Review: golang-k8s-apiextensions-apiserver 0.36.4-1

Package Information

Description	API server for API extensions like CustomResourceDefinitions (library) apiextensions-apiserver provides an API for registering CustomResourceDefinitions (CRDs), the mechanism used to extend the Kubernetes API with custom resource types. It implements the thirdpartyresources design proposal from the Kubernetes api-machinery group. It provides the implementation for CustomResourceDefinitions that is included as a delegate server inside of kube-apiserver, handling the registration, validation, and serving of custom resources.
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Arthur Diniz <arthurbd@debian.org>
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-k8s-apiextensions-apiserver.git (browse)
Closes	#1135575
Tracker	https://tracker.debian.org/pkg/golang-k8s-apiextensions-apiserver
Uploaded	25 days ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Wed, 16 Sep 2026 22:27:35 +0100
Source	golang-k8s-apiextensions-apiserver
Version	0.36.4-1
Changed-By	Arthur Diniz <arthurbd@debian.org>

Changelog◂

golang-k8s-apiextensions-apiserver (0.36.4-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1135575)

.dsc◂

Component	main
Package-List	golang-k8s-apiextensions-apiserver-dev deb golang optional arch=all
Section	golang
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/kubernetes/apiextensions-apiserver
Upstream-Name: apiextensions-apiserver
Upstream-Contact: http://slack.k8s.io

Files: *
Copyright: 2014-2025 The Kubernetes Authors
License: Apache-2.0

Files: debian/*
Copyright: 2026 Arthur Diniz <arthurbd@debian.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 25 days ago.

Report◂

DFSG NEW review for golang-k8s-apiextensions-apiserver version 0.36.4-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

The upstream tree is uniformly licensed Apache-2.0 by The Kubernetes Authors. Every Go source file (sampled across pkg/, examples/, test/, hack/, root) carries the standard Copyright ... The Kubernetes Authors + Apache-2.0 header; the root LICENSE is the full Apache-2.0 text. A tree-wide grep (excluding .pc/ and debian/) found no non-Apache licence markers (no MIT/BSD/ISC/GPL/MPL/CC, no "Good, not Evil" or other non-free terms), no non-Kubernetes copyright holders, and no vendored third-party code (no vendor/ directory). The only binary files are four .pb protobuf test fixtures under pkg/apis/testdata that have human-readable .json/.yaml counterparts. debian/copyright is DEP-5 (Format: copyright-format/1.0, exact canonical URL), accurately covers Files: * (Apache-2.0, The Kubernetes Authors) and Files: debian/* (Apache-2.0, packaging author), includes the full Apache-2.0 text with a /usr/share/common-licenses reference; there is no Files-Excluded because the orig tarball is un-repacked. Headerless data/config files (yaml/json/swagger, OWNERS, .import-restrictions) carry no individual notices but are upstream-generated and covered by the aggregate LICENSE and the Files: * stanza.

Packaging

The packaging follows the Debian Go Packaging Team golang-repo-template and is of good quality. debian/control: single Architecture: all, Multi-Arch: foreign -dev package; Build-Depends matches Depends; every named -dev dependency exists in unstable and covers the actual imports (cel-go → golang-cel-cel-go-dev providing cel.dev/cel-go, yaml v2 → golang-gopkg-yaml.v2-dev which also ships go.yaml.in/yaml/v2, etcd, kms, sigs-json/randfill all present). debian/rules is a clean dh invocation with the golang buildsystem, DH_GOLANG_EXCLUDES for the etcd-dependent test/integration, DH_GOLANG_INSTALL_EXTRA for the test manifest, and a hook removing the unwanted apiextensions-apiserver binary from the -dev package. Patches have DEP-3-style headers with clear rationale and are correctly not forwarded (json-patch v5 swap is test-only; cel-go import rewrite matches the Debian package rename in bug #1146564). No maintainer scripts needed for a library-only package. Standards-Version 4.7.4 is current (4.7.4.1 was a no-change repack). dpkg-build-api (= 1), gbp.conf, salsa-ci and upstream/metadata are present and correct.

Issues

minor packaging 1. Patch 0002 does more than its description states: CEL cost test values are changed without being mentioned ◂

Files: debian/patches/0002-Migrate-cel-go-import-path-to-cel.dev-cel-go.patch
Evidence: The patch Subject says only 'Migrate cel-go import path to cel.dev/cel-go' and the description says 'Rewrite all imports from github.com/google/cel-go to cel.dev/cel-go', but the diff also changes expected cost numbers in pkg/apiserver/schema/cel/celcoststability_test.go (e.g. "self.val1.startsWith('Rook')": 4 -> 3, exists(m, m.v2 == 'z'): 24 -> 22, optMap(...).hasValue(): 18 -> 29) and a cost budget 9 -> 8 in pkg/apiserver/schema/defaulting/validation_test.go.
Problem: These numeric changes adapt the tests to Debian's newer cel-go (0.32.0) than the version upstream pins (0.26.0); they are not part of the import-path migration the patch claims to be. The description omits them, so a reviewer or future maintainer cannot tell whether they are deliberate and how the values were derived.
Fix: Extend the patch comment to state that the CEL cost-stability expectations and the cost budget in the two test files were adjusted to match the cel-go version Debian ships, and that the changes are test-only.

Verified ◂

Read all of debian/copyright, control, rules, changelog, examples, gbp.conf, salsa-ci.yml, patches/series and both patches, source/format, upstream/metadata, and the .dsc
Read root LICENSE (Apache-2.0 full text) and top-level README/OWNERS/CONTRIBUTING/code-of-conduct/SECURITY_CONTACTS/main.go/go.mod
Sampled every directory of the upstream tree (pkg/, examples/, test/, hack/, artifacts/, .github/); every Go file read carries the Apache-2.0 header 'Copyright ... The Kubernetes Authors'
Tree-wide grep for licence markers (SPDX, GNU GPL/LGPL, Apache, MPL, public domain, MIT, BSD, ISC, ZLIB, MPL, Affero, 'Good, not Evil', JSON License, CC-BY) and for other copyright holders (Google Inc, Red Hat, SUSE, VMware, Microsoft, CNCF, etc.) found no non-Apache licence and no non-Kubernetes holder; go.mod/go.sum contain no licence claims
No vendor/ directory exists; all third-party imports resolve to Debian golang packages
Binary/tool data in tree is limited to pkg/apis/testdata/HEAD/*.pb (with .json/.yaml counterparts) and two test TLS key/cert files under pkg/cmd/server/testing/testdata (README: 'generated for testing purposes only')
Package-name existence checked for the unusual deps: golang-cel-cel-go-dev, golang-etcd-server-dev, golang-k8s-kms-dev, golang-k8s-sigs-randfill-dev, golang-k8s-sigs-json-dev, golang-gopkg-yaml.v2-dev all present in the package lists
golang-gopkg-yaml.v2-dev ships the go.yaml.in/yaml/v2 import path used by pkg/controller/openapi/v2/conversion_test.go (verified on the reviewing system at /usr/share/gocode/src/go.yaml.in/yaml/v2)
No remaining github.com/google/cel-go or gopkg.in/evanphx/json-patch.v4 imports in the active tree; patch 0002 rewrote all to cel.dev/cel-go and the only remaining mentions are in comments/go.mod/go.sum
dh_golang and the debhelper golang buildsystem man pages confirm a GOPATH-mode build, so the stale go.mod requires (github.com/google/cel-go, gopkg.in/evanphx/json-patch.v4) cannot break the build
Patches 0001/0002 touch only test files; test/integration (including the json-patch v5 test) is excluded from the build via DH_GOLANG_EXCLUDES
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.37.1, packaged 0.36.4), which is not a fault of the package.

Not confirmed ◂

Could not run the actual build or tests in the archive environment (reviewing system does not have the k8s golang dependencies installed); build correctness is inferred from go-team conventions, package-list, and import-path checks
The CEL cost-stability expected values adjusted in patch 0002 were not re-verified by running those tests against Debian's cel-go 0.32.0
Only representative reads of .go files in every directory plus tree-wide greps, not a line-by-line read of all ~300 source files

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 24 days ago, started 24 days ago, completed 24 days ago.

Final Comment

See full review detail for one minor issue found by LLM review.

Back to Dashboard | View all reviews for this package