DFSG NEW review for jackson-dataformats-binary version 2.18.11-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 1 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 13 found

Licensing

Everything in the tree is free software: Apache-2.0 for all five modules and for debian/* (root LICENSE and ion/LICENSE are the full Apache-2.0 text, each module's META-INF/LICENSE says Apache-2.0, the poms declare 'The Apache Software License, Version 2.0'), plus one BSD-3-Clause file, protobuf/src/main/resources/descriptor.proto. No non-free terms, no binary-only files, no source-less binaries. debian/copyright is in DEP-5 format with exactly the 1.0 Format URL and a Files-Excluded list that matches the tree, but it is not accurate: it puts the BSD-3-Clause descriptor.proto under the Apache-2.0 catch-all without reproducing the BSD notice, and it names only FasterXML, LLC although the whole ion module is copyright Amazon.com, Inc. and every module's META-INF/NOTICE names Tatu Saloranta.

Packaging

Competent java-team packaging: maven-debian-helper driven by debian/*.poms, maven.rules, maven.ignoreRules and maven.publishedRules, debhelper-compat 13, a two-line rules file with one idempotent execute_after_dh_auto_install, correct takeover of the existing libjackson2-dataformat-cbor (2.7.8-5.1) and libjackson2-dataformat-smile (2.7.8-6) via versioned Provides/Breaks/Replaces, Standards-Version 4.7.4 against Policy 4.7.4.1, every dependency resolvable, and a sane initial changelog closing #1150976. Only nits: prebuilt javadoc for old releases is shipped in the tarball, and there is no autopkgtest.

Issues

1. [blocker] [licensing] descriptor.proto is BSD-3-Clause (Google) but debian/copyright claims Apache-2.0 for it

• Files: protobuf/src/main/resources/descriptor.proto:1-28, debian/copyright:8-10
• Evidence: // Copyright 2008 Google Inc. All rights reserved. and the three clauses Redistributions of source code must retain the above copyright notice ..., Redistributions in binary form must reproduce the above copyright notice ..., Neither the name of Google Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.; debian/copyright has Files: * / Copyright: 2011-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com> / License: Apache-2.0.
• Problem: The catch-all stanza states the wrong licence for this file: it is Google's three-clause BSD protobuf descriptor, not Apache-2.0. BSD is not in /usr/share/common-licenses, so its notice and full text must be reproduced in debian/copyright (Policy 12.5); they appear nowhere in the package. The file is part of the source package (it belongs to the protobuf module, which debian/ does not build), so debian/copyright must cover it.
• Fix: Add a paragraph Files: protobuf/src/main/resources/descriptor.proto with Copyright: 2008, Google Inc. and License: BSD-3-clause, and a stand-alone License: BSD-3-clause paragraph containing the full three-clause text and disclaimer.

2. [important] [licensing] Copyright holders named in the sources are missing from debian/copyright

• Files: debian/copyright:8-10, ion/NOTICE:2, ion/src/main/java/com/fasterxml/jackson/dataformat/ion/EnumAsIonSymbolModule.java:2, avro/src/main/resources/META-INF/NOTICE:10, cbor/src/main/resources/META-INF/NOTICE:10, smile/src/main/resources/META-INF/NOTICE:10, protobuf/src/main/resources/META-INF/NOTICE:10
• Evidence: Copyright 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. in ion/NOTICE:2 and in the header of the ion module's Java files (about 35 files, e.g. IonFactory.java:2, IonParser.java:2, IonValueMapper.java:2), and Copyright 2007-, Tatu Saloranta (tatu.saloranta@iki.fi) in the META-INF/NOTICE of every module.
• Problem: debian/copyright has a single Copyright: line naming FasterXML, LLC. The ion module is copyright Amazon.com, Inc. and the NOTICE files of every module name Tatu Saloranta; neither is represented. The licence is the same (Apache-2.0), so this is not a free-software defect, but the record of the copyright in the tree is incomplete and inaccurate.
• Fix: Add the holders, e.g. a second Copyright: line in the Files: * paragraph (2007-, Tatu Saloranta <tatu.saloranta@iki.fi>) and a paragraph Files: ion/* / Copyright: 2012-2016, Amazon.com, Inc. or its affiliates / License: Apache-2.0.

3. [minor] [licensing] Prebuilt javadoc for releases 2.8-2.14 is shipped in the source tarball with no sources

• Files: docs/javadoc/**, debian/copyright:5-6
• Evidence: docs/javadoc/avro/2.14/com/fasterxml/jackson/dataformat/avro/AvroMapper.html (and the same for cbor, smile, protobuf and ion under 2.8, 2.9, 2.10-2.14) ends with <p class="legalCopy"><small>Copyright &#169; 2019 <a href="http://fasterxml.com/">FasterXML</a>. All rights reserved.</small></p>.
• Problem: Generated javadoc HTML for much older releases is distributed in the upstream tarball, while the Java sources it was generated from are not in the package; Policy 4.16 asks for such source-less generated files to be removed by repacking or supplied under debian/missing-sources. It is not installed into any binary package, so no user-visible file is affected, which is why this is minor.
• Fix: Repack the upstream tarball to drop docs/javadoc (list it in Files-Excluded), or record the generating sources in debian/missing-sources.

4. [minor] [packaging] No autopkgtest

• Files: debian/
• Evidence: debian/ contains changelog, control, copyright, libjackson2-dataformat-cbor-java.poms, maven.ignoreRules, maven.properties, maven.publishedRules, maven.rules, rules, source/format and watch: there is no debian/tests/control.
• Problem: A brand-new source package with no autopkgtest gets no regression coverage in the archive's CI and cannot be gated on one, although the tree has a complete JUnit suite that would run there (cbor on JUnit 5, smile on JUnit 4, both in Build-Depends).
• Fix: Add debian/tests/control with a Test-Command that runs the packaged modules' tests (for example mvn -o -pl cbor,smile test), with the JUnit packages it needs in Tests-Depends.

5. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Evidence: 2.18.11-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• Coverage: the tree is the multi-module Maven project jackson-dataformats-binary 2.18.11 (avro, cbor, smile, protobuf, ion, root pom, docs/, release-notes/) with all packaging under debian/; every debian/ file was read (copyright, control, rules, changelog, source/format, libjackson2-dataformat-cbor-java.poms, maven.rules, maven.ignoreRules, maven.publishedRules, maven.properties). .pc/ was not read.
• Licence evidence collected over the whole tree by grep for Copyright, (C), the copyright sign, SPDX-License-Identifier, Licensed under, Permission is hereby granted, Redistribution and use, GNU General Public, GNU Lesser, Apache License, Mozilla Public, Eclipse Public, Creative Commons, public domain, All rights reserved: only Apache-2.0 and the single BSD-3-Clause header in protobuf/src/main/resources/descriptor.proto; no SPDX tags anywhere, no non-commercial/no-derivative/field-of-use wording.
• debian/copyright is already in machine-readable format with exactly the 1.0 Format URL, so no replacement is proposed; its Files-Excluded (mvnw*, .mvn/*) names nothing still present: the root listing has no mvnw and no .mvn.
• The 13 files the scan listed are all fuzz-regression test data under each module's src/test/resources/data/, each read by the test named after it, none of them built or installed: avro/src/test/resources/data/fuzz-65649.avro (avro/src/test/java/.../fuzz/AvroFuzz449_65618_65649_IOOBETest.java:52); cbor/src/test/resources/data/clusterfuzz-cbor-35979.cbor (CBORFuzz_35979_StringValueTest.java:27); cbor/src/test/resources/data/clusterfuzz-cbor-65617.cbor (CBORFuzz451_65617_IOOBETest.java:20); cbor/src/test/resources/data/clusterfuzz-cbor-65768.cbor (CBORFuzz458_65768_NPETest.java:20); ion/src/test/resources/data/fuzz-420.ion (Fuzz420_65062_65083IOOBETest.java:24); ion/src/test/resources/data/fuzz-65062.ion (Fuzz_65062_VarintTest.java:24); ion/src/test/resources/data/fuzz-65274.ion (Fuzz434_65268_65274_NPETest.java:41,52); ion/src/test/resources/data/fuzz-65452.ion (Fuzz437_65452_NPETest.java:23); ion/src/test/resources/data/fuzz-66141.ion (IonFuzz_471_66141_AssertionErrorTest.java:21); ion/src/test/resources/data/fuzz-66149.ion (IonFuzz_469_66149_NegArraySizeTest.java:21); ion/src/test/resources/data/issue-303.ion (DatabindRead303Test.java:19); smile/src/test/resources/data/clusterfuzz-smile-35932.smile (Fuzz_291_35932_TruncUTF8NameTest.java:19); smile/src/test/resources/data/clusterfuzz-smile-65126.smile (Fuzz_426_65126IOOBETest.java:16). They are tiny OSS-Fuzz/clusterfuzz crash inputs, not build outputs; the same directories hold a few more of the same kind: smile/src/test/resources/data/clusterfuzz-smile-32654.smile, ion/src/test/resources/data/fuzz-65268.ion, ion/src/test/resources/data/fuzz-65273.ion, ion/src/test/resources/data/issue-302.ion.
• No built artifacts in the tree: glob for *.jar, *.class, *.so, *.dll, *.exe, *.min.js, *.pdf, *.zip, *.ttf, *.woff found nothing.
• The only images are javadoc's own boilerplate under docs/javadoc/*/2.8|2.9/resources/ (background.gif, tab.gif, titlebar.gif, titlebar_end.gif); the only other non-HTML files under docs/ are javadoc's script.js and stylesheet.css. No fonts or sounds anywhere.
• Standards-Version 4.7.4 is current: Policy on the reviewing system is 4.7.4.1 (same first two components).
• Every dependency resolves in the archive: debhelper-compat 13, default-jdk, junit4 4.13.2-6, junit5 5.10.3-1, libbuild-helper-maven-plugin-java 3.3.0-1, libmaven-bundle-plugin-java 4.1.0-1, libreplacer-java 1.5.3-3, maven-debian-helper 2.6.9, libjackson2-annotations-java / libjackson2-core-java / libjackson2-databind-java all 2.18.11-1, so the >= 2.18.11 constraints are satisfiable and not overly tight.
• The takeover of the old binaries is done the usual way: Provides: libjackson2-dataformat-cbor (= ${binary:Version}) with Breaks/Replaces: libjackson2-dataformat-cbor (<< 2.18.11~), and the same for smile; the archive still has libjackson2-dataformat-cbor 2.7.8-5.1 and libjackson2-dataformat-smile 2.7.8-6, both below the relation, so it applies.
• Maintainer: Debian Java Maintainers pkg-java-maintainers@lists.alioth.debian.org is the address other java-team packages in the archive use (libjackson2-core-java, junit4, maven-debian-helper), so it is not an issue; Uploaders: Emmanuel Bourg.
• There are no debian/patches, no maintainer scripts, no *.maintscript, no install/links/docs/dirs files; debian/rules is the usual dh $@ for a maven-debian-helper package (the maven buildsystem addon is found automatically) with one idempotent execute_after_dh_auto_install that reinstalls the two poms with --no-parent --has-package-version.
• debian/changelog is 2.18.11-1, distribution unstable, urgency medium, an initial release closing #1150976, dated 15 Oct 2026; debian/source/format is 3.0 (quilt) with nothing to apply.
• Copyright 2012 FasterXML.com in the protobuf and smile META-INF/services/com.fasterxml.jackson.core.JsonFactory files and Copyright 2013 FasterXML.com in an ion test file are older spellings of the FasterXML holder already named in debian/copyright, so they are covered by the existing stanza apart from the holder-list inaccuracy reported above.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.3, packaged 2.18.11), which is not a fault of the package.

Not confirmed

• citm_catalog.json (cbor/src/test/resources/data/ and smile/src/test/resources/data/, 1.6 MB each) carries no copyright or licence notice and its origin cannot be established from the package; it is the well-known JSON benchmark catalog and is read only as test data by cbor BiggerDataTest and smile BiggerDataParseTest.
• The build's reactor: avro, protobuf and ion are marked --ignore in debian/libjackson2-dataformat-cbor-java.poms although the root pom lists all five modules, and com.amazon.ion:ion-java (used by ion/pom.xml) has no package in the archive while libavro-java is 1.8.2; whether maven-debian-helper restricts the build to cbor and smile, and whether the version-less org.junit.jupiter:junit-jupiter test dependency of cbor/pom.xml (no rule in debian/maven.rules) resolves, would only show in a build.
• debian/rules reinstalls cbor/pom.xml and smile/pom.xml with mh_installpom --no-parent, while their carry no versions of their own (they come from the removed parent's dependencyManagement); whether maven-repo-helper supplies them when installing can only be seen by inspecting the built package's /usr/share/maven-repo files.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: read: "jackson-dataformats-binary-2.18.11/.." is not a file of the package or of the reviewing system.

Proposed changes

None.