DFSG NEW review for node-earcut version 3.2.4-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The upstream code and the packaging are ISC throughout (LICENSE says 'Copyright (c) 2026, Mapbox'; debian/copyright is DEP-5 with a matching Files: * stanza, a debian/* stanza and the full ISC text), and no other holder or licence appears anywhere in the tree. The exception is bench/tiles-fixture.bin, 4.5 MB of packed MVT geometry that bench/bench-tiles.js says was generated from a 'local tile cache' by a script the .gitignore keeps out of the tree; the file carries no licence, its provenance is undocumented and its preferred form for modification is absent, while debian/copyright claims it is ISC/Mapbox.

Packaging

Debhelper compat 14 (the recommended level) with a bare dh sequencer, dh-sequence-nodejs-no-lerna and dh-sequence-single-binary (both provided by dh-nodejs), a package-name-prefixed debian/node-earcut.docs, a clean debian/nodejs/build (tsc + rollup) whose outputs debian/clean removes, package.json#files covering exactly what the module needs (src/earcut.js, generated src/earcut.d.ts and dist bundles), an autopkgtest with the fixtures it needs, sane changelog, Vcs-* and upstream/metadata, and Standards-Version 4.7.4 against Policy 4.7.4.1. No patches, maintainer scripts or runtime dependencies are needed for an architecture: all module.

Issues

1. [blocker] [licensing] bench/tiles-fixture.bin is 4.5 MB of generated map-tile data with no source, generator or licence

• Files: bench/tiles-fixture.bin, bench/bench-tiles.js:1-2, .gitignore:5, test/test.js:270-273, debian/tests/pkg-js/files:3, debian/copyright:6-8
• Basis: inferred from what was read, not seen directly
• Evidence: bench/bench-tiles.js: The fixture was generated from a local tile cache by a one-off, author-machine-specific script; regenerating it is intentionally out of scope for this repo. .gitignore: bench/extract-tiles.mjs (the generator, not shipped). test/test.js: assert.equal(polys.length, 119680); debian/tests/pkg-js/files lists bench/tiles-fixture.bin; debian/copyright: Files: * / Copyright: 2026, Mapbox / License: ISC.
• Problem: The file is not authored source but machine output: 4.5 MB (most of the 3.6 MB orig tarball) of packed MVT command/coordinate varints decoded by bench/tiles-fixture.js. Its generator is deliberately absent (and gitignored), so the preferred form for modification is not in the package, and the tile cache it was cut from is never identified: vector-tile data of that kind is usually derived from OpenStreetMap (ODbL) or another provider's tiles, and no licence or attribution for it appears anywhere. debian/copyright nevertheless asserts ISC/Mapbox for it. That is both a DFSG problem (no traceable licence, no source) and an inaccurate copyright file, and the file is also shipped into the autopkgtest environment.
• Fix: Establish and document the provenance and licence of the tile data and ship the extraction script (bench/extract-tiles.mjs) and, if the data is derived from OSM, its ODbL attribution in debian/copyright with its own Files: stanza; or regenerate the fixture from a documented freely licensed source; or drop the fixture together with bench/bench-tiles.js and the 'mvt fixture' test that hard-codes its 119680 polygons.

Verified

• Whole upstream tree inventoried (76 files, directory by directory, .pc/ and debian/cargo-checksum.json excluded): root files, .github/workflows/node.yml, bench/, src/, test/ with 56 fixtures, viz/, debian/.
• LICENSE is the ISC text with Copyright (c) 2026, Mapbox; debian/copyright reproduces the same short name, holder and year, includes the full ISC text (ISC is not in /usr/share/common-licenses), and is valid DEP-5 with the exact Format URL and no Files-Excluded (the orig tarball is a plain 3.2.4, not a repack).
• Licence-strings grep over the tree found notices only in LICENSE, package.json ("license": "ISC") and package-lock.json, whose MIT/Apache-2.0 entries are devDependencies of the upstream build and are neither shipped nor vendored as code.
• src/earcut.js:901 says the refine pass is Adapted from delaunator's edge legalization; delaunator is Mapbox's ISC code, so the holder named in debian/copyright covers it.
• test/fixtures/*.json and test/expected.json are upstream test polygons and expected triangle counts with no third-party notices; earcut.png is the README screenshot named in README.md; viz/index.html and viz/viz.js are the in-tree demo, using only ../src/earcut.js and no CDN or vendored library; eslint.config.js, rollup.config.js, tsconfig.json, CODEOWNERS and .gitignore are upstream configuration. All fall under Files: *.
• debian/control: compat 14 via debhelper-compat (debhelper 14.5 on the reviewing system, where 14 is the recommended level); at compat 14 dh_gencontrol adds relationship substvars itself, so the absent Depends field is correct; Architecture: all, Section: javascript; Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components equal).
• apt-cache: nodejs 24.22.1, node-typescript 6.0.3, rollup 3.30.0, node-rollup-plugin-terser 7.0.2 exist; dh-nodejs 0.17.14 Provides dh-sequence-nodejs-no-lerna and dh-sequence-single-binary, matching the Build-Depends and the sequence modules in /usr/share/perl5/Debian/Debhelper/Sequence.
• dh-nodejs installs package.json#files (src/earcut.js, src/earcut.d.ts, dist/earcut.min.js, dist/earcut.dev.js); debian/nodejs/build runs tsc and rollup -c to produce the two generated paths, and debian/clean removes them again, so the installed module has its types and bundles.
• dh_auto_test with the nodejs buildsystem runs debian/tests/pkg-js/test (node --test test/test.js); debian/tests/pkg-js/files supplies the test directory and the two bench files that test.js imports. Testsuite: autopkgtest-pkg-nodejs and debian/tests/pkg-js/test are consistent.
• Single binary package with the single-binary add-on: debian/node-earcut.docs is package-prefixed, as that add-on requires at compat >= 14.
• Changelog is a sane 3.2.4-1 unstable initial release closing #1152464; debian/upstream/metadata has valid Bug-Database/Bug-Submit/Repository fields; no patches and no maintainer scripts are present.
• uscan found the packaged version as the newest upstream release (upstream 3.2.4, packaged 3.2.4).

Not confirmed

• bench/tiles-fixture.bin itself was not opened (binary); it is described from bench/tiles-fixture.js, bench/bench-tiles.js, README.md ('119,680 real-world polygons ... drawn from a window of map tiles through zooms 4-16') and its 4.5 MB size in the orig tarball.
• Whether the tile cache the fixture was cut from is OpenStreetMap, a Mapbox service or another provider cannot be determined from the package; that uncertainty is itself part of the licensing issue.

Proposed changes

None.