DFSG NEW review for ipcsocket version 1.8.0+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the correct Format line and three stanzas that cover the whole tree: Files: * under Apache-2.0 by Eugene Yokota, Ethan Atkins and other contributors; the seven Nailgun-derived UnixDomain*/Win32NamedPipe* classes and LICENSE.txt under Apache-2.0 by Martian Software, Inc.; and debian/* under Apache-2.0 by Juan Manuel Méndez Rey. The Apache-2.0 boilerplate is given with a pointer to /usr/share/common-licenses/Apache-2.0. The DFSG repack removed the prebuilt JNI .so/.dll/.dylib files (none remain; src/main/resources is empty), and the hand-written JNI C sources and the Java inputs of the javac-generated jni/*.h headers are still present. No non-free wording, no other licence, no vendored third-party library and no built binary was found.

Packaging

A conventional, well-formed Debian Java package: debhelper compat 14 with the javahelper and maven-repo-helper dh sequences, jh_build compiling src/main/java to ipcsocket.jar, the upstream JUnit tests run both in override_dh_auto_test and by autopkgtest against the installed jar, and Maven metadata published from a hand-maintained POM with maven.rules/maven.ignoreRules mapping JNA to the Debian versions. Build-Depends are complete (default-jdk-headless, libjna-java, libjna-platform-java, junit4 <!nocheck>), Architecture: all with Multi-Arch: foreign, Standards-Version 4.7.4 against current Policy 4.7.4.1, changelog is an initial unstable upload closing the ITP, Vcs-* and debian/upstream/metadata are present, and there are no patches or maintainer scripts to get wrong.

Issues

None.

Verified

• Prescan: dfsg-author-check scanned 48 files, declared 4 copyright holders in debian/copyright and reported that every holder it found is named there; its output listed no individual files to account for.
• debian/copyright read in full: Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, header with Upstream-Name/Source/Comment/Files-Excluded, then Files: *, the Martian stanza and Files: debian/*, and one stand-alone License: Apache-2.0 paragraph.
• The Martian stanza names exactly the seven files whose headers say Copyright 2004-2015, Martian Software, Inc. or Copyright 2004-2017, Martian Software, Inc.: ReferenceCountedFileDescriptor.java, UnixDomainServerSocket.java, UnixDomainSocket.java, UnixDomainSocketLibrary.java, Win32NamedPipeLibrary.java, Win32NamedPipeServerSocket.java, Win32NamedPipeSocket.java, plus LICENSE.txt (Nailgun Copyright © 2004-2012, Martian Software, Inc.). The copyright field's 2004-2017 is only year drift.
• The remaining Java, C, sbt, markdown and example files carry no notice; README.md (Apache v2), build.sbt (licenses := Seq(License.Apache2)), debian/poms/ipcsocket.pom (<name>Apache-2.0</name>) and LICENSE.txt all state Apache-2.0 for the project, so Files: * is accurate.
• Grep of the whole tree (src, jni, examples, project, .github, root files) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, permission wording, GNU, MIT, BSD, Mozilla, Creative Commons, non-commercial, no-modification, Good-not-Evil and All-rights-reserved found no licence term other than the Martian Apache-2.0 headers and comments about BSD operating systems.
• No .so, .dll, .dylib, .jar, .class, .zip or .pdf file exists in the tree; src/main/resources/ is empty, which matches the three Files-Excluded directories and the +dfsg repack stated in debian/copyright and debian/README.source.
• jni/*.h begin /* DO NOT EDIT THIS FILE - it is machine generated */; they are javac -h jni output (build.sbt sets Compile / javacOptions ++= Seq("-h", .../jni)) whose inputs, the classes in src/main/java, are in the package. jni/*.c are hand-written project code covered by Files: *. Removing the prebuilt native libs therefore loses no source.
• examples/echo-server/dependency-reduced-pom.xml is maven-shade-plugin output for the pom.xml next to it; examples/echo-server/nodejs-client/package-lock.json is npm's lock file for the package.json next to it; the 15-line index.js has no notice and is covered by Files: *. None is a built binary or of unclear provenance.
• debian/ read in full: control, rules, changelog, copyright, README.source, clean, gbp.conf, salsa-ci.yml, libipcsocket-java.{classpath,docs,poms}, maven.rules, maven.ignoreRules, poms/ipcsocket.pom, source/format, tests/control, tests/run-junit, upstream/metadata.
• Override at compat 14: override_dh_auto_test checks DEB_BUILD_OPTIONS for nocheck itself, which is redundant but harmless — the debhelper tool for compat 14/dh_auto_test states dh skips hook and override targets of dh_auto_test when nocheck is listed.
• maven-repo-helper mh_install (read /usr/bin/mh_install) reads debian/$package.poms and passes each line's options to mh_installpom and mh_installjar, so --has-package-version --java-lib --usj-name=ipcsocket --artifact=ipcsocket.jar is valid input that installs ipcsocket-1.8.0.jar + the ipcsocket.jar link and the cleaned POM into /usr/share/maven-repo (mh_install(1), maven-repo-helper reference.html).
• The orig tarball contains a single top-level directory, sbt-ipcsocket-027030b; dpkg-source renames a lone top-level directory to the target package directory on extraction (Dpkg::Source::Archive::extract), so the name does not affect unpacking or building.
• No debian/patches (no series, no patches), no maintainer scripts, 3.0 (quilt), changelog ipcsocket (1.8.0+dfsg-1) unstable; urgency=medium with the date a real Wednesday, Closes: #1152326, and Testsuite: autopkgtest in the .dsc.
• Dependencies check out against the archive: dh-sequence-javahelper is provided by javahelper, dh-sequence-maven-repo-helper by maven-repo-helper, and libjna-java/libjna-platform-java/junit4/default-jdk-headless all exist.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.0.0~M2, packaged 1.8.0+dfsg), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• I could not build or run anything; the build and the JUnit suite (at build time and in autopkgtest) are taken as passing, as the review brief directs.
• javatools/javahelper is not installed on the reviewing system, so I could not read jh_build/jh_installlibs/jh_classpath/jh_depends: in particular whether jh_installlibs also installs ipcsocket.jar (alongside mh_install --java-lib) and how the space-separated single-line debian/libipcsocket-java.classpath is consumed. A build would show the resulting /usr/share/java layout; the autopkgtest, which runs against /usr/share/java/ipcsocket.jar with only the package's Depends installed, would catch a broken jar or a missing JNA dependency.
• --has-package-version in debian/libipcsocket-java.poms asserts that the POM version is the upstream part of the package version (POM 1.8.0 against 1.8.0+dfsg); maven-repo-helper only calls this a hint for mh_make, and the effect of the mismatch on the published Maven metadata could not be verified.

Proposed changes

None.