DFSG NEW review for golang-sourcehut-rjarry-go-opt version 2.2.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is in DEP-5 format and matches the tree. Every upstream file is MIT/Expat, copyright 2023 Robin Jarry, except shlex.go, which carries Apache-2.0 code from Google (2012) and Robin Jarry's MIT-licensed changes; the file has its own stanza naming both holders and combining Apache-2.0 and Expat. The full Expat text is included and Apache-2.0 is correctly delegated to /usr/share/common-licenses/Apache-2.0. All licences are free and compatible; there are no non-free terms, no generated binaries, and no vendored third-party code.

Packaging

The packaging is otherwise clean and modern: debhelper compat 14 with dh-sequence-golang, Standards-Version 4.7.4 (current Policy is 4.7.4.1), correct XS-Go-Import-Path for the /v2 module, a minimal and sufficient Build-Depends set, Testsuite: autopkgtest-pkg-go, no patches, no maintainer scripts, and a sane gbp.conf. The one problem is the binary package rename in 2.2.1: the new golang-sourcehut-rjarry-go-opt-v2-dev has no Provides and no transition, while packages in the archive still build-depend on the old name golang-sourcehut-rjarry-go-opt-dev.

Issues

1. [important] [packaging] Renamed -dev binary leaves reverse build-dependencies unsatisfiable (no Provides/transition)

• Files: debian/control (Replaces and Conflicts fields); debian/changelog (2.2.1-1 entry)
• Basis: inferred from what was read, not seen directly
• Evidence: debian/control has Replaces: golang-sourcehut-rjarry-go-opt-dev and Conflicts: golang-sourcehut-rjarry-go-opt-dev but no Provides:. The archive's current binary is golang-sourcehut-rjarry-go-opt-dev 2.2.0-1, and aerc 0.22.0-2 carries Built-Using: ... golang-sourcehut-rjarry-go-opt (= 2.2.0-1), i.e. it was built against that -dev package.
• Problem: From 2.2.1 this source builds only golang-sourcehut-rjarry-go-opt-v2-dev. The old binary is no longer produced, so once the 2.2.0-1 binary leaves the archive every package whose Build-Depends names golang-sourcehut-rjarry-go-opt-dev — aerc at least, per its Built-Using — becomes unbuildable, until its source is updated. The import path is unchanged (git.sr.ht/~rjarry/go-opt/v2), so a compatibility Provides costs nothing.
• Fix: Add Provides: golang-sourcehut-rjarry-go-opt-dev (= ${binary:Version}) (or unversioned if all reverse build-deps are unversioned) to the binary package, or update all reverse build-dependencies in a coordinated transition. Also consider Breaks alongside Replaces and a versioned Replaces: golang-sourcehut-rjarry-go-opt-dev (<< 2.2.1-1), as Policy 7.6.1 recommends for a replaced package.

Verified

• Prescan: it listed no files to examine; its author check found all copyright holders named in debian/copyright.
• Upstream tree is small: 8 .go files, README.md, go.mod, go.sum, LICENSE, .build.yml, .gitignore; no vendored code, binaries, archives, minified files or generated sources. go.sum holds only checksums of testify and its indirect test dependencies.
• args.go and args_test.go carry SPDX-License-Identifier: MIT and Robin Jarry 2023; spec.go, complete.go, opt.go and the remaining tests have no header but are covered by Files: * and the top-level MIT LICENSE.
• shlex.go header: Google's 2012 Apache-2.0 notice for the inspired code plus SPDX-License-Identifier: MIT for Robin Jarry's changes; debian/copyright names both holders and both licences for that file, README.md says the same.
• debian/copyright is DEP-5 with Format:, Upstream-Name, Source, Files: * / shlex.go / debian/* stanzas in the correct override order, and stand-alone License: paragraphs for Expat and Apache-2.0.
• All debian/ files read: control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, watch (not reviewed), source/format (3.0 quilt), upstream/metadata, upstream/signing-key.asc (ASCII-armoured PGP key). No patches, install files, maintainer scripts or debian/tests/.
• Build-Depends (debhelper-compat (= 14), dh-sequence-golang, golang-any, golang-github-stretchr-testify-dev) all exist; the tests import only the standard library and testify, so the set is sufficient.
• tests/control is unnecessary: autopkgtest-pkg-go is a test suite known to autopkgtest/lintian.
• Standards-Version 4.7.4 is current (Policy 4.7.4.1; first two components match).
• gbp.conf's dist = DEP14 is valid: gbp's buildpackage accepts both DEP-14 and DEP14 as the special branch-derived distribution value.
• Not verified: the package was not built and its tests were not run.
• uscan found the packaged version as the newest upstream release (upstream 2.2.1, packaged 2.2.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• That aerc's Build-Depends names exactly golang-sourcehut-rjarry-go-opt-dev is inferred from its Built-Using field; the binary package lists on the reviewing system cannot show source Build-Depends. If aerc's Build-Depends were already updated to the new name in the same batch, the rename would be safe.

Proposed changes

None.