jline3 3.29.0+ds-1

Package Information

Description	Console input handling library JLine is a Java library for handling console input. It is similar in functionality to BSD editline and GNU readline but with additional features that bring it in par with ZSH line editor. People familiar with the readline/editline capabilities for modern shells (such as bash and tcsh) will find most of the command editing features of JLine to be familiar. This package contains the JLine Java classes. Native terminal support is provided by the libjline3-jni package; without it JLine falls back to the pure-Java exec (stty) terminal provider.
Maintainer	Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/java-team/jline3.git (browse)
Popcon Installs	192
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/jline3
Uploaded	13 hours ago

New Package Report

.changes◂

Version	3.29.0+ds-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all amd64
Distribution	unstable
Date	Tue, 09 Jun 2026 23:11:51 +0200
Source	jline3

Changelog◂

jline3 (3.29.0+ds-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release 3.29.0 (needed by Scala 2.13.18 bootstrap).
   * d/watch: Version 5 git mode; Repacksuffix +ds.
   * d/copyright: Files-Exclude prebuilt JNI binaries; build
     libjlinenative.so from C.
   * New libjline3-jni package (Arch: any) with the native library from
     source.
   * d/control: refresh build-deps for 3.29; Standards-Version 4.7.4.
   * d/maven.rules: map jna, jansi and sshd to the debian version instead
     of a fixed one, so newer uploads of them do not break the build.
   * Build the JNI library with the Debian build flags (debug symbols,
     hardening).

.dsc◂

Section	java
Priority	optional
Component	main
Package-List	libjline3-java deb java optional arch=all libjline3-jni deb java optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: JLine
Source: https://github.com/jline/jline3
Files-Excluded: *.exe
                mvnw*
                .mvn
                .travis*
                native/src/main/resources/org/jline/nativ/*

Files: *
Copyright: 2000-2005, Dieter Wimberger
           2002-2017, Guillaume Nodet
           2002-2016, Jason Dillon
License: BSD-3-clause

Files: builtins/src/main/java/org/jline/builtins/Options.java
       builtins/src/main/java/org/jline/builtins/ScreenTerminal.java
       builtins/src/test/java/org/jline/builtins/OptionsTest.java
       native/src/main/java/org/jline/nativ/JLineNativeLoader.java
       native/src/main/java/org/jline/nativ/OSInfo.java
Copyright: 2002-2020, the original author(s)
           2023, the original author(s)
License: BSD-3-clause and Apache-2.0
Comment:
 These files carry a dual header: the JLine BSD-3-clause notice plus the
 Apache Software Foundation grant under the Apache License, Version 2.0.
 Both licenses apply.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

Files: demo/src/main/java/org/apache/felix/gogo/jline/Posix.java
Copyright: 2023, the original author(s)
           Apache Software Foundation (Apache Felix)
License: BSD-3-clause and Apache-2.0
Comment:
 Apache Felix Gogo code carrying a dual header: the JLine BSD-3-clause notice
 plus the Apache Software Foundation grant under the Apache License,
 Version 2.0. Both licenses apply.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

Files: debian/*
Copyright: 2019, Saif Abdul Cassim <saif.15@cse.mrt.ac.lk>
           2020, Samyak Jain <samyak.jn11@gmail.com>
License: BSD-3-clause
Comment:
 The Debian packaging is licensed under the same terms as the upstream project.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or
 without modification, are permitted provided that the following
 conditions are met:
 .
 Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
 .
 Redistributions in binary form must reproduce the above copyright
 notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with
 the distribution.
 .
 Neither the name of JLine nor the names of its contributors
 may be used to endorse or promote products derived from this
 software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
 BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
 EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
 OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 OF THE POSSIBILITY OF SUCH DAMAGE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
   http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 2 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 8 hours ago.

Report◂

DFSG NEW review for jline3 version 3.29.0+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 2 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Every file in the tree is under BSD-3-clause or Apache-2.0, both DFSG-free and mutually compatible, so there is no licence that blocks distribution. debian/copyright is not accurate, however: Files: * declares BSD-3-clause for a number of files that carry only the ASF Apache-2.0 grant, including native/src/main/native/clibrary.c, which is compiled into the shipped libjline3-jni library, and the terminal provider service files packaged into the jars; and console-ui/LICENSE.txt, an Apache-2.0 text naming Copyright 2020 Andreas Wegmann, is not described at all. The Apache-2.0 licence text itself is present (stand-alone paragraph plus /usr/share/common-licenses), so both faults are fixable by correcting the stanzas.

Packaging

Packaging is sound: debhelper 13 with maven-debian-helper, a proper arch:any JNI package built from the in-tree C sources with the dpkg-buildflags hardening flags, correct arch:all/arch:any split, DEP-3 patch, working dependency set that exists in the archive, current Standards-Version (4.7.4 against Policy 4.7.4.1) and sane changelog. No maintainer scripts, no policy violation found. The test suite is not run (maven.test.skip=true and an empty override_dh_auto_test, no autopkgtest), which is accepted Java-team practice and not a fault, but worth knowing.

Issues

1. [blocker] [licensing] Files: * declares BSD-3-clause for Apache-2.0-only files, including clibrary.c compiled into libjline3-jni

Files: debian/copyright:10-14 (Files: *), native/src/main/native/clibrary.c:1-14, native/src/main/native/kernel32.c:1-14, native/Makefile:1-15, native/Makefile.common:1-15, terminal*/src/main/resources/META-INF/services/org/jline/terminal/provider/{exec,ffm,jansi,jna,jni}:1-14, .github/dependabot.yml:1-16, .github/release-drafter.yml:1-16, .github/workflows/*.yml, demo/etc/logging.properties:1-15, demo/etc/logging-verbose.properties:1-15
Basis: checked, in the package or with a reference tool
Evidence: Files: * gives License: BSD-3-clause. clibrary.c:2-4: Copyright (C) 2009-2017 the original author(s). / Licensed under the Apache License, Version 2.0 (the "License"); with no BSD block anywhere in the file; kernel32.c and the provider files (# Copyright (C) 2022 the original author(s). / # Licensed under the Apache License, Version 2.0) are the same. native/Makefile:1 and the .github files read Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. Contrast builtins/src/main/java/org/jline/builtins/Options.java, which carries both the BSD block and the ASF block and is covered by the dual-licence stanza at debian/copyright:16-30.
Problem: The copyright file states the wrong licence (and omits the ASF as holder) for these files. It matters for the shipped artefacts: debian/rules compiles clibrary.c and jlinenative.c into libjlinenative.so for libjline3-jni, and the provider service files are resources inside the jline3-terminal/-jansi/-jna/-jni/-ffm jars in libjline3-java. Each file's own notice is Apache-2.0 only, so d/copyright must say so.
Fix: Add an Apache-2.0 stanza (or extend the existing dual-licence ones) covering native/src/main/native/.c, native/Makefile, terminal*/src/main/resources/META-INF/services/org/jline/terminal/provider/, .github/ and demo/etc/*.properties, with the holder from the notices (the original author(s); Apache Software Foundation for the ASF-headed files) and License: Apache-2.0. The Apache-2.0 licence text at debian/copyright:82-97 already covers the reference to /usr/share/common-licenses/Apache-2.0.

2. [blocker] [licensing] console-ui/LICENSE.txt (Apache-2.0, Copyright 2020 Andreas Wegmann) is not described in debian/copyright

Files: console-ui/LICENSE.txt:189 and the whole file, debian/copyright: no console-ui stanza; Files: * at line 10 applies instead
Basis: checked, in the package or with a reference tool
Evidence: Copyright 2020 Andreas Wegmann followed by Licensed under the Apache License, Version 2.0 (the "License"); in the Apache-2.0 appendix. debian/copyright names neither Andreas Wegmann nor any Apache licence for console-ui; Files: * makes the file BSD-3-clause with Dieter Wimberger/Guillaume Nodet/Jason Dillon as holders.
Problem: A file shipped in the source grants Apache-2.0 and names a copyright holder that debian/copyright does not mention, so the file does not accurately describe the licensing of every file. (The console-ui/*.java sources are BSD-headered, so the licence file looks like a leftover from the standalone ConsoleUI project, but that does not remove the need to describe the file as shipped.)
Fix: Add a stanza, e.g. Files: console-ui/LICENSE.txt / Copyright: 2020, Andreas Wegmann / License: Apache-2.0, and if it is a stale copy rather than the licence of console-ui/src, say so in a Comment so the discrepancy is recorded.

Verified

The prescan's one finding, console-ui/LICENSE.txt:189 (Andreas Wegmann), is reported as its own issue above.
Files-Excluded / prebuilt binaries: the +ds tarball has native/src/main/resources/org/jline/nativ excluded and that directory is now empty; the corresponding C sources are in the tree (native/src/main/native/clibrary.c, jlinenative.c, jlinenative.h, kernel32.c) and debian/rules compiles clibrary.c and jlinenative.c into libjlinenative.so, so nothing is a built binary without its source.
Whole-tree grep for GPL/LGPL/MPL/EPL/CDDL/Creative Commons, non-commercial, no-modification and similar wording found no matches; the only licences present are BSD-3-clause and Apache-2.0, which are compatible with each other.
File headers sampled across every module (builtins, console, console-ui, jansi-core, native, reader, remote-ssh, remote-telnet, style, terminal, terminal-*): BSD-3-clause with the original author(s) plus Dieter Wimberger for remote-telnet, and dual BSD+ASF exactly where debian/copyright:16-42 says (builtins Options.java, ScreenTerminal.java, OptionsTest.java, native JLineNativeLoader.java, OSInfo.java, demo Posix.java). The BSD-3-clause text in debian/copyright matches LICENSE.txt.
All of debian/ read: changelog, control, copyright, rules, source/format, patches/series and remove-werror.patch (DEP-3 header present, purpose clear), libjline3-java.poms, maven.rules, maven.ignoreRules, maven.properties, salsa-ci.yml, upstream/metadata. No debian/tests.
Dependencies exist in the archive: libjansi-java 2.4.3, libmina-sshd-java 2.13.2, libjuniversalchardet-java 2.5.0, libjna-java; default-jdk-headless is openjdk-25, which compiles both the release-8 modules and terminal-ffm's release 22.
Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool) — current.
libjline3-jni installs libjlinenative.so into /usr/lib//jni, the directory other Debian JNI packages use (e.g. /usr/lib/x86_64-linux-gnu/jni/libjunixsocket-native-system.so), and JLineNativeLoader's last-resort path scans java.library.path for System.mapLibraryName("jlinenative"), i.e. libjlinenative.so.
No binaries, fonts, PDFs or minified files in the tree; the only images are console-ui/doc logos and screenshots, project artwork under the tree's BSD grant.
Tests are never executed: debian/maven.properties sets maven.test.skip=true and debian/rules has an empty override_dh_auto_test; there is no autopkgtest. Not a policy violation.
Ignored .pc/ and debian/cargo-checksum.json as instructed.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 3.30.17, packaged 3.29.0+ds), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

builtins/pom.xml and console/pom.xml depend on com.googlecode.juniversalchardet:juniversalchardet (version 1.0.3 via pom.xml's juniversalchardet.version), but debian/maven.rules rewrites only jansi, sshd, jna, jsr305 and junit to debian, while the archive's libjuniversalchardet-java is 2.5.0. If that package installs no 1.0.3 alias in /usr/share/maven-repo the offline Maven build cannot resolve the dependency; a build in a clean chroot with the listed Build-Depends would show either way. It is not visible from the package alone (the package is not installed here).
I could not run a JVM here, so whether Debian's java.library.path actually lists /usr/lib//jni (the location libjline3-jni relies on) is unverified; other Debian JNI packages install there, which suggests it does.

Proposed changes

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-10-29 05:03 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package