Review: golang-gitlab-gitlab-org-api-client-go-v2 2.50.0-1

Package Information

Description	GitLab API client enabling Go programs to interact with GitLab (library) A GitLab API client enabling Go programs to interact with GitLab in a simple and uniform way.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Maytham Alsudany <maytham@debian.org>
Sponsor	maytham@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-gitlab-gitlab-org-api-client-go-v2.git (browse)
Closes	#1153393
Tracker	https://tracker.debian.org/pkg/golang-gitlab-gitlab-org-api-client-go-v2
Uploaded	9 hours ago

New Package Report

.changes◂

Date	Sun, 08 Nov 2026 12:35:07 +0800
Source	golang-gitlab-gitlab-org-api-client-go-v2
Version	2.50.0-1
Changed-By	Maytham Alsudany <maytham@debian.org>
Architecture	source all
Distribution	unstable

Changelog◂

golang-gitlab-gitlab-org-api-client-go-v2 (2.50.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1153393)

.dsc◂

Component	main
Package-List	golang-gitlab-gitlab-org-api-client-go-v2-dev deb golang optional arch=all
Section	golang
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://gitlab.com/gitlab-org/api/client-go
Upstream-Name: client-go
Upstream-Contact: https://gitlab.com/gitlab-org/api/client-go/-/work_items

Files: *
Copyright:
 2021 Andrea Funto'
 2021 Arkbriar
 2021 Eric Stevens
 2021 Igor Varavko
 2021 Kordian Bruck
 2021 Markus Lackner
 2021 Matej Velikonja
 2021 Matthias Simon
 2021 Patrick Webster
 2021 Paul Cioanca
 2021 Paul Shoemaker
 2021 Pavel Kostohrys
 2021 Sander van Harmelen
 2021 Sander van Harmelen, Michael Lihs
 2021 Serena Fang
 2021 Stany MARCEL
 2021 Sune Keller
 2022 Daniela Filipe Bento
 2022 Daniel Steinke
 2022 FantasyTeddy
 2022 Mai Lapyst
 2022 Masahiro Yoshida
 2022 Ryan Glab <ryan.j.glab@gmail.com>
 2022 Timo Furrer <tuxtimo@gmail.com>
 2023 Hakki Ceylan, Yavuz Turk
 2023 James Hong
 2023 Nick Westbury
 2023 Sander van Harmelen
 2023 徐晓伟 <xuxiaowei@xuxiaowei.com.cn>
 2024 oapi-codegen
 2024 Sander van Harmelen
 2026 GitLab Inc.
 2026 Jimmy Spagnola
License: Apache-2.0

Files: debian/*
Copyright: 2026 Maytham Alsudany <maytham@debian.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the full text of the Apache license, version 2.0 can be
 found at /usr/share/common-licenses/Apache-2.0

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 8 hours ago.

Report◂

DFSG NEW review for golang-gitlab-gitlab-org-api-client-go-v2 version 2.50.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is Apache-2.0 throughout: the top-level LICENSE is the Apache 2.0 text, every Go file that carries a notice carries the same Apache-2.0 boilerplate, and debian/copyright is in DEP-5 format with a Files: * stanza naming all 32 copyright holders that appear in the tree (the pre-scan's author check found no holder missing) plus a Files: debian/* stanza. The only third-party-derived file, nullable.go, retains its own Apache-2.0 notice naming 2024 oapi-codegen, which the copyright file names. Generated files (config/v1beta1/config.pb.go, testing/*_mock.go) have their generator inputs in the tree, and the orig tarball is an unmodified upstream export, so no Files-Excluded is needed.

Packaging

Conventional and correct Go team packaging: debhelper compat 13 with dh-sequence-golang, one Architecture: all -dev package with Multi-Arch: foreign, XS-Go-Import-Path matching the module path, autopkgtest-pkg-go, Standards-Version 4.7.4 against Policy 4.7.4.1, working Vcs-* and Homepage, and Build-Depends that cover the imports of the packages actually shipped (go.uber.org/mock is a real runtime dependency of the installed testing/ package, testify and heredoc are <!nocheck>). Three minor defects remain: the DH_GOLANG_EXCLUDES pattern keeps config/ out of the build but not out of the installed tree, all test failures are discarded, and a stray debug command is left in rules.

Issues

minor packaging 1. DH_GOLANG_EXCLUDES anchored at the import path excludes config/ from the build but not from the installed package ◂

Files: debian/rules:4, config/config.go
Basis: checked, in the package or with a reference tool
Evidence: export DH_GOLANG_EXCLUDES := ^gitlab.com/gitlab-org/api/client-go/v2/config(/|$$); dh-golang's install computes my $source_rel = File::Spec->abs2rel($source, "$builddir/src/$ENV{DH_GOPKG}") (golang.pm:875-878) and matches the pattern against that, while get_targets (golang.pm:735-752) matches it against the full import paths returned by go list.
Problem: The pattern only matches the full import path, so it removes the config package from go install/go test targets but never matches the relative paths used for installation ("config/config.go"), and DH_GOLANG_EXCLUDES_ALL defaults to true at compat 13, i.e. the exclusion is meant to apply to installation as well. /usr/share/gocode/src/gitlab.com/gitlab-org/api/client-go/v2/config/{config,extensions,oauth2_token_source}.go and config/v1beta1/config.pb.go are therefore shipped although they import buf.build/go/protovalidate, buf.build/go/protoyaml, github.com/zalando/go-keyring and google.golang.org/protobuf, none of which is in the binary package's Depends: Go sources are shipped that cannot be compiled by a user, which is also dead weight in the -dev package.
Fix: Use a pattern that matches both forms, e.g. export DH_GOLANG_EXCLUDES := (^|/)config(/|$$), and check the installed tree (dpkg -c) for usr/share/gocode/src/gitlab.com/gitlab-org/api/client-go/v2/config/.

minor packaging 2. dh_auto_test || true discards every test failure and no other step runs the tests ◂

Files: debian/rules:10-12
Basis: checked, in the package or with a reference tool
Evidence: override_dh_auto_test: / # Tests are flaky / dh_auto_test || true
Problem: The override throws away the exit status of the whole Go test run, so a failing test, or a test binary that does not compile at all, is invisible. dh_auto_test is part of dh's build sequence at compat 13 (Debian::Debhelper::Sequence::root_sequence, @bd), and the package's only other test path, Testsuite: autopkgtest-pkg-go, runs /usr/bin/dh_golang_autopkgtest, which just calls debian/rules build; the same override applies there. Nothing in the package or in autopkgtest therefore ever reports a test regression.
Fix: Fix or explicitly skip the flaky tests (build tag, -short, -run selection) so that dh_auto_test can fail the build, and add debian/tests/control if the full suite must stay out of the build; at minimum keep the ignoring limited to the known-flaky test names.

minor packaging 3. Leftover debug command @cat debian/files in execute_before_dh_builddeb ◂

Files: debian/rules:14-15
Basis: checked, in the package or with a reference tool
Evidence: execute_before_dh_builddeb: / @cat debian/files
Problem: This prints the contents of debian/files into every build log; nothing consumes it, and it is packaging code that exists only from debugging.
Fix: Drop the execute_before_dh_builddeb target.

Verified ◂

Read every file of debian/ (changelog, control, copyright, rules, lintian-overrides, gbp.conf, salsa-ci.yml, source/format, upstream/metadata); there are no patches, maintainer scripts, debian/tests or install/links/docs files.
Tree inventory over the whole 755-file tree (also compared with the orig tarball's top level): Go sources and tests, testdata/ JSON/GraphQL/text fixtures, testdata/systemhooks, testdata/webhooks, docs/, CI and container config, LICENSE. No binaries, fonts, images, PDFs or minified files; the pre-scan listed no built files.
Licence evidence: LICENSE is Apache-2.0; the Go file headers are // Copyright <year>, <holder> followed by Licensed under the Apache License, Version 2.0. A search for MIT, BSD, GPL, LGPL, MPL, ISC, CC and public-domain wording found no licence statement anywhere else: the hits are GitLab's own licence-template test data (project_templates_test.go "lgpl-3.0") and a random string in group_clusters_test.go.
Copyright completeness: the pre-scan's author check (debianscan authors) read all 755 files and reported every holder in the tree named in debian/copyright; spot-checked the unusual entries against the headers, e.g. orbit.go "Copyright 2026, GitLab Inc.", project_serviceaccounts.go "Copyright 2026, Jimmy Spagnola", dockerfile_templates.go "Copyright 2022, FantasyTeddy", resource_iteration_events.go "Copyright 2023, Hakki Ceylan, Yavuz Turk", nullable.go "Copyright 2024 oapi-codegen" — all present in the Files: * stanza.
nullable.go and nullable_test.go state "This code was adapted from https://github.com/oapi-codegen/nullable" and keep that project's Apache-2.0 header, so the Apache-2.0 declaration for them is consistent.
Generated files have their inputs in the tree and are not unexplained build artefacts: config/v1beta1/config.pb.go says source: config/v1beta1/config.proto and that .proto is present; testing/*_mock.go come from the //go:generate ... mockgen directives in testing/api_generated.go.
testdata/ contains only API fixtures (JSON, .graphql, show_merge_request_raw_diff.txt); gitlaboauth2/success.html is a self-contained template with no external assets, embedded via //go:embed success.html, which is why DH_GOLANG_INSTALL_EXTRA names it.
The orig tarball has no debian/ inside and matches the unpacked tree, so debian/copyright needs no Files-Excluded.
Standards-Version 4.7.4 against Policy 4.7.4.1 (reference tool policy): same first two components, so current.
Dependencies: inspected the imports of the shipped packages; the library uses google/go-querystring, hashicorp/go-cleanhttp, hashicorp/go-retryablehttp, golang.org/x/oauth2 and golang.org/x/time, and testing/ imports go.uber.org/mock/gomock in ordinary (non-test) files, so its place in Depends is right. testify and makenowjust/heredoc are only used by tests/examples and are marked <!nocheck>.
dh-golang behaviour checked in /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm (configure copies the whitelisted extensions, get_targets and install match DH_GOLANG_EXCLUDES against different path forms) and in /usr/share/perl5/Debian/Debhelper/Sequence/root_sequence.pm (dh_auto_test is in the build sequence at compat 13); /usr/bin/dh_golang_autopkgtest only calls debian/rules build.
debian/copyright is already in DEP-5 format with the correct Format URL and a pointer to /usr/share/common-licenses/Apache-2.0, so no replacement is proposed.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 3.46.0, packaged 2.50.0), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Build-Depends and Depends require golang-github-hashicorp-go-retryablehttp-dev (>= 0.7.8), but the reviewing system's package lists carry only version 0.7.1-1 of that package, so the versioned requirement looks unsatisfiable there; if no 0.7.8 upload is waiting in NEW, a clean build would fail to install the Build-Depends and the binary package would be uninstallable. A build in a clean unstable chroot would show which it is.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 8 hours ago.

Review Information

accepted — allocated to mechtilde 7 hours ago, started 7 hours ago, completed 7 hours ago.

Final Comment

Back to Dashboard | View all reviews for this package