DFSG NEW review for monaco-editor version 0.47.0+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every file of the source tree is Expat/MIT: the whole tree carries Microsoft's MIT header in LICENSE.txt and per file, with three named exceptions (src/basic-languages/swift/swift.ts by David Owens II, src/basic-languages/postiats/* by Artyom Shalkhakov, src/basic-languages/wgsl/* by Microsoft and Google LLC), and the full Expat text is reproduced, so nothing needs a pointer into /usr/share/common-licenses. No non-free wording exists anywhere in the tree, the repack drops no file whose licence would have mattered, and ThirdPartyNotices.txt is just upstream's compilation of notices for components that are not files of this source package. debian/copyright is machine-readable and matches the notices, with one format slip (a Source field inside a Files stanza).

Packaging

The packaging is otherwise careful and well documented: DEP-3 patches each explained in README.source, a custom build whose shims and patches are all justified, autopkgtest, debhelper compat 14, a font symlink, and the engine's package verified as waiting in NEW. One path, however, is wrong: both the build and the installed symlink take codicons from /usr/share/fonts/truetype/codicons/codicon.ttf, while fonts-codicons's own metadata says it installs into /usr/share/fonts-codicons/. That has to be corrected before upload, so the packaging is not yet of good quality.

Issues

1. [important] [packaging] codicon font is taken from and linked to /usr/share/fonts/truetype/codicons/codicon.ttf, but fonts-codicons installs into /usr/share/fonts-codicons/

• Files: debian/build.sh:49, debian/node-monaco-editor.links:1, debian/rules:18
• Basis: inferred from what was read, not seen directly
• Evidence: debian/build.sh:49 cp /usr/share/fonts/truetype/codicons/codicon.ttf \ (under set -eu); debian/node-monaco-editor.links:1 usr/share/fonts/truetype/codicons/codicon.ttf usr/share/nodejs/monaco-editor/esm/vs/base/browser/ui/codicons/codicon/codicon.ttf; fonts-codicons description (apt-cache): "This package ships the TrueType font, together with the CSS stylesheet, the SVG sprite and the TypeScript icon table that upstream publishes alongside it, installed in /usr/share/fonts-codicons/."
• Problem: The build copies the font out of a path its Build-Depends does not provide, and the shipped symlink points at the same non-existent path. Since debian/build.sh runs under set -eu, the copy aborts the build (a file debian/build.sh names that is not in the tree and, on this evidence, not in the font package either); if the copy did not run, dh_link would still install node-monaco-editor with a dangling codicon.ttf symlink, so the font would be missing from the installed tree. apt-cache, the only reference available here, says the font package installs into /usr/share/fonts-codicons/ instead.
• Fix: Check the font package's file list and change debian/build.sh, debian/node-monaco-editor.links and the comment in debian/rules to the path fonts-codicons really installs (on the evidence here /usr/share/fonts-codicons/codicon.ttf).

2. [minor] [licensing] Source field used inside a Files stanza, which copyright-format 1.0 does not allow there

• Files: debian/copyright:9-12

• Basis: checked, in the package or with a reference tool

• Evidence:

  Files: src/basic-languages/swift/swift.ts
  Copyright: David Owens II
  Source: https://github.com/owensd/vscode-swift
  License: Expat
  

• Problem: copyright-format 1.0 section 5.2 lists only Files, Copyright, License and Comment as allowed in a Files stanza; Source is defined as a header-stanza field (5.1, 6.4). The field here is therefore non-conforming, and parsers that validate against the 1.0 field list reject it.

• Fix: Remove the Source line from the stanza, or fold the URL into a Comment field of that stanza (e.g. Comment: taken from https://github.com/owensd/vscode-swift).

Verified

• Read all of debian/ in full (control, rules, changelog, copyright, README.source, README.Debian, build.sh, clean, get-orig-source, gbp.conf, salsa-ci.yml, source/format, links files, patches/series and all six patches, tests/pkg-js/{test,SKIP}, upstream/metadata, build-modules/*). debian/watch not reviewed.
• Inventory: upstream tree is src/, build/, docs/, scripts/, test/, and the root files (LICENSE.txt, ThirdPartyNotices.txt, package.json, package-lock.json, gulpfile.js, CHANGELOG.md, README.md, CONTRIBUTING.md, MAINTAINING.md, SECURITY.md, editor.code-workspace, dotfiles). Grepped the whole tree for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, Apache License, MPL, GNU GPL/LGPL, public domain, Creative Commons, all rights reserved, and for non-free wording (non-commercial, no-derivative, research-only, "no evil").
• All licence statements found are Expat/MIT except those reproduced inside ThirdPartyNotices.txt; no file is left without a licence, and no minified JS, jar, class, .so, PDF or other built artifact is shipped in the source (the five generated src/language/typescript/lib files are cut from the orig tarball and listed in debian/clean for removal after the build).
• src/basic-languages: every file carries the Microsoft MIT header except postiats (Artyom Shalkhakov), swift (David Owens II) and wgsl ("Microsoft Corporation, Google LLC"). debian/copyright names Shalkhakov and Owens II; the wgsl stanza names only Google LLC, while Microsoft for those files comes from Files: * (a deliberate shorthand, not a missing holder). postiats.ts also credits the original ATS/Postiats lexer by Hongwei Xi in a comment, which is a provenance note rather than a copyright notice.
• ThirdPartyNotices.txt: upstream's own compilation of third-party notices for the components its release incorporates (TypeScript 4.4.4 under Apache-2.0, and the material TypeScript bundles: DefinitelyTyped MIT, Unicode, W3C DOM and HTML, WHATWG DOM under CC-BY-4.0, Khronos WebGL, js-beautify MIT, Ionic documentation Apache-2.0, plus vscode-swift MIT). None of them are files of this source package: TypeScript's lib files are removed by the repack and rebuilt from node-typescript ("this package's TypeScript", README.Debian), and the others do not appear outside this notice file. The file itself is Microsoft's MIT work, covered by Files: *, so the holders the scan listed (Einar Lielmanis/Liam Newman, The Khronos Group, Unicode Inc, W3C, WHATWG) need no stanza; the scan's suggestion of an Expat stanza naming them would be wrong.
• DFSG: no non-free terms anywhere; the licences that would be involved if the bundled material were present (Apache-2.0, Unicode, W3C, CC-BY-4.0) are all free.
• debhelper compat 14; substvars need not be named by hand. dh_auto_test is a no-op here: with no Makefile and no buildsystem claiming the test step, dh's sequencer skips it (checked in dh_auto_test and the makefile buildsystem module), so the browser-only test/unit and test/smoke suites are not run at build; README.source says so.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match) - not an issue. Changelog 0.47.0+ds-1 to unstable, initial release closing an ITP; source format 3.0 (quilt); gbp.conf, Vcs-* and salsa-ci.yml sane.
• Dependencies checked with apt-cache: node-typescript 6.0.3-2, node-vscode-l10n, fonts-codicons and esbuild exist; node-monaco-editor-core is not in the archive yet but is built by the upload waiting in NEW, so that dependency is not an issue.
• Patches are all Debian-specific and marked Origin: vendor / Forwarded: not-needed, each explained in README.source (TypeScript 6 adaptations, commit from the environment, no AMD tree, TypeScript from the packaged compiler, no prettier pass, larger stack).
• debian/copyright is already machine-readable (DEP-5), so no replacement is proposed.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.57.0, packaged 0.47.0+ds), which is not a fault of the package.

Not confirmed

• The file list of fonts-codicons: the package is not installed here and apt-cache gives only its control fields, from whose Description the path conflict above is derived; dpkg -c on fonts-codicons or a build would settle it.
• The build output (out/monaco-editor) and the resulting binary packages could not be built or inspected, so the assembled tree, the appended plugin notices and the number of differing files claimed in README.Debian were not seen.
• Binary media under docs/ (debugging-core.gif, debugging-languages.gif, launch config.png, code-structure.dio.svg, out-folders.dio.svg) were recorded by name only, not opened; they are covered by Files: * (Microsoft, Expat) and carry no separate notice.
• The tarballs and .dsc beside the unpacked tree were not compared against it.

Proposed changes

None.