DFSG NEW review for liqp version 0.9.2.3+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is MIT (Expat): LICENSE and NOTICE name Bart Kiers, and the files that translate or quote Ruby code from Shopify Liquid or Jekyll are separately credited to Tobias Luetke and to Tom Preston-Werner and Jekyll contributors. No file carries a different or extra licence, and no non-free wording (non-commercial, no-derivatives, field-of-use) exists anywhere in the tree or in any test fixture. The two files with unsuitable provenance, the Maven wrapper jar and ComparingExpressionNodeTest.java (Stack Overflow), are excluded from the +ds tarball and are absent; debian/copyright is DEP-5, reproduces the MIT text in full, and its stanzas match the Ruby code actually quoted in the Java tests.

Packaging

Plain maven-debian-helper packaging that does what Policy and Java team practice want: debhelper-compat 14 with dh $@ (the maven buildsystem is auto-detected from pom.xml, so no --buildsystem is needed), architecture-independent dependencies properly in Build-Depends-Indep, one DEP-3 patch that the tree shows applied and that compiles either way, an autopkgtest exercising the installed jar through the library's real defaults, Vcs-* and upstream/metadata present, and Standards-Version 4.7.4 current against Policy 4.7.4.1. Only one thing could not be confirmed: whether all names in Build-Depends-Indep exist in the archive.

Issues

None.

Verified

• The prescan listed no files at all and no unmatched holder: it scanned 314 files and matched every holder it found against debian/copyright, so there is nothing left to account for from it.
• debian/copyright is machine-readable (Format 1.0) with Upstream-Name/Upstream-Contact/Source, a header Comment, Files-Excluded, the five Files stanzas and one stand-alone License: Expat paragraph; the MIT text it gives is identical in substance to LICENSE.
• A grep of the whole tree (excluding .pc/ and debian/) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, All rights reserved, Permission is hereby granted, GNU , Apache License, Mozilla Public, public domain, CC-BY, Creative Commons, non-commercial and not Evil matches only LICENSE and NOTICE: no source file carries a header, so the Files: * / debian/* structure plus the two third-party stanzas describes the tree completely.
• Files quoting Ruby test code were enumerated with a grep for def test_, assert_equal and assert_template_result: AbsTest, At_LeastTest, At_MostTest, CeilTest, ConcatTest, DefaultTest, FloorTest, LstripTest, RoundTest, RstripTest, SliceTest, Sort_NaturalTest, StripTest, Url_DecodeTest, Url_EncodeTest and where/LiquidWhereImplTest contain Liquid's test code and are in the Liquid/Tobias Luetke stanza; Absolute_UrlTest, Normalize_WhitespaceTest, Relative_UrlTest and where/JekyllWhereImplTest contain Jekyll's and are in the Jekyll stanza. No file with quoted Ruby code is left in Files: * only.
• ruby/cases_absolute_url_sharp.rb repeats the Jekyll test setup that ruby/_helpers.rb holds (Jekyll::Configuration/DEFAULTS, Jekyll::Site, render helper); that boilerplate is Jekyll's MIT code, whose holders are already named in debian/copyright; the rest of the ruby/ scripts are upstream's own assertions calling Liquid/Jekyll APIs.
• @author Christian Kohlschütter appears in Insertions.java, PlainBigDecimal.java, RenderTransformer.java and filters/{Pop,Push,Shift,Unshift}.java with no copyright statement, exactly as the Files: * Comment says; no other author tag or Created by line makes a copyright claim.
• The stackoverflow.com link at ruby/cases_empty_and_blank.rb:35 is a comment explaining that Ruby-on-Rails' blank? is deliberately not reproduced, not copied code; the same applies to the gist URL in filters/Absolute_Url.java:88.
• Every Files-Excluded entry is gone from the unpacked tree: no .mvn/, mvnw or mvnw.cmd, and no src/test/java/liqp/nodes/ComparingExpressionNodeTest.java.
• .github/badges/branches.svg and .github/badges/jacoco.svg are shields.io-format JaCoCo status badges produced by the workflow in .github/workflows/ci.yml (cicirello/jacoco-badge-generator); they are generated images carrying no code and are covered by the Expat Files: * stanza.
• ruby/docker_images/jekyll/Dockerfile and ruby/docker_images/liquid/Dockerfile are upstream's throwaway containers for running the Ruby comparison scripts (FROM ruby:3.3-alpine / FROM alpine:latest, gem install jekyll/liquid); they contain no third-party code and are not used by the Debian build.
• The maven buildsystem is selected automatically: check_auto_buildable in /usr/share/perl5/Debian/Debhelper/Buildsystem/maven.pm returns true when pom.xml exists, so dh $@ in debian/rules runs mh_patchpoms, the ANTLR generation and the jar/pom installation without --buildsystem=maven.
• debian/patches/json-filter-ioexception.patch is listed in series and applied: src/main/java/liqp/filters/Json.java catches IOException, and the header has Description, Author, Forwarded and Last-Update.
• Build-Depends names checked with apt-cache: antlr4-maven-plugin 4.9.2-3 matches the 4.9.2 pinned in debian/maven.rules; libjackson2-modules-java8-java 2.22.4-1 is the package that provides the jackson-datatype-jsr310 module the POM needs and the autopkgtest puts on its classpath; jackson core/annotations/databind, antlr4, junit4, maven-debian-helper and default-jdk-headless are the normal Java team packages.
• debian/tests/render matches the library's actual defaults: the default LIQUID flavor's snippetsFolderName is "snippets" (src/main/java/liqp/parser/Flavor.java, TemplateParser.Builder.build), so {% include 'greet' ... %} resolves snippets/greet.liquid, which the script creates.
• All of debian/ read in full: control, rules, changelog (unstable, 0.9.2.3+ds-1, closes ITP #1149769, valid date), gbp.conf, libliqp-java.poms, maven.rules, maven.ignoreRules, README.source, source/format (3.0 quilt), tests/control, tests/render, upstream/metadata, patches/. There are no maintainer scripts, .install/.links/.docs/.dirs files, and no debian/compat; maven-debian-helper installs the jar, symlink and POM itself.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: current, not an issue.
• uscan found the packaged version as the newest upstream release (upstream 0.9.2.3, packaged 0.9.2.3+ds).

Not confirmed

• libstrftime4j-java, in Build-Depends-Indep, is not in the unstable/experimental package lists nor in the NEW queue as of 2026-10-29T04:00:53Z (apt-cache answers "no packages found" and nothing provides it), so whether the package is buildable in a clean unstable chroot depends on a fact the lists do not show; it is presumably present or awaiting its own NEW review, since the review assumes the build succeeds.
• The executable bit on debian/tests/render could not be checked (read access gives no file modes), so autopkgtest's ability to run it as Tests: render was not verified.
• Whether Debian's current jackson-databind still declares throws IOException on ObjectMapper.writeValueAsString was not checked (the installed jar is binary); catching IOException around a call that declares the subclass JsonProcessingException compiles either way, so the patch is harmless, but it may no longer be needed.

Proposed changes

None.