DFSG NEW review for golang-github-umisama-go-cpe version 0.0~git20190323.cdd6c3c-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is Expat (MIT) — the single LICENSE file, which README.md confirms ('under the MIT License'), and no other licence notice anywhere: a grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU, Apache, Mozilla, public domain and All rights reserved matched only LICENSE and debian/copyright. Expat is DFSG-free with no non-free wording anywhere. debian/copyright is DEP-5 with the correct Format URL, a Files: * stanza naming the one upstream holder ('2014 umisama', matching the LICENSE header verbatim), a Files: debian/* stanza for the packaging, and a stand-alone Expat paragraph with the full text (correctly given in full, as Expat is not in /usr/share/common-licenses). Every file in the tree is covered by one of the two stanzas and no holder is missing.

Packaging

By-the-book Debian Go team packaging: 3.0 (quilt), debhelper-compat 14 with dh-go's golang addon, build-dependencies that all exist in the archive (dh-go 1.69, golang-any, testify 1.11.1-2 matching the version go.mod requires, and the dpkg-build-api virtual package), one patch with complete DEP-3 headers and a clear Debian-only purpose, an arch:all Multi-Arch: foreign -dev package, Testsuite: autopkgtest-pkg-go, valid DEP-14 gbp.conf, upstream/metadata, and a commented lintian override for the one tag that dh-go's addon naming provokes. Standards-Version 4.7.4 is current (Policy 4.7.4.1 here). No policy violation, bug or missing piece was found; the only oddities — trailing commas in two relation fields and --builddirectory=debian/_build — are harmless template artifacts.

Issues

None.

Verified

• Inventory: 11 upstream files (LICENSE, README.md, .travis.yml, go.mod, attribute.go, encoder.go, matching.go, naming.go and the three *_test.go) and 13 entries under debian/ (changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, watch, patches/series, patches/0001-add-go-mod.patch, source/format, source/lintian-overrides, upstream/metadata); every one read in full or grepped.
• The only licence notice in the tree is LICENSE ('Copyright (c) 2014 umisama', Expat text); it matches the Files: * stanza and the short name used for it. No per-file headers exist.
• No compiled, minified or generated artefacts, no vendored third-party code, no fonts, images or media: every file is text. The non-test Go sources import only the standard library (fmt, regexp, strings); the *_test.go files add github.com/stretchr/testify/assert, which is what the go.mod requirement and the Build-Depends entry are for.
• debian/copyright is machine-readable: exact 1.0 Format URL, Files: * / Files: debian/* stanzas with Copyright and License, one stand-alone Expat paragraph holding the full permission text. Comment is a permitted field in a Files stanza (copyright-format 5.2).
• The prescan's holder check reported no unnamed holder and listed no file for me to examine; the only copyright holder in the tree is named in debian/copyright.
• The CPE example strings in naming_test.go (WFN, URI and formatted-string bindings) are short factual examples from NISTIR-7695-CPE-Naming, a US-government publication, used as test data.
• go.mod exists only because debian/patches/0001-add-go-mod.patch creates it: a five-line module declaration, Debian-authored but carrying no notice of its own, under a licence (Expat) identical to the stanza that covers it — noted, not a fault.
• Dependencies all resolve: apt-cache shows dh-go 1.69 (Debian Go Packaging Team; describes itself as providing the 'golang' addon, the 'golang' buildsystem and dh_golang, with Conflicts: dh-golang and no Provides field, which is what the lintian override's comment asserts), golang-github-stretchr-testify-dev 1.11.1-2 (exactly the version go.mod requires), and dpkg-build-api as a virtual package provided by dpkg-dev 1.23.11 (= 1).
• Dpkg::BuildAPI.pm on this system confirms Build-Depends: dpkg-build-api (= 1) is the supported way to declare build API level 1, and that MAX_BUILD_API is 1, so the declaration is valid as written.
• Read dh-golang's Debian::Debhelper::Buildsystem::golang: DH_GOPKG comes from XS-Go-Import-Path (github.com/umisama/go-cpe here, so the module path is right), the source is copied into the workspace with debian/ and .pc skipped, and its install stage puts the module source at /usr/share/gocode/src/<DH_GOPKG> under the package's own build directory — for a one-Package source at compat 14 the single-binary addon is activated (SequencerUtil.pm), so that directory is debian/golang-github-umisama-go-cpe-dev and the -dev package is populated without a debian/install file.
• --builddirectory=debian/_build is accepted (Debian::Debhelper::Buildsystem::_set_builddir only rewrites paths starting with '../' or already absolute) and is removed by dh_auto_clean, which calls the golang buildsystem's clean/rmdir_builddir.
• The trailing comma after the last Build-Depends entry and after ${misc:Depends} in debian/control is harmless: Dpkg::Deps::parse splits the field on commas and drops the empty trailing item, so no bad dependency results — cosmetic only, not reported.
• Packaging files read in full: no maintainer scripts, no *.maintscript, no debian/install, no debian/tests (the Testsuite field relies on autodep8). The patch is DEP-3 (Description, Author, Forwarded: not-needed, Last-Update) and changes nothing upstream code depends on.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20190323.cdd6c3c, packaged 0.0~git20190323.cdd6c3c).

Not confirmed

• Whether the package builds and passes its tests, and whether the autopkgtest-pkg-go suite succeeds: the tree shows nothing that would fail, and the source build-depends on testify, which is what its own tests need, but no build was run.
• dh-go 1.69's own buildsystem and sequence implementation, which is not installed on this reviewing system (only dh-golang's, which I read); the override's and the patch's statements about dh-go's behaviour therefore rest on dh-go's package description, not on its code.

Proposed changes

None.