DFSG NEW review for gumbo-parser version 0.14.1+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 3 blocker, 1 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 3 found

Licensing

The core library, examples, Python bindings and autogen.sh are correctly Apache-2.0/ISC, and the DEP-5 file is well-formed. But debian/copyright does not describe the third-party test and fuzz data shipped in the source: every tests/tree_construction/*.dat is copied from the Web Platform Tests (update.sh), and six complete third-party web pages are shipped under fuzz/corpus; neither is covered by any stanza, while the Files: * stanza asserts Apache-2.0 with Google/contributors as holders. The src/utf8.c stanza also wrongly overrides the file's Google/Apache-2.0 header with an Expat-only declaration, and doc/entities.json is WHATWG material with no stanza. The corpus in particular is redistributed without any documented permission, so the source is not demonstrably DFSG-free.

Packaging

The packaging is generally sound: compat 13 with the dh sequencer and meson, correct Multi-Arch same on both arch:any packages, a symbols file, a working ${python3:Depends} python3-gumbo package, hardening enabled, a current Standards-Version and clean changelog. Only minor cleanups are warranted: the retained 00-tests.patch edits Makefile.am although the build uses meson (it is dead), and debian/upstream/metadata still points at the old upstream repository.

Issues

1. [blocker] [licensing] Six complete third-party website pages shipped in fuzz/corpus with no licence

• Files: fuzz/corpus/blender.org.2025.07.06.html, fuzz/corpus/codeberg.org.2025.07.06.html, fuzz/corpus/ffmpeg.org.2026.08.16.html, fuzz/corpus/kernel.org.2025.07.06.html, fuzz/corpus/openssh.org.2026.08.16.html, fuzz/corpus/sqlite.org.2026.08.16.html, debian/copyright:6-9
• Basis: checked, in the package or with a reference tool
• Evidence: The files are full captures of the six sites (e.g. <title>blender.org - Home of the Blender project ...</title>, <title>SQLite Home Page</title>). debian/copyright says Files: * / Copyright: 2010-2014, Google Inc / 2026 gumbo-parser contributors / License: Apache-2.0; no other stanza and no licence file mention them.
• Problem: These are third-party, copyrighted web pages (text and markup, including site branding) reproduced in the source tarball without any licence grant or attribution. They are not authored by Google or the gumbo contributors, so Apache-2.0 on the catch-all cannot cover them. Redistributing them without permission violates the DFSG; Policy 12.5 requires the copyright file to describe the distribution licence of every file.
• Fix: Remove the corpus from the DFSG tarball: add fuzz/corpus/* to Files-Excluded in debian/copyright and repack (the corpus is unused unless -Dfuzz=true), or document an explicit licence and holder for each page if one exists.

2. [blocker] [licensing] WPT tree-construction test data has no copyright stanza

• Files: tests/tree_construction/*.dat, tests/tree_construction/update.sh, README.md:18, debian/copyright:6-9
• Basis: checked, in the package or with a reference tool
• Evidence: update.sh says WPT DIRECTORY is usually cloned from https://github.com/web-platform-tests/wpt and copies "$src"/html/syntax/parsing/resources/*.dat into the directory; README.md advertises conformance with the Web Platform Tests suite. debian/copyright attributes all of tests/ to Google/contributors under Apache-2.0.
• Problem: Every tests/tree_construction/*.dat is imported third-party test data, not gumbo code. The package contains neither the WPT authors' copyright notice nor the WPT licence text, and the catch-all's Apache-2.0 claim does not apply to them. A copyright file that names the wrong holder and omits the actual licence for 66 files is inaccurate and incomplete; Policy 12.5 requires the licence of every file to be stated.
• Fix: Add a Files: tests/tree_construction/*.dat stanza naming the Web Platform Tests contributors as copyright holders and stating the WPT licence (and its full text in a stand-alone License paragraph, since it is not in /usr/share/common-licenses), and exclude these paths from the Files: * claim.

3. [blocker] [licensing] src/utf8.c stanza overrides its Apache-2.0 header with an Expat-only declaration

• Files: src/utf8.c:1-10, src/utf8.c:46-57, debian/copyright:30-33
• Basis: checked, in the package or with a reference tool
• Evidence: The file begins // Copyright 2010 Google Inc. All Rights Reserved. followed by the Apache-2.0 grant, and embeds a block starting // Copyright (c) 2008-2009 Bjoern Hoehrmann <bjoern@hoehrmann.de> under the Expat permission notice. debian/copyright has Files: src/utf8.c / Copyright: (c) 2008-2009 Bjoern Hoehrmann / License: Expat, which overrides Files: *.
• Problem: The stanza declares the whole file Expat and drops Google's copyright and Apache-2.0 licence for the surrounding code, so the copyright file misstates the licensing of a file that is linked into libgumbo.so. This is an inaccurate debian/copyright (Policy 12.5).
• Fix: List both holders in the stanza (Copyright: 2010, Google Inc and (c) 2008-2009 Bjoern Hoehrmann) and give both licences, e.g. a stand-alone License: Apache-2.0 and Expat with the Expat text retained, or split the file's portions in the comment if that is preferred.

4. [important] [licensing] doc/entities.json and the generated character-reference tables derive from WHATWG data with no stanza

• Files: doc/entities.json, genentities.sh:46, src/char_ref_gperf.gperf, src/char_ref_gperf.c, debian/copyright:6-9
• Basis: checked, in the package or with a reference tool
• Evidence: genentities.sh:46 states # doc/entities.json come from https://html.spec.whatwg.org/entities.json, and the script generates char_ref_gperf.gperf and char_ref_gperf.c from it. debian/copyright has no WHATWG entry and covers the file with the Google/contributors Apache-2.0 stanza.
• Problem: The entity table is third-party WHATWG material, with its own copyright and attribution terms, not Apache-2.0 Google code. The copyright file neither names the holder nor states the licence under which the package redistributes it, which Policy 12.5 requires and which the upstream licence (attribution-based) demands.
• Fix: Add a stanza for doc/entities.json (and note that src/char_ref_gperf.gperf/src/char_ref_gperf.c are generated from it) naming the WHATWG copyright holder and stating the applicable WHATWG licence with its text or a pointer if it is in /usr/share/common-licenses.

5. [minor] [packaging] 00-tests.patch patches Makefile.am, but the package builds with meson

• Files: debian/patches/00-tests.patch, debian/patches/series, debian/rules:4, meson.build
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules:4 is dh $@ --with python3 --buildsystem=meson; meson.build lists the test sources and uses dependency('gtest_main'). The only patch rewrites the gtest rules in Makefile.am (including GTEST_DIR = /usr/src/gtest), a file meson never reads.
• Problem: The patch is dead: it changes nothing about the built package and its contents are obsolete (the tests are built by meson against the system gtest). Keeping it obscures what Debian actually changes and will mislead the next update.
• Fix: Drop debian/patches/00-tests.patch and leave debian/patches/series empty, or remove the patch machinery if nothing else is patched.

6. [minor] [packaging] debian/upstream/metadata points at the old upstream repository

• Files: debian/upstream/metadata:2-5, debian/control:10, debian/copyright:3
• Basis: checked, in the package or with a reference tool
• Evidence: metadata has Bug-Database: https://codeberg.org/grisha/gumbo-parser/issues and Repository: https://codeberg.org/grisha/gumbo-parser.git, while Homepage and the copyright Source are https://codeberg.org/gumbo-parser/gumbo-parser.
• Problem: The metadata fields describe the superseded grisha repository, so bug-submission and repository links are inconsistent with the package's declared upstream. This is stale metadata rather than a policy violation.
• Fix: Update the four URLs to https://codeberg.org/gumbo-parser/gumbo-parser (issues and .git as appropriate).

Verified

• Read all of debian/ (control, rules, changelog, copyright, install/docs/examples, symbols, not-installed, source/format, upstream/metadata, patches/series and 00-tests.patch) and inventoried the whole source tree (150 files, .pc/ excluded).
• debian/copyright is DEP-5, its Format URL is the current one, and its pointer to /usr/share/common-licenses/Apache-2.0 is valid; doc/COPYING contains the Apache-2.0 text.
• src/.c, src/.h, tests/.cc (except the two 2026 files), examples/ and python/gumbo/* carry Google/contributor Apache-2.0 headers, and the Kevin B. Hendricks stanzas for examples/prettyprint.cc and examples/serialize.cc match their headers; autogen.sh is ISC as declared. No other copyright holder appears in these files.
• Generated files have their preferred forms in the tree: src/tag_gperf.h, tag_enum.h, tag_strings.h, tag_sizes.h come from src/tag.in via gentags.sh, and src/char_ref_gperf.c from src/char_ref_gperf.gperf via genentities.sh; no other generated code or vendored library was found.
• The scan-flagged tests/tree_construction/domjs-unsafe.dat, pending-spec-changes-plain-text-unsafe.dat and plain-text-unsafe.dat are WPT test inputs (see update.sh); they read as ordinary text and are flagged binary only because they deliberately contain invalid UTF-8/NUL bytes, so they are test data, not built artifacts.
• The source has no .so, .a, .jar, .pyc, .class, minified JS/CSS, firmware or other built binary files, and no non-commercial, no-modification or field-of-use wording.
• Standards-Version 4.7.3 matches current Policy 4.7.4.1 in its significant components; compat 13 is allowed, and the meson-installed files (headers, .a, .so symlink, .so.4.*, gumbo.pc) are each claimed by libgumbo-dev.install or libgumbo4.install, so dh_missing has nothing to fail on.
• libgtest-dev on this system ships gtest_main.pc, which meson's dependency('gtest_main') needs; the symbols file's * Build-Depends-Package: libgumbo-dev line is in the correct form.
• Packaging structure checked: libgumbo-dev and libgumbo4 are arch:any with Multi-Arch same and a shared-library dependency on the matching binary, python3-gumbo is arch:all with ${python3:Depends} and a versioned libgumbo4 dependency, hardening=+all is set, and the changelog is well formed.
• uscan found the packaged version as the newest upstream release (upstream 0.14.1, packaged 0.14.1+dfsg).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The exact licence of the Web Platform Tests data and of each captured website was not verified from a local copy; the finding stands on the package's own provenance (update.sh, README.md) and the absence of any corresponding stanza or licence text.
• The exact WHATWG licence for doc/entities.json was not verified from a local copy.
• No build or test was run: whether meson/gtest and the setup.py install succeed, and whether every symbol listed in debian/libgumbo4.symbols is actually exported, is unconfirmed.
• debian/watch looks at codeberg.org/gumbo-parser/gumbo-parser, but Repository in debian/upstream/metadata names codeberg.org/grisha/gumbo-parser. Whether these are the same upstream was not checked.

Proposed changes

None.