Review: jackson-dataformats-binary 2.18.11-1

Package Information

Description	fast and powerful JSON library for Java -- CBOR dataformat The Jackson Data Processor is a multi-purpose Java library for processing JSON. Jackson aims to be the best possible combination of fast, correct, lightweight, and ergonomic for developers. It offers three alternative methods for processing JSON: * Streaming API inspired by StAX * Tree Model * Data Binding converts JSON to and from POJOs In addition to the core library, there are numerous extension that provide additional functionality such as additional data formats beyond JSON, additional data types or JVM languages. This package contains an extension for reading and writing Concise Binary Object Representation (CBOR) data, as specified by RFC 7049.
Maintainer	Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed By	Emmanuel Bourg <ebourg@apache.org>
Sponsor	ebourg@apache.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/java-team/jackson-dataformats-binary.git (browse)
Closes	#1150976
Blocked Bugs	#1151018 (normal), #1151019 (normal)
Tracker	https://tracker.debian.org/pkg/jackson-dataformats-binary
Uploaded	16 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Thu, 22 Oct 2026 13:39:06 +0200
Source	jackson-dataformats-binary
Version	2.18.11-1
Changed-By	Emmanuel Bourg <ebourg@apache.org>
Architecture	source all

Changelog◂

jackson-dataformats-binary (2.18.11-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1150976)

.dsc◂

Priority	optional
Component	main
Package-List	libjackson2-dataformat-cbor-java deb java optional arch=all libjackson2-dataformat-smile-java deb java optional arch=all
Section	java

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Jackson dataformats binary
Source: https://github.com/FasterXML/jackson-dataformats-binary
Upstream-Contact: FasterXML <info@fasterxml.com>
Files-Excluded: mvnw*
                .mvn/*

Files: *
Copyright: 2011-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
           2007-, Tatu Saloranta <tatu.saloranta@iki.fi>
License: Apache-2.0

Files: ion/*
Copyright: 2011-2016, Amazon.com, Inc. or its affiliates
License: Apache-2.0

Files: protobuf/src/main/resources/descriptor.proto
Copyright: 2008, Google Inc.
License: BSD-3-clause

Files: debian/*
Copyright: 2026, Emmanuel Bourg
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems the full text of the Apache License version 2.0
 can be found in the file /usr/share/common-licenses/Apache-2.0.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
     * Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
     * Redistributions in binary form must reproduce the above
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
     * Neither the name of Google Inc. nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 16 days ago.

Report◂

DFSG NEW review for jackson-dataformats-binary version 2.18.11-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 13 found

Licensing

All source is Apache-2.0 except the sole Google vendored file protobuf/src/main/resources/descriptor.proto, which is BSD-3-clause. Both licences are DFSG-free and compatible. debian/copyright is DEP-5, covers every file (Files: * Apache-2.0, ion/* Amazon, descriptor.proto BSD-3-clause, debian/* Apache-2.0), includes full Apache-2.0 and BSD-3-clause texts, and points correctly to /usr/share/common-licenses. The only inaccuracy is that the ion/* stanza names only Amazon, while a few ion files (e.g. MockObjectConfiguration.java) are copyrighted by FasterXML.com; a minor holder omission.

Packaging

Clean, conventional maven-debian-helper packaging: debhelper compat 13, Standards-Version 4.7.4 (current 4.7.4.1), renamed legacy binary packages with correct Provides/Replaces/Breaks, matching 2.18.11 runtime deps, maven.rules/publishedRules mapping to 2.x, bogus/missing parent and bom poms handled. Architecture: all with no shared libs, so no ${shlibs:Depends} is a non-issue. Initial release; no autopkgtests or debian/upstream/metadata, but neither is required.

Issues

minor licensing 1. ion/* stanza omits FasterXML.com holder for ion files not authored by Amazon ◂

Files: debian/copyright, ion/src/test/java/com/fasterxml/jackson/dataformat/ion/jsr310/MockObjectConfiguration.java
Basis: checked, in the package or with a reference tool
Evidence: MockObjectConfiguration.java:2 — Copyright 2013 FasterXML.com; the ion/* stanza names only 2011-2016, Amazon.com, Inc. or its affiliates. The prescan's two other FasterXML.com files are the META-INF/services JsonFactory files in protobuf/ and smile/, correctly covered by the Files: * (FasterXML) stanza.
Problem: For ion files written by FasterXML rather than Amazon, the copyright holder named in the header is not listed in debian/copyright. The licence short name (Apache-2.0) is correct.
Fix: Add FasterXML.com to the Copyright: of the Files: ion/* stanza, or give these files their own stanza naming FasterXML.com.

minor packaging 2. Files-Excluded is set but the version carries no repack suffix ◂

Files: debian/copyright, debian/changelog, debian/watch
Basis: found by the review tooling's own checks
Evidence: 2.18.11-1
Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified ◂

avro/src/test/resources/data/fuzz-65649.avro — fuzz-corpus test fixture (parsing input), not built code; no DFSG/preferred-form concern.
cbor/src/test/resources/data/clusterfuzz-cbor-35979.cbor — fuzz-corpus test fixture, not built code; no concern.
cbor/src/test/resources/data/clusterfuzz-cbor-65617.cbor — fuzz-corpus test fixture, not built code; no concern.
cbor/src/test/resources/data/clusterfuzz-cbor-65768.cbor — fuzz-corpus test fixture, not built code; no concern.
ion/src/test/resources/data/fuzz-420.ion — fuzz-corpus test fixture, not built code; no concern.
ion/src/test/resources/data/fuzz-65062.ion — fuzz-corpus test fixture, not built code; no concern.
ion/src/test/resources/data/fuzz-65274.ion — fuzz-corpus test fixture, not built code; no concern.
ion/src/test/resources/data/fuzz-65452.ion — fuzz-corpus test fixture, not built code; no concern.
ion/src/test/resources/data/fuzz-66141.ion — fuzz-corpus test fixture, not built code; no concern.
ion/src/test/resources/data/fuzz-66149.ion — fuzz-corpus test fixture, not built code; no concern.
ion/src/test/resources/data/issue-303.ion — fuzz-corpus/regression test fixture, not built code; no concern.
smile/src/test/resources/data/clusterfuzz-smile-35932.smile — fuzz-corpus test fixture, not built code; no concern.
smile/src/test/resources/data/clusterfuzz-smile-65126.smile — fuzz-corpus test fixture, not built code; no concern.
docs/javadoc/*.html are generated javadoc pages whose Copyright © … FasterXML … All rights reserved. footer is standard javadoc boilerplate, not a licence restriction; their generating source is present.
descriptor.proto is BSD-3-clause Google (header confirmed), captured by the dedicated stanza with full BSD text.
Tree-wide grep for GNU/MIT/ISC/public-domain/non-commercial/no-modification/Mozilla/etc. found only Apache-2.0 and BSD-3-clause wording.
No .jar/.class/.so/.dll/.exe/.pyc/minified artifacts anywhere in the tree.
protobuf/ and smile/ META-INF/services com.fasterxml.jackson.core.JsonFactory files carry FasterXML.com and match the Files: * FasterXML stanza — same entity, not an issue.
maven.ignoreRules correctly excludes the moditect/jacoco/gradle-module-metadata plugins; maven.rules and maven.publishedRules map every package to the 2.x version.
Both binary packages depend on existing 2.18.11 packages (libjackson2-core-java 2.18.11-1 confirmed in the archive) and correctly rename the legacy libjackson2-dataformat-cbor/smile names via Provides/Replaces/Breaks.
Standards-Version 4.7.4 vs current Policy 4.7.4.1 is fine.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.4, packaged 2.18.11), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

The root pom reactor lists modules cbor, smile, avro, protobuf, ion, while only cbor and smile poms are installed (avro/protobuf/ion are --ignore) and avro/ion-java/protobuf-java are not in Build-Depends. Whether avro/protobuf/ion are excluded from the actual Maven reactor by maven-debian-helper's handling of the .poms file (no man page installed to confirm) decides whether the reactor builds; a build would show it. Not reported as a fault.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 16 days ago.

Review Information

accepted — allocated to awm 16 days ago, started 16 days ago, completed 16 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
2.18.11-2	876f6ca3…	2026-10-22 11:36	2026-10-22 11:36	dfsg-uploader	rejected	VIEW
2.18.11-1	c77ef0e5…	2026-10-20 07:31	2026-10-20 07:31	dfsg-uploader	rejected	VIEW

Public Notes

16 days ago ● public

Missed Author Check

Command: dfsg-author-check -markdown
Exit code: 1

Author check: jackson-dataformats-binary-2.18.11

Scanned 4110 files. Authors declared in debian/copyright: 5.

Not named in debian/copyright (1):

FasterXML.com
- ion/src/test/java/com/fasterxml/jackson/dataformat/ion/jsr310/MockObjectConfiguration.java:2
- protobuf/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory:1
- smile/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory:1

Result: 1 holder not named in debian/copyright

To name them, add to the end of debian/copyright:

Files: ion/src/test/java/com/fasterxml/jackson/dataformat/ion/jsr310/MockObjectConfiguration.java
Copyright: 2013 FasterXML.com
License: Apache-2.0

Files: protobuf/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory
 smile/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory
Copyright: 2012 FasterXML.com
License: Apache-2.0

Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.

Back to Dashboard | View all reviews for this package