Review: golang-github-vifraa-gopom 1.0.0-1

Package Information

Description	Maven POM file parser for Go (library) Parser for Apache Maven POM files written in Go. It unmarshals a pom.xml into a Project struct mirroring the Maven 3.6.3 model, covering coordinates, parent and module declarations, properties, dependencies and dependency management, build plugins, profiles, repositories, distribution management and reporting. Parse reads a POM from a file path and ParseFromReader from any io.Reader; custom XML marshalling handles Maven's free-form properties element.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-vifraa-gopom.git (browse)
Closes	#1148625
Tracker	https://tracker.debian.org/pkg/golang-github-vifraa-gopom
Uploaded	13 days ago

New Package Report

.changes◂

Version	1.0.0-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Tue, 22 Sep 2026 03:47:08 +0200
Source	golang-github-vifraa-gopom

Changelog◂

golang-github-vifraa-gopom (1.0.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148625)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-github-vifraa-gopom-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/vifraa/gopom
Upstream-Name: gopom
Upstream-Contact: https://github.com/vifraa/gopom/issues

Files: *
Copyright: 2020 Viktor Franzén
License: Expat

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Expat
Comment: Debian packaging is licensed under the same terms as upstream

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 13 days ago.

Report◂

DFSG NEW review for golang-github-vifraa-gopom version 1.0.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole upstream tree is a single-holder MIT/Expat work: LICENSE carries Copyright (c) 2020 Viktor Franzén with the Expat text, README.md repeats the same holder and licence, and no other file in the tree carries a copyright notice, a different licence or non-free wording. debian/copyright is DEP-5 with the exact 1.0 Format URL, matches the holder for Files: *, uses the correct short name Expat with the full licence text reproduced, and its debian/* stanza (2026 Juan Manuel Méndez Rey, Expat) overrides the catch-all for the packaging. No file lacks a licence, no file is present only in built form, and no exception to /usr/share/common-licenses applies here because the Expat text is given in full.

Packaging

A conventional single-binary Go library package from the Go team: debhelper compat 14, dh-go's golang buildsystem with an explicit --with=golang, dpkg-build-api (= 1), golang-any, test dependency on testify, Testsuite: autopkgtest-pkg-go with no debian/tests/control needed (autodep8 0.31 knows Go packages), DEP-5 copyright and a well-formed salsa-ci/gbp/upstream metadata set. Dependencies are correct and satisfiable in the archive (dh-go 1.69, golang-github-stretchr-testify-dev 1.11.1-2), the changelog is a proper initial release closing an ITP, the version and distribution are right, and there are no patches to review. The one lintian override is a documented workaround for lintian's stale mapping of the golang addon to dh-golang, which dh-go 1.69 conflicts with, so it is not itself a fault.

Issues

None.

Verified ◂

Read the entire upstream tree: .gitignore, LICENSE, README.md, example_pom.go, go.mod, go.sum, gopom.go, gopom_test.go and .github/workflows/test.yml; it is 8 files plus the CI workflow, all hand-written Go/text with no vendor directory, no minified or generated file, and no binary, archive, font or PDF to inspect.
Licensing evidence across the tree: the only licence texts are LICENSE:1-21 (MIT/Expat, Copyright (c) 2020 Viktor Franzén) and README.md:67-69 (Copyright (c) 2020-present [Viktor Franzén](https://github.com/vifraa) / Licensed under [MIT License](./LICENSE)); a grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GPL/LGPL/Apache/MPL and All rights reserved returns nothing else, and a grep for DO NOT EDIT, Code generated, non-commercial, may not be modified found no matches.
The prescan's one item, README.md:67 Copyright (c) 2020-present [Viktor Franzén], is the same holder already named in the Files: * stanza as 2020 Viktor Franzén; the year drift is the only difference and is not an issue, and it is not a separate holder needing a stanza.
debian/copyright is DEP-5 with Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/; Comment is one of the optional fields allowed in a Files stanza (copyright-format 1.0 §5.2, §6.6, checked with the policy tool), and the Files: debian/* stanza is placed after Files: *, so it correctly overrides the catch-all for the packaging. No Files-Excluded is needed: golang-github-vifraa-gopom_1.0.0.orig.tar.gz contains exactly gopom-1.0.0/ with the same eight files and .github/ as the unpacked tree, so nothing was dropped and nothing in the tree is absent from the tarball.
debian/rules is dh $@ --builddirectory=debian/_build --buildsystem=golang --with=golang; dh-go 1.69 (apt-cache) provides the golang debhelper sequence addon, the golang buildsystem module and dh_golang, and the reviewing system's /usr/share/perl5/Debian/Debhelper/Sequence/golang.pm and Buildsystem/golang.pm confirm both are available, so the build-dep and the two options are consistent. The buildsystem's configure step skips debian, .pc, .git and the build directory at the top level, so a build directory under debian/ is not copied into the Go workspace.
The golang buildsystem defaults GO111MODULE to off (/usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm, _set_go111module) and sets GOPATH to the build directory while symlinking /usr/share/gocode/src, so go.mod's github.com/stretchr/testify v1.6.1 is not resolved against the network at build time; Debian's golang-github-stretchr-testify-dev (1.11.1-2, apt-cache) satisfies the Build-Depends and the Depends of the -dev package, which is right for a package whose installed sources include gopom_test.go.
Build-Depends: dpkg-build-api (= 1) is satisfied by dpkg-dev 1.23.11 (apt-cache lists it as the provider), and at API level 1 the only relevant change here is that Rules-Requires-Root defaults to no, which is correct for this arch:all, no-root build.
Standards-Version: 4.7.4 is current: the Policy on the reviewing system lists version 4.7.4 as its newest upgrade-checklist entry (A10.2), and the first three components match anyway.
Testsuite: autopkgtest-pkg-go is the autodep8 Go suite (autodep8 0.31 lists 'Go packages' among the types it supports, and the source has XS-Go-Import-Path: github.com/vifraa/gopom), so no debian/tests/control is required; Multi-Arch: foreign on this arch:all -dev package matches the Go team's other -dev packages, e.g. golang-github-stretchr-testify-dev (apt-cache).
Package metadata is complete and consistent: debian/changelog is 1.0.0-1, distribution unstable, closing an ITP, debian/upstream/metadata and debian/gbp.conf are well-formed, debian/source/format is 3.0 (quilt) with no debian/patches series to review, and debian/source/lintian-overrides only documents why dh-go does not satisfy lintian's dh-golang mapping for the golang addon.
The .pc/ directory in the unpacked tree is not part of the shipped packaging: the listing of golang-github-vifraa-gopom_1.0.0-1.debian.tar.xz:debian/ shows only changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, source/, upstream/ and watch. It was ignored per the instructions.
uscan found the packaged version as the newest upstream release (upstream 1.0.0, packaged 1.0.0).

Not confirmed ◂

Whether salsa repo referenced by Vcs-Git/Vcs-Browser exists and is reachable, and whether #1148625 in the changelog is the ITP this release closes: neither the network nor the Debian BTS is available to this review.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 13 days ago.

Review Information

accepted — allocated to awm 13 days ago, started 13 days ago, completed 13 days ago.

Final Comment

Back to Dashboard | View all reviews for this package