DFSG NEW Queue

DFSG, Licensing & New Packages Team

javaparser 3.28.2-1

Package Information

DescriptionJava library for parsing Java source files

The library features abstract syntax tree (AST) generation and supports the visitor pattern. The AST records the source code structure, javadoc and comments. It is also possible to change the AST nodes or create new ones to modify the source code.

Main features are: * light weight * good performance * easy to use * AST can be modified * AST can be created from scratch

MaintainerDebian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed ByEmmanuel Bourg <ebourg@apache.org>
Sponsorebourg@apache.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/java-team/javaparser.git (browse)
Popcon Installs2072
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/javaparser
Uploaded2 hours ago

New Package Report

.changes◂
Sourcejavaparser
Version3.28.2-1
Changed-ByEmmanuel Bourg <ebourg@apache.org>
Architecturesource all
Distributionunstable
DateTue, 03 Nov 2026 08:52:14 +0100
Changelog◂ 
javaparser (3.28.2-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release
     - Refreshed the patches
     - Ignore the new central-publishing-maven-plugin
   * Build the symbol solver in the new libjavaparser-symbol-solver-java package
   * Updated the package description
   * Updated debian/copyright
   * Converted debian/watch to the version 5 format
   * Removed the Priority field
   * Standards-Version updated to 4.7.4
.dsc◂
Package-Listlibjavaparser-java deb java optional arch=all
libjavaparser-symbol-solver-java deb java optional arch=all
Sectionjava
Priorityoptional
Componentmain
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: javaparser
Upstream-Contact: Júlio Vilmar Gesser
Source: https://github.com/javaparser/javaparser
Files-Excluded: *.jar
                *.aar
                .mvn/*
                mvnw*

Files: *
Copyright: 2007-2010, Júlio Vilmar Gesser
           2011, 2013-2026, The JavaParser Team
           2015-2016, Federico Tomassetti
           2021, Oliver Kopp
License: LGPL-3+ or Apache-2.0

Files: javaparser-symbol-solver-testing/src/test/resources/PlatformTestUtil.java.txt
Copyright: 2000-2019, JetBrains s.r.o.
License: Apache-2.0

Files: debian/*
Copyright: 2013, Benjamin Mesing
           2017-2026, Emmanuel Bourg
           2022-2024, Pierre Gruet
License: LGPL-3+

License: LGPL-3+
 LGPL license 3.0 or any later version of that license.
 On Debian GNU/Linux system you can find the complete text of the
 license in '/usr/share/common-licenses/LGPL-3'

License: Apache-2.0
 On Debian systems, the full text of the Apache License, Version 2.0 can be
 found in the file '/usr/share/common-licenses/Apache-2.0'.

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for javaparser version 3.28.2-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 1 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 12 found, 9 not mentioned in this report

Licensing

The JavaParser code itself is DFSG-free: every source header offers the LGPL version 3 or later or the Apache License 2.0, both licences are compatible, and both texts are covered by /usr/share/common-licenses pointers. debian/copyright is nevertheless inaccurate. Two symbol-solver test fixtures carry an 'All Rights Reserved. Confidential Information of Agilysys NV, LLC.' notice with no licence grant anywhere, so they cannot be redistributed as they are, and the catch-all Files: * stanza credits only the JavaParser holders while four TensorFlow samples and one Apache Groovy sample belong to other copyright holders.

Packaging

Sound, conventional maven-debian-helper packaging: debhelper-compat 13 with a plain dh $@ (the maven build system is auto-detected from pom.xml), a .poms file that assigns each shipped module to the right binary package, both binary packages Arch: all / Multi-Arch: foreign with substvars, DEP-3 headers on both patches, and Standards-Version 4.7.4, which is current. The only fault found is stale prose in debian/README.source.

Issues

blocker licensing 1. Two issue113 test fixtures carry an Agilysys 'All Rights Reserved / Confidential Information' notice and no licence grant ◂
  • Files: javaparser-symbol-solver-testing/src/test/resources/issue113/com/foo/Widget.java:2, javaparser-symbol-solver-testing/src/test/resources/issue113/com/foo/base/Widget.java:2
  • Basis: checked, in the package or with a reference tool
  • Evidence: * (C) 2016 Agilysys NV, LLC. All Rights Reserved. Confidential Information of Agilysys NV, LLC.
  • Problem: The only statement in these two files is an ownership and confidentiality notice; no permission to copy, modify or distribute is given, so they are not licensed at all. debian/copyright has no stanza for them, so Files: * attributes them to the JavaParser Team under LGPL-3+ or Apache-2.0, which is false, and the source package ships them anyway. Distribution without a grant fails DFSG 1-3 and Policy 2.2.1 (every package in main must comply with the DFSG) and Policy 12.5. Note that simply adding a Files: stanza for them with License: LGPL-3+ or Apache-2.0, as the scan's holder list suggests, would not fix it: there is no such grant to record.
  • Fix: Get a licence from Agilysys (or upstream's confirmation that the paste is licensed under the project's terms), or drop the two files from the source package (a further Files-Excluded/repack) and adapt Issue113Test.java, which parses src/test/resources/issue113/com/foo/Widget.java. Whichever way it is settled, record the files, their real holder and their real licence in debian/copyright.
important licensing 2. Files: * does not name The TensorFlow Authors or the Apache Software Foundation, whose files are in the tree ◂
  • Files: javaparser-core-testing/src/test/resources/com/github/javaparser/issue_samples/issue_2627/Ops.java:1, javaparser-core-testing/src/test/resources/com/github/javaparser/issue_samples/issue_2627/Ops_cr.java:1, javaparser-core-testing/src/test/resources/com/github/javaparser/issue_samples/issue_2627/Ops_crlf.java:1, javaparser-core-testing/src/test/resources/com/github/javaparser/issue_samples/issue_2627/Ops_lf.java:1, javaparser-core-testing/src/test/resources/com/github/javaparser/issue_samples/issue_2627/DefaultStrategy.java:2-18, debian/copyright:11-15
  • Basis: checked, in the package or with a reference tool
  • Evidence: // Copyright 2020 The TensorFlow Authors. All Rights Reserved. (the four Ops*.java) and * Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. in DefaultStrategy.java, whose package groovy.transform.builder; shows it is an unmodified copy of Groovy's file.
  • Problem: Files: * lists only Júlio Vilmar Gesser, the JavaParser Team, Federico Tomassetti and Oliver Kopp, so the copyright of these five files is attributed to the wrong entity, which makes debian/copyright inaccurate (Policy 4.5, 12.5). The licensing itself is fine — all five are Apache-2.0, one of the two options Files: * offers — but the holders are missing while a comparable third-party file (PlatformTestUtil.java.txt, JetBrains) does have its own stanza.
  • Fix: Add a Files: stanza for javaparser-core-testing/src/test/resources/com/github/javaparser/issue_samples/issue_2627/Ops*.java with Copyright: 2020 The TensorFlow Authors / License: Apache-2.0, and one for DefaultStrategy.java naming The Apache Software Foundation (and Groovy's contributors) with License: Apache-2.0.
minor packaging 3. debian/README.source documents a debian/rules get-orig-source target that does not exist ◂
  • Files: debian/README.source:9, debian/rules:3-4
  • Basis: checked, in the package or with a reference tool
  • Evidence: The original tarball was repackaged, because it was distributed in there zip format. Use debian/rules get-orig-source to repeat the repackaging. while debian/rules is only %: / dh $@.
  • Problem: debian/rules has no get-orig-source target and dh provides no such action, so the documented command fails; the paragraph also still describes the source as repacked from a zip, whereas it is now fetched from git and excludes the Maven wrapper and the .jar/.aar fixtures.
  • Fix: Drop the paragraph, or point at the real procedure (uscan/git and the Files-Excluded list in debian/copyright).
minor packaging 4. Files-Excluded is set but the version carries no repack suffix ◂
  • Files: debian/copyright, debian/changelog, debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: 3.28.2-1
  • Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
  • Fix: Add the suffix to the version, and Repacksuffix to debian/watch.
Verified ◂
  • Every Java source header under javaparser-core/ and javaparser-symbol-solver-core/ (1049 Copyright lines sampled in full) states the dual either version 3 of the License, or (at your option) any later version LGPL / Apache terms, matching the LGPL-3+ or Apache-2.0 in Files: *; the holders Gesser, JavaParser Team, Tomassetti and Kopp (RecordAsTypeIdentifierNotAllowed.java:3) are all named there.
  • The PlatformTestUtil.java.txt stanza is correct: the file starts // Copyright 2000-2019 JetBrains s.r.o. Use of this source code is governed by the Apache 2.0 license, which the stanza records as Apache-2.0.
  • No other third-party licence wording exists in the tree: a tree-wide search for Permission is hereby granted, MIT, BSD, ISC, MPL, EPL, Creative Commons, public domain and All rights reserved matches only LICENSE.APACHE/LICENSE.GPL/LICENSE.LGPL (the project's own copies of the texts) and the TensorFlow/Agilysys headers reported above.
  • The eleven .class files listed by the scan are test inputs, not build output, and none is an issue: javaparser-symbol-solver-testing/src/test/resources/record_declarations/box/Box.class, .../record_declarations/box/BoxWithAllConstructors.class, .../record_declarations/box/BoxWithNonCanonicalConstructor.class, .../record_declarations/box/Foo.class and .../record_declarations/box/GenericBox.class are loaded byte-by-byte through a ClassLoader in ReflectionRecordDeclarationTest (box/%s.class), which is why the matching sources Box.java, BoxWithAllConstructors.java, BoxWithNonCanonicalConstructor.java and GenericBox.java sit in the parent record_declarations/ directory (Foo is the empty class the test declares without a source).
  • javaparser-symbol-solver-testing/src/test/resources/EmptyVarargsCallTest/foo/Foo.class, .../issue2951/foo/A.class, .../issue2953/foo/A.class, .../issue2953/foo/IB.class, .../pullRequest2398/A.class and .../pullRequest2398/B.class are likewise compiled fixtures for the symbol solver's bytecode tests, each with its .java source beside it (Foo.java, A.java, IB.java, A.java, B.java).
  • javaparser-core-testing/src/test/resources/com/github/javaparser/source_zip/test.zip is test data read by SourceZipTest; it contains test_zip/Bar.java, test_zip/test.txt and test_zip/dir/.
  • Generated code has its inputs in the tree: javaparser-core/src/main/javacc/java.jj, javaparser-core/src/main/java-templates/ and the javaparser-core-generators / javaparser-core-metamodel-generator modules are all present, and no shipped file carries a generated, do not edit marker.
  • Files-Excluded (*.jar, *.aar, .mvn/*, mvnw*) matches the tree: no jar, aar, mvnw or .mvn exists, so the stanza does not name files that are still shipped.
  • debian/copyright is DEP-5 with the correct Format URI, Upstream-Name/Source, a Files: * catch-all and per-file stanzas; no replacement file is needed.
  • Packaging: debhelper-compat 13 with ${maven:Depends}, ${misc:Depends} and ${maven:OptionalDepends} present, two Arch: all / Multi-Arch: foreign packages, debian/libjavaparser-java.poms assigning javaparser-core to libjavaparser-java and javaparser-symbol-solver-core (with --package=libjavaparser-symbol-solver-java) to the new package, both patches carrying DEP-3 headers, and Standards-Version 4.7.4, whose first two components equal the reviewing system's Policy (4.7.4.1).
  • Build-Depends names exist in the archive: libjavacc-maven-plugin-java 3.2.1-1 (which itself depends on javacc, 7.0.13-1), libtemplating-maven-plugin-java 1.0.0-2 and libchecker-framework-java 3.2.0+ds-4.
  • uscan found the packaged version as the newest upstream release (upstream 3.28.2, packaged 3.28.2).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, LGPL-3).
Not confirmed ◂
  • Not verified whether the --package=libjavaparser-symbol-solver-java option on the javaparser-symbol-solver-core line of debian/libjavaparser-java.poms is honoured by the component that actually installs the jar: this rules file uses the maven build system's own install step (debian-maven-plugin, invoked with the main package name), not mh_install/mh_installpom, and the mh tools' option parser would give the file-level package precedence. A build would show which package receives the symbol-solver jar and its /usr/share/maven-repo entries.
  • I could not check whether javassist-3.27-compatibility.patch is still needed against the javassist version in the archive; the method it replaces (LocalVariableAttribute.variableNameByIndex) is only exercised at run time by the symbol solver's tests.
  • What these files are. The scan made before the review picked them out (built files, minified code, archives, licence wording that is rarely free, or licences that are not accepted), and this report does not mention them: javaparser-symbol-solver-testing/src/test/resources/issue2951/foo/A.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/issue2953/foo/A.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/issue2953/foo/IB.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/pullRequest2398/A.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/pullRequest2398/B.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/record_declarations/box/BoxWithAllConstructors.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/record_declarations/box/BoxWithNonCanonicalConstructor.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/record_declarations/box/Foo.class (Java class file); javaparser-symbol-solver-testing/src/test/resources/record_declarations/box/GenericBox.class (Java class file).
Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until , because the review found serious issues.

Back to Dashboard | View all reviews for this package