golang-gopkg-evanphx-json-patch.v4 4.13.0-1

Package Information

Description	apply RFC6902/RFC7396 JSON patches (gopkg.in v4) Go library to apply RFC 6902 JSON patches and create/apply RFC 7396 merge patches. This package provides the gopkg.in/evanphx/json-patch.v4 import path (v4 API). The v5 API is already in golang-github-evanphx-json-patch-dev.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Hermes Rodríguez <hrodrig@usb.ve>
Sponsor	maytham@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-gopkg-evanphx-json-patch.v4.git (browse)
Closes	#1148498
Tracker	https://tracker.debian.org/pkg/golang-gopkg-evanphx-json-patch.v4
Uploaded	2 hours ago

New Package Report

.changes◂

Changed-By	Hermes Rodríguez <hrodrig@usb.ve>
Architecture	source all
Distribution	unstable
Date	Sun, 08 Nov 2026 19:53:35 +0800
Source	golang-gopkg-evanphx-json-patch.v4
Version	4.13.0-1

Changelog◂

golang-gopkg-evanphx-json-patch.v4 (4.13.0-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1148498)

.dsc◂

Section	golang
Priority	optional
Component	main
Package-List	golang-gopkg-evanphx-json-patch.v4-dev deb golang optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: json-patch
Upstream-Contact: https://github.com/evanphx/json-patch/issues
Source: https://github.com/evanphx/json-patch

Files: *
Copyright: 2014 Evan Phoenix
License: BSD-3-clause

Files: v5/internal/json/*
Copyright: 2010-2021 The Go Authors
License: BSD-3-clause

Files: debian/*
Copyright: 2026 Hermes Rodríguez <hrodrig@usb.ve>
License: BSD-3-clause

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
   * Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
   * Neither the name of the copyright holder nor the names of its
     contributors may be used to endorse or promote products derived from
     this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
 OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for golang-gopkg-evanphx-json-patch.v4 version 4.13.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 1 minor
debian/watch: old format (version 4)
debian/copyright: machine-readable
Scan before the review: 1 found

Licensing

Everything in the tree is DFSG-free: upstream's own code is 3-clause BSD, and the 21 files under v5/internal/json are copies of Go's encoding/json under Go's BSD-3 terms, with the licence text reproduced in debian/copyright and the Go Authors named. The copyright file is not complete, however: cmd/json-patch/file_flag.go and its v5/ copy say they were borrowed from Concourse (Apache-2.0), yet the only stanza that matches them claims Copyright: 2014 Evan Phoenix under BSD-3-clause, and no stanza or comment mentions Concourse at all. All other holders, licences and files in the tree are matched correctly by the DEP-5 stanzas.

Packaging

Tidy dh-make-golang-style packaging. debian/rules uses the golang buildsystem with DH_GOLANG_EXCLUDES := cmd v5, which does exclude both the CLI (which needs go-flags) and the nested v5 module from dh_golang's target list and install filter, so only the standard-library-only v4 library is built, tested and shipped; Build-Depends is therefore complete. Compat 13 with dpkg-build-api 1, dh-sequence-golang, Testsuite: autopkgtest-pkg-go, correct Vcs-*/Homepage/XS-Go-Import-Path, gbp.conf and upstream/metadata are sane, and Standards-Version 4.7.4 is current against Policy 4.7.4.1. No patches, maintainer scripts or missing dependencies; nothing needed fixing in the packaging.

Issues

blocker licensing 1. debian/copyright records cmd/json-patch/file_flag.go as Evan Phoenix/BSD-3 although it is copied from Concourse ◂

Files: cmd/json-patch/file_flag.go:3, v5/cmd/json-patch/file_flag.go:3, debian/copyright:6-8
Basis: checked, in the package or with a reference tool
Evidence: Both copies begin // Borrowed from Concourse: https://github.com/concourse/atc/blob/master/atccmd/file_flag.go, and the body is that file's FileFlag/UnmarshalFlag/Path code verbatim, with no copyright or licence notice of its own. debian/copyright's only matching stanza is Files: * / Copyright: 2014 Evan Phoenix / License: BSD-3-clause; no stanza (and no Comment) names Concourse or any other holder.
Problem: The two files are third-party code from Concourse (published under the Apache License 2.0), so they are neither Evan Phoenix's copyright nor BSD-3-clause work, and Apache-2.0 requires its notices to be kept. The files are not installed (DH_GOLANG_EXCLUDES := cmd v5), so the binary package is unaffected, but the source package ships them and debian/copyright must accurately record the copyright and licence of every file in it (Policy 12.5; copyright-format 5.2 requires the Copyright and License fields to state them). As written the copyright file is inaccurate.
Fix: Add a Files stanza for cmd/json-patch/file_flag.go v5/cmd/json-patch/file_flag.go with the Concourse project's copyright statement and License: Apache-2.0, plus a stand-alone License: Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0 (Policy 12.5 prefers the reference to quoting the text); alternatively ask upstream to drop or replace the borrowed code.

minor packaging 2. debian/watch is in the old version 4 format ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: version=4
Problem: Version 5 is the current format of debian/watch.
Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

Read every file of debian/ in full (control, rules, changelog, gbp.conf, salsa-ci.yml, gitlab-ci.yml, source/format, upstream/metadata, copyright); the .debian.tar.xz contains exactly these files, with no patches, tests/control or maintainer scripts.
Covered the upstream tree by reading LICENSE and README in full, the heads of every .go file, and grepping all 45 files for Copyright/(C)/(c)/©/SPDX/licence/BSD/GPL wording and for borrow/generate/URL markers; only LICENSE and the 21 Go files under v5/internal/json carry copyright notices.
v5/internal/json/testdata/code.json.gz is a gzip stream whose member is code.json (1.9 MB uncompressed): Go's encoding/json JSON test corpus, i.e. test data, not a built artifact. The plain JSON is recoverable with gunzip, and Files: v5/internal/json/* assigns it to The Go Authors/BSD-3. No test in this tree references it.
debian/copyright is valid DEP-5 with the correct Format URL; Files: *, v5/internal/json/* (2010-2021 The Go Authors) and debian/* stanzas, and a stand-alone BSD-3-clause paragraph whose terms match the top-level LICENSE.
The Go-derived files under v5/internal/json say their BSD-style licence is in 'the LICENSE file'; their terms are the same 3-clause BSD as the text reproduced in debian/copyright, so the licence is included as required.
v5/ is a separate module (go.mod: module github.com/evanphx/json-patch/v5, requiring go-flags and x/sys) and cmd/ imports go-flags; both are excluded via DH_GOLANG_EXCLUDES ('cmd' and 'v5' are matched as regexes against dh_golang's target list and install filter), so no Build-Depends for those libraries is needed and neither is installed.
The v4 root package (patch.go, merge.go, errors.go) imports only the standard library, as do patch_test.go and merge_test.go, so golang-any suffices as the only build dependency.
dpkg-build-api (= 1) is provided by dpkg-dev 1.23.11 on the reviewing system, debhelper-compat (= 13) is satisfied (debhelper 14.5 installed), and Standards-Version 4.7.4 matches Policy 4.7.4.1 (same 4.7 series).
apt-cache shows golang-github-evanphx-json-patch-dev 5.7.0 in unstable, so the description's statement that the v5 API is already there is accurate; golang-gopkg-evanphx-json-patch.v4-dev exists nowhere yet, so the changelog's 'Initial release' and ITP closure are consistent.
No .maintscript, debian/tests, patches/series or install/links/docs files exist to go wrong; Testsuite: autopkgtest-pkg-go with autodep8 is the Go team's normal pattern, and gbp.conf/upstream/metadata fields are well formed.
uscan found the packaged version as the newest upstream release (upstream 4.13.0, packaged 4.13.0).

Not confirmed ◂

The gzip payload of v5/internal/json/testdata/code.json.gz was not decompressed (the reader reports only the member name and size); its identification as Go's JSON test corpus follows from that member name and the Go encoding/json copy it sits beside.
The upstream licence file of the Concourse project could not be inspected from the reviewing system (no network); its Apache-2.0 licence is known from the project, and the copyright mismatch in debian/copyright stands on the file's own 'Borrowed from Concourse' note regardless.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Template: Github
Dist: https://github.com/evanphx/json-patch
Uversionmangle: s/(\d)[_\.\-+]?(RC|rc|pre|dev|beta|alpha)[.]?(\d*)$/$1~$2$3/

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-09 13:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package