jackson3-dataformats-binary 3.3.0-1

Package Information

Description	fast and powerful JSON library for Java -- CBOR dataformat The Jackson Data Processor is a multi-purpose Java library for processing JSON. Jackson aims to be the best possible combination of fast, correct, lightweight, and ergonomic for developers. It offers three alternative methods for processing JSON: * Streaming API inspired by StAX * Tree Model * Data Binding converts JSON to and from POJOs In addition to the core library, there are numerous extension that provide additional functionality such as additional data formats beyond JSON, additional data types or JVM languages. This package contains an extension for reading and writing Concise Binary Object Representation (CBOR) data, as specified by RFC 7049.
Maintainer	Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed By	Emmanuel Bourg <ebourg@apache.org>
Sponsor	ebourg@apache.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/java-team/jackson3-dataformats-binary.git (browse)
Closes	#1152918
Tracker	https://tracker.debian.org/pkg/jackson3-dataformats-binary
Uploaded	5 hours ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Fri, 13 Nov 2026 10:38:33 +0100
Source	jackson3-dataformats-binary
Version	3.3.0-1
Changed-By	Emmanuel Bourg <ebourg@apache.org>

Changelog◂

jackson3-dataformats-binary (3.3.0-1) unstable; urgency=medium
 .
   * Cloned the package as jackson3-dataformats-binary (Closes: #1152918)
   * New upstream release
     - Depend on libjackson3-core-java and libjackson3-databind-java
     - Updated the Maven rules
     - Build without the Java module descriptors
     - Updated debian/copyright
   * Excluded the docs directory from the source tarball

.dsc◂

Package-List	libjackson3-dataformat-cbor-java deb java optional arch=all libjackson3-dataformat-smile-java deb java optional arch=all
Section	java
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Jackson dataformats binary
Source: https://github.com/FasterXML/jackson-dataformats-binary
Upstream-Contact: FasterXML <info@fasterxml.com>
Files-Excluded: mvnw*
.mvn/*
docs

Files: *
Copyright: 2011-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
2007-2026, Tatu Saloranta <tatu.saloranta@iki.fi>
License: Apache-2.0

Files: ion/*
Copyright: 2011-2016, Amazon.com, Inc. or its affiliates
License: Apache-2.0

Files: protobuf/src/main/resources/tools/jackson/dataformat/protobuf/schema/descriptor.proto
protobuf/src/test/resources/tools/jackson/dataformat/protobuf/schema/descriptor.proto
Copyright: 2008, Google Inc.
License: BSD-3-clause

Files: debian/*
Copyright: 2026, Emmanuel Bourg
License: Apache-2.0

License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems the full text of the Apache License version 2.0
can be found in the file /usr/share/common-licenses/Apache-2.0.

License: BSD-3-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
.
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
* Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 4 hours ago.

Report◂

DFSG NEW review for jackson3-dataformats-binary version 3.3.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 12 found

Licensing

Everything in the tree is Apache-2.0 (root LICENSE and README, per-module NOTICE/LICENSE under */src/main/resources/META-INF, Amazon's Apache-2.0 headers in the ion module) except the two copies of Google's descriptor.proto, under BSD-3-clause; both are DFSG-free, no non-free wording is present, and greps for any other licence name found none. debian/copyright is DEP-5, ordered so the ion/protobuf/debian stanzas override Files: *, reproduces the full BSD-3-clause text and points at /usr/share/common-licenses/Apache-2.0. The one inaccuracy is that the Files: ion/* stanza drops Tatu Saloranta, whose copyright the ion module's own NOTICE states; the ion module is neither built nor installed, so Policy 2.3 does not require that notice and it is completeness only. No built or generated files are shipped: upstream's generated docs/ javadoc is the docs entry in Files-Excluded and is absent from the tree, and the only generated sources have their .java.in templates present.

Packaging

A clean clone of the jackson-dataformats-binary packaging: debhelper compat 13 with dh_auto_* plus a small post-install hook, arch:all packages split per dataformat, maven-debian-helper driven by debian/.poms with the three unbuilt modules (avro, protobuf, ion) marked --ignore, maven.rules and maven.ignoreRules matching what the poms actually use (the jacoco/cyclonedx/gradle-metadata/moditect plugins are ignored, so no build dependencies on them; build-helper, maven-bundle and replacer are declared and genuinely needed), a single DEP-3 patch that removes the module descriptors, ${misc:Depends} present and the dependencies on the jackson3 core and databind packages spelled out, Standards-Version 4.7.4 against a 4.7.4.1 Policy, sane unstable/3.3.0-1 changelog, Vcs- and Homepage set. Nothing here would stop a sponsor; the open points are the 3.3.0 version of the jackson3 core and databind dependencies, which the archive does not yet carry, and two things about the Maven POM and reactor handling that only a build would settle.

Issues

minor licensing 1. Files: ion/* omits Tatu Saloranta, whose copyright ion/src/main/resources/META-INF/NOTICE states ◂

Files: debian/copyright:14-16, ion/src/main/resources/META-INF/NOTICE:10
Basis: checked, in the package or with a reference tool
Evidence: stanza Files: ion/* with Copyright: 2011-2016, Amazon.com, Inc. or its affiliates, while the NOTICE it covers says Copyright 2007-, Tatu Saloranta (tatu.saloranta@iki.fi)
Problem: Files: ion/* comes after Files: * and so replaces its Copyright field for every file below ion/, including ion/src/main/resources/META-INF/NOTICE, which names Tatu Saloranta as a holder; that holder is therefore not represented for those files. Policy 2.3 does not require it here: the ion module takes no part in a binary package (ion/pom.xml is marked --ignore in debian/libjackson3-dataformat-cbor-java.poms and only cbor and smile are built and installed), and the file is a plain-text NOTICE shipped with its notice intact, so the case falls outside all three conditions of Policy 2.3. The DFSG team still asks for a complete debian/copyright.
Fix: Add 2007-2016, Tatu Saloranta <tatu.saloranta@iki.fi> to the ion stanza, or narrow the stanza to ion/src/main/java/* and ion/src/test/* so that ion's NOTICE and LICENSE stay under Files: *.

minor packaging 2. Files-Excluded is set but the version carries no repack suffix ◂

Files: debian/copyright, debian/changelog, debian/watch
Basis: found by the review tooling's own checks
Evidence: 3.3.0-1
Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified ◂

debian/copyright is DEP-5 with the correct Format URL; its stanzas are ordered so that later ones override Files: *, Files: ion/* covers the whole ion subtree (copyright-format section 6.9), and the two descriptor.proto paths are single anchored paths.
Holders found in the tree are FasterXML, LLC and Tatu Saloranta (Files: *; the NOTICE and LICENSE files under cbor/, avro/, protobuf/ and smile/ src/main/resources/META-INF), Amazon.com (ion/, matching the Copyright 2011/2012-2016 Amazon.com, Inc. or its affiliates headers on every ion main and test source), and Google Inc. (the two descriptor.proto copies). The prescan's one unmatched name, FasterXML.com in ion/src/test/java/tools/jackson/dataformat/ion/jsr310/MockObjectConfiguration.java:2, is FasterXML, LLC under its domain spelling and is named in Files: *.
Licences are Apache-2.0 for the whole tree apart from BSD-3-clause for the two descriptor.proto copies; the BSD-3 text is reproduced in full in debian/copyright and Apache-2.0 is given with a pointer to /usr/share/common-licenses/Apache-2.0. Greps for non-commercial, no-modification, field-of-use, CC-BY-NC and the JSON 'Good, not Evil' wording, and for MIT/GPL/LGPL/MPL/EPL/ISC licence names, found nothing.
The 12 files the prescan lists as unrecognised binary data are oss-fuzz regression inputs under */src/test/resources/data/, each read by its own test and none installed. avro/src/test/resources/data/fuzz-65649.avro is read by AvroFuzz449_65618_65649_IOOBETest; cbor/src/test/resources/data/clusterfuzz-cbor-35979.cbor by CBORFuzz_35979_StringValueTest, cbor/src/test/resources/data/clusterfuzz-cbor-65617.cbor by CBORFuzz451_65617_IOOBETest, cbor/src/test/resources/data/clusterfuzz-cbor-65768.cbor by CBORFuzz458_65768_NPETest; ion/src/test/resources/data/fuzz-420.ion by Fuzz420_65062_65083IOOBETest, ion/src/test/resources/data/fuzz-65062.ion by Fuzz_65062_VarintTest, ion/src/test/resources/data/fuzz-65274.ion by Fuzz434_65268_65274_NPETest, ion/src/test/resources/data/fuzz-65452.ion by Fuzz437_65452_NPETest, ion/src/test/resources/data/fuzz-66141.ion by IonFuzz_471_66141_AssertionErrorTest, ion/src/test/resources/data/fuzz-66149.ion by IonFuzz_469_66149_NegativeArraySizeTest, ion/src/test/resources/data/issue-303.ion by UncaughtExceptionsTest; smile/src/test/resources/data/clusterfuzz-smile-65126.smile by SmileFuzz_426_65126IOOBETest. They are crash inputs, not code, and carry no copyrightable content.
citm_catalog.json (1.6 MB, present in both cbor/src/test/resources/data and smile/src/test/resources/data) is the JSON benchmark catalog read by BiggerDataTest and BiggerDataParseTest: test data, not installed, covered by Files: *.
No built artefacts: no .class, .jar, .war, .pdf or .zip files in the tree; the generated javadoc tree upstream calls docs/ is the docs entry in Files-Excluded and is absent; the only generated sources are PackageVersion.java.in templates processed at build time by the maven-replacer plugin, whose input is present.
Only cbor and smile reach a binary package: avro/pom.xml, protobuf/pom.xml and ion/pom.xml are marked --ignore in debian/libjackson3-dataformat-cbor-java.poms, and the two binary packages match the two installed modules.
debian/patches/01-no-module-descriptors.patch has DEP-3 headers (Description, Author, Forwarded: not-needed) and only deletes the four module-info.java files; it creates nothing.
Read in full: debian/control, copyright, changelog, rules, source/format, the patch and series, libjackson3-dataformat-cbor-java.poms, maven.rules, maven.ignoreRules, maven.properties. Build-Depends names checked with apt-cache: junit5 5.14.4-2, libreplacer-java 1.5.3-3 and libjackson2-annotations-java 2.22-1 exist, so the (>= 2.22) requirement is met. The mh_installpom options used by the poms file and the rules (--no-parent, --has-package-version, --java-lib, --usj-name, --package) are all real, checked in its manual page and in /usr/share/doc/maven-repo-helper/reference.html.
Licence inventory was made by grepping the whole tree for Copyright, (C), the copyright sign, SPDX-License-Identifier, Licensed under, Permission is hereby granted, All rights reserved and public domain, and by reading every LICENSE and NOTICE file found (root, ion/, and the four modules' src/main/resources/META-INF).
uscan found the packaged version as the newest upstream release (upstream 3.3.0, packaged 3.3.0).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Build-Depends and Depends require libjackson3-core-java >= 3.3.0 and libjackson3-databind-java >= 3.3.0, but the package lists carry only 3.2.4-1 and 3.2.4-2; if 3.3.0 of those two sources is not waiting in NEW, this upload cannot be built and the two binary packages cannot be installed.
The maven reactor build is started on the root pom.xml, whose modules element lists cbor, smile, avro, protobuf and ion; I could not tell from the package or from maven-debian-helper what restricts the build to the two installed modules, while apache-avro, ion-java and protobuf-java are not in Build-Depends.
Whether the POMs reinstalled with --no-parent in debian/rules:5-7 stay usable: cbor/pom.xml:32-41 and smile/pom.xml:41-50 declare jackson-core and jackson-databind without a version, which they take from the removed parent's dependencyManagement.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 4 hours ago.

Back to Dashboard | View all reviews for this package