Review: golang-github-twitchtv-twirp 8.1.3+ds-1

Package Information

Description	framework for service-to-service communication emphasizing simplicity (library) Twirp is a framework for service-to-service communication emphasizing simplicity and minimalism. It generates routing and serialization from API definition files and lets you focus on your application's logic instead of thinking about folderol like HTTP methods and paths and JSON. Twirp is similar to gRPC, but without the custom HTTP server and transport implementations: it runs on the standard library's extremely-well-tested-and-high-performance net/http Server. It can run on HTTP 1.1, not just http/2, and supports JSON serialization for easy debugging.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-twitchtv-twirp.git (browse)
Closes	#1152507
Tracker	https://tracker.debian.org/pkg/golang-github-twitchtv-twirp
Uploaded	2 days ago

New Package Report

.changes◂

Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Fri, 30 Oct 2026 08:03:29 +0100
Source	golang-github-twitchtv-twirp
Version	8.1.3+ds-1

Changelog◂

golang-github-twitchtv-twirp (8.1.3+ds-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152507)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-twitchtv-twirp-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/twitchtv/twirp
Upstream-Name: twirp
Upstream-Contact: https://github.com/twitchtv/twirp/issues
Files-Excluded:
 vendor
 _tools
 website
Comment: vendor/ and _tools/src/ are copies of Go dependencies and of the
 tools used to regenerate code; Debian builds against its own packages.
 website/ is the documentation site, not used by the build.

Files: *
Copyright: 2018 Twitch Interactive, Inc.
License: Apache-2.0

Files: internal/gen/wrappers.go
Copyright: 2018 Twitch Interactive, Inc.
           2010 The Go Authors
License: Apache-2.0 and BSD-3-clause
Comment: Contains code from https://github.com/protocolbuffers/protobuf-go.

Files: THIRD_PARTY
Copyright: 2010 The Go Authors
License: BSD-3-clause
Comment: Notice for the protobuf code upstream vendors; that copy is
 excluded from the Debian source.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
     * Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
     * Redistributions in binary form must reproduce the above
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
     * Neither the name of Google Inc. nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for golang-github-twitchtv-twirp version 8.1.3+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 1 found

Licensing

The tree is Apache-2.0 throughout, with one file (internal/gen/wrappers.go) carrying Go-Authors BSD-3 code and the BSD-3 notice reproduced in THIRD_PARTY; both are covered by their own stanzas, the BSD-3 text is included in full and Apache-2.0 points at /usr/share/common-licenses. Every source file I read carries the Twitch Interactive copyright header or is generated from a .proto present in the tree, so no holder or licence is unaccounted for, and no non-free or field-of-use wording exists anywhere. The only binary file, internal/gen/typemap/testdata/fileset.pb, is a test fixture regenerable from testdata/*.proto via its go:generate line. Files-Excluded matches the repacked tarball.

Packaging

Dependencies are complete and correct for the sources actually installed (pkg/errors and protobuf in Depends, testify only in Build-Depends with <!nocheck>), the source is arch:all/Multi-Arch: foreign as Go libraries are, the patch carries DEP-3 headers, autopkgtests come from the Go autodep8 template, and Standards-Version matches current Policy. Compat 14 with dh-go and dpkg-build-api (= 1) are used correctly, and the one substantive change, repacking plus go.mod, is documented in the patch. One minor defect: debian/gbp.conf sets gbp's dist option to DEP14, which is not a distribution.

Issues

minor packaging 1. debian/gbp.conf sets the gbp dist option to DEP14, which is a branch-layout name, not a distribution ◂

Files: debian/gbp.conf:3
Basis: checked, in the package or with a reference tool
Evidence: dist = DEP14; gbp's option table describes dist as "Build for this distribution when using git-pbuilder" (/usr/lib/python3/dist-packages/gbp/config.py:283-285)
Problem: dist is gbp buildpackage's pbuilder/mock distribution, i.e. a Debian suite like sid. DEP14 is the name of a git branch layout, so any gbp buildpackage --git-pbuilder run (a maint/build command, not salsa-ci) would target a nonexistent distribution and fail; the setting is also misleading to anyone reading the file. The DEP-14 layout is already expressed by debian-branch = debian/sid.
Fix: Delete the dist = DEP14 line, or set it to sid if maintainer pbuilder builds are wanted.

Verified ◂

Inventory: 164 upstream files (excluding .pc/ and debian/), plus debian/; all of debian/ was read in full, and docs/ (14 .md), .github/, the shell scripts, Makefile, Gopkg.* and tools.json were sampled.
All .go files carry // Copyright 2018/2019 Twitch Interactive, Inc. All Rights Reserved. plus the Apache-2.0 notice, except the *.pb.go/*.twirp.go files, which say Code generated ... DO NOT EDIT and have their inputs in the tree (service.proto, etc.; protoc-gen-twirp is in-tree, protoc-gen-go is Debian's).
internal/gen/wrappers.go is the only source file containing Go Authors code: its header has This file contains some code from https://github.com/protocolbuffers/protobuf-go and the full BSD-3 notice, and the Files: internal/gen/wrappers.go stanza declares exactly Apache-2.0 and BSD-3-clause with both holders; THIRD_PARTY is the BSD-3 notice text and has its own stanza.
internal/gen/typemap/testdata/fileset.pb, the binary the scan could not identify, is a protobuf FileDescriptorSet test fixture: internal/gen/typemap/testdata/gen.go has //go:generate protoc --descriptor_set_out=fileset.pb --include_imports --include_source_info ./service.proto, and every .proto it imports (public_reimporter, public_importer, importer, root_pkg, service) is in the same directory. Test data, not a program lacking its source.
logo.png is the Twitch logo referred to by README.md; it is part of the Apache-2.0 upstream tree and is covered by Files: * (trademark rights aside, no separate DFSG issue).
vendor/, _tools/ and website/ are absent from golang-github-twitchtv-twirp_8.1.3+ds.orig.tar.xz, so Files-Excluded matches what was repacked; no other vendored third-party code was found (third-party imports are only via google.golang.org/protobuf and github.com/pkg/errors, both Debian packages).
debian/copyright is valid DEP-5: header paragraph (Format, Upstream-Name, Source, Upstream-Contact, Files-Excluded, Comment), four Files: stanzas (*, internal/gen/wrappers.go, THIRD_PARTY, debian/*) applied in the right order, and two stand-alone License: paragraphs; the BSD-3 text is reproduced in full and Apache-2.0 refers to /usr/share/common-licenses/Apache-2.0. No GPL, MIT, CC-*, non-commercial, no-modification or field-of-use wording exists in the tree.
Non-test imports of the packages that get installed are only github.com/pkg/errors and google.golang.org/protobuf, both in the binary package's Depends; github.com/stretchr/testify appears only in _test.go files and is in Build-Depends with <!nocheck>.
dpkg-build-api (= 1) is the form dpkg-build-api(7) documents; dh-go provides both the golang sequence addon and the golang buildsystem, so --buildsystem=golang --with=golang are correct at debhelper-compat (= 14); XS-Go-Import-Path matches the module path. dh_golang installs .go/.proto files, testdata and go.mod, so LICENSE/NOTICE are not copied into the -dev package, but the holder and the licence text live in /usr/share/doc//copyright and in base-files, Debian's normal arrangement.
autodep8's Go template is Test-Command: /usr/bin/dh_golang_autopkgtest with Depends: @, @builddeps@ (/usr/share/autodep8/support/go/generate), so testify and the remaining Build-Depends are installed for the autopkgtest; Testsuite: autopkgtest-pkg-go is therefore sufficient.
Repack and patch rationale are documented: the +ds version matches the orig tarball, and debian/patches/0001-add-go-mod.patch (DEP-3 Description/Author/Forwarded/Last-Update, listed in series) is the only patch; it adds go.mod with upstream's pinned versions and sid's testify, which is not a fault.
debian/changelog is a sane initial release for a package not in the archive (apt-cache finds no golang-github-twitchtv-twirp-dev), distribution unstable, and the date is a real past Friday.
uscan found the packaged version as the newest upstream release (upstream 8.1.3, packaged 8.1.3+ds).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Bug #1152507 is assumed to be the ITP that Closes: refers to; the BTS is not reachable from here, so the closure could not be checked.
The practical effect of dist = DEP14 depends on whether any maintainer or CI job runs gbp with --git-pbuilder; salsa-ci's debian.yml recipe was not followed further.

Proposed changes ◂

None.

Uploader's response to the LLM review

False positive, so no change. DEP14 is a special value of gbp's dist option. gbp-buildpackage(1) says: "The special value DEP-14 will set the distribution to build for from the branch name." With debian-branch = debian/sid it builds for unstable (gbp/scripts/buildpackage.py, get_pbuilder_dist). dh-make-golang writes it by default.

— Juan Manuel Méndez Rey (mendezr), 1 day ago

Review Information

accepted — allocated to mechtilde 1 day ago, started 1 day ago, completed 1 day ago.

Final Comment

Back to Dashboard | View all reviews for this package