Review: jackson-dataformats-binary 2.18.11-2

Package Information

Description	fast and powerful JSON library for Java -- CBOR dataformat The Jackson Data Processor is a multi-purpose Java library for processing JSON. Jackson aims to be the best possible combination of fast, correct, lightweight, and ergonomic for developers. It offers three alternative methods for processing JSON: * Streaming API inspired by StAX * Tree Model * Data Binding converts JSON to and from POJOs In addition to the core library, there are numerous extension that provide additional functionality such as additional data formats beyond JSON, additional data types or JVM languages. This package contains an extension for reading and writing Concise Binary Object Representation (CBOR) data, as specified by RFC 7049.
Maintainer	Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed By	Emmanuel Bourg <ebourg@apache.org>
Sponsor	ebourg@apache.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/java-team/jackson-dataformats-binary.git (browse)
Tracker	https://tracker.debian.org/pkg/jackson-dataformats-binary
Uploaded	17 days ago

New Package Report

.changes◂

Source	jackson-dataformats-binary
Version	2.18.11-2
Changed-By	Emmanuel Bourg <ebourg@apache.org>
Architecture	source all
Distribution	unstable
Date	Tue, 20 Oct 2026 19:31:30 +0200

Changelog◂

jackson-dataformats-binary (2.18.11-2) unstable; urgency=medium
 .
   * Added the missing info in debian/copyright

.dsc◂

Priority	optional
Component	main
Package-List	libjackson2-dataformat-cbor-java deb java optional arch=all libjackson2-dataformat-smile-java deb java optional arch=all
Section	java

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Jackson dataformats binary
Source: https://github.com/FasterXML/jackson-dataformats-binary
Upstream-Contact: FasterXML <info@fasterxml.com>
Files-Excluded: mvnw*
                .mvn/*

Files: *
Copyright: 2011-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
           2007-, Tatu Saloranta <tatu.saloranta@iki.fi>
License: Apache-2.0

Files: ion/*
Copyright: 2011-2016, Amazon.com, Inc. or its affiliates
License: Apache-2.0

Files: protobuf/src/main/resources/descriptor.proto
Copyright: 2008, Google Inc.
License: BSD-3-clause

Files: debian/*
Copyright: 2026, Emmanuel Bourg
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems the full text of the Apache License version 2.0
 can be found in the file /usr/share/common-licenses/Apache-2.0.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
     * Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
     * Redistributions in binary form must reproduce the above
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
     * Neither the name of Google Inc. nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 17 days ago.

Report◂

DFSG NEW review for jackson-dataformats-binary version 2.18.11-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 13 found

Licensing

All source is Apache-2.0 (whole tree, FasterXML, and the Amazon ion/ subtree) plus one Google descriptor.proto under BSD-3-clause; both short names are correct and compatible, and both licence texts are included (Apache-2.0 and BSD-3-clause refer to /usr/share/common-licenses, both present). No non-free terms, no no-modification/no-commercial clauses, no built artifacts without source: the only non-text files are 13 binary test fixtures for avro/cbor/ion/smile fuzz regression tests, which are test data, not products needing a generator. Files-Excluded removes mvnw* and .mvn/. The only inaccuracy is that the Files: ion/ stanza attributes a single FasterXML.com test file to Amazon.

Packaging

Solid, conventional Debian Java packaging: debhelper compat 13 with a plain dh $@ rule plus the standard maven-debian-helper POM reinstall hook; two arch:all binary packages (cbor, smile) built from five upstream modules, with the other modules excluded from the POMs; a correct Provides/Breaks/Replaces rename from the old libjackson2-dataformat-(cbor|smile) names; versioned Depends on the same 2.18 line of jackson-core/databind; Standards-Version 4.7.4 matches current Policy 4.7.4.1. No autopkgtest is present, which is common for java-team packages and not a policy violation.

Issues

minor licensing 1. ion/* stanza misattributes FasterXML's MockObjectConfiguration.java to Amazon ◂

Files: debian/copyright (Files: ion/* stanza), ion/src/test/java/com/fasterxml/jackson/dataformat/ion/jsr310/MockObjectConfiguration.java:2
Basis: checked, in the package or with a reference tool
Evidence: The file header reads Copyright 2013 FasterXML.com, but the Files: ion/* stanza assigns 2011-2016, Amazon.com, Inc. or its affiliates to every file under ion/. Every other ion/ file is genuinely Amazon's, so only this one test file is mis-attributed; the holder name FasterXML.com appears nowhere in debian/copyright.
Problem: The machine-readable copyright attributes this file to the wrong entity, so the copyright holders in file notices are not accurately represented. Minor; the file is Apache-2.0 either way, so freedom and licence accuracy are unaffected.
Fix: Add a Files stanza for ion/src/test/java/com/fasterxml/jackson/dataformat/ion/jsr310/MockObjectConfiguration.java with Copyright: 2013 FasterXML.com / License: Apache-2.0 (or otherwise attribute FasterXML.com).

minor packaging 2. Files-Excluded is set but the version carries no repack suffix ◂

Files: debian/copyright, debian/changelog, debian/watch
Basis: found by the review tooling's own checks
Evidence: 2.18.11-2
Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified ◂

debian/copyright is DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/), with Files: , Files: ion/, Files: protobuf/src/main/resources/descriptor.proto, Files: debian/* stanzas plus Apache-2.0 and BSD-3-clause License paragraphs, both resolving to /usr/share/common-licenses; no Format-line or common-license pointer problems.
Top-level LICENSE and ion/LICENSE are full Apache-2.0 texts; ion/NOTICE names Amazon; all match the Apache-2.0 short name used.
Grep for GPL/LGPL/MPL/public-domain/CC-non-commercial/no-modification/JSON-clause found nothing but All rights reserved javadoc footers (harmless boilerplate, not a licence term).
Whole tree sampled: smile/, cbor/, avro/, protobuf/, ion/ main and test Java sources carry Apache-2.0 headers matching the Files: * / ion/* stanzas; Google's descriptor.proto (BSD-3-clause) is correctly stanzared.
The two META-INF/services JsonFactory files in protobuf/ and smile/ say Copyright 2012 FasterXML.com; they fall under Files: * which names FasterXML, LLC and Tatu Saloranta - the same organisation under a different spelling, so not a real holder discrepancy.
The 13 binary files listed by the prescan are fuzz/issue-regression test fixtures of the modules' own binary formats, not compiled/generated shipping products: avro/src/test/resources/data/fuzz-65649.avro, cbor/src/test/resources/data/clusterfuzz-cbor-35979.cbor, cbor/src/test/resources/data/clusterfuzz-cbor-65617.cbor, cbor/src/test/resources/data/clusterfuzz-cbor-65768.cbor, ion/src/test/resources/data/fuzz-420.ion, ion/src/test/resources/data/fuzz-65062.ion, ion/src/test/resources/data/fuzz-65274.ion, ion/src/test/resources/data/fuzz-65452.ion, ion/src/test/resources/data/fuzz-66141.ion, ion/src/test/resources/data/fuzz-66149.ion, ion/src/test/resources/data/issue-303.ion, smile/src/test/resources/data/clusterfuzz-smile-35932.smile, smile/src/test/resources/data/clusterfuzz-smile-65126.smile. No .jar/.class/.so/.dll/.pyc/.min.js/.war/.zip artifacts exist anywhere.
docs/javadoc/ holds generated HTML javadoc for older module versions; it is generated directly from the Java sources present in-tree and is not installed into any binary package, so it is not a preferred-form concern.
Files-Excluded mvnw* and .mvn/* are actually absent from the tree.
Packaging: Build-Depends (debhelper-compat 13, default-jdk, junit4, junit5, libmaven-bundle-plugin-java, libreplacer-java, maven-debian-helper, jackson 2.18 deps) cover the cbor/smile build; maven.rules/publishedRules/ignoreRules and the cbor-named .poms file (which routes smile/pom.xml to its own package and --ignore's avro/protobuf/ion) are consistent with the two published modules; changelog shows the initial release (closing #1150976) and a copyright-fix revision; source format 3.0 (quilt); Vcs-Git points at the salsa java-team.
The execute_after_dh_auto_install re-installs the cbor and smile POMs with --no-parent, the normal maven-debian-helper idiom to drop the missing parent reference; not a fault.
Standards-Version 4.7.4 is a current value (first two components 4.7 match Policy 4.7.4.1).
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.4, packaged 2.18.11), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Whether the package builds is not verifiable here, but nothing in the packaging points to a certain failure: all Build-Depends names exist and the POM modules referenced (cbor, smile, plus the parent pom.xml) are present; avro/protobuf/ion are excluded via --ignore.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 16 days ago, started 16 days ago, completed 16 days ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
2.18.11-1	c77ef0e5…	2026-10-20 07:31	2026-10-20 07:31	dfsg-uploader	rejected	VIEW
2.18.11-1	f08385e1…	2026-10-23 02:12	2026-10-23 02:15	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package