DFSG NEW review for jackson3-databind version 3.2.4-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is Apache-2.0 and debian/copyright is already DEP-5 (correct Format: line): Files: * for Tatu Saloranta/FasterXML, LLC, stanzas for the differently-held files (Google Inc., Ben Manes) and for debian/*, and the one licence text needed is a pointer to /usr/share/common-licenses/Apache-2.0, where the Apache-2.0 text really is. No non-free terms, no licence-less file, no built file without source, and no licence combination problem. The scan's single finding, FasterXML.com in 41 javatime files, is the same holder as the FasterXML, LLC, Seattle, USA <info@fasterxml.com> already named under Files: *, so it is not missing. The one gap is that a test file copied from Apache Cayenne carries the ASF header yet is attributed to FasterXML (reported below, minor; the licence is still correct).

Packaging

Ordinary, competently done Debian Java packaging: dh with maven-debian-helper and javahelper, compat 13, ${maven:Depends}/${misc:Depends} in place, maven rules/ignoreRules/properties consistent with the POM, one small DEP-3 patch that removes the two module-info.java files, salsa-ci.yml, gbp.conf and DEP-12 upstream metadata, no maintainer scripts, 3.0 (quilt), and Standards-Version 4.7.4 against Policy 4.7.4.1. Minors only: an unused Build-Depends (xmlstarlet), and two Build-Depends I could not confirm (groovy, and libjackson2-annotations-java (>= 2.22), which the archive lists only at 2.18.11-1).

Issues

1. [minor] [licensing] Files: * gives Tatu Saloranta/FasterXML as the holder of src/test/java/tools/jackson/databind/util/internal/PrivateMaxEntriesMapTest.java, which carries the ASF header and is copied from Apache Cayenne

• Files: debian/copyright:29, src/test/java/tools/jackson/databind/util/internal/PrivateMaxEntriesMapTest.java:1-21
• Basis: inferred from what was read, not seen directly
• Evidence: the file's header: * Licensed to the Apache Software Foundation (ASF) under one … * regarding copyright ownership. The ASF licenses this file, and two lines below it //copied from https://github.com/apache/cayenne/blob/b156addac1c8e4079fa88e977fee609210c5da69/cayenne-server/src/test/java/org/apache/cayenne/util/concurrentlinkedhashmap/ConcurrentLinkedHashMapTest.java; debian/copyright has no stanza for it, so Files: * applies: Copyright: 2007-2026, Tatu Saloranta … 2012-2022, FasterXML, LLC, Seattle, USA.
• Problem: The file says it is licensed to the ASF and is copied from an ASF project, so its copyright is the ASF's (or its contributors'), not Tatu Saloranta's or FasterXML's; the copyright file is expected to record the holder of every file in the source, which this one already does for the sibling derived file (MapTestFactory.java, Copyright: 2015, Ben Manes). The licence itself is right: Apache-2.0, matching Files: *, so nothing here is non-free.
• Fix: Add a stanza for that file, for example Files: src/test/java/tools/jackson/databind/util/internal/PrivateMaxEntriesMapTest.java / Copyright: The Apache Software Foundation / License: Apache-2.0.

2. [minor] [packaging] Build-Depends on xmlstarlet is used by nothing

• Files: debian/control:20
• Basis: inferred from what was read, not seen directly
• Evidence: xmlstarlet, in Build-Depends; debian/rules is the whole build (%:\n\tdh $@ --with javahelper), and searching the package and the build tooling installed here finds xmlstarlet only in debian/control and in /usr/share/perl5/Debian/Debhelper/Buildsystem/leiningen.pm (the Leiningen build system, not used here); maven-debian-helper's own dh build system (maven.pm) does not call it, and the archive's javahelper 0.82 does not depend on it.
• Problem: A build dependency that no part of the build invokes is dead weight in every buildd chroot and in the source's declared interface.
• Fix: Drop xmlstarlet from Build-Depends, and groovy too if nothing needs it (see Not confirmed).

3. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Basis: found by the review tooling's own checks
• Evidence: 3.2.4-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• debian/copyright is already machine-readable (DEP-5, correct Format: line), so no replacement text is proposed.
• Licence of the whole tree: Apache-2.0. Every Java file carries Licensed under the Apache License, Version 2.0, upstream LICENSE is the full Apache-2.0 text, src/main/resources/META-INF/NOTICE is the Apache NOTICE (and ships in the jar), and debian/* has its own stanza; debian/* really is the packaging of the Java team (Wolodja Wentland, Markus Koschany).
• Holders found by an exhaustive case-insensitive grep for copyright, (C) and © across the tree (51 hits) are all covered: the 44 Copyright 2013 FasterXML.com files under src/{main,test}/java/tools/jackson/databind/ext/javatime/ (the 41 the scan listed, plus the javatime util/DecimalUtils.java and the javatime serializers/deserializers), Tatu Saloranta (NOTICE: Copyright 2007-, Tatu Saloranta), Google Inc. (util/internal/LinkedDeque.java:2, PrivateMaxEntriesMap.java:2, package-info.java:2, Copyright 2011 Google Inc. All Rights Reserved.), Ben Manes (util/internal/MapTestFactory.java:2, Copyright 2015 Ben Manes. All Rights Reserved.).
• The scan's 41 files with Copyright 2013 FasterXML.com (src/main/java/tools/jackson/databind/ext/javatime/{,deser,ser,util}/.java and src/test/java/tools/jackson/databind/ext/javatime/{,deser,ser}/.java) are the same holder as FasterXML, LLC, Seattle, USA <info@fasterxml.com> already named under Files: * — the header's FasterXML.com is that company's site/domain — so no separate stanza is required; Debian's own shipped copyright for jackson-databind 2.18.11 (/usr/share/doc/libjackson2-databind-java/copyright) names the same javatime code only as FasterXML, LLC.
• util/internal/Linked.java and UnreflectHandleSupplier.java have no copyright header at all and are covered by Files: *; test/.../util/internal/{CLHMTestlibTests,PrivateMaxEntriesMapStressTest}.java likewise.
• No built or non-preferred-form files: no .jar, .class, .so, .dll, .exe, .pyc, .pdf, image, font, archive or minified JS/CSS anywhere in the tree.
• Files-Excluded (mvnw, mvnw.cmd, .mvn/*, docs/javadoc) matches the tree: there is no mvnw, no .mvn/ directory, and docs/ contains only README.md (upstream itself emptied it).
• The JSON/TXT files under src/test/resources (data/citm_catalog.json, data/float-array-755.txt, fuzz/oss-fuzz-47034.json, fuzz/oss-fuzz-47036.json, com/fasterxml/jackson/databind/deser/DummyProcessableContent.json) are test fixtures, covered by Files: *.
• Embedded third-party code (Google's ConcurrentLinkedHashMap files, the Cayenne-derived test) is not a library Debian ships separately: there is no libconcurrentlinkedhashmap-java package, so vendoring it is not a duplicate-library problem.
• Packaging files read in full: control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, patches/series and patches/no-module-descriptors.patch, libjackson3-databind-java.classpath and .poms, maven.rules, maven.ignoreRules, maven.properties, upstream/metadata.
• The single patch is well formed DEP-3 (Description/Author/Forwarded: not-needed) and deletes src/main/java/module-info.java and src/test/java/module-info.java, matching its purpose (jackson3-core is packaged without a module descriptor); nothing else is patched.
• Standards-Version 4.7.4 is current against Policy 4.7.4.1 (same first two components); compat 13 is declared through debhelper-compat (= 13) with no debian/compat, and Depends: ${misc:Depends}, ${maven:Depends} plus Recommends: ${maven:OptionalDepends} are the right substvars for it.
• debian/rules needs no explicit build system: debhelper's maven.pm (check_auto_buildable, read at /usr/share/perl5/Debian/Debhelper/Buildsystem/maven.pm) selects itself whenever pom.xml is present, and debian/maven.properties supplies maven.test.skip=true.
• libjackson2-annotations-java and the (2.x-namespaced) annotations POM are used as the pom declares them; libjackson3-core-java (>= 3.2.4) is not in the archive yet but is built by jackson3-core 3.2.4-1, waiting in ftp-master's NEW, so its absence is not a fault.
• There is no debian/tests directory, so autopkgtest has nothing to run while the build skips the suite (maven.test.skip=true).
• No maintainer scripts, no debian/install|links|dirs, no Multi-Arch field and no Conflicts/Breaks are needed: the 3.x jar (jackson3-databind.jar) and its tools.jackson.* POM namespace do not collide with the 2.x package's jackson-databind.jar and com.fasterxml.jackson.* namespace.
• uscan found the packaged version as the newest upstream release (upstream 3.2.4, packaged 3.2.4).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Build-Depends libjackson2-annotations-java (>= 2.22): the archive's lists (2026-10-26) have only 2.18.11-1 for that binary package, which does not satisfy the constraint, and the apt-cache tool only looks in NEW for names the archive does not have at all, so it did not check whether a 2.22 upload is waiting there. If none is, the package cannot be built.
• Build-Depends groovy: nothing in the package refers to groovy (only 2018 changelog entries about groovy/groovy2), and neither jackson-databind's own pom nor the installed 2.x jackson-base pom declares a groovy dependency; if the 3.2.4 parent tools.jackson:jackson-base, which is outside this source package, needs it, the dependency is justified. I could not inspect that parent pom.
• Whether the build resolves the parent tools.jackson:jackson-base:3.2.4: the deps on the parent are rewritten by mh_patchpoms when the corresponding Debian POM exists in the local maven repo (the 2.x case, jackson-base-debian.pom, is installed by another jackson2 source package), and debian/maven.rules here carries no rule for it or for tools.jackson.core:jackson-core. Only a build would show it.
• I could not read javahelper (it is not installed on this reviewing system), so the claim that xmlstarlet is unused rests on the package itself and on debhelper/maven-debian-helper as installed here, not on javahelper's scripts.

Proposed changes

None.