golang-github-theupdateframework-go-tuf 2.4.2+0.7.0-2

Package Information

Description	Securing software in golang (library) The Update Framework (TUF) helps developers maintain the security of software update systems, providing protection even against attackers that compromise the repository or signing keys. TUF provides a flexible framework and specification that developers can adopt into any software update system.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Otto Kekäläinen <otto@debian.org>
Sponsor	otto@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-theupdateframework-go-tuf.git (browse)
Popcon Installs	6
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/golang-github-theupdateframework-go-tuf
Uploaded	3 hours ago

New Package Report

.changes◂

Date	Thu, 22 Oct 2026 07:38:38 +0000
Source	golang-github-theupdateframework-go-tuf
Version	2.4.2+0.7.0-2
Changed-By	Otto Kekäläinen <otto@debian.org>
Architecture	source amd64 all
Distribution	unstable

Changelog◂

golang-github-theupdateframework-go-tuf (2.4.2+0.7.0-2) unstable; urgency=medium
 .
   [ Juan Manuel Méndez Rey ]
   * Team upload.
   * Rename the library package to golang-github-theupdateframework-go-tuf-v2-dev
     to match the module path, and keep the old name as a transitional
     package.
   * Set XS-Go-Import-Path to github.com/theupdateframework/go-tuf/v2. Keep v0
     installed at github.com/theupdateframework/go-tuf/v0, which sigstore
     imports.
   * Build-Depend and Depend on golang-github-syndtr-goleveldb-dev
     (v0/client/leveldbstore) and golang-golang-x-crypto-dev
     (v0/encrypted). Build-Depend on golang-github-dustin-go-humanize-dev
     and golang-golang-x-term-dev (v0/cmd) and, for the tests, on
     golang-github-google-gofuzz-dev and golang-gopkg-check.v1-dev. All are
     imported directly but were only pulled in indirectly, and goleveldb
     and gofuzz no longer are with go-containerregistry 0.22.1.
   * Disable the uscan job in Salsa CI. uscan cannot match the combined
     2.4.2+0.7.0 version.

.dsc◂

Priority	optional
Component	main
Package-List	go-tuf deb devel optional arch=any golang-github-theupdateframework-go-tuf-dev deb oldlibs optional arch=all golang-github-theupdateframework-go-tuf-v2-dev deb golang optional arch=all
Section	devel

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: go-tuf
Source: https://github.com/theupdateframework/go-tuf

Files: *
Copyright: 2024 The Update Framework Authors
License: Apache-2.0

Files: v0/*
Copyright: 2014-2020, Prime Directive, Inc.
License: BSD-3-clause

Files: v0/client/python_interop/testdata/*
Copyright: 2010, Justin Samuel and Justin Cappos.
           2008, The Tor Project, Inc.
           2012-2023, New York University and the TUF contributors,
License: Expat or BSD-3-Clause

Files: v0/client/python_interop/testdata/python-tuf-v3.0.0/client.py
Copyright: 2012-2023, New York University and the TUF contributors
License: Expat or Apache-2.0

License: BSD-3-clause
 The BSD License
 .
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
   * Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
 .
   * Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
 .
   * Neither the name of the copyright holder nor the names of its
     contributors may be used to endorse or promote products derived from
     this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: Expat
 The MIT License
 .
 Permission is hereby granted, free of charge, to any person
 obtaining a copy of this software and associated
 documentation files (the "Software"), to deal in the Software
 without restriction, including without limitation the rights to
 use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to
 whom the Software is furnished to do so, subject to the
 following conditions:
 .
 The above copyright notice and this permission notice shall
 be included in all copies or substantial portions of the
 Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT
 WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
 INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR
 PURPOSE AND NONINFRINGEMENT. IN NO EVENT
 SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.

Files: debian/*
Copyright: 2023 Reinhard Tartler <siretart@tauware.de>
           2024-2026 Simon Josefsson <simon@josefsson.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for golang-github-theupdateframework-go-tuf version 2.4.2+0.7.0-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 2 found

Licensing

Licensing is DFSG-compliant: the v2 codebase is Apache-2.0 (The Update Framework Authors), the v0 component is BSD-3-clause (Prime Directive, Inc.), and the python-interop testdata carries Expat/BSD/Apache terms, all free. The licenses assigned in debian/copyright match the actual text and versions. Two minor holder-accuracy nits remain: the NOTICE file also names The Apache Software Foundation (not listed in the Files: * stanza), and the X41 audit PDF under v0 is a compiled third-party report whose holder (X41 D-Sec, 2023) is not named and is mislabelled under the v0 BSD-3 stanza. Neither affects DFSG compliance or licence assignment to code.

Packaging

Packaging is of good quality: clean GRE 1.0-style control with proper binary split (library -dev v2, transitional oldlibs go-tuf-dev, and go-tuf CLI), Multi-Arch: foreign where appropriate, compat 13 with correctly named substvars, current Standards-Version 4.7.4 (vs Policy 4.7.4.1), verified Build-Depends/Depends against the archive, and Salsa CI configured. The v0 component is installed to its own import path so sigstore keeps compiling. Upstream test files that fail in the Debian build environment are deliberately removed in rules; this is a maintainer choice and not a packaging fault within this review's scope.

Issues

1. [minor] [licensing] NOTICE holder 'The Apache Software Foundation' not named in debian/copyright

Files: NOTICE:4 (in Files: * stanza of debian/copyright)
Basis: checked, in the package or with a reference tool
Evidence: NOTICE contains Apache 2.0 License\nCopyright 2024 The Apache Software Foundation\n... SPDX-License-Identifier: Apache-2.0. The Files: * stanza only names 2024 The Update Framework Authors.
Problem: The Apache Software Foundation is a copyright holder named in a shipped file but is absent from debian/copyright, so the copyright section is not fully accurate.
Fix: Add a Files: NOTICE stanza naming both The Update Framework Authors and The Apache Software Foundation under Apache-2.0 (or add ASF to the Files: * copyright line).

2. [minor] [licensing] X41 audit PDF is a generated third-party report with the wrong holder/licence in debian/copyright

Files: v0/docs/audit/X41-go-tuf-Audit-2023-Final-Report-PUBLIC.pdf
Basis: checked, in the package or with a reference tool
Evidence: The companion blog-post.md and the report are by Radoslav Dimitrov, X41 D-Sec GmbH, 2023. debian/copyright covers it only under Files: v0/* / Copyright: 2014-2020, Prime Directive, Inc. / BSD-3-clause.
Problem: A published compiled PDF whose copyright holder is X41 D-Sec (not Prime Directive) and whose licence is not established in-tree; it is mislabelled by the v0 stanza and has no editable source form in the package.
Fix: Give the audit report its own stanza naming X41 D-Sec and its actual licence, or exclude it (Files-Excluded), or confirm an explicit license for it.

3. [minor] [packaging] uscan finds only upstream versions older than the packaged one

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: upstream 2.4.2, packaged 2.4.2+0.7.0
Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
Fix: Check where debian/watch looks and how it mangles versions.

Verified

All v2 Go sources under metadata/, internal/, examples/ carry SPDX-License-Identifier: Apache-2.0 and Copyright 2024 The Update Framework Authors, matching the Files: * stanza. Read exhaustively.
v0 Go sources (client, cmd, data, encrypted, sign, verify, leveldbstore, filejsonstore) carry no per-file headers; they are licensed by v0/LICENSE (BSD-3-clause, Prime Directive, Inc.), matching Files: v0/*. No other licence terms (GPL/LGPL/Apache/Mozilla/public-domain/non-free wording) appear anywhere in v0 outside the python-interop testdata.
v0/client/python_interop/testdata/LICENSE.txt (Expat by Justin Samuel/Justin Cappos, BSD-3 by The Tor Project) matches the Expat or BSD-3-Clause stanza; testdata/python-tuf-v3.0.0/client.py declares MIT OR Apache-2.0 and Copyright 2012-2023 NYU and the TUF contributors, matching its Expat or Apache-2.0 stanza.
v0/client/testdata/Published2Times_roottoolarge/server/metadata/2.root.json (the 500KB binary the scan flagged) is a deliberate oversized-root TUF metadata fixture, referenced by v0/client/client_test.go:602 (ErrMetaTooLarge{Name: "2.root.json", Size: defaultRootDownloadLimit+1}) — test data, not a built artifact; correctly under Files: v0/*.
The various testdata/ JSON fixtures (go-tuf generator, php-tuf-fixtures, Published*Time trees) are generated metadata used by the v0 self-tests; no conflicting copyright/licence headers found in them.
NOTICE is installed as documentation via debian/docs; it is Apache-2.0.
debian/copyright is DEP-5 (correct Format URL); full licence texts are supplied for BSD-3-clause and Expat, and Apache-2.0 points to /usr/share/common-licenses/Apache-2.0 (a valid common-license).
No compiled artifacts other than the flagged PDF and JSON fixture: no .jar/.class/.so/.dll/.exe/.pyc/min.js/fonts/images in the tree.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

The exact published licence of the X41 audit PDF (no licence text is present in-tree).

Proposed changes

None.

Uploader's response to the LLM review

The uploader was emailed about the review 0 hours ago.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
2.4.1+0.7.0-2~exp	869c2606…	2026-03-21 09:55	2026-03-21 09:57	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package