Review: jline4 4.0.14+ds-1

Package Information

Description	console input handling library for Java (JLine 4) JLine is a Java library for handling console input. It is similar in functionality to BSD editline and GNU readline but with additional features that bring it on par with the ZSH line editor. This package contains JLine 4: the line reader (org.jline.reader), the terminal abstraction (org.jline.terminal) and its JNI terminal provider, and the native library loader. It can be installed together with JLine 3 (libjline3-java).
Maintainer	Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/java-team/jline4.git (browse)
Closes	#1149767
Tracker	https://tracker.debian.org/pkg/jline4
Uploaded	11 days ago

New Package Report

.changes◂

Date	Fri, 02 Oct 2026 19:06:50 +0200
Source	jline4
Version	4.0.14+ds-1
Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all amd64
Distribution	unstable

Changelog◂

jline4 (4.0.14+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1149767)

.dsc◂

Component	main
Package-List	libjline4-java deb java optional arch=all libjline4-jni deb java optional arch=any
Section	java
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: JLine
Upstream-Contact: Guillaume Nodet <gnodet@gmail.com>
Source: https://github.com/jline/jline3
Comment:
 The orig tarball is repacked (+ds) to drop:
  - prebuilt native libraries for every platform (the JNI library is built
    from native/src/main/native at build time);
  - demo/wget.exe, a prebuilt Windows executable;
  - .mvn, .mvx, mvx and mvx.cmd: Maven extensions (git versioning, release
    tooling) and a launcher that downloads Maven, none usable offline;
  - website/, the documentation web site (not used by the build);
  - the help texts of the nano and less builtins and three nano syntax
    files, copied from GNU nano and less without their licence notices;
    they belong to the builtins, demo and groovy modules, which this
    package does not build.
Files-Excluded:
 .mvn
 .mvx
 mvx
 mvx.cmd
 demo/wget.exe
 native/src/main/resources/org/jline/nativ/FreeBSD
 native/src/main/resources/org/jline/nativ/Linux
 native/src/main/resources/org/jline/nativ/Mac
 native/src/main/resources/org/jline/nativ/Windows
 website
 builtins/src/main/resources/org/jline/builtins/*-help.txt
 demo/src/main/scripts/nanorc/groovy.nanorc
 demo/src/main/scripts/nanorc/java.nanorc
 demo/src/main/scripts/nanorc/xml.nanorc
 groovy/src/main/resources/org/jline/groovy/java.nanorc

Files: *
Copyright: 2002-2026, the original author(s)
           2002-2026, the original author or authors
License: BSD-3-clause
Comment:
 Most files carry the short JLine header ("This software is distributable
 under the BSD license"), which refers to LICENSE.txt. The *.caps files in
 terminal/src/main/resources/org/jline/utils are terminal descriptions
 printed by infocmp from the terminfo database (capability data).

Files: console-ui/*
Copyright: 2020, Andreas Wegmann
           2025, the original author(s)
License: BSD-3-clause
Comment:
 ConsoleUI was written by Andreas Wegmann and merged into JLine
 (console-ui/README.md); its sources now carry the JLine BSD-3-clause
 header. This module is not built by this package.

Files: console-ui/LICENSE.txt
Copyright: 2020, Andreas Wegmann
License: Apache-2.0
Comment:
 The licence file of the original ConsoleUI project.

Files: native/src/main/native/clibrary.c
       native/src/main/native/kernel32.c
       native/src/main/resources/org/jline/nativ/jlinenative.properties
       terminal/src/main/resources/META-INF/jline/README.md
       terminal/src/main/resources/META-INF/jline/providers/dumb
       terminal/src/main/resources/META-INF/jline/providers/exec
       terminal/src/main/resources/META-INF/services/org.jline.terminal.spi.TerminalProvider
       terminal-ffm/src/main/resources/META-INF/jline/providers/ffm
       terminal-ffm/src/main/resources/META-INF/services/org.jline.terminal.spi.TerminalProvider
       terminal-jni/src/main/resources/META-INF/jline/providers/jni
       terminal-jni/src/main/resources/META-INF/services/org.jline.terminal.spi.TerminalProvider
Copyright: 2009-2026, the original author(s)
           2019, the original author or authors
License: Apache-2.0

Files: .github/dependabot.yml
       .github/release-drafter-3x.yml
       .github/release-drafter.yml
       .github/workflows/master-build.yml
       demo/etc/logging.properties
       demo/etc/logging-verbose.properties
       native/Makefile
       native/Makefile.common
Copyright: The Apache Software Foundation
License: Apache-2.0
Comment:
 These files carry the Apache Software Foundation licence header, which
 has no copyright line; the ASF is the holder it refers to.

Files: builtins/src/main/java/org/jline/builtins/Options.java
       builtins/src/test/java/org/jline/builtins/OptionsTest.java
       demo/src/main/java/org/apache/felix/gogo/jline/Posix.java
       demo/src/main/java/org/apache/felix/gogo/jline/Shell.java
       native/src/main/java/org/jline/nativ/JLineNativeLoader.java
       native/src/main/java/org/jline/nativ/OSInfo.java
Copyright: the original author(s)
           The Apache Software Foundation
License: BSD-3-clause and Apache-2.0
Comment:
 These files carry the JLine BSD-3-clause header and, below it, the
 Apache Software Foundation licence header. Both licences apply.

Files: remote-telnet/src/main/java/org/jline/builtins/telnet/Connection.java
       remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionData.java
       remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionEvent.java
       remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionFilter.java
       remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionListener.java
       remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionManager.java
       remote-telnet/src/main/java/org/jline/builtins/telnet/PortListener.java
       remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java
Copyright: 2000-2005, Dieter Wimberger
           the original author(s)
License: BSD-3-clause and BSD-3-clause-telnetd
Comment:
 Code from the Java TelnetD library: the JLine BSD-3-clause header and the
 original TelnetD licence (text below). Both apply. This module is not
 built by this package.

Files: debian/*
Copyright: 2026, Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: BSD-3-clause

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or
 without modification, are permitted provided that the following
 conditions are met:
 .
 Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
 .
 Redistributions in binary form must reproduce the above copyright
 notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with
 the distribution.
 .
 Neither the name of JLine nor the names of its contributors
 may be used to endorse or promote products derived from this
 software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
 BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
 EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
 OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 OF THE POSSIBILITY OF SUCH DAMAGE.

License: BSD-3-clause-telnetd
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 Redistributions of source code must retain the above copyright notice,
 this list of conditions and the following disclaimer.
 Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 Neither the name of the author nor the names of its contributors
 may be used to endorse or promote products derived from this software
 without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS ``AS
 IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 2 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 10 days ago.

Report◂

DFSG NEW review for jline4 version 4.0.14+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 2 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The bulk of the tree is BSD-3-clause JLine code, with correctly stanned Apache-2.0 files (ASF headers), six dual BSD-3/Apache-2.0 files, the Java TelnetD files (Dieter Wimberger, BSD-3 plus the TelnetD text) and console-ui (BSD-3, with its original Apache-2.0 LICENSE.txt declared); nothing non-free was found and the BSD text matches LICENSE.txt. But the catch-all Files stanza is wrong for GNU nano's syntax files kept under builtins/src/test/resources/nano and for the third-party theme file demo/src/main/scripts/nanorc/dark.nanorctheme, whose author Yuri Sakhno is not named. Those two inaccuracies make debian/copyright an unreliable description of the source.

Packaging

The packaging is sound: debhelper compat 14, Standards-Version 4.7.4, complete and available Build-Depends, a clean split between the arch:all jars and the Multi-Arch: same JNI package, DEP-3 patches that explain the Debian-only library path and POM version, a real autopkgtest with correct dependencies, and sane changelog, gbp.conf, README.source and maven helper files. No packaging issue worth reporting was found.

Issues

blocker licensing 1. builtins test fixtures java.nanorc, xml.nanorc and shell.nanorc reproduce GNU nano syntax files but are declared BSD-3-clause ◂

Files: builtins/src/test/resources/nano/java.nanorc:5-23, builtins/src/test/resources/nano/xml.nanorc:5-10, builtins/src/test/resources/nano/shell.nanorc:5-14, debian/copyright:14, debian/copyright:34-37
Basis: inferred from what was read, not seen directly
Evidence: java.nanorc:5-6 syntax "Java" "\.java$" / magic "Java " followed by GNU nano's keyword, javadoc (color magenta "@author.*") and TODO rules; xml.nanorc:7,10 magic "(XML|SGML) (sub)?document" and color white "^.+$"; shell.nanorc:10-12 the \<(alias|bg|bind|builtin|...|wait)\> builtin list and color brightblue "\<(case|do|done|elif|else|esac|fi|for|...)". debian/copyright:14 itself records that such files are copied from GNU nano and less without their licence notices, while debian/copyright:34-37 gives all of them License: BSD-3-clause.
Problem: GNU nano's syntax files are GPL-3-or-later (checked in /usr/share/doc/nano/copyright, Files: * -> GPL-3+), and these three fixtures carry neither nano's copyright nor its licence notice. Files: * therefore states the wrong licence and holder for them and no GPL text or common-licenses pointer is given, contrary to Policy 12.5. The maintainer already removed the same copies from demo/ and groovy/ through Files-Excluded for exactly this reason, so the copies in the builtins test resources were overlooked. They are only test fixtures and are not installed in any binary, so this is an inaccurate copyright file rather than a licence conflict in the shipped jars.
Fix: Add a Files stanza for builtins/src/test/resources/nano/java.nanorc, xml.nanorc and shell.nanorc (and re-check python.nanorc), naming the GNU nano copyright holders with License: GPL-3+ and the pointer to /usr/share/common-licenses/GPL-3; or replace the fixtures with syntax files written for JLine. SyntaxHighlighterTest counts five .nanorc fixtures and jnanorc includes java.nanorc and xml.nanorc, so keep the fixture count consistent.

blocker licensing 2. debian/copyright does not name Yuri Sakhno for demo/src/main/scripts/nanorc/dark.nanorctheme ◂

Files: demo/src/main/scripts/nanorc/dark.nanorctheme:1-24, demo/src/main/scripts/nanorc/light.nanorctheme, debian/copyright:34-37
Basis: inferred from what was read, not seen directly
Evidence: dark.nanorctheme:21-24 # Author: Yuri Sakhno / # ysakhno at gmail dot com / # https://github.com/YSakhno/nanorc/; the file names no licence of its own, while debian/copyright:34-37 attributes every file to Copyright: 2002-2026, the original author(s) under License: BSD-3-clause.
Problem: This is a third-party file that names its author and project but gives no licence notice, so the catch-all stanza claims for it both the wrong holder (the JLine authors) and terms the file does not state; light.nanorctheme is the same theme format and evidently derived from it. Policy 12.5 requires the copyright file to carry the actual copyright and licence of every file; the prescan's author check cannot see this because it only matches Copyright/(C)/© lines.
Fix: Add a Files stanza for demo/src/main/scripts/nanorc/{dark,light}.nanorctheme recording Yuri Sakhno (and any other holders) with the licence of https://github.com/YSakhno/nanorc/ (GPL-3+ with the common-licenses pointer if that is what the project uses), or replace the two theme files with themes written by the JLine authors and drop the copied header.

Verified ◂

Read every file under debian/ in full. debian/copyright is DEP-5 with the exact copyright-format 1.0 URL and standalone texts for BSD-3-clause, BSD-3-clause-telnetd and Apache-2.0; the BSD text matches LICENSE.txt.
Collected licence evidence tree-wide with grep (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Apache Software Foundation, GNU/LGPL/AGPL, MPL, MIT/ISC, zlib, public domain, non-commercial, no-modification, Creative Commons): no non-free terms and no GPL/LGPL/MPL/MIT-labelled file exists in the tree apart from the GNU nano copies reported.
Files-Excluded entries are indeed absent: .mvn, .mvx, mvx, mvx.cmd, demo/wget.exe, native/src/main/resources/org/jline/nativ/{Linux,Mac,Windows,FreeBSD} (only jlinenative.properties remains), website/, builtins *-help.txt, demo/src/main/scripts/nanorc/{groovy,java,xml}.nanorc and groovy/src/main/resources/org/jline/groovy/java.nanorc.
All ASF-headed files are covered by the two Apache-2.0 stanzas (clibrary.c, kernel32.c, native/Makefile and Makefile.common, the four .github files, demo/etc/logging*.properties) or by the BSD-3-clause and Apache-2.0 stanza (Options.java, OptionsTest.java, Posix.java, Shell.java, JLineNativeLoader.java, OSInfo.java); I opened Posix.java and JLineNativeLoader.java and saw the JLine header above the ASF header.
The eight remote-telnet files carry the Dieter Wimberger BSD-3 notice plus the TelnetD terms, both reproduced in the copyright file; Connection.java was read to confirm.
console-ui sources carry the JLine BSD-3 header (AbstractPromptableElement.java sampled) and console-ui/LICENSE.txt is Apache-2.0 as declared; the module is not built.
The 16 *.caps files in terminal/src/main/resources/org/jline/utils are infocmp dumps (first line Reconstructed via infocmp from file: ...), i.e. terminfo capability data as the Files: * comment at debian/copyright:38-43 says; ncurses, their source, is MIT/X11 (/usr/share/doc/ncurses-base/copyright), so the BSD-3 claim on these data files is not a licence conflict.
ScreenTerminal.java credits the Apache Karaf WebConsole plug-in (Apache-2.0) and Ajaxterm (public domain) under its BSD-3 header; Apache-2.0 allows that relicensing with attribution, the Apache text is in debian/copyright, and builtins is not a built module, so it is acceptable.
docs/ConsoleUI-Logo.png is the only binary asset besides the .caps files; not opened, per instructions (see unconfirmed).
Prescan: it listed no files; its author check only matches Copyright/(C)/© lines, which is why the author block in dark.nanorctheme and the headerless nano fixtures did not appear there.
Packaging: debhelper-compat 14, Standards-Version 4.7.4 (first two components of the reviewing system's 4.7.4.1), Maintainer/Uploaders/Vcs-*/Homepage present. All Build-Depends exist: debhelper, default-jdk-headless 2:1.25-77 (points to openjdk-25), maven-debian-helper 2.7 (pulls maven >= 3.9 and the core Maven plug-ins) and libmaven-bundle-plugin-java.
debian/rules: hardening=+all with dpkg-buildflags; the JNI library is built from native/src/main/native with -fPIC -shared -lutil into /usr/lib//jni/jline4; only native, terminal, terminal-jni and reader are built and installed, with arch/indep overrides that match; debian/native is removed after clean.
Patches: DEP-3 headers (Description/Author/Forwarded/Last-Update) on both; 0001 adds the jline4 subdirectory to the java.library.path lookup (loadNativeLibrary() sets nativeLibraryPath at JLineNativeLoader.java:415, so the early return is consistent with the other success branches) and 0002 writes the literal version into the five installed POMs; both are Debian-specific and explained in README.source.
The upstream suite is skipped because pom.xml:114 pins JUnit 6.0.3 while Debian ships JUnit 5, so README.source's explanation holds; debian/tests/readline compiles and runs against the installed jars and its Depends are correct (default-jdk-headless gives java/javac, bsdutils provides script per apt-cache, dpkg-dev gives dpkg-architecture). libjline3-jni, needed for the coexistence claim, exists via jline3 3.29.0+ds-1 in NEW.
Changelog 4.0.14+ds-1 to unstable (initial release, closes #1149767) matches the orig tarball name; gbp.conf, README.source, maven.rules, .poms, maven.ignoreRules and maven.properties are consistent with the four built modules.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 4.4.8, packaged 4.0.14+ds), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

docs/ConsoleUI-Logo.png: its licence is not stated anywhere in the package. It is evidently the ConsoleUI project's logo, but the console-ui Apache-2.0 LICENSE.txt does not clearly cover it and the image was not opened.
console/src/main/java/org/jline/console/impl/SystemRegistryImpl.java:1012 says its unescape() is Based on code by Udo Klimaschewski, https://gist.github.com/uklimaschewski/6741769; the gist's licence could not be checked from the package, and debian/copyright names no such holder.
Whether builtins/src/test/resources/nano/python.nanorc is also copied from GNU nano could not be established: it resembles none of the nano syntax files installed here (it is much longer) although it uses the same constructs.
No build or autopkgtest run was possible in this read-only review.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 10 days ago, started 10 days ago, completed 10 days ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

The uploader said:

Fixed in
https://salsa.debian.org/java-team/jline4/-/merge_requests/1 for an upload
of 4.0.14+ds2-1 to replace this one.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
4.0.14+ds2-1	0d2e59de…	2026-10-28 19:32	2026-10-28 19:43	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package