DFSG NEW review for node-comlink version 4.4.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 1.0 with Files: * under Apache-2.0 (holders Google Inc. 2017 / Google LLC 2019) and a debian/* stanza for the maintainer. Every file in the tree matches the catch-all; the src/*.ts carry SPDX Apache-2.0 headers, the JS tests/examples carry the Apache boilerplate, and the headerless config/doc files (tsconfig, rollup config, Markdown, example HTML, fixtures) are covered by Files: *. A grep for non-free terms ('Good, not Evil', non-commercial, no modification, CC-NC) found only Apache boilerplate; there is no vendored third-party code (docs point to unpkg/CDN links, not embedded copies) and no pre-built/minified artifacts in the source (dist/ is generated at build time; the tidy 26KB orig tarball contains no dist/). The Apache-2.0 text is reproduced and correctly points to /usr/share/common-licenses/Apache-2.0. A single Apache-2.0 binary is trivially compatible. The pre-scan found every copyright holder it detected named in debian/copyright.

Packaging

Clean dh-nodejs packaging: debhelper compat 14 with dh $@, Build-Depends complete and present in the archive (debhelper-compat, dh-nodejs, dh-sequence-nodejs-no-lerna, rollup, node-rollup-plugin-{typescript,terser}, node-tslib, node-typescript, node-rimraf, and chai/mocha marked <!nocheck>, which at compat 14 is right since dh skips the test hooks under nocheck). The nodejs build system builds with rollup and runs the tests via debian/tests/pkg-js/test (mocha, node worker_threads); the autopkgtest is wired through Testsuite: autopkgtest-pkg-nodejs plus that test file, the standard pkg-js pattern. Two sensible Arch:all binaries (node-comlink module, libjs-comlink browser build with Multi-Arch: foreign); install and docs files are correct, and the execute_after_dh_auto_install hook stripping CONTRIBUTING from the shipped module is deliberate. Standards-Version 4.7.4 matches current policy (checked: 4.7.4.1); changelog sane, init release closes an ITP; Vcs-*/upstream/metadata point at the right places.

Issues

None.

Verified

• debian/copyright is machine-readable; Files: * Apache-2.0 with Google Inc./Google LLC holders matches every file-level notice in the tree (2017 Google Inc. test/example headers, 2019 Google LLC SPDX headers in src/*.ts).
• Every one of the 56 files was matched to Files: *; the pre-scan's holder check ("every holder found is named in debian/copyright") confirmed.
• No restricted-terms hits: grep for 'Good, not Evil', non-commercial, non-modification, CC-*-NC, 'All rights reserved' returned only Apache-2.0 boilerplate (you may not use this file except in compliance).
• No pre-built objects: orig tarball contains no dist/, no minified JS, no binaries/fonts/images; the only external media are README/example links to unpkg, jsdelivr and user-images.githubusercontent.com, not embedded files.
• No embedded/vendored third-party code; the rollup build's only imports are the declared Build-Depends.
• Files without explicit headers (tsconfig.json, rollup.config.mjs, structured-clone-table.md, *.html, .md, .travis.yml, Dockerfile, renovate.json, .gitignore, CODEOWNERS, CONTRIBUTING, CONTRIBUTORS, .husky/pre-commit, tests fixtures and tests/node/.mjs, type-checks.ts) are upstream project files covered by the single LICENSE and Files: * — the CLA wording in CONTRIBUTING is a contribution agreement, not a license restriction on the code.
• Apache-2.0 full text present in debian/copyright and pointer to /usr/share/common-licenses/Apache-2.0 is correct.
• Build-Depends names exist in the archive (spot-checked debhelper-compat, dh-nodejs, dh-sequence-nodejs-no-lerna, rollup, node-rollup-plugin-typescript, node-rollup-plugin-terser, node-tslib, node-typescript, node-rimraf, chai, mocha via apt-cache).
• node-rollup-plugin-typescript 12.3.0 and rollup (node-rollup) 3.x versions confirm the Debian packages repoint at the @rollup/plugin-* successors the build imports.
• dh-nodejs sequence (nodejs.pm / nodejs.pm buildsystem, nodejs_no_lerna subclass) adds the nodejs build system to dh_auto_build/test/install and runs debian/tests/pkg-js/test during dh_auto_test; chai/mocha as <!nocheck> Build-Depends is consistent with compat 14 skipping test hooks under nocheck.
• Autopkgtest wiring is the standard pkg-js pattern (Testsuite: autopkgtest-pkg-nodejs + debian/tests/pkg-js/test), no debian/tests/control required.
• debian/rules hook removes only debian/tmp/usr/share/nodejs/comlink/CONTRIBUTING before dh_install, an intentional trim of the CLA doc from the shipped module.
• Standards-Version 4.7.4 matches current Policy 4.7.4.1 (read via policy tool).
• libjs-comlink.install globs (dist/umd/comlink*.js*, dist/esm/...) match the rollup outputs; .d.ts stays with the node module.
• uscan found the packaged version as the newest upstream release (upstream 4.4.2, packaged 4.4.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Could not inspect node-rollup-plugin-terser's installed file layout to prove it provides the @rollup/plugin-terser module path the build imports (not installed on this system). Evidence is strong it does — its Depends (node-jest-worker, node-serialize-javascript, Provides node-smob) match @rollup/plugin-terser's dependencies and Debian packages js-yaml/workerpool record /usr/share/nodejs/@rollup/plugin-terser as the resolved module path — so a build should succeed; a build here would confirm.

Proposed changes

None.