DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: golang-github-roaringbitmap-roaring-v2 2.29.0-1

Package Information

DescriptionRoaring bitmaps in Go

This is a go version of the Roaring bitmap data structure.

Roaring bitmaps are found to work well in many important applications:

Use Roaring for bitmap compression whenever possible. Do not use other bitmap compression methods (Wang et al., SIGMOD 2017 (http://db.ucsd.edu/wp-content/uploads/2017/03/sidm338-wangA.pdf))

MaintainerDebian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed ByAndrew Lee (李健秋) <ajqlee@debian.org>
Sponsorajqlee@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/go-team/packages/golang-github-roaringbitmap-roaring-v2.git (browse)
Closes#940416, #1123003
Trackerhttps://tracker.debian.org/pkg/golang-github-roaringbitmap-roaring-v2
Uploaded1 month, 11 days ago

New Package Report

.changes◂
DateSun, 27 Sep 2026 12:32:37 +0200
Sourcegolang-github-roaringbitmap-roaring-v2
Version2.29.0-1
Changed-ByAndrew Lee (李健秋) <ajqlee@debian.org>
Architecturesource all
Distributionunstable
Changelog◂
golang-github-roaringbitmap-roaring-v2 (2.29.0-1) unstable; urgency=medium
 .
   * debian/watch: Switch to version 5 and pin to major version v2.
   * New upstream version 2.29.0
   * debian/control: rename source/binary and vcs-tags.
   * Drop legacy patches.
   * debian/control: drop Priority: optional (now the default).
   * debian/control: Drop Rules-Requires-Root: no (now the default).
   * debian/control: bump to Standards-version to 4.7.4.
   * debian/control: bump to debhelper 14.
   * debian/control: put myself as Uploaders. (Closes: #940416)
   * debian/rules: patch from Chris Lamb to make package build
     reproducible. (Closes: #1123003)
   * debian/copyright: update.
   * debian/control: switch to Module-Aware builds via dh-go.
   * debian/gbp.conf: switch to Go Team defaults gbp.conf.
   * debian/salsa-ci.yml: switch to Go Team Defaults salsa-ci.yml.
.dsc◂
Sectiongolang
Priorityoptional
Componentmain
Package-Listgolang-github-roaringbitmap-roaring-v2-dev deb golang optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: roaring
Source: https://github.com/RoaringBitmap/roaring
Files-Excluded:
  Godeps/_workspace

Files: *
Copyright: 2016 Maciej Biłas
           2016 Brent Pedersen <bpederse@gmail.com>
           2016 Will Glynn
           2016 Tyson Maly
           2016 Bob Potter <bobby.potter@gmail.com>
           2016 Elliot Murphy
           2016 Daniel Lemire
           2016 tgruben
           2016 Couchbase Inc
License: Apache-2.0

Files: runcontainer.go
Copyright: 2009 The Go Authors
           2016 by the roaring authors
License: Apache-2.0 and BSD-3-Clause
Comment: Derived original code from BSD-3-Clause to Apache-2.0

Files: smat_hits_test.go
Copyright: 2016 Couchbase, Inc.
License: Apache-2.0

Files: debian/*
Copyright: 2018 Alexandre Viau <aviau@debian.org>
           2026 Andrew Lee (李健秋) <ajqlee@debian.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
    * Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
    * Neither the name of Google Inc. nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

Review Information

accepted — allocated to awm 1 month, 10 days ago, started 1 month, 10 days ago, completed 1 month, 10 days ago.

Final Comment

Hi,

in debian/copyright: the License: BSD-3-Clause text is truncated mid-sentence. It ends at:
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
…and jumps straight to License: Apache-2.0, missing the closing clause OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. (compare with the complete text at runcontainer.go:32). The embedded license is incomplete/invalid

  1. Stale dependencies

golang-github-glycerine-go-unsnap-stream-dev and golang-github-tinylib-msgp-dev are listed in both Build-Depends and Depends, but nothing in the source tree imports or uses msgp or unsnap-stream anymore. They only appear in control, roaring64/Makefile (dev deps target), and README.md. They should be dropped.

  1. Missing build dependency

production amd64 code imports golang.org/x/sys/cpu (bitsetops_avx512_amd64.go, popcnt_avx512_amd64.go, fillbits_vbmi2_amd64.go), but golang-golang-x-sys-dev is absent from both Build-Depends and Depends. With no vendor/ dir and module-aware dh-go, this is a required build dep.

  1. Wrong Depends set on the -dev binary

the manually curated Depends mixes test-only/build-only deps with runtime deps:

  • golang-github-stretchr-testify-dev and golang-github-google-uuid-dev are used only in _test.go files (e.g. roaring64/bsi64_test.go for uuid), not by library consumers — they shouldn't be runtime Depends.
  • Conversely the real runtime dep golang-golang-x-sys-dev is missing.
  • Notably the field uses ${misc:Depends} but not ${golang:Depends}, so dh-golang isn't auto-populating the runtime dependency set; the hand-curated list is what ships and it's incorrect/incomplete.

I hope this analysis is useful.

Thanks!

Back to Dashboard | View all reviews for this package