Review: golang-github-rclone-go-proton-api 1.0.4-1

Package Information

Description	Proton API library used by rclone and Go-based clients (library) Go Proton API, a Go library implementing a client and development server for (a subset of) the Proton REST API. . This library supersedes github.com/henrybear327/go-proton-api (golang-github-henrybear327-go-proton-api-dev) which in turn was forked from go-proton-api (github.com/ProtonMail/go-proton-api) and supports the Proton API Bridge (github.com/rclone/Proton-API-Bridge) project.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Drew Parsons <dparsons@debian.org>
Sponsor	dparsons@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-rclone-go-proton-api.git (browse)
Closes	#1151230
Tracker	https://tracker.debian.org/pkg/golang-github-rclone-go-proton-api
Uploaded	20 days ago

New Package Report

.changes◂

Date	Mon, 19 Oct 2026 02:05:22 +0200
Source	golang-github-rclone-go-proton-api
Version	1.0.4-1
Changed-By	Drew Parsons <dparsons@debian.org>
Architecture	source all
Distribution	unstable

Changelog◂

golang-github-rclone-go-proton-api (1.0.4-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1151230)
     - Depends: golang-github-protonmail-gluon-dev
       (>= 0.17.0+git20230724-308be39~)
   * use DH_GOLANG_EXCLUDES to exclude executables
     (client and server in server/cmd) since we only provide the
     library dev package
   * copy modulus.asc (and .sig) to server/backend/ build dir before
     build (go builder only copies go files)

.dsc◂

Package-List	golang-github-rclone-go-proton-api-dev deb golang optional arch=all
Section	golang
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/rclone/go-proton-api
Upstream-Name: go-proton-api
Upstream-Contact: Nick Craig-Wood <nick@craig-wood.com>

Files: *
Copyright: 2020 James Houlahan,
 2022 Proton AG,
 2025-2026 Chun-Hung Tseng (henrybear327)
 2026 Nick Craig-Wood and Rclone developers
License: Expat

Files: debian/*
Copyright: 2026 Drew Parsons <dparsons@debian.org>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 19 days ago.

Report◂

DFSG NEW review for golang-github-rclone-go-proton-api version 1.0.4-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 1 found

Licensing

The whole tree is MIT/Expat under the single upstream LICENSE (2020 James Houlahan, 2022 Proton AG), with no per-file headers naming any other holder or licence, no vendored third-party tree, and no non-free or field-of-use terms. debian/copyright is DEP-5, uses the Expat short name, reproduces the full licence text, and its Files: * and Files: debian/* stanzas cover every file; no DFSG problem found.

Packaging

The packaging is otherwise conventional and sound (compat 14, dh-sequence-golang, correct single dev package, arch:all, Multi-Arch: foreign, DEP-5 copyright, autopkgtest-pkg-go, no patches, salsa CI). It has one blocking-for-sponsorship defect: the versioned Build-Depends on gluon names a version that no package in the archive satisfies, so an upload would fail dependency resolution.

Issues

important packaging 1. Build-Depends on gluon requires a version that cannot be satisfied ◂

Files: debian/control:17, debian/control:47, debian/changelog:6
Basis: checked, in the package or with a reference tool
Evidence: debian/control:17 golang-github-protonmail-gluon-dev (>= 0.17.0+git20230724-308be39~); apt-cache shows only golang-github-protonmail-gluon-dev 0.17.0-4 (including ftp-master's NEW queues); Policy 5.6.12: the empty part sorts before any non-letter, so 0.17.0 < 0.17.0+git20230724, i.e. 0.17.0-4 does not satisfy the constraint. debian/changelog:6 also says the requirement is on Depends, but debian/control:47 has golang-github-protonmail-gluon-dev with no version.
Problem: No version of gluon in the archive compares greater than or equal to 0.17.0+git20230724-308be39~, so sbuild would fail to resolve the build dependencies and the package would not build. The constraint also appears only in Build-Depends: the binary package's Depends is unversioned, so a consumer could be built against an inadequate gluon even where the source actually needs the newer API, which is what the changelog states.
Fix: Depend on a version that exists: if Debian's 0.17.0-4 contains the API this snapshot needs, change the Build-Depends to (>= 0.17.0-4) and add the same version to the binary package's Depends; otherwise upload the newer gluon first and name its real Debian version.

Verified ◂

All 171 upstream files were inventoried (root Go sources, server/, server/backend/, server/cmd/, server/proto/, testdata/, utils/, .github/); no vendored third-party source tree or bundled library exists, so the single upstream LICENSE covers everything.
server/backend/modulus.sig (the scan's unrecognised binary): a 96-byte ASCII-armored PGP signature, upstream data embedded with //go:embed at server/backend/modulus.go:28 alongside modulus.asc; it is hand-written data, not a build product, and falls under the tree's Expat licence.
server/backend/modulus.asc: armored modulus used by the same development server via go:embed; data, not a built file.
testdata/body.pgp, testdata/prv.asc, testdata/pub.asc: OpenPGP fixtures read by message_types_test.go; test data, not built artifacts.
server/proto/server.pb.go and server_grpc.pb.go: generated by protoc/protoc-gen-go from server/proto/server.proto, which is present in the tree, so the generated code has its source input.
debian/copyright is machine-readable DEP-5 with the correct Format URL, Expat short name and the full MIT text; Files: * and Files: debian/* stanzas cover the tree and the packaging.
No other licence wording appears anywhere: grep for GNU/LGPL/Apache/Mozilla/CC/public-domain/non-commercial/All rights reserved found nothing; only LICENSE and COPYING_NOTES.md carry copyright notices, naming Houlahan and Proton AG, both in debian/copyright.
The binary package is Architecture: all and ships only Go source; the tree contains no binaries, minified code, firmware, PDFs or archives needing source.
Build-Depends names were checked against the archive (golang-golang-x-net-dev, golang-github-protonmail-gopenpgp-v3-dev, golang-github-protonmail-go-crypto-dev, golang-github-bradenaw-juniper-dev, golang-github-protonmail-go-srp-dev, golang-uber-goleak-dev) and all exist; dpkg-build-api (= 1) is provided by dpkg-dev.
The Go imports of the shipped sources match the listed dependencies; DH_GOLANG_EXCLUDES = server/cmd correctly drops the two main packages that are not shipped.
Testsuite: autopkgtest-pkg-go is appropriate; tests needing Proton credentials skip when the environment variables are unset (server/server_test.go:1480-1484).
No debian/patches and no quilt series; source format is 3.0 (quilt); the orig tarball contains no debian/ directory.
debian/rules copies modulus.asc and modulus.sig into the dh-golang build directory before dh_auto_build, and the files exist in the tree at the named path.
uscan found the packaged version as the newest upstream release (upstream 1.0.4, packaged 1.0.4).

Not confirmed ◂

Whether Debian's gluon 0.17.0-4 actually contains the API this snapshot needs; if it does, only the version expression is wrong.
Whether go test (autopkgtest-pkg-go) passes in the archive build environment; the package was not built here.

Proposed changes ◂

None.

Uploader's response to the LLM review

The required gluon update has already been uploaded.

— Drew Parsons (dparsons), 19 days ago

Review Information

accepted — allocated to awm 19 days ago, started 19 days ago, completed 19 days ago.

Final Comment

Back to Dashboard | View all reviews for this package