Review: jackson-dataformats-text 2.18.11-2
Package Information
| Description | fast and powerful JSON library for Java -- YAML dataformat The Jackson Data Processor is a multi-purpose Java library for processing JSON. Jackson aims to be the best possible combination of fast, correct, lightweight, and ergonomic for developers. It offers three alternative methods for processing JSON: * Streaming API inspired by StAX * Tree Model * Data Binding converts JSON to and from POJOs In addition to the core library, there are numerous extension that provide additional functionality such as additional data formats beyond JSON, additional data types or JVM languages. This package contains an extension for reading and writing YAML encoded data. |
|---|---|
| Maintainer | Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> |
| Changed By | Emmanuel Bourg <ebourg@apache.org> |
| Sponsor | ebourg@apache.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/java-team/jackson-dataformats-text.git (browse) |
| Tracker | https://tracker.debian.org/pkg/jackson-dataformats-text |
| Uploaded | 17 days ago |
New Package Report
.changes
| Distribution | unstable |
|---|---|
| Date | Tue, 20 Oct 2026 19:25:49 +0200 |
| Source | jackson-dataformats-text |
| Version | 2.18.11-2 |
| Changed-By | Emmanuel Bourg <ebourg@apache.org> |
| Architecture | source all |
Changelog
jackson-dataformats-text (2.18.11-2) unstable; urgency=medium . * Added the missing info in debian/copyright
.dsc
| Package-List | libjackson2-dataformat-yaml-java deb java optional arch=all |
|---|---|
| Section | java |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Jackson dataformats text
Source: https://github.com/FasterXML/jackson-dataformats-text
Upstream-Contact: FasterXML <info@fasterxml.com>
Files-Excluded: mvnw*
.mvn/*
Files: *
Copyright: 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
2007-, Tatu Saloranta <tatu.saloranta@iki.fi>
License: Apache-2.0
Files: toml/src/main/jflex/com/fasterxml/jackson/dataformat/toml/toml.jflex
toml/src/test/java/com/fasterxml/jackson/dataformat/toml/TomlParserTest.java
Copyright: 2020-2021, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
Tom Preston-Werner
License: Apache-2.0 and MIT
Comment: The TOML grammar and parts of the test suite are adapted from the
TOML project, as stated in toml/LICENSE.
Files: toml/src/main/jflex/skeleton-toml
Copyright: Gerwin Klein, Steve Rowe, Regis Decamps, Google LLC
License: BSD-3-clause
Files: debian/*
Copyright: 2026, Emmanuel Bourg <ebourg@apache.org>
License: Apache-2.0
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems the full text of the Apache License version 2.0
can be found in the file /usr/share/common-licenses/Apache-2.0.
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
License: BSD-3-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
* Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
* Neither the names of the authors nor the names of JFlex contributors may
be used to endorse or promote products derived from this software without
specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 17 days ago.
Report
DFSG NEW review for jackson-dataformats-text version 2.18.11-2
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 2 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 1 found
Licensing
The source is entirely free and DFSG-compliant. Almost all files fall under the Files: * catch-all, licensed Apache-2.0 (Jackson's standard licence, matching the LICENSE/NOTICE files in each module's META-INF and the root LICENSE). The toml module's jflex grammar and test file are correctly singled out as Apache-2.0 and MIT (adapted from the TOML project, per toml/LICENSE), and the JFlex skeleton as BSD-3-clause. The Files-Excluded: mvnw* .mvn/* repacking directives are honoured (no such files remain in the tree). No minified, compiled or non-source artifacts beyond test fixtures: csv/.../fuzz-50402.csv, the toml clusterfuzz testcase files and the docs/javadoc HTML are generated/test data whose Java sources are present. The only inaccuracy is that the properties module's services file carries 'Copyright 2012 FasterXML.com', a variant of the entity named in Files: * (FasterXML, LLC), which is not literally represented.
Packaging
Clean, conventional Debian Java packaging: debhelper-compat 13 with a simple dh $@ rules file, maven-debian-helper Build-Depends, and maven.rules/publishedRules that build only the yaml module (csv/properties/toml are marked --ignore in the .poms file). Standards-Version 4.7.4 matches current Policy 4.7.4.1. The binary package libjackson2-dataformat-yaml-java correctly renames the standalone libjackson2-dataformat-yaml (2.8.11) with Provides/Replaces/Breaks; the renamed package is not yet in the archive, so the Provides is not a fault. Changelog documents the initial release with bug closure and a follow-up fixing debian/copyright. No maintainer scripts, tests or policy violations present.
Issues
minor licensing 1. Copyright holder 'FasterXML.com' not named in debian/copyright ◂
- Files: properties/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory (line 1); debian/copyright
Files: *stanza - Basis: checked, in the package or with a reference tool
- Evidence: File header:
# Copyright 2012 FasterXML.com; debian/copyrightFiles: *names onlyFasterXML, LLC, Seattle, USAandTatu Saloranta. - Problem: The
Files: *catch-all correctly licenses this file (Apache-2.0) but does not name the holder in its own header, 'FasterXML.com'. It is the same company as FasterXML, LLC under an older name, so this is cosmetic, but the holder shown in the file notice is not represented. - Fix: Add 'FasterXML.com' to the Copyright line of the
Files: *stanza (or a small dedicated stanza for the properties services files), e.g.Copyright: 2013-2017, FasterXML, LLC; 2012 FasterXML.com.
minor packaging 2. Files-Excluded is set but the version carries no repack suffix ◂
- Files:
debian/copyright,debian/changelog,debian/watch - Basis: found by the review tooling's own checks
- Evidence:
2.18.11-2 - Problem:
debian/copyrighthasFiles-Excluded, so uscan repacks the upstream tarball, but the version indebian/changelogdoes not say so with a suffix such as+dfsgor+ds, as is the convention for a tarball that differs from upstream's. - Fix: Add the suffix to the version, and
Repacksuffixtodebian/watch.
Verified ◂
- debian/copyright is DEP-5 machine-readable with the correct Format: URL; all Files/License stanzas verified against on-tree LICENSE/NOTICE files and licence bodies (Apache-2.0, MIT, BSD-3-clause).
- Files-Excluded (mvnw*, .mvn/*) are absent from the tree; the repacked tarball honours them.
- No holder-vs-file mismatch beyond the FasterXML.com naming variant above; sampled main/test Java sources carry no per-file copyright headers and rely on the module LICENSE/NOTICE, correctly captured by
Files: *. - csv/src/test/resources/data/fuzz-50402.csv is binary test input read by FuzzCSVReadTest (
readResource("/data/fuzz-50402.csv")); not shipped functionality, no DFSG concern. - toml test resources clusterfuzz-testcase-minimized-* are fuzz regression test data.
- docs/javadoc/csv/2.10/ HTML is generated javadoc whose Java sources are present in the tree; covered by
Files: *Apache-2.0. - Packaging: debhelper-compat 13,
dh $@, Standards-Version 4.7.4 (valid for Policy 4.7.4.1), build deps exist (apt-cache), ${maven:Depends}/${misc:Depends} present, rename Provides/Replaces/Breaks correct. - toml/LICENSE is a third-party licence file (TOML MIT + JFlex BSD) applied to the grammar/skeleton; matches the dedicated debian/copyright stanzas.
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream2.22.4, packaged2.18.11), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
None.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 16 days ago, started 16 days ago, completed 16 days ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.