DFSG NEW review for golang-gorm-driver-sqlite version 1.6.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with a Files: * stanza (MIT/Expat, 2013-NOW Jinzhu) and a Files: debian/* stanza (2026 Maytham Alsudany), and reproduces the full Expat text. The only copyright/licence notice in the tree is License, whose holder and terms the file matches; nothing in the tree carries other holders, non-free terms, or a different licence, and no binaries, minified files, generated code or vendored third-party code are present.

Packaging

Modern Debian Go Team packaging: debhelper compat 13 with dh-sequence-golang, dh-golang build from go.mod, a single arch:all -dev package with Multi-Arch: foreign, both imported modules in Build-Depends/Depends, Testsuite: autopkgtest-pkg-go, DEP-5 copyright and the team's salsa-ci/gbp metadata. Standards-Version: 4.7.4 is current against Policy 4.7.4.1, the changelog is a valid initial release, and no patches are needed.

Issues

None.

Verified

• Read every file under debian/ (control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, upstream/metadata); debian/watch not reviewed, as instructed.
• Read all 16 upstream files (14 at top level plus .github/dependabot.yml and .github/workflows/ci.yml); all are plain Go, YAML, Markdown or text.
• Only copyright/licence notice in the upstream tree is License: Copyright (c) 2013-NOW Jinzhu <wosmvp@gmail.com>, MIT text; the prescan's author check found no holder that debian/copyright omits, and Files: * with License: Expat matches it.
• No non-free wording anywhere (grep for non-commercial, no-modification, field-of-use, CC-*-NC/ND, public-domain and similar found none), and no License/COPYING/NOTICE/AUTHORS files in subdirectories.
• No binary, minified, generated or archive files: ddlmod_test.go etc. are ordinary Go test sources, and the SQL strings in the tests are plain test data.
• Dependencies checked with apt-cache: golang-gorm-gorm-dev 1.31.1 (go.mod requires 1.30.0), golang-github-mattn-go-sqlite3-dev 1.14.52 (requires 1.14.22), and dh-sequence-golang is provided by dh-golang 1.67. The indirect modules (jinzhu/now, jinzhu/inflection, x-text) are Depends of golang-gorm-gorm-dev, hence present for the GOPATH-mode dh-golang build.
• Standards-Version: 4.7.4 compared with the policy tool's current Policy 4.7.4.1: first two components match, so current.
• Build layout is the standard Go one: at compat 13 dh_auto_install writes into the single package directory, so no .install files are needed and dh_missing --fail-missing has nothing outstanding.
• The orig tarball's License and go.mod were read from the archive and match the unpacked tree byte-for-byte.
• uscan found the packaged version as the newest upstream release (upstream 1.6.0, packaged 1.6.0).

Not confirmed

• No build or test was run; in particular I could not compile the tests against Debian's gorm 1.31.1 (they use gorm.io/gorm/utils/tests), though the version satisfies go.mod's requirement.
• The orig tarball's sole top-level directory is go-gorm-sqlite-6f07b51/, which is not a release-tag name; without network access I could not confirm it is the upstream v1.6.0 tag (its contents match the unpacked tree).

Proposed changes

None.