golang-github-tetratelabs-wabin 0.0~git20230304.f6f8748-1

Package Information

Description	WebAssembly binary encoder and data model for Go Library for encoding and manipulating WebAssembly binaries in Go, mainly used prior to instantiation (e.g. with wazero). No runtime dependencies beyond the standard library.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Hermes Rodríguez <hrodrig@usb.ve>
Sponsor	maytham@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-tetratelabs-wabin.git (browse)
Closes	#1148105
Tracker	https://tracker.debian.org/pkg/golang-github-tetratelabs-wabin
Uploaded	1 hour ago

New Package Report

.changes◂

Date	Sun, 08 Nov 2026 19:17:26 +0800
Source	golang-github-tetratelabs-wabin
Version	0.0~git20230304.f6f8748-1
Changed-By	Hermes Rodríguez <hrodrig@usb.ve>
Architecture	source all
Distribution	unstable

Changelog◂

golang-github-tetratelabs-wabin (0.0~git20230304.f6f8748-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148105)
   * debian/rules: explicit binary targets (upstream has binary/ directory).

.dsc◂

Component	main
Package-List	golang-github-tetratelabs-wabin-dev deb golang optional arch=all
Section	golang
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: wabin
Upstream-Contact: https://github.com/tetratelabs/wabin/issues
Source: https://github.com/tetratelabs/wabin

Files: *
Copyright: 2022 Tetrate Labs
License: Apache-2.0

Files: debian/*
Copyright: 2026 Hermes Rodríguez <hrodrig@usb.ve>
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for golang-github-tetratelabs-wabin version 0.0~git20230304.f6f8748-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 1 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All upstream files are Apache-2.0: the tree's only licence text is the full Apache License 2.0 in LICENSE, and the DEP-5 debian/copyright is well formed and points at /usr/share/common-licenses/Apache-2.0. Nothing non-free is present, no third-party code is vendored, and no file lacks a licence. The copyright file is nevertheless inaccurate: LICENSE:189 carries the notice Copyright 2020-2022 wazero authors, and wabin's sources are the wasm binary package extracted from wazero, so those authors hold copyright on portions, but Files: * names only 2022 Tetrate Labs.

Packaging

Team-standard Go packaging of good quality: debhelper compat 13 with dh-sequence-golang and dpkg-build-api (= 1), correct Build-Depends (testify as <!nocheck>, matching dh_auto_test running go test at build time), Standards-Version 4.7.4 against Policy 4.7.4.1, Multi-Arch: foreign, Testsuite: autopkgtest-pkg-go, Vcs-* and Homepage fields, a sane initial changelog. The explicit binary targets with .PHONY are a correct workaround for upstream's top-level binary/ directory, and --builddirectory=debian/_build works with the golang buildsystem. No packaging faults found.

Issues

blocker licensing 1. Files: * in debian/copyright omits the wazero authors named by LICENSE ◂

Files: debian/copyright:6-8, LICENSE:189
Basis: checked, in the package or with a reference tool
Evidence: LICENSE:189: Copyright 2020-2022 wazero authors (in the licence's filled-in appendix, which is this work's copyright line), while debian/copyright has Files: * / Copyright: 2022 Tetrate Labs.
Problem: wabin reuses wazero's licence file and its wasm binary encoder/data-model code (the tree mirrors wazero's internal wasm packages), so wazero's authors are a copyright holder of part of the source. debian/copyright names only Tetrate Labs, so it does not accurately describe the copyright of every file (DEP-5 / Policy 12.5). The licence itself (Apache-2.0) is correct and DFSG-free.
Fix: Add the holder to the catch-all stanza, e.g. Copyright: 2022 Tetrate Labs, 2020-2022 wazero authors, or add a separate Files: LICENSE stanza with Copyright: 2020-2022 wazero authors and License: Apache-2.0.

minor packaging 2. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

debian/copyright is DEP-5 with the current Format URL; Files: * plus the later debian/* stanza cover the whole tree (patterns reach any depth), and the Apache-2.0 paragraph is the standard notice with a pointer to /usr/share/common-licenses/Apache-2.0, so no full text is required.
Grep of all upstream files for Copyright, (C), ©, SPDX-License-Identifier, 'Licensed under', 'Permission is hereby granted', GPL/LGPL, Apache, MPL and 'public domain' found text only in LICENSE and debian/copyright: no per-file headers, no second licence, no 'All rights reserved' or field-of-use terms.
The prescan listed only LICENSE:189 (wazero authors) and no built, minified, archive, PDF or generated files; the tree is 59 upstream files (Go sources and tests, README.md, RATIONALE.md, Makefile, go.mod/go.sum, .editorconfig, .gitattributes, .gitignore, .github/workflows/commit.yaml) and none of those files is a binary or needs a missing generator input.
No vendored third-party code: the only external imports are github.com/stretchr/testify (tests only); go.sum records only testify and its dependencies. testify's Debian package is in Build-Depends with <!nocheck>, and dh_auto_test (skipped under nocheck at compat 13) is what runs go test in the golang buildsystem.
Build dependencies resolve: golang-any 2:1.27~1 and golang-github-stretchr-testify-dev 1.11.1-2 exist in unstable, and dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11.
Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 in its first two components; no policy-upgrade issue.
Testsuite: autopkgtest-pkg-go is a known autopkgtest runner (listed in lintian's known-testsuites data), so no debian/tests is needed.
Read every file under debian/ (control, rules, changelog, copyright, gbp.conf, gitlab-ci.yml, salsa-ci.yml, source/format, upstream/metadata); the explicit binary targets prevent make from treating upstream's binary/ directory as an up-to-date goal, and Buildsystem::_set_builddir keeps debian/_build relative while golang.pm's preprocess excludes top-level debian, so the workspace is cleaned and not copied recursively.
Multi-Arch: foreign and Architecture: all for the -dev package match the archive's other Go library packages (e.g. golang-github-stretchr-testify-dev).
Ignored .pc/ as instructed; no debian/cargo-checksum.json is present.
uscan found the packaged version as the newest upstream release (upstream 0.0~git20230304.f6f8748, packaged 0.0~git20230304.f6f8748).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

None.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Source: https://github.com/tetratelabs/wabin.git
Matching-Pattern: HEAD
Mode: git
Pgpmode: none

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-09 12:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package