DFSG NEW review for golang-github-zyedidia-generic version 1.2.2~git20230320.4410d23-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is under the Expat (MIT) licence, reproduced in full in debian/copyright, and the two licence files that exist (top-level LICENSE and avl/LICENSE) match the two Files stanzas exactly, including avl/LICENSE's extra holder Kostas Karasavvas. No file carries a different or absent licence, there is no vendored third-party code, no binary or minified file, and no file that asks to be fetched. The only gap is provenance documentation: btree/btree.go and trie/trie.go state that they are adapted from Sedgewick and Wayne's algs4 Java implementations, and debian/copyright says nothing about that (reported as minor).

Packaging

Small, conventional Go library packaging of good quality: 3.0 (quilt) with one DEP-3 patch, debhelper compat 14 with dh-go and dpkg-build-api 1, Standards-Version 4.7.4 against Policy 4.7.4.1, correct build-dependencies (dh-go, dpkg-build-api, golang-any, and both runtime imports), a single arch:all Multi-Arch: foreign -dev package whose Depends lists role-appropriate library packages, Testsuite: autopkgtest-pkg-go, Vcs-* and upstream/metadata present, README.source explaining the git-snapshot version, and no maintainer scripts. The patch is necessary (the golang buildsystem runs go test at build time, and multimap's tests used the old x/exp/slices comparison API) and matches the API of the x/exp version in the archive; nothing else in the tree uses the old API.

Issues

1. [minor] [licensing] debian/copyright does not mention that btree/btree.go and trie/trie.go are adapted from Sedgewick and Wayne's algs4 code

• Files: btree/btree.go:13-15, trie/trie.go:4-6, debian/copyright (Files: * stanza)
• Basis: inferred from what was read, not seen directly
• Evidence: btree/btree.go: // Adapted from the B-tree implementation in Algorithms, 4th ed., by Robert\n// Sedgewick and Kevin Wayne.\n// https://algs4.cs.princeton.edu/62btree/BTree.java.html.; trie/trie.go: // Adapted from the TST implementation in Algorithms, 4th ed., by Robert\n// Sedgewick and Kevin Wayne.\n// https://algs4.cs.princeton.edu/52trie/TST.java.html. debian/copyright's only upstream stanza is Files: * / Copyright: 2021 Zachary Yedidia / License: Expat.
• Problem: These are the only two files in the tree that name anyone other than the project author, and they say the code was adapted from a named third-party implementation rather than written from the algorithm alone. debian/copyright therefore does not account for their provenance: it neither names Sedgewick and Wayne (if the adaptation makes them copyright holders of parts of the files) nor states the terms the algs4 Java sources are available under. Nothing in the package shows the terms (the algs4 pages are not in the source, and avl.go, which is also an adaptation, does carry its own avl/LICENSE with the adapted work's holder), so a sponsor asked to sign this upload would want the question settled rather than left to the reader's assumption that Expat is enough.
• Fix: Ask upstream to confirm the two files are independent reimplementations, or name the holders and the terms of the adapted work: either add the algs4 licence text plus a Files stanza or a Comment for btree/* and trie/* in debian/copyright, in the way avl/LICENSE and the avl/* stanza already do for the AVL tree.

Verified

• debian/copyright is DEP-5 and every Files pattern resolves as intended: Files: * (Expat, 2021 Zachary Yedidia) is overridden by Files: avl/* (2017 Kostas Karasavvas, 2021 Zachary Yedidia) and by Files: debian/*; the Expat text is given in full as a stand-alone License paragraph, so nothing outside /usr/share/common-licenses is merely referenced by name.
• Upstream evidence matches: LICENSE is Copyright (c) 2021: Zachary Yedidia. under the MIT text, and avl/LICENSE is Copyright (c) 2017 Kostas Karasavvas, 2021 Zachary Yedidia and says it applies to avl.go, exactly as the avl/* stanza and its Comment state. The prescan's author check found three holders and no file to look at; nothing in the tree contradicts it.
• A whole-tree grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, GNU, Apache, public domain, All rights reserved finds notices only in LICENSE and avl/LICENSE (and debian/copyright itself); the .go, .md, .yaml, .mod, .sum, Makefile and .github/workflows/test.yaml files carry none. No file in the tree is left without a licence.
• No vendored third-party code and no built artefacts: 69 text files, all .go/.md/.yaml/.mod/.sum/.gitignore/.editorconfig plus the two LICENSE files; no archives, binaries, bytecode, minified JS/CSS or fonts. DOC.md and the per-package README.md files are <!-- Code generated by gomarkdoc. DO NOT EDIT --> output whose inputs and recipe are in the tree (the .go sources and the Makefile's gomarkdoc targets).
• The README.md badge links report MIT; nothing in the tree asserts a different licence.
• Quilt patch applied and correct: multimap/multimap_test.go now imports cmp and uses func(a, b entry) int closures, matching the installed golang.org/x/exp/slices (/usr/share/gocode/src/golang.org/x/exp/slices/sort.go: SortFunc, SortStableFunc and IsSortedFunc all take func(a, b E) int), and the rewritten comparisons preserve the original lexicographic order.
• The patch is also complete as far as the archive's x/exp goes: multimap/values.go uses slices.Index, the test file uses slices.Sort/Clone/Equal/EqualFunc, interval/itree.go uses x/exp/constraints.Ordered and mapset/set.go uses x/exp/maps.Clear, all of which exist in the installed copy of golang.org/x/exp (0.0~git20261009.ca0d7ba), so no other old-API call remains.
• Build-dependency existence checked with apt-cache: dh-go 1.69 (Provides nothing, Conflicts: dh-golang, ships the golang addon and the dh_golang_autopkgtest command) exists; dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11; golang-golang-x-exp-dev (0.0~git20261009.ca0d7ba-1) and golang-github-segmentio-fasthash-dev (1.0.3-3) exist and match go.mod's requires (fasthash v1.0.3). Both are imported by non-test code (generic.go imports both; interval, mapset and multimap import x/exp), so the -dev package's Depends is right, and the x/exp test-only import is covered by the build dependency.
• Packaging files read in full and consistent: debian/control, rules, changelog, copyright, README.source, gbp.conf, salsa-ci.yml, source/format, source/lintian-overrides, upstream/metadata, patches/series and the patch. Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1 (policy tool), so it is current; compat 14 plus dpkg-build-api (= 1) makes Rules-Requires-Root default to no (dpkg-build-api(7) v1), so its absence is correct; the changelog's 2026-09-22 is a past Tuesday, Distribution unstable, version 1.2.2~git20230320.4410d23-1 matching the .dsc and tarball names.
• The lintian override in debian/source/lintian-overrides is accurate: apt-cache shows dh-go 1.69 with no Provides while dh-golang 1.67 provides dh-sequence-golang, so build-depending on dh-go is not a missing-dependency problem.
• The dh-golang buildsystem (read at /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm) copies only .go/.c/.h/.s/go.mod/go.sum/testdata into the workspace and installs from there, so the .pc (quilt) directory and .github/ are not leaked into the -dev package.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.2.2~git20261015.fa8e326, packaged 1.2.2~git20230320.4410d23), which is not a fault of the package.

Not confirmed

• The terms the algs4 Java sources (https://algs4.cs.princeton.edu/62btree/BTree.java.html and .../52trie/TST.java.html) are distributed under, which decides whether btree/btree.go and trie/trie.go being adaptations is a licence conflict rather than just a documentation gap: no copy of algs4 exists below /usr on the reviewing system (grep of /usr/share/doc found only unrelated Sedgewick citations) and no URL may be fetched, so this could not be checked.
• Whether the autopkgtest-pkg-go runner actually works for this package: Testsuite: autopkgtest-pkg-go is served by dh-go's dh_golang_autopkgtest (the command is listed in the package's control data), and neither dh-go nor dh-golang is installed here, so the runner could not be read or exercised.

Proposed changes

None.