DFSG NEW review for jackson-dataformats-text version 2.18.11-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The tree's licences themselves are free and mutually compatible (Apache-2.0 for almost everything, MIT for the TOML grammar/test cases, 3-clause BSD for the JFlex skeleton), and no non-free wording exists anywhere. But debian/copyright is a single Files: * Apache-2.0 stanza naming only FasterXML, LLC: the MIT and BSD-3-clause parts of the toml module (documented by upstream in toml/LICENSE) are not recorded, and the copyright holders named in the NOTICE files (Tatu Saloranta) and in a service-file header (FasterXML.com) are absent. Those are inaccuracies in the copyright file, not DFSG violations of the code.

Packaging

Packaging follows the Debian Java team's maven-debian-helper conventions and I found nothing a sponsor would require changed. debhelper-compat 13 with a plain dh $@, Standards-Version 4.7.4 (Policy is 4.7.4.1), DEP-5 copyright, 3.0 (quilt) with no patches, a sane initial changelog, and Build-Depends whose every name exists in the archive in a satisfying version. The .poms file builds only the yaml module (csv, properties and toml are --ignored) and publishes it as jackson-dataformat-yaml 2.x, with the unsuffixed libjackson2-dataformat-yaml provided/broken/replaced as a rename. Tests are JUnit 4, matching the junit4 build dependency, and the known-failing tests are excluded by the parent pom's surefire configuration. No maintainer scripts, no autopkgtest (none is required), no embedded copy of a library Debian ships.

Issues

1. [blocker] [licensing] MIT and BSD-3-clause parts of the toml module are not recorded in debian/copyright

• Files: debian/copyright:8-10, toml/LICENSE:5, toml/LICENSE:42, toml/src/main/jflex/com/fasterxml/jackson/dataformat/toml/toml.jflex, toml/src/main/jflex/skeleton-toml, toml/src/test/java/com/fasterxml/jackson/dataformat/toml/TomlParserTest.java

• Evidence:

  debian/copyright has only:

  Files: *
  Copyright: 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
  License: Apache-2.0
  

  whereas toml/LICENSE says The TOML grammar and some parts of the test suite are adapted from the TOML project, which is licensed under the MIT license: followed by Copyright (c) Tom Preston-Werner, and, for the JFlex lexer generator, Copyright (c) Gerwin Klein, Steve Rowe, Régis Décamps, Google LLC. All rights reserved. under a 3-clause BSD-style licence.

• Problem: Upstream's own toml/LICENSE states that the TOML grammar and parts of the test suite are MIT (Tom Preston-Werner) and that the JFlex skeleton (toml/src/main/jflex/skeleton-toml, from which Lexer.java is generated at build time by the jflex-maven-plugin) is 3-clause BSD. debian/copyright declares every upstream file Apache-2.0 with FasterXML, LLC as the sole copyright holder, so those files' licence and holders are misstated; both licences require their notices to be reproduced, and Policy 12.5 requires the copyright file to accompany the package with its licences and copyright information. The licences are free and Apache-2.0-compatible, so this is an accuracy defect, not a DFSG violation of the code.

• Fix: Add stanzas for the toml module's non-Apache parts, e.g. Files: toml/src/main/jflex/* with the MIT holder (Tom Preston-Werner) and Files: toml/src/main/jflex/skeleton-toml with the JFlex holders (Gerwin Klein, Steve Rowe, Régis Décamps, Google LLC), plus one stand-alone License: MIT and one License: BSD-3-clause paragraph carrying the full texts from toml/LICENSE.

2. [important] [licensing] copyright holders Tatu Saloranta and FasterXML.com missing from debian/copyright

• Files: debian/copyright:9, csv/src/main/resources/META-INF/NOTICE:10, properties/src/main/resources/META-INF/NOTICE:10, toml/src/main/resources/META-INF/NOTICE:10, yaml/src/main/resources/META-INF/NOTICE:10, properties/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory:1
• Evidence: All four module NOTICE files say Copyright 2007-, Tatu Saloranta (tatu.saloranta@iki.fi), and properties/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory starts with # Copyright 2012 FasterXML.com; debian/copyright's only holder line is Copyright: 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>.
• Problem: The upstream author and copyright holder Tatu Saloranta (credited in release-notes/CREDITS-2.x as the author of the CSV, Properties and YAML modules) and the earlier holder name FasterXML.com are not named anywhere in debian/copyright, and the recorded years (2013-2017) contradict the files' own notices (2007-). The licence short name is correct for these files, so this is an incomplete holder list rather than a wrong licence.
• Fix: List both holders with their year ranges, e.g. Copyright: 2007-2026, Tatu Saloranta <tatu.saloranta@iki.fi> and 2013-2026, FasterXML, LLC <info@fasterxml.com>.

3. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Evidence: 2.18.11-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• debian/copyright is machine-readable DEP-5 (canonical Format: URL) with Files: *, Files: debian/* and one Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0; nothing in it is disallowed by copyright-format 1.0.
• Every licence notice inside csv/, properties/, yaml/, docs/ and the top level read Apache-2.0 only: top-level LICENSE (full Apache-2.0 text), the per-module src/main/resources/META-INF/LICENSE and NOTICE, the four module poms' <licenses> blocks and the module READMEs. toml/LICENSE is the only file declaring anything else.
• A tree-wide grep for non-free wording (non-commercial, no modification, Good, not Evil, field-of-use, CC-*-NC/-ND, All rights reserved) found only the JFlex BSD-3 text in toml/LICENSE and the javadoc page footers (Copyright (c) 2019 FasterXML. All rights reserved.), which are the standard javadoc footer over Apache-2.0-licensed pages.
• Files-Excluded: mvnw* and .mvn/* are consistent with the repacked .orig tarball: no mvnw, mvnw.cmd or .mvn path exists in the tree.
• csv/src/test/resources/data/fuzz-50402.csv is 138 KB of deliberately non-UTF-8 bytes (the scan's unrecognised binary file) used as the regression input of csv/src/test/java/com/fasterxml/jackson/dataformat/csv/fuzz/FuzzCSVReadTest.java#testReadBoundary50402 (OSS-Fuzz issue 50402); it is test data of the csv module, which debian/libjackson2-dataformat-yaml-java.poms marks --ignore, so it is neither built nor installed.
• csv/samples/f_5500_2010_first9999.csv is the 6.4 MB text file that the scan read only to 4 MiB: the first 9999 rows of the US Department of Labor 2010 Form 5500 public filing dataset, consumed only by the manual performance harness csv/src/test/java/perf/F5500Reader.java (file passed on the command line, F5500Entry as the POJO); it carries no separate licence notice and is not installed by any binary package.
• toml/src/test/resources/clusterfuzz-testcase-minimized-TOMLFuzzer-{5068015447703552,6370486359031808,6542204348006400} are ~4 KB non-UTF-8 fuzz regression inputs read by FuzzTomlReadTest and FuzzTomlRead57237Test; test data of the unbuilt toml module.
• yaml/src/test/resources/data/fuzz-65918.yaml and csv/src/test/resources/data/story-100.csv (read by FuzzYAML_65918_Test and ReadBracketedArray442Test) are plain test data, as is csv/src/test/resources/data/fuzz-50402.csv's neighbour set; none is installed.
• docs/javadoc/** is upstream's checked-in copy of the project website (generated javadoc HTML for csv, properties, toml and yaml, versions 2.9-2.14) with javadoc's own .css/.gif resources and no font binaries; the documented Java sources are in the tree, the pages only carry the project's Apache-2.0 footer, and nothing from docs/ is installed.
• yaml/src/main/java/com/fasterxml/jackson/dataformat/yaml/UTF8Reader.java and UTF8Writer.java (and the same-named files in the unbuilt csv module and csv/.../impl/) are Apache-2.0 copies of jackson-core's internal IO classes with the same copyright holders; they need no separate stanza and no library is vendored that Debian already ships.
• The yaml module's tests (checked across deser/, ser/, type/, fuzz/, constraints/) import only org.junit.* and extend the module-local ModuleTestBase over junit.framework.TestCase, matching Build-Depends junit4 and the junit → 4.x maven.rules entry; no jackson test-jar is required.
• The known-failing tests under yaml/src/test/java/com/fasterxml/jackson/dataformat/yaml/failing/ are excluded from the run by the surefire <excludes>com/fasterxml/jackson/**/failing/*.java</excludes> configuration in the root pom's build/pluginManagement, so they do not fail the build.
• All Build-Depends names exist in the archive at satisfying versions: debhelper-compat (= 13), default-jdk, junit4 4.13.2-6, libjackson2-core-java 2.18.11-1, libjackson2-databind-java 2.18.11-1, libjackson2-annotations-java 2.18.11-1, libyaml-snake-java 2.5+ds-1, libbuild-helper-maven-plugin-java 3.3.0-1, libreplacer-java 1.5.3-3, maven-debian-helper 2.6.9; the versioned ones are satisfied by 2.18.11.
• The archive still has a concrete libjackson2-dataformat-yaml (2.8.11-5, source jackson-dataformat-yaml); the new binary libjackson2-dataformat-yaml-java Provides it as a virtual package and Breaks/Replaces it below 2.18.11~, which Policy 7.5 permits and which covers that version. libjackson2-dataformat-yaml-java itself is new, so its absence from the package lists is expected.
• Packaging files read in full: debian/{control,rules,changelog,copyright,watch,source/format,libjackson2-dataformat-yaml-java.poms,maven.rules,maven.ignoreRules,maven.properties,maven.publishedRules} and the root and yaml poms; debian/ has no patches, maintainer scripts, tests or upstream/metadata.
• Standards-Version 4.7.4 has the same first two components as Policy 4.7.4.1, so it is current; the changelog's 2.18.11-1 / unstable / initial-release entry with a matching date (Thu, 15 Oct 2026) is sane.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.3, packaged 2.18.11), which is not a fault of the package.

Not confirmed

• Nothing could be built or run (read-only review), so no build or test result is claimed. I found no certain build failure in the tree: the files referenced by the built poms (replacer's PackageVersion.java.in template, moditect's module-info.java, which debian/maven.ignoreRules disables) are present, and the ignored csv/properties/toml modules are never built.
• csv/samples/f_5500_2010_first9999.csv carries no licence statement and no provenance note; that the underlying Form 5500 data is a US-government public disclosure dataset is inferred from its column headers and file name, and its terms cannot be checked from anything in the package (no URL and no other file may be read from here).
• The jackson toml module's compliance test data (compliance/valid, compliance/invalid, read by ComplianceValidTest/ComplianceInvalidTest) is not in the tarball, so those tests would silently run empty; the toml module is not built by this packaging, so this has no effect on the binary packages.

Proposed changes

None.