golang-github-zclconf-go-cty-yaml 1.2.0-1
Package Information
| Description | YAML marshalling and unmarshalling for go-cty This package enables Go programs to comfortably encode and decode YAML values. It was developed as part of the juju project, and is based on a pure Go port of the well-known libyaml C library to parse and generate YAML data quickly and reliably. The package supports most of YAML 1.1 and 1.2, including support for anchors, tags, map merging, etc. Multi-document unmarshalling is not yet implemented, and base-60 floats from YAML 1.1 are purposefully not supported since they're a poor design and are gone in YAML 1.2. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Sponsor | tsimonq2@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-zclconf-go-cty-yaml.git (browse) |
| Closes | #1152508 |
| Popcon Installs | 2 |
| Tracker | https://tracker.debian.org/pkg/golang-github-zclconf-go-cty-yaml |
| Uploaded | 2 hours ago |
New Package Report
.changes
| Date | Fri, 30 Oct 2026 08:44:41 +0100 |
|---|---|
| Source | golang-github-zclconf-go-cty-yaml |
| Version | 1.2.0-1 |
| Changed-By | Juan Manuel Méndez Rey <juan.mendezr@proton.me> |
| Architecture | source all |
| Distribution | unstable |
Changelog
golang-github-zclconf-go-cty-yaml (1.2.0-1) unstable; urgency=medium
.
* New upstream version 1.2.0, the one trivy needs.
* Reintroduce: trivy needs it (Closes: #1152508).
* Build with dh-go.
* Standards-Version 4.7.4, debhelper-compat 14, debian/watch version
5..dsc
| Package-List | golang-github-zclconf-go-cty-yaml-dev deb golang optional arch=all |
|---|---|
| Section | golang |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: go-cty-yaml
Upstream-Contact: https://github.com/zclconf/go-cty-yaml/issues
Source: https://github.com/zclconf/go-cty-yaml
Files: *
Copyright: 2011-2016 Canonical Ltd
2019-2025 Martin Atkins
License: Apache-2.0
Comment: Derived from gopkg.in/yaml.v2 (Canonical); modifications for cty
interfacing by Martin Atkins, under the same terms (NOTICE).
Files: LICENSE.libyaml apic.go emitterc.go parserc.go readerc.go scannerc.go writerc.go yamlh.go yamlprivateh.go
Copyright: 2006 Kirill Simonov
License: Expat
Comment: The files were ported to Go from C files of libyaml, and thus
are still covered by their original copyright and license.
Files: debian/*
Copyright: 2020 Thorsten Alteholz <debian@alteholz.de>
2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
License-Reference: /usr/share/common-licenses/Apache-2.0
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 hour ago.
Report
DFSG NEW review for golang-github-zclconf-go-cty-yaml version 1.2.0-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 2 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The tree is DFSG-free: Apache-2.0 for the cty-facing code and the derived yaml.v2 files, Expat/MIT for the eight files ported from libyaml, both recorded in LICENSE, LICENSE.libyaml and NOTICE. debian/copyright is DEP-5, names Canonical Ltd, Martin Atkins and Kirill Simonov, and matches the files and their notices. Two small inaccuracies in the copyright file remain: the Expat licence text is cut off mid-sentence, and the Apache-2.0 paragraph puts its /usr/share/common-licenses pointer in an undefined License-Reference field.
Packaging
Packaging is clean and current: debhelper-compat 14 with dh-go, dpkg-build-api 1, arch-all -dev package with the single cty dependency, Testsuite: autopkgtest-pkg-go, Vcs-* and upstream metadata present, no patches to review, changelog in unstable with a proper version bump over the removed 1.0.2-3. No packaging issues found.
Issues
minor licensing 1. Expat licence text in debian/copyright stops at 'DEALINGS IN THE', dropping the final 'SOFTWARE.' ◂
- Files:
debian/copyright:40-54 (stand-alone License: Expat stanza) - Basis: checked, in the package or with a reference tool
- Evidence: The last line of the file is
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE, while LICENSE.libyaml:24-30 ends... DEALINGS IN THE/SOFTWARE.with a closing warranty sentence intact. - Problem: The MIT/Expat notice that must accompany the eight ported libyaml files (and LICENSE.libyaml) is reproduced incompletely, so debian/copyright does not state those files' licence in full; the sentence is truncated mid-phrase.
- Fix: Append the missing
SOFTWARE.to the last line of the Expat licence paragraph so it matches LICENSE.libyaml verbatim.
minor licensing 2. Stand-alone Apache-2.0 stanza uses a License-Reference field, which copyright-format 1.0 does not define ◂
- Files:
debian/copyright:38 (License-Reference: /usr/share/common-licenses/Apache-2.0) - Basis: checked, in the package or with a reference tool
- Evidence:
License-Reference: /usr/share/common-licenses/Apache-2.0follows the Apache-2.0 boilerplate. copyright-format section 5.3 lists only License and Comment as fields permitted in a stand-alone License stanza, and no section of the specification defines License-Reference. - Problem: The pointer to the full Apache-2.0 text sits in a non-standard field; a strict DEP-5 consumer does not treat it as part of the License field, and section 6.7 requires the full text or the /usr/share/common-licenses pointer to be given in that field.
- Fix: Drop the License-Reference field and put the pointer in the License field's text instead, e.g.
On Debian systems, the complete text of the Apache License 2.0 is in /usr/share/common-licenses/Apache-2.0.
Verified ◂
- The prescan listed no individual files to account for; its only output was the author check, which found every copyright holder in the tree named in debian/copyright.
- Licence evidence in the tree is confined to LICENSE (Apache-2.0), LICENSE.libyaml (MIT/Expat, Copyright (c) 2006 Kirill Simonov) and NOTICE (derived from gopkg.in/yaml.v2, 2011-2016 Canonical Ltd; cty modifications 2019 Martin Atkins). No .go file carries a copyright or licence header, SPDX tag or 'All rights reserved' line, so the Files: * and Expat stanzas are consistent with the files' own notices.
- The Expat stanza correctly covers exactly the eight mechanically ported files named in LICENSE.libyaml: apic.go, emitterc.go, parserc.go, readerc.go, scannerc.go, writerc.go, yamlh.go, yamlprivateh.go, plus LICENSE.libyaml itself.
- No non-free wording anywhere in the tree: grep for non-commercial, no modifications, field-of-use, research/personal use, 'Good, not Evil', 'All rights reserved' found nothing.
- No vendor/ or third_party/ directory and no embedded copy of a separately packaged library; the libyaml code is upstream's own port, documented in LICENSE.libyaml.
- All 28 upstream files (CHANGELOG.md, .travis.yml, .github/FUNDING.yml, go.mod, go.sum and the .go sources) are plain text; no images, fonts, binaries, minified or generated files. .pc/ and debian/cargo-checksum.json were left out as instructed.
- Apache-2.0 and Expat are compatible and both permit modification and redistribution.
- debian/ files: changelog, control, copyright, docs (NOTICE), gbp.conf, gitlab-ci.yml, rules, salsa-ci.yml, source/format, upstream/metadata read; no patches, no maintainer scripts, no debian/tests needed because Testsuite: autopkgtest-pkg-go generates the test.
- Dependencies checked in the archive: dh-go 1.69 (provides the golang buildsystem, sequence addon and dh_golang), dpkg-build-api (= 1) provided by dpkg-dev 1.23.11, debhelper 14.5 supports compat 14, golang-github-zclconf-go-cty-dev 1.12.1 satisfies the go.mod requirement of go-cty v1.0.0.
- Standards-Version 4.7.4 against Policy 4.7.4.1: same first two components, current.
- The changelog version 1.2.0-1 sorts above the previous 1.0.2-3, so the reintroduction is a clean upgrade path, and the distribution is unstable.
- uscan found the packaged version as the newest upstream release (upstream
1.2.0, packaged1.2.0). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- The upstream README is not in the source tree, so the long description's statement that the code 'was developed as part of the juju project' (inherited from yaml.v2) could not be compared with upstream documentation; it is not a policy or licensing fault.
- Bug #1152508 closed in the changelog and the salsa repository URLs could not be checked from here.
Proposed changes ◂
None.
Uploader's response to the LLM review
Both are right, thanks. They are fixed for the next revision (1.2.0-2: Expat text completed, License-Reference replaced by a sentence in the licence text). Please accept this upload.
— Juan Manuel Méndez Rey (mendezr), 1 hour ago
They are fixed for the next revision, 1.2.0-2:
https://salsa.debian.org/go-team/packages/golang-github-zclconf-go-cty-yaml/-/commit/ab1316ab3edc7bb98438ab3fc41c311b72b474fe .
Please accept this upload.
— Juan Manuel Méndez Rey (mendezr), 0 hours ago