DFSG NEW review for golang-github-smallnest-ringbuffer version 0.0~git20241116.4613814-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 1 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The bulk of the tree (ring_buffer.go, pipe.go's own header, tests, README, the GIF) is MIT/Expat, correctly named in debian/copyright with the full text reproduced, and the packaging under debian/ is Expat too. But Files: * attributes every upstream file to 2019 smallnest under Expat, and that is wrong for the github.com/smallnest/ringbuffer code taken from the Go standard library: pipe_test.go carries a Copyright 2009 The Go Authors / BSD-style header of its own, and pipe.go reproduces Go's io.Pipe documentation verbatim while its header credits only smallnest. The Go Authors' copyright and licence text are nowhere in debian/copyright. This is an inaccurate debian/copyright rather than a DFSG violation - no non-free terms and no undistributed built artefacts were found - but it must be fixed before upload.

Packaging

The packaging follows the Go team's current practice: compat 14 with dh $@ --buildsystem=golang --with=golang and dh-go (which 1.69 still provides the golang addon and buildsystem for), dpkg-build-api (= 1), golang-any, Testsuite: autopkgtest-pkg-go, Multi-Arch: foreign on an Architecture: all source-only -dev package, no patches, and a complete set of Vcs-*, Homepage and XS-Go-Import-Path fields. Standards-Version: 4.7.4 matches current Policy 4.7.4.1, the changelog dates are consistent (22 Sep 2026 is a Tuesday) and the lintian override for missing-build-dependency-for-dh-addon golang is justified in place. No packaging fault worth fixing was found.

Issues

1. [blocker] [licensing] Files: * gives pipe_test.go as 2019 smallnest/Expat, but the file states Copyright 2009 The Go Authors under a BSD-style licence, unnamed and untexted in debian/copyright

• Files: pipe_test.go:1-3, debian/copyright (Files: * stanza)
• Basis: checked, in the package or with a reference tool
• Evidence: pipe_test.go line 1-4: // Copyright 2009 The Go Authors. All rights reserved. / // Use of this source code is governed by a BSD-style / // license that can be found in the LICENSE file. / // Adapted from stdlib tests to check compatibility. debian/copyright has only Files: * / Copyright: 2019 smallnest / License: Expat, and no stanza naming The Go Authors.
• Problem: A stated copyright holder (The Go Authors, 2009) is not named in debian/copyright, and its licence is not the one given for the file: Expat is claimed where the file says BSD-style. The file also points at the LICENSE file for its licence, but the tree's LICENSE is the MIT text of smallnest, so the BSD-3-clause notice is not reproduced anywhere in the package - a BSD licence requires that it be. debian/copyright is therefore inaccurate and incomplete for a shipped file.
• Fix: Add a stanza before the catch-all, e.g. Files: pipe_test.go / Copyright: 2009 The Go Authors / License: Go, and add the stand-alone License: Go paragraph with the full three-clause text plus patent grant exactly as golang-1.27-go's /usr/share/doc/golang-1.27-go/copyright gives it (BSD-3-Clause with the Neither the name of Google Inc. clause; naming it BSD-3-clause and reproducing the same text is equally fine). Then narrow Files: * or leave it as the catch-all for the remaining files.

2. [important] [licensing] pipe.go reproduces Go's io.Pipe documentation and API verbatim but its header credits only Copyright 2019 smallnest under MIT

• Files: pipe.go:1-92, debian/copyright (Files: * stanza)
• Basis: checked, in the package or with a reference tool
• Evidence: pipe.go's own header: // Copyright 2019 smallnest. All rights reserved. / // Use of this source code is governed by a MIT-style license that can be found in the LICENSE file. Its body copies the stdlib text word for word: // CloseWithError never overwrites the previous error if it exists and always returns nil., // A PipeReader is the read half of a pipe., // it reads data from the pipe, blocking until a writer arrives or the write end is closed. If the write end is closed with an error, that error is returned as err; otherwise err is io.EOF. - all present in /usr/share/go-1.27/src/io/pipe.go (which carries Copyright 2009 The Go Authors ... BSD-style).
• Problem: A substantial expressive portion of the file comes from the Go standard library, whose copyright notice (The Go Authors, 2009) was dropped from the file and is consequently missing from debian/copyright as well, which attributes the file to smallnest/Expat alone. File-level notices upstream are inconsistent (the same derivation is acknowledged in pipe_test.go), so the lesson is that the MIT header alone does not describe this file.
• Fix: Give pipe.go the same treatment as pipe_test.go in debian/copyright (a Files: pipe.go stanza naming both holders, smallnest and 2009 The Go Authors, with the MIT and Go/BSD-3-clause texts), and forward the missing stdlib notice upstream.

Verified

• debian/copyright is DEP-5, begins with the exact Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ line, and needs no replacement.
• LICENSE is the MIT text of Copyright (c) 2019 smallnest; the License: Expat short name and the full text in debian/copyright match it, and README.md's MIT badge agrees.
• Stanza order is right: Files: debian/* (2026 Juan Manuel Mendez Rey, Expat) comes after Files: * and overrides it for the packaging; debian/salsa-ci.yml, gbp.conf and the rest are covered.
• Every upstream file other than the two above was read or grepped for notices and has none: ring_buffer.go and pipe.go carry the smallnest 2019 header, ring_buffer_test.go, ring_buffer_benchmark_test.go, example_test.go, .travis.yml, .gitignore and go.mod are unmarked, go.mod's module github.com/smallnest/ringbuffer matches XS-Go-Import-Path and has no requires.
• Circular_Buffer_Animation.gif is a 96.5 KB animated raster image used only as the README's illustration; GIF is itself an editable graphics format, so no preferred-form-for-modification problem, and it is covered by the Files: * Expat stanza.
• No non-free wording (non-commercial, no-modification, field-of-use), no minified JS/CSS, no archives, bytecode, shared objects or firmware blobs anywhere in the tree; no vendored third-party code and no debian/patches, so nothing to check for patch or vendoring issues.
• Packaging: debian/control's Build-Depends are all satisfied - dh-go 1.69 (apt-cache) still ships the golang debhelper addon and golang buildsystem used by --with=golang, golang-any is the right toolchain dependency, dpkg-build-api (= 1) is current; the missing dh-golang Build-Depends is not a fault and debian/source/lintian-overrides' missing-build-dependency-for-dh-addon override explains exactly why.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): first two components current, not an issue. changelog version 0.0~git20241116.4613814-1, unstable, and the Tue 22 Sep 2026 date are consistent; it closes an ITP bug.
• debian/rules is the standard one-line dh invocation with compat 14, debian/_build as build directory, hardening and substvars left to dh; debian/upstream/metadata and gbp.conf are populated; Testsuite is autopkgtest-pkg-go, for which no debian/tests/control is needed.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.0~git20261019.6a48b0f, packaged 0.0~git20241116.4613814), which is not a fault of the package.

Not confirmed

• Circular_Buffer_Animation.gif: the README's link label is wikipedia but the file has no attribution and no provenance note anywhere in the tree, so it may well be a Wikimedia Commons image (typically CC-BY-SA or public domain) rather than smallnest's own work, in which case debian/copyright's attribution of it to smallnest under Expat is wrong. No tool available here can fetch the Commons file page; the uploader should check the image's origin and, if it is not upstream's, add the correct holder and licence or exclude it.
• I could not check from this system that the autopkgtest-pkg-go pseudo-testsuite is actually provided (autopkgtest/autodep8 are not installed and apt-cache knows no binary of that name); if it is not, the package would silently have no autopkgtest. This is the Go team's standard practice, so it is not reported as an issue.

Proposed changes

None.