only the top-level LICENSE and the linkedlist.go header carry copyright/licence text.
Only one LICENSE/COPYING/NOTICE/AUTHORS file exists (top-level LICENSE); no vendored third-party subdirectories with their own licences.
No binary/generated/minified files (.so/.o/.class/.jar/.exe/.min.js/.pyc) found; quic-go is pure Go source using go modules (go.sum), all deps external.
Read all debian/ files and patches: control, rules, changelog, source/format (3.0 quilt), gbp.conf, upstream/metadata, salsa-ci.yml, .install; controls/Depends/Build-Depends consistent; Standards-Version 4.7.4 vs current Policy 4.7.4.1 fine; autopkgtest via dh-sequence-golang.
Scan candidate linkedlist.go is the only file debian/copyright may not name; confirmed and reported as an issue.
uscan found the packaged version as the newest upstream release (upstream 0.64.1, packaged 0.64.1).

Not confirmed ◂

Could not run a build or the autopkgtest suite; no build failure suspected from the tree.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.

Review Information

rejected — allocated to siretart 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

The file linkedlist.go:1-3 was copied from Go's standard library and is copyrighted by The Go Authors under
the BSD-3-Clause license, but copyright:6-10 incorrectly lumps it under a generic catch-all rule declaring
the whole package as MIT/Expat. This violates Debian Policy §12.5 because Debian requires an accurate legal
record of all authors and licenses, and because the source tree lacks the required BSD-3-Clause license text
anywhere else, leaving users without the true legal terms governing that file unless a dedicated stanza is
added.

The assets/ directory contains logo files whose custom license (LICENSE.md) explicitly excludes them from the
MIT license, bans anyone from modifying them, limits their use solely to editorial/press contexts, and allows
upstream to revoke permission at will. This violates core Debian Free Software Guidelines—specifically DFSG
§3 (which guarantees the right to create modifications/derived works) and DFSG §6 (which forbids restricting
how or where files are used) -- meaning the entire package cannot be accepted into Debian main until these non-
free assets are removed from the source tarball via Files-Excluded in a repacked +ds release.

Back to Dashboard | View all reviews for this package