DFSG NEW review for golang-k8s-controller-manager version 0.36.4-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Licensing is DFSG-free and uniformly Apache-2.0. The top-level LICENSE is the complete Apache License 2.0, and every .go file carries the standard Apache-2.0 header naming ``The Kubernetes Authors'' (years 2014-2023); no other holder, license text, SPDX tag or restrictive term appears anywhere in the tree. debian/copyright is DEP-5: Files: * covers all upstream files and the later debian/* stanza covers the packaging, both Apache-2.0, with the license notice plus a pointer to /usr/share/common-licenses/Apache-2.0, which is accurate and complete.

Packaging

A small, correct pkg-go package: debhelper compat 14 with dh $@ --buildsystem=golang, dh-sequence-golang, dpkg-build-api (= 1), Standards-Version 4.7.4 (current with Policy 4.7.4.1), DEP-14 gbp configuration, Testsuite: autopkgtest-pkg-go, 3.0 (quilt) with no patches, and an initial-release changelog closing the ITP. Build and runtime dependencies match the code's imports one by one and every named package exists in unstable at 0.36.4; golang-any 2:1.27~1 satisfies the go 1.26.0 directive. The only defect is an over-broad oauth2 dependency (minor).

Issues

1. [minor] [packaging] Depends and Build-Depends name golang-golang-x-oauth2-google-dev although only golang.org/x/oauth2 is imported

• Files: debian/control, pkg/clientbuilder/client_builder_dynamic.go:26
• Basis: checked, in the package or with a reference tool
• Evidence: client_builder_dynamic.go:26 imports "golang.org/x/oauth2" (no ``oauth2/google'' anywhere in the tree); debian/control lists golang-golang-x-oauth2-google-dev in both Build-Depends and the -dev package's Depends. apt-cache: golang-golang-x-oauth2-dev provides package oauth2; golang-golang-x-oauth2-google-dev provides oauth2/google and Depends on the base package plus golang-google-cloud-compute-metadata-dev.
• Problem: The binary package and the build dependency point at the google sub-packge, which the code never imports. It works only transitively (google-dev depends on the base oauth2 package), and it drags golang-google-cloud-compute-metadata-dev into the build chroot and into the dependency set of every consumer of the -dev package. Relationship fields should name the packages providing the imported modules.
• Fix: Replace golang-golang-x-oauth2-google-dev with golang-golang-x-oauth2-dev in both Build-Depends and Depends (keep golang-github-stretchr-testify-dev, which the tests import).

Verified

• All upstream files were inventoried file by file (52 paths outside debian/), matching the file list of the orig tarball; go.mod was compared with the tarball's copy and is identical, so no unrecorded modification is present.
• Every .go file carries the Apache-2.0 header Copyright <year> The Kubernetes Authors; LICENSE is the full Apache-2.0 text (201 lines). Greps for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/GNU Lesser/Apache/Mozilla/BSD/MIT/All rights reserved/non-commercial/NonCommercial/NoDerivatives/Commons Clause found nothing else.
• The prescan's author check found no holder missing from debian/copyright; this matches my own grep of all files. The only Copyright strings outside the file headers are in the LICENSE appendix boilerplate (Copyright {yyyy} {name of copyright owner}) and the two debian/copyright stanzas.
• Files without an in-file notice (OWNERS, config/OWNERS, pkg/features/OWNERS, SECURITY_CONTACTS, CONTRIBUTING.md, code-of-conduct.md, README.md, .github/PULL_REQUEST_TEMPLATE.md, go.mod, go.sum) are repository metadata covered by the root LICENSE and by the Files: * stanza.
• config/zz_generated.deepcopy.go, config/v1/zz_generated.deepcopy.go, config/v1alpha1/zz_generated.{conversion,deepcopy,model_name}.go and config/v1beta1/zz_generated.{conversion,deepcopy,model_name}.go are upstream-generated Go sources (Code generated by deepcopy-gen. DO NOT EDIT.), derived from the types.go files present in the same packages; they are source, not build artifacts, and need no separate generator input for DFSG purposes.
• The scan listed no built binaries, minified files, archives or PDFs; the tree contains only Go source, go.mod/go.sum, markdown and plain-text metadata.
• debian/copyright: DEP-5, correct Format URL, Files: * then debian/* (later stanza wins), Apache-2.0 short name matches the LICENSE text, full text available via common-licenses, and the packaging stanza names the Debian copyright holder.
• Dependency cross-check against imports: k8s.io/{api,apimachinery,apiserver,client-go,component-base,klog,utils}, github.com/spf13/pflag, golang.org/x/oauth2 and (tests) github.com/stretchr/testify are all in Build-Depends and Depends and all exist in unstable at the required versions (apt-cache: golang-k8s-api-dev 0.36.4-1, -apimachinery 0.36.4-3, -apiserver 0.36.4-2, -client-go 0.36.4-1, -component-base 0.36.4-2, -utils git20260707, golang-any 2:1.271).
• dpkg-build-api (= 1) is a real virtual package provided by dpkg-dev 1.23.11 and is the recommended level; dh-sequence-golang is provided by dh-golang 1.67; at compat 14 relationship substvars are added by dh_gencontrol, so ${misc:Depends} alone is correct.
• A --builddirectory inside debian/ is handled by dh-golang's build system, which skips the debian/ directory when copying sources into the Go workspace; debian/rules clean removes it.
• debian/changelog: version 0.36.4-1 matches upstream tag v0.36.4 (gbp upstream-vcs-tag = v%(version%~%-)s), distribution unstable, a single ITP closure, and the date is a real Friday
• dist = DEP14 in debian/gbp.conf is a valid gbp sentinel, not a distribution name: gbp/scripts/buildpackage.py handles options.pbuilder_dist == 'DEP14' by deriving the suite from the DEP-14 branch.
• debian.tar.xz contains only the debian/ files, with no patches/ directory, consistent with 3.0 (quilt) and an empty patch series.
• Tests import only packages already in the declared dependencies (testify/assert, k8s.io/client-go/util/testing, k8s.io/apiserver/pkg/server/healthz, k8s.io/component-base/config, k8s.io/apimachinery, pflag).
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.37.2, packaged 0.36.4), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• No build or test run was possible; the statement that the code compiles and its tests pass against the archive's 0.36.4 libraries rests on the exact version match found with apt-cache, not on an observed build.

Proposed changes

None.