Review: libjson-schema-tiny-perl 0.034-1

Package Information

Description	module to validate data against a schema, minimally JSON::Schema::Tiny aims to be a slimmed-down JSON Schema evaluator and validator, supporting the most popular keywords. Unlike JSON::Schema::Modern, this is not a complete implementation of the JSON Schema specification. Some features and keywords are left unsupported in order to keep the code small and the execution fast.
Maintainer	Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed By	gregor herrmann <gregoa@debian.org>
Sponsor	gregoa@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/perl-team/modules/packages/libjson-schema-tiny-perl.git (browse)
Closes	#1152233
Tracker	https://tracker.debian.org/pkg/libjson-schema-tiny-perl
Uploaded	12 days ago

New Package Report

.changes◂

Changed-By	gregor herrmann <gregoa@debian.org>
Architecture	source all
Distribution	unstable
Date	Tue, 27 Oct 2026 00:10:47 +0100
Source	libjson-schema-tiny-perl
Version	0.034-1

Changelog◂

libjson-schema-tiny-perl (0.034-1) unstable; urgency=medium
 .
   * Initial release (closes: #1152233).

.dsc◂

Package-List	libjson-schema-tiny-perl deb perl optional arch=all
Section	perl
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://metacpan.org/release/JSON-Schema-Tiny
Upstream-Contact: Karen Etheridge <ether@cpan.org>
Upstream-Name: JSON-Schema-Tiny

Files: *
Copyright: 2021, Karen Etheridge <ether@cpan.org>
License: Artistic or GPL-1+

Files: debian/*
Copyright: 2026, gregor herrmann <gregoa@debian.org>
License: Artistic or GPL-1+

License: Artistic
 This program is free software; you can redistribute it and/or modify
 it under the terms of the Artistic License, which comes with Perl.
 .
 On Debian systems, the complete text of the Artistic License can be
 found in `/usr/share/common-licenses/Artistic'.

License: GPL-1+
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 1, or (at your option)
 any later version.
 .
 On Debian systems, the complete text of version 1 of the GNU General
 Public License can be found in `/usr/share/common-licenses/GPL-1'.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 11 days ago.

Report◂

DFSG NEW review for libjson-schema-tiny-perl version 0.034-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is in DEP-5 format with the correct Format line, and its two stanzas cover the tree: Files: * (2021, Karen Etheridge) for all upstream files and Files: debian/* (2026, gregor herrmann) for the packaging. The declared Artistic or GPL-1+ matches LICENCE, which carries the full GPL-1 and Artistic 1.0 texts plus the "same terms as the Perl 5 programming language system itself" grant, and matches the module POD, README and dist.ini. Both licences are in /usr/share/common-licenses and the file points there, which DEP-5 permits. A tree-wide search found no other copyright holder or licence notice, no non-free terms and no binary, minified or otherwise source-less files; the pre-scan's holder check agrees that every holder found is named.

Packaging

Standard Debian Perl Team packaging: debhelper compat 13 through debhelper-compat, Build.PL/Module::Build::Tiny driven by plain dh $@, 3.0 (quilt) with no patches, autopkgtest-pkg-perl, and an initial changelog entry closing an ITP. The runtime Depends and the test Build-Depends-Indep match upstream's META.json, and the archive's versions satisfy every minimum (builtin::compat 0.003003, experimental 0.036, Mojolicious 9.x, Test::JSON::Schema::Acceptance 1.040); stable, which the module requires at 0.031, is Perl core since 5.38, which the archive's perl 5.42/5.44 provides, so no Debian package for it exists or is needed. Standards-Version 4.7.4 is current against Policy 4.7.4.1.

Issues

None.

Verified ◂

Read every file in debian/ in full (changelog, control, copyright, gbp.conf, libjson-schema-tiny-perl.docs, rules, source/format, upstream/metadata); debian/watch was left to the separate check.
Covered the whole upstream tree rather than sampling: all 96 MANIFEST-listed files were opened or grepped for copyright and licence wording, including lib/JSON/Schema/Tiny.pm (1710 lines, headers and POD), all of t/ and xt/, the t/additional-tests-* JSON data and READMEs, and inc/*.pm; .pc/ was not read.
Only two holders appear anywhere: Karen Etheridge (LICENCE, README, dist.ini, module POD) and the FSF inside the embedded GPL-1 text; the pre-scan reports "every holder found is named in debian/copyright".
t/additional-tests-/.json are schema/test data with no third-party notice; each directory's README says these are upstream's tests waiting to be accepted into the main JSON-Schema-Test-Suite, so Files: * under Karen Etheridge's Artistic/GPL-1+ is right.
t/results/*.txt are recorded acceptance-test logs (each starts generated with: Test::JSON::Schema::Acceptance ...) holding filenames and pass/fail counts, not compiled or generated code whose source would be needed.
README, INSTALL, MANIFEST and META.json/META.yml are Dist::Zilla output, but their generator configuration is present (dist.ini, weaver.ini) and the module source is the .pm, so the preferred form for modification is shipped; inc/AppendSection.pm and inc/CheckConflicts.pm are Dist::Zilla/Moose authoring plugins, not installed by Module::Build::Tiny.
LICENCE contains the full GNU GPL version 1 and Perl Artistic License 1.0 texts; debian/copyright points to /usr/share/common-licenses/Artistic and /usr/share/common-licenses/GPL-1 instead of duplicating them, as DEP-5 allows.
No .js, .css, .jar, .class, .so, .dll, .exe, .pyc, font, image or PDF files exist in the tree; no non-commercial, no-modification or field-of-use wording anywhere except the GPL-1's own clause in LICENCE.
The installed CONTRIBUTING carries upstream's contribution policy (including rules on AI-assisted patches); it restricts how contributions are accepted, not use, modification or redistribution of the software, so it is not a licence restriction.
Runtime dependencies match META.json: libbuiltin-compat-perl 0.003003-2 (exactly the required version), libexperimental-perl 0.036 (>= 0.026), libfeature-compat-try-perl 0.05, libmojolicious-perl and libautovivification-perl; stable 0.031 is core since Perl 5.38 (Module::CoreList and /usr/share/perl/5.42.3/stable.pm on this system), so no Debian package for it can be depended on and its absence from Depends is correct.
Test dependencies are sufficient for t/: libtest-simple-perl 1.302225 Provides libtest2-suite-perl (so Test2::V0 is available), libtest-warnings-perl 0.038 provides Test2::Warnings, and libtest-deep-perl, libmodule-build-tiny-perl 0.053 and libtest-json-schema-acceptance-perl 1.040 (>= 1.026) are in the archive.
Testsuite: autopkgtest-pkg-perl needs no debian/tests; autodep8's Perl template installs @builddeps@ (Build-Depends and Build-Depends-Indep) for the build-deps test, so the test-only dependencies reach the testbed.
debian/rules is dh $@ and lets dh's Module::Build::Tiny buildsystem drive Build.PL; at compat 13 there are no override_/execute_ targets, so no nocheck handling is required, and dh adds the relationship substvars itself.
3.0 (quilt) with no debian/patches and no series file; changelog 0.034-1 targets unstable, is the initial release and closes #1152233; source Section, Architecture: all, the Build-Depends/Build-Depends-Indep split, Vcs-* and Homepage follow Perl Team practice.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Artistic, GPL-1).

Not confirmed ◂

No build, test run or autopkgtest was performed in this read-only review, so nothing beyond what the files themselves show was exercised.
The Vcs-* and Homepage URLs and the ITP bug number #1152233 in debian/changelog were not fetched or checked against the BTS or Salsa (no network access from this review), so their reachability and ownership are unverified.
debian/watch could not be tested automatically: uscan ended with exit status 2 and no result that could be read, which is not normal and may mean the watch file made it misbehave. Run uscan --report on it by hand, with caution.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 11 days ago.

Review Information

accepted — allocated to awm 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

Back to Dashboard | View all reviews for this package