DFSG NEW review for jackson-dataformats-text version 2.18.11-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 2 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The licences actually present (Apache-2.0, plus MIT and BSD-3-Clause in the toml tree) are all DFSG-free and mutually compatible, but debian/copyright does not describe them. It puts every upstream file under a single Apache-2.0 stanza held by FasterXML, omitting Tatu Saloranta, whom every NOTICE names, and it omits the MIT (Tom Preston-Werner) and BSD-3-Clause (JFlex authors) terms that toml/LICENSE declares for the TOML grammar, parts of the toml test suite and the JFlex skeleton, together with the required licence texts.

Packaging

The packaging is small and correct: compat 13 with the maven buildsystem auto-detected from pom.xml, complete and satisfiable Build-Depends, versioned Provides plus Breaks/Replaces for the rename from the old libjackson2-dataformat-yaml binary, a single-jar package laid out by maven-debian-helper, and a sane initial changelog. The only gap is the absence of any autopkgtest.

Issues

1. [blocker] [licensing] debian/copyright omits Tatu Saloranta as a copyright holder

• Files: debian/copyright:9-10, csv/src/main/resources/META-INF/NOTICE:10, properties/src/main/resources/META-INF/NOTICE:10, yaml/src/main/resources/META-INF/NOTICE:10, toml/src/main/resources/META-INF/NOTICE:10

• Basis: checked, in the package or with a reference tool

• Evidence:

  NOTICE: Copyright 2007-, Tatu Saloranta (tatu.saloranta@iki.fi)
  debian/copyright: Copyright: 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>

• Problem: Every NOTICE file shipped in the jars and in the source names Tatu Saloranta as the copyright holder from 2007 on, but the single Files: * stanza names only FasterXML, LLC. A copyright holder stated in the files is missing from debian/copyright, so the file is inaccurate and cannot be relied on for redistribution (Policy 12.5).

• Fix: Add Tatu Saloranta (2007-...) to the Copyright field of the Files: * stanza, keeping FasterXML as well.

2. [blocker] [licensing] debian/copyright declares everything Apache-2.0 but ignores the MIT and BSD-3-Clause terms in toml/LICENSE

• Files: debian/copyright:8-10, toml/LICENSE:5-9, toml/LICENSE:31-42, toml/src/main/jflex/com/fasterxml/jackson/dataformat/toml/toml.jflex, toml/src/main/jflex/skeleton-toml

• Basis: checked, in the package or with a reference tool

• Evidence:

  toml/LICENSE: The TOML grammar and some parts of the test suite are adapted from the TOML project, which is licensed under the MIT license: / Copyright (c) Tom Preston-Werner and The JFlex lexer generator is licensed under a 3-clause BSD-style license: / Copyright (c) Gerwin Klein, Steve Rowe, Régis Décamps, Google LLC.
  debian/copyright: Files: * ... License: Apache-2.0

• Problem: The toml module ships an extra licence file that grants MIT terms over the grammar (toml.jflex) and parts of its test suite, and BSD-3-Clause terms over the JFlex skeleton (skeleton-toml). debian/copyright assigns the whole tree to Apache-2.0 and contains neither those holders nor their licence texts, and neither MIT nor BSD-3-Clause is in /usr/share/common-licenses, so their notices must be reproduced. The result is an inaccurate and incomplete copyright file (Policy 12.5, copyright-format 1.0).

• Fix: Add Files stanzas for toml/ (or at least toml/src/main/jflex/, toml/src/test/ and toml/LICENSE) with the MIT holder and BSD-3-Clause holders, and stand-alone License paragraphs containing the full MIT and BSD-3-Clause texts.

3. [minor] [packaging] No autopkgtest despite a substantial JUnit suite

• Files: debian/tests/ (absent)
• Basis: checked, in the package or with a reference tool
• Evidence: debian/ contains no tests/ directory; the source has yaml/src/test/java/** with JUnit 4 tests.
• Problem: Nothing exercises the installed jar after the build, so packaging errors that only appear at runtime (a missing runtime dependency, an unloadable jar) would go unnoticed. This is a quality gap for a new package, not a Policy violation.
• Fix: Add debian/tests/control with a test that builds a small YAML document through the installed jackson-dataformat-yaml jar, using the existing JUnit suite or a short Java main.

4. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Basis: found by the review tooling's own checks
• Evidence: 2.18.11-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• Read all of debian/: changelog, control, copyright, rules, source/format, the .poms and maven rules/ignoreRules/publishedRules/properties. There are no patches, maintainer scripts, install/links/docs files or tests.
• Inspected the upstream inventory under csv/, properties/, toml/, yaml/, docs/, release-notes/ and the top-level files. No .jar, .class, .so, .dll, .exe or archive is present.
• The prescan's binary csv/src/test/resources/data/fuzz-50402.csv is an intentionally non-UTF-8 OSS-Fuzz regression input, loaded with readResource() by csv/src/test/java/com/fasterxml/jackson/dataformat/csv/fuzz/FuzzCSVReadTest.java:33; it contains no licence material and is legitimate test data.
• The prescan's second holder, properties/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory:1 (Copyright 2012 FasterXML.com), is the FasterXML entity already named in debian/copyright; the 2012 year versus 2013-2017 is only year drift.
• Read every LICENSE/NOTICE file: root LICENSE and each module's src/main/resources/META-INF/{LICENSE,NOTICE}. Apart from toml/LICENSE they state Apache-2.0 and name Tatu Saloranta (reported above). No per-file copyright or SPDX headers exist in the Java sources.
• toml/LICENSE was the only place declaring MIT and BSD-3-Clause; the files it covers (toml.jflex grammar, toml tests, skeleton-toml) are present in the source tree.
• Files-Excluded in debian/copyright names mvnw* and .mvn/*; neither exists in the tree, so the exclusion matches the repacked tarball.
• Build-Depends are satisfiable: apt-cache shows libjackson2-core-java, libjackson2-databind-java and libjackson2-annotations-java 2.18.11-1 and libyaml-snake-java 2.5+ds-1 in the archive.
• debian/rules is dh $@; debhelper's maven buildsystem (Buildsystem/maven.pm) auto-detects a root pom.xml, so no explicit --buildsystem is required.
• The rename is handled correctly: libjackson2-dataformat-yaml (2.8.11-5, source jackson-dataformat-yaml) is still in unstable, and the new libjackson2-dataformat-yaml-java Provides it versioned and Breaks/Replaces it below 2.18.11~.
• docs/javadoc/** is upstream-committed generated javadoc for releases 2.9-2.14, not used by the build and not installed; the pages inspected carry only the FasterXML copyright notice.
• Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 (first two components equal), and the changelog version/distribution/date are consistent.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.3, packaged 2.18.11), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• No build or test run was possible. In particular, I could not determine whether dh_auto_build's Maven reactor also builds the three modules marked --ignore in debian/libjackson2-dataformat-yaml-java.poms: toml/pom.xml pins jflex-maven-plugin 1.9.0 while Debian ships 1.8.2, although mh_patchpoms normally substitutes the Debian plugin version. A build would show whether this matters.
• The prescan read only the first 4 MiB of one large file (most likely a docs/javadoc index-all.html); I did not read that file in full.

Proposed changes

None.