Review: golang-github-rclone-proton-api-bridge 1.0.5-1

Package Information

Description	open-source Proton API bridge for rclone (library) proton-go-api provides the basic building blocks of API calls and error handling, such as 429 exponential back-off, but it is pretty much just a barebone interface to the Proton API. For example, the encryption and decryption of the Proton Drive file are not provided in this library. . This codebase, Proton API Bridge, bridges the gap, so software like rclone can be built on top of this quickly. This codebase handles the intricate tasks before and after calling Proton APIs, particularly the complex encryption scheme, allowing developers to implement features for other software on top of this codebase. Currently, only Proton Drive APIs are bridged, as we are aiming to implement a backend for rclone. golang-github-rclone-proton-api-bridge supersedes golang-github-henrybear327-proton-api-bridge
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Drew Parsons <dparsons@debian.org>
Sponsor	dparsons@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-rclone-proton-api-bridge.git (browse)
Closes	#1151231
Tracker	https://tracker.debian.org/pkg/golang-github-rclone-proton-api-bridge
Uploaded	20 days ago

New Package Report

.changes◂

Version	1.0.5-1
Changed-By	Drew Parsons <dparsons@debian.org>
Architecture	source all
Distribution	unstable
Date	Mon, 19 Oct 2026 02:23:14 +0200
Source	golang-github-rclone-proton-api-bridge

Changelog◂

golang-github-rclone-proton-api-bridge (1.0.5-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1151231)

.dsc◂

Priority	optional
Component	main
Package-List	golang-github-rclone-proton-api-bridge-dev deb golang optional arch=all
Section	golang

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/rclone/Proton-API-Bridge
Upstream-Name: Proton-API-Bridge
Upstream-Contact: Nick Craig-Wood <nick@craig-wood.com>

Files: *
Copyright: 2023-2026 Chun-Hung Tseng (henrybear327)
 2026 Nick Craig-Wood and rclone developers
License: Expat

Files: debian/*
Copyright: 2026 Drew Parsons <dparsons@debian.org>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 19 days ago.

Report◂

DFSG NEW review for golang-github-rclone-proton-api-bridge version 1.0.5-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole tree is MIT/Expat: LICENSE carries the only licence notice, no source file has a conflicting header, and no non-free terms occur anywhere. debian/copyright is DEP-5 (correct Format URL), has a Files: * stanza plus an overriding debian/* stanza, reproduces the Expat text required for a permissive licence, and names both upstream holders (Chun-Hung Tseng, and Nick Craig-Wood/rclone developers for the rclone-derived code). The prescan found no holder missing from it.

Packaging

The packaging is otherwise a clean, conventional single arch:all Go -dev package (compat 14, dh-sequence-golang, no patches, no maintscripts, Standards-Version 4.7.4 against current 4.7.4.1), but both the Build-Depends and the binary Depends pin gluon to a version that does not exist in the archive: only 0.17.0-4 is available, and it sorts below the required 0.17.0+git20230724-308be39~. As it stands the package cannot be built against unstable. There is also a wrong value in gbp.conf.

Issues

important packaging 1. Versioned gluon dependency cannot be satisfied by the gluon package in the archive ◂

Files: debian/control:9, debian/control:25
Basis: checked, in the package or with a reference tool
Evidence: golang-github-protonmail-gluon-dev (>= 0.17.0+git20230724-308be39~) in Build-Depends and in the -dev package's Depends; apt-cache show golang-github-protonmail-gluon-dev gives only Version: 0.17.0-4.
Problem: Debian version ordering puts 0.17.0-4 below 0.17.0+git20230724-308be39~ (the upstream part 0.17.0 is a prefix of 0.17.0+git...), so the version constraint is not met by anything in unstable/experimental. A clean build fails at dependency resolution (dpkg-checkbuilddeps), and even a build made against a snapshot in NEW would leave the -dev package uninstallable while the archive has 0.17.0-4.
Fix: Relax the constraint to what the archive actually has (drop it, or use >= 0.17.0), unless a gluon source snapshot that provides commit 308be39 is also being uploaded to NEW; in that case confirm that upload exists, since the review environment's package lists show only 0.17.0-4.

minor packaging 2. gbp.conf sets dist to DEP14, but gbp's special value is DEP-14 ◂

Files: debian/gbp.conf:3
Basis: checked, in the package or with a reference tool
Evidence: dist = DEP14, while gbp-buildpackage(1) documents: The special value DEP-14 will set the distribution to build for from the branch name.
Problem: The key is the buildpackage --git-dist option, so DEP14 is taken as a literal distribution name; a gbp buildpackage --git-pbuilder run would use a nonexistent distribution instead of deriving it from debian/sid.
Fix: Change it to dist = DEP-14, or remove the line and let gbp default to unstable.

Verified ◂

Read the entire non-debian, non-.pc tree (34 files): the only licence notice is LICENSE (MIT/Expat); no .go file, README.md or Documentation.md carries a copyright or SPDX header, and there are no other COPYING/NOTICE/AUTHORS files.
debian/copyright is machine-readable with the exact Format URL; Files: * and the later Files: debian/* cover every path, the Expat text matches LICENSE, and the prescan reported no copyright holder missing from it.
testcase/empty.txt and testcase/integrationTestImage.png / integrationTestImage2.png are integration-test fixtures referenced by drive_test.go; they are test data, not built artifacts, and were recorded by name only (not opened).
No minified JS/CSS, .jar/.class/.so/.dll/.exe/.pyc, PDFs, archives, firmware or generated code in the tree; no vendor/ directory or embedded third-party copy.
drive_test_helper.go's StringFn is copied from rclone (MIT), and 'Nick Craig-Wood and rclone developers' is named in debian/copyright, so that inclusion is covered.
debian/control: one arch:all -dev package with Multi-Arch: foreign (as on other pkg-go -dev packages), debhelper compat 14, dh-sequence-golang, dpkg-build-api (= 1) (provided by dpkg-dev 1.23.11), no missing substvars; no patches, no maintainer scripts; Standards-Version 4.7.4 is current enough (Policy 4.7.4.1).
debian/rules' golang buildsystem and --builddirectory are the usual dh-golang setup; the single-binary add-on is provided by debhelper (14.5) and is valid at compat 14, where it would also be activated implicitly.
Testsuite: autopkgtest-pkg-go needs no debian/tests directory; the integration tests skip when PROTON_API_BRIDGE_TEST_* credentials are absent, so the generated autopkgtest does not need network access.
golang-github-rclone-go-proton-api-dev is absent from the archive but built by golang-github-rclone-go-proton-api 1.0.4-1 in ftp-master's NEW queue, so that dependency is not a fault.
Could not build or run the tests (read-only review, no build).
uscan found the packaged version as the newest upstream release (upstream 1.0.5, packaged 1.0.5).

Not confirmed ◂

Whether a gluon source snapshot satisfying the 0.17.0+git20230724-308be39~ constraint is waiting in NEW: apt-cache reports only the archive version 0.17.0-4 and does not check NEW when the package name is already in the lists. If such an upload is accepted together with this one, the dependency would become satisfiable.
go.mod requires golang-github-relvacode-iso8601 v1.6.0 while the archive has 1.3.0; I did not build, and the only API used, iso8601.ParseString, appears to exist there, so I have not reported it as a fault.

Proposed changes ◂

None.

Uploader's response to the LLM review

The required gluon update has already been uploaded.

— Drew Parsons (dparsons), 19 days ago

Review Information

accepted — allocated to awm 19 days ago, started 19 days ago, completed 19 days ago.

Final Comment

Back to Dashboard | View all reviews for this package