DFSG NEW review for golang-gopkg-mail.v2 version 2.3.1-6

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: absent
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5: Files: * gives 2014 Alexandre Cesaro under Expat (MIT) for all upstream files, debian/* covers the packaging under the same licence, and the full Expat text is included. The tree's only licence notice is LICENSE, whose text matches that stanza; there are no per-file notices, no vendored third-party code, no non-free terms and no unlicensed files. The pre-scan's holder check found nothing missing, and I found no holder it omits.

Packaging

A standard, clean Debian Go packaging: compat 13 with dh-golang and golang-any, one architecture-independent -dev package with Multi-Arch: foreign and XS-Go-Import-Path, ${misc:Depends}, Testsuite: autopkgtest-pkg-go, 3.0 (quilt), gbp/gitlab-ci files from the Go team template, and Standards-Version 4.7.3 (Policy is 4.7.4.1). The one patch is a test-only, DEP-3-styled workaround for the Go 1.24 MIME table; with unstable's Go 1.27 the builtin table again has .txt/.zip, so it is redundant there but harmless (and still useful for older-Go backports). The -6 upload is a reintroduction of a package the archive no longer has, consistently versioned above -5.

Issues

1. [minor] [packaging] There is no debian/watch

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Problem: Without a watch file new upstream releases are not noticed by uscan, the tracker or the maintainer's tools.
• Fix: Add a debian/watch in version 5 format, or, if upstream has no usable release channel, one holding a comment that says so.

Verified

• Read in full: all 20 upstream files (LICENSE, README.md, CONTRIBUTING.md, CHANGELOG.md, .gitignore, .travis.yml, doc.go, all .go sources and tests), plus every file under debian/ (copyright, control, rules, changelog, source/format, gbp.conf, gitlab-ci.yml, patches/series and the patch).
• Licence evidence: a grep of the whole tree for Copyright, (C), ©, SPDX-License-Identifier, Permission is hereby granted, GNU, Apache, Mozilla, public domain, All rights reserved, Licensed under returned only LICENSE and debian/copyright. LICENSE is MIT text matching the Expat paragraph in debian/copyright; the only notice is Copyright (c) 2014 Alexandre Cesaro, which Files: * names.
• No third-party or vendored code: every import is Go stdlib except gopkg.in/alexcesaro/quotedprintable.v3 in mime_go14.go, which is guarded by // +build !go1.5 and therefore never compiled with any Go in Debian; no licence-bearing copy of it is shipped.
• The pre-scan listed no individual files to account for; its author check found every holder it saw named in debian/copyright, and I found none omitted. CHANGELOG.md:34,36 ("Contributed by Quantcast.") is an acknowledgement of a contribution, not a copyright notice, so it needs no holder entry.
• Files-Excluded: Godeps/_workspace names a path absent from the orig tarball: the tarball holds the same 20 files as the unpacked tree and no Godeps/, so nothing was repacked and no +ds version is due; the entry is informational only.
• Patch 0001 is test-only and has DEP-3-style From/Date/Subject headers plus a description; the .css/.webp expectations it introduces match Go's builtin types (checked /usr/lib/go-1.27/src/mime/type.go:72,120), and Go 1.27 again has .txt/.zip builtin (type.go:114,129), so the workaround is redundant on unstable's default golang-any 2:1.27~1 but not harmful.
• Packaging checked: debhelper-compat (= 13), dh-golang, golang-any; Architecture: all with Multi-Arch: foreign and Depends: ${misc:Depends} (same shape as archive Go dev packages such as golang-gopkg-yaml.v3-dev); XS-Go-Import-Path: gopkg.in/mail.v2; Testsuite: autopkgtest-pkg-go (the implicit control file, so no debian/tests/control is needed); source format 3.0 (quilt); Standards-Version: 4.7.3 against Policy 4.7.4.1 (first two components match).
• No maintscripts, install/links/docs/dirs files or debian/tests exist, and none are required for a single source-only arch:all package.
• apt-cache show golang-gopkg-mail.v2-dev finds it nowhere in unstable, consistent with the -6 changelog's "reintroduce"; version 2.3.1-6 sorts above 2.3.1-5.

Not confirmed

• As instructed, nothing was built or executed; the patch's expected MIME values were checked against the installed Go 1.27 mime table rather than by running go test.
• Whether a bug (ITP or the removal request) exists to which the -6 reintroduction entry should refer; the changelog cites none and the archive lists cannot show it.

Proposed changes

None.