DFSG NEW review for jackson-dataformats-binary version 2.18.11-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 2 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 13 found

Licensing

All licences found are free: Apache-2.0 throughout, with one BSD-3-Clause file (Google's protobuf descriptor.proto), and no non-free terms. However debian/copyright is inaccurate and incomplete: it attributes every upstream file to FasterXML under Apache-2.0, while the ion/ module is Amazon.com's Apache-2.0 work, descriptor.proto is Google BSD-3-Clause, and the NOTICE files shipped in the jars carry Tatu Saloranta's copyright. The BSD-3-Clause notice and two copyright holders are therefore missing.

Packaging

The packaging is otherwise conventional (compat 13, maven buildsystem, DEP-5 copyright, correct Build-Depends versions, Provides/Breaks/Replaces transition from the old cbor/smile packages), but the installed Maven POMs are stripped of their parent and keep versionless dependencies, so they are unusable by dependent packages. In addition the Maven aggregator lists the avro, protobuf and ion modules, whose dependencies are absent from Build-Depends; a build would show whether that breaks the build.

Issues

1. [blocker] [licensing] descriptor.proto is Google BSD-3-Clause but debian/copyright declares Apache-2.0 for all files

• Files: protobuf/src/main/resources/descriptor.proto:2-25, debian/copyright:8-10
• Basis: checked, in the package or with a reference tool
• Evidence: descriptor.proto: // Copyright 2008 Google Inc. All rights reserved. and // Redistribution and use in source and binary forms ... Neither the name of Google Inc. nor the names of its contributors ...; debian/copyright stanza: Files: * / Copyright: 2011-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com> / License: Apache-2.0.
• Problem: The file is Google's BSD-3-Clause code, not Apache-2.0 FasterXML code. debian/copyright therefore names the wrong licence and holder, and the BSD-3-Clause notice, which is not in /usr/share/common-licenses, is not reproduced (copyright-format 6.7/6.8, Policy 4.5 and 12.5). It is part of the source package even though the protobuf module is not built.
• Fix: Add a Files: protobuf/src/main/resources/descriptor.proto stanza with Copyright: 2008, Google Inc. and License: BSD-3-Clause, and a stand-alone License: BSD-3-Clause paragraph containing the three-clause text from the file header.

2. [blocker] [licensing] debian/copyright omits the Amazon.com holder of ion/ and Tatu Saloranta's NOTICE copyright

• Files: ion/NOTICE:2, ion/src/main/java/com/fasterxml/jackson/dataformat/ion/IonFactory.java:2, avro/src/main/resources/META-INF/NOTICE:10, cbor/src/main/resources/META-INF/NOTICE:10, smile/src/main/resources/META-INF/NOTICE:10, debian/copyright:8-10
• Basis: checked, in the package or with a reference tool
• Evidence: ion/NOTICE: Copyright 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.; every ion Java source begins Copyright 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. (Apache-2.0); every module's META-INF/NOTICE says Copyright 2007-, Tatu Saloranta (tatu.saloranta@iki.fi). The only upstream stanza is Files: * / Copyright: 2011-2017, FasterXML, LLC.
• Problem: Files: * attributes the whole tree to FasterXML, so two holders who assert copyright in files of the source package (and, for the NOTICE files, in the cbor and smile jars built from it) are not named. This makes debian/copyright inaccurate (Policy 4.5, copyright-format 6.8).
• Fix: Add a Files: ion/* stanza with Copyright: 2012-2016, Amazon.com, Inc. or its affiliates and License: Apache-2.0, and add 2007-, Tatu Saloranta to the copyright of the Files: * stanza (or a stanza covering the META-INF/NOTICE files).

3. [important] [packaging] POMs reinstalled with --no-parent lose the dependency versions inherited from their parent

• Files: debian/rules:6-9, cbor/pom.xml:44-66, smile/pom.xml:41-56, debian/libjackson2-dataformat-cbor-java.poms:1-3
• Basis: inferred from what was read, not seen directly
• Evidence: debian/rules runs mh_installpom ... --no-parent ... cbor/pom.xml for both modules; the cbor and smile POMs declare jackson-databind, jackson-annotations and (cbor) junit-jupiter with no <version> element, inheriting them from their parent; mh_cleanpom(1): The POM will be normalised, and its parent tag removed if the option --no-parent is given and If versions are given for a dependency, this version will be replaced by the 'debian' version.
• Problem: After the hook the POMs installed into /usr/share/maven-repo have no parent and still no versions on their dependencies, because mh_cleanpom only rewrites versions that are present and does not inline the parent's dependencyManagement. A Maven POM with versionless dependencies and no parent cannot be resolved, so other packages building against libjackson2-dataformat-cbor-java or libjackson2-dataformat-smile-java fail on the broken metadata. The parent POM (jackson-dataformats-binary) is also installed only in the cbor package (first line of the .poms), so smile's POM could not have kept it without a missing reference.
• Fix: Install the jackson-dataformats-binary parent POM in both binary packages (or change the modules' parent to one shipped in Debian) and install cbor/pom.xml and smile/pom.xml without --no-parent; alternatively patch both POMs to give explicit elements to jackson-databind, jackson-annotations and junit-jupiter, and install them with --no-parent.

4. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Basis: found by the review tooling's own checks
• Evidence: 2.18.11-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• Read every file under debian/ in full: changelog, control, copyright, rules, source/format, maven.rules, maven.ignoreRules, maven.publishedRules, maven.properties and libjackson2-dataformat-cbor-java.poms.
• debian/copyright is machine-readable DEP-5 with the correct Format URL: two Files stanzas (*, debian/*) and one stand-alone Apache-2.0 paragraph that points to /usr/share/common-licenses/Apache-2.0, which exists on the system.
• The root LICENSE, every module's src/main/resources/META-INF/LICENSE and ion/LICENSE are Apache-2.0. A tree-wide grep for other grants (MIT, BSD, MPL, EPL, GPL, LGPL, CC, public domain) found only the BSD-3-Clause text in protobuf/src/main/resources/descriptor.proto.
• Copyright notices found across avro/, cbor/, ion/, protobuf/ and smile/: FasterXML / FasterXML.com, Amazon.com (ion/, with Apache-2.0 headers), Tatu Saloranta (the five META-INF/NOTICE files) and Google Inc. (descriptor.proto only). The FasterXML.com notices are the same holder as the FasterXML, LLC stanza and need no separate entry.
• The 13 binary test inputs are regression data, not built artifacts, and each is loaded by a named fuzz test; all fall under the project's Apache-2.0 licence: avro/src/test/resources/data/fuzz-65649.avro (AvroFuzz449_65618_65649_IOOBETest); cbor/src/test/resources/data/clusterfuzz-cbor-35979.cbor, clusterfuzz-cbor-65617.cbor and clusterfuzz-cbor-65768.cbor (CBORFuzz_35979, CBORFuzz451_65617, CBORFuzz458_65768); ion/src/test/resources/data/fuzz-420.ion, fuzz-65062.ion, fuzz-65274.ion, fuzz-65452.ion, fuzz-66141.ion, fuzz-66149.ion and issue-303.ion (Fuzz420_65062_65083, Fuzz_65062_Varint, Fuzz434_65268_65274, Fuzz437_65452, IonFuzz_471_66141, IonFuzz_469_66149, DatabindRead303Test); smile/src/test/resources/data/clusterfuzz-smile-35932.smile and clusterfuzz-smile-65126.smile (Fuzz_291_35932, Fuzz_426_65126).
• docs/javadoc/ is upstream's checked-in HTML javadoc for versions 2.8 to 2.14 (about 2000 pages). It is not built or installed by this package, its pages carry the FasterXML copyright footer, and its script.js, stylesheet.css and resources/*.gif are standard javadoc tool output, not separately licensed third-party content.
• Files-Excluded names mvnw* and .mvn/*; neither is present in the tree, so the exclusion matches the uploaded source.
• No .jar, .class, .so, .dll, .exe, .pyc or PDF files exist in the tree; there is no debian/patches directory, no maintainer script and no debian/tests.
• Build-Depends names exist in the archive: libjackson2-core-java, libjackson2-databind-java and libjackson2-annotations-java are at 2.18.11-1, and junit4, junit5, libbuild-helper-maven-plugin-java, libreplacer-java, libmaven-bundle-plugin-java and maven-debian-helper exist.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match, not an issue); compat 13; maven is in dh's third-party buildsystem list (Dh_Buildsystems.pm) and is auto-detected from pom.xml, so dh $@ runs the Maven build; Provides/Breaks/Replaces correctly target the old real packages libjackson2-dataformat-cbor 2.7.8-5.1 and libjackson2-dataformat-smile 2.7.8-6.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.3, packaged 2.18.11), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The root pom.xml lists cbor, smile, avro, protobuf and ion under , so mvn package from the aggregator would compile the avro, protobuf and ion modules, but Build-Depends contains none of their dependencies (org.apache.avro:avro 1.11.3, com.amazon.ion:ion-java 1.11.11, logback-classic, assertj, hamcrest-all, Square protoparser). A build would show whether maven-debian-helper builds the POMs marked --ignore and the build fails on unresolved dependencies, or whether something excludes them.

Proposed changes

None.