DFSG NEW review for jackson3-core version 3.2.4-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

debian/copyright is DEP-5 (canonical Format URL) and matches the tree: the Files: * Apache-2.0 stanza covers everything, the Schubfach stanza (Expat, Raffaello Giulietti) matches exactly the three io/schubfach/*.java sources, Schubfach-LICENSE and the four unittest/io/schubfach/*Checker.java/MathUtilsTest.java files, and the FastDoubleParser stanza names all four holders of the two META-INF licence texts with the composite licence Expat and BSL-1.0 and BSD-2-clause, whose BSL-1.0 and BSD-2-clause notices are reproduced in full. No other copyright holder appears anywhere in the tree, every licence is DFSG-free, no non-free clause exists, no binary or vendored third-party code is present, and no file lacks a licence. The two holders the prescan suspected were missing (Daniel Lemire, Werner Randelshofer) are both named.

Packaging

Standard, well-maintained Java team packaging: compat 13 with dh $@, Architecture: all, correct use of maven-debian-helper, all Build-Depends/-Indep names present in the archive, a single DEP-3-headered patch with a clear purpose, the jackson-bom/jackson-base/oss-parent POMs installed with the version conflict against libjackson2-core-java avoided deliberately, and a clean changelog for a renamed source package. Only a small defect in debian/replace-generate.sh (a broken error branch) was found; nothing else a sponsor would require is wrong. One aspect of the build cannot be confirmed without building (see Not confirmed).

Issues

1. [minor] [packaging] debian/replace-generate.sh's "unreplaced tag" check never fails: the exit status is passed to echo, not executed

• Files: debian/replace-generate.sh:30-31
• Basis: checked, in the package or with a reference tool
• Evidence: echo 'Not all tags were\n replaced' >&2 exit 1 — the ; between the redirect and exit 1 is missing, so exit and 1 become arguments of echo
• Problem: The guard that is meant to abort the build when a template token such as @projectversion@ was not substituted does not exit: the script continues with set -e satisfied (echo returns 0) and installs a PackageVersion.java still containing literal @...@ tokens, turning a clear error into a confusing compile failure later.
• Fix: Add the missing separator: echo 'Not all tags were replaced' >&2; exit 1 (or make the if body a single { ...; exit 1; }).

2. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Basis: found by the review tooling's own checks
• Evidence: 3.2.4-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• debian/copyright read in full; DEP-5, Format: is the canonical copyright-format/1.0 URL. Stanzas: Files: * (Apache-2.0, 2007-2026 Tatu Saloranta, 2012-2022 FasterXML LLC), the Schubfach stanza (Expat, 2018-2020 Raffaello Giulietti), the FastDoubleParser stanza (Expat and BSL-1.0 and BSD-2-clause, 2023-2024 Werner Randelshofer / 2021 The fast_float authors / 2020-2022 Tim Buktu / 2022 Daniel Lemire) and debian/* (Apache-2.0) last, so it overrides the catch-all for debian/.
• Every Files: pattern checked against the tree: src/main/java/tools/jackson/core/io/schubfach/* matches exactly DoubleToDecimal.java, FloatToDecimal.java, MathUtils.java (each carrying the Raffaello Giulietti Expat header), and the four listed test files are exactly those present in src/test/java/tools/jackson/core/unittest/io/schubfach/.
• The FastDoubleParser stanza covers both META-INF texts and names every holder they mention; FastDoubleParser-ThirdParty-LICENSE contains the Boost Software License (for Daniel Lemire's fast_double_parser), the MIT text (fast_float authors) and the 2-clause BSD text (Tim Buktu), all reflected by License: Expat and BSL-1.0 and BSD-2-clause; BSL-1.0 is cited by reference, Expat and BSD-2-clause are given in full.
• Prescan's two "possibly named under a similar name" holders are actually present: Werner Randelshofer and Daniel Lemire are both in the FastDoubleParser stanza (only the country suffix "Switzerland" is dropped).
• Tree-wide grep for Copyright, (C), © (excluding .pc/) finds no holder beyond Tatu Saloranta (main sources), Raffaello Giulietti (schubfach sources and their checkers) and the third-party licence texts; grep for SPDX, "Licensed under", "Permission is hereby granted", GNU/LGPL, Apache/Mozilla/CC, "public domain", "All rights reserved", "non-commercial" finds nothing outside the Apache/MIT/BSL/BSD texts.
• No built or opaque files in the tree: glob for jar/class/zip/png/gif/jpg/pdf/so/dll/exe/pyc/min.js/woff/ttf matches nothing; no vendored copy of another library (Jackson uses ch.randelshofer.fastdoubleparser from libfastdoubleparser-java 2.0.1-4, which the archive has, and org.moditect/maven-shade-plugin are in debian/maven.ignoreRules so the Debian jar is not shaded).
• Generated file has its generator input in the tree: src/main/java/tools/jackson/core/json/PackageVersion.java is produced by debian/replace-generate.sh from the shipped PackageVersion.java.in, and removed in override_dh_auto_clean.
• Files-Excluded (docs/javadoc/, mvnw, .mvn/*) names nothing present: the tree has no mvnw, no .mvn and docs/ holds only README.md. release.sh still calls ./mvnw, but it is an upstream release helper not used by the build.
• Prescan binary file src/test/resources/data/fuzz-json-34435.json is a fuzz input (a corrupt JSON document, with JVM symbol strings in it from the fuzzer corpus) used as a crash reproducer by src/test/java/tools/jackson/core/unittest/fuzz/Fuzz34435ParseTest.java; prescan binary file src/test/resources/data/fuzz-json-utf32-32208.json is the same kind of input, UTF-32 encoded, used by Fuzz32208UTF32ParseTest.java and perf/ManualFuzzUTF32.java. Both are test data, not programs, and are covered by Files: * (Apache-2.0).
• src/test/resources/data/FastDoubleParser_errorcases.txt (912 KB) is a list of numeric literals only, with no text, header or licence notice, and no test in the tree references it; it is data, covered by Files: *. Likewise test_0xA0.json, floats-755.json and META-INF/maven/foo/bar/foo-bar/pom.properties are small hand-made test fixtures.
• Packaging files read: control, rules, changelog (all 3.2.4-1 entries), source/format, patches/series and no-module-descriptors.patch, libjackson3-core-java.poms, maven.properties, maven.rules, maven.ignoreRules, replace-generate.sh, salsa-ci.yml, upstream/metadata, and the three installed POMs. No maintainer scripts, no debian/tests, no .maintscript, no gbp.conf.
• Build-Depends/-Indep names all exist in the archive (apt-cache): junit5 5.14.4, libassertj-core-java 3.26.3, libbuild-helper-maven-plugin-java 3.3.0, libfastdoubleparser-java 2.0.1-4, libmaven-bundle-plugin-java 5.1.9, libmaven-enforcer-plugin-java 3.5.0, libreplacer-java 1.5.3.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components match, so it is current; changelog is for unstable, 3.2.4-1, team upload, Closes: #1149814, and keeps the jackson-core history, correct for a source package cloned and renamed.
• uscan found the packaged version as the newest upstream release (upstream 3.2.4, packaged 3.2.4).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, BSL-1.0).

Not confirmed

• Whether the build compiles tools.jackson.core.json.PackageVersion twice. debian/rules:9,12 generates src/main/java/tools/jackson/core/json/PackageVersion.java before dh_auto_configure, while the inherited POM configuration (debian/jackson-base-3.2.4.pom:183-196, the process-packageVersion execution of com.google.code.maven-replacer-plugin with phase generate-sources) writes the same class to ${generatedSourcesDir}/tools/jackson/core/json/PackageVersion.java, i.e. target/generated-sources, which debian/oss-parent-79.pom:371-382 adds as an extra source root via build-helper-maven-plugin. Nothing in debian/maven.ignoreRules disables the replacer, and libreplacer-java is a Build-Depends-Indep, which suggests it does run in the Debian build; if so javac should report a duplicate class. A build would show this immediately, either as duplicate class: tools.jackson.core.json.PackageVersion or as the replacer not being executed at all (in which case debian/replace-generate.sh is the only generator and all is well).
• Whether the test scope resolves with the versions the installed parent POMs pin: debian/oss-parent-79.pom pins junit-bom 6.0.3 and assertj 3.27.7 while the archive has junit5 5.14.4 and libassertj-core-java 3.26.3; maven-debian-helper's version mangling is expected to reconcile them, but that could not be checked (the maven buildsystem of maven-debian-helper is not installed on this reviewing system).

Proposed changes

None.