DFSG NEW review for node-earcut version 3.2.4+ds1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the canonical Format URL and is accurate: upstream earcut is ISC under Copyright (c) 2026, Mapbox, exactly as in LICENSE and in package.json ("license": "ISC"), the Debian packaging is ISC under Edward Betts, and the complete ISC text is included (ISC is not in /usr/share/common-licenses). The non-free bench fixture is genuinely absent from the +ds1 orig tarball, is documented in Files-Excluded/README.source, and the only Debian delta (removing the bench-dependent test) is in dgit's generated patch. A whole-tree search for copyright/licence wording found no other holder, licence or restrictive term. ISC is DFSG-free and the ISC packaging is compatible with it.

Packaging

Standard, well-formed pkg-js packaging: debhelper compat 14 with the dh-nodejs (no-lerna) and single-binary sequences, a minimal %: dh $@, tsc + rollup driven from debian/nodejs/build, generated files removed by debian/clean, an autopkgtest script under debian/tests/pkg-js, DEP-5 copyright, upstream metadata and Standards-Version 4.7.4 (current: Policy is 4.7.4.1). The only Debian change is the removal of the bench-dependent MVT test, carried in dgit's generated single patch as the patches-applied merge workflow requires. No confirmed policy violation; two build-side details I could not verify from the package are listed under Not confirmed.

Issues

None.

Verified

• debian/copyright read in full: DEP-5, Files: * = 2026, Mapbox / ISC, Files: debian/* = 2026 Edward Betts / ISC, one stand-alone License: ISC paragraph whose text matches LICENSE verbatim, and Files-Excluded: bench/* with a Comment explaining the non-free MVT benchmark data.
• The prescan listed no files: its dfsg-author-check found every copyright holder it found named in debian/copyright (Result: every holder found is named in debian/copyright), and no built files, minified code, PDFs or non-free wording were flagged, so there is nothing else to account for.
• Whole tree searched with gitignore: false for Copyright, (C), (c), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU GPL/LGPL, Apache License, Mozilla Public, public domain and All rights reserved: matches only in LICENSE, debian/copyright and debian/README.source; no third holder, no additional licence grant, no restrictive term.
• Upstream LICENSE (ISC, Mapbox) and package.json ("license": "ISC", "type": "module") agree with debian/copyright; nothing else in the tree states a different licence.
• src/earcut.js (1025 lines): no licence header; read the file head and the refine() comment Adapted from delaunator's edge legalization (line 901) and the David Eberly bridge comment (line 424). No separate holder or licence text is attached, so the Files: * Mapbox ISC stanza (same upstream author/licence for delaunator) covers it.
• DFSG repack is real: the orig tarball listing (node-earcut-3.2.4+ds1.orig.tar.xz) has no bench/ directory, and the unpacked tree has none either; the sole reference left is the upstream package.json scripts.pretest/bench entries and .gitignore, which are inert.
• debian/patches/series lists only dgit-changes; the patch removes the import {readTilesFixture} from '../bench/tiles-fixture.js' line and the mvt fixture test from test/test.js, matching debian/README.source; quilt applied it (its record is in .pc/, ignored as instructed).
• test/test.js read in full: its remaining tests use only test/fixtures and test/expected.json, both relative to the test directory, and every key in expected.json has a matching fixture; nothing else from the excluded bench tree is needed.
• test/fixtures/ holds 55 JSON files, plain coordinate arrays (sampled eberly-3.json and dude.json) with no licence/copyright marker; test/expected.json holds expected triangle counts and deviations (test data, not a build artifact); both are covered by Files: *.
• package-lock.json is an npm lock file for the devDependencies (its per-dependency license fields are eslint/rollup/terser metadata), not shipped code; the source tree contains no node_modules and no vendored third-party JavaScript.
• earcut.png is the image README.md embeds (![Earcut triangulation example](earcut.png)); not opened, and covered by Files: *; viz/index.html and viz/viz.js are the upstream browser demo, .github/workflows/node.yml, CODEOWNERS, .gitignore, eslint.config.js, rollup.config.js and tsconfig.json are upstream build/CI files, all with no separate licence notice.
• Debian files read in full: control, rules, changelog, copyright, clean, node-earcut.docs, README.source, source/format, patches/series, patches/dgit-changes, tests/pkg-js/files, tests/pkg-js/test, nodejs/build, nodejs/extlinks, upstream/metadata. debian/watch deliberately not reviewed.
• control: debhelper-compat (= 14), Standards-Version 4.7.4 (first two components match Policy 4.7.4.1), Vcs-Git/Vcs-Browser set, Homepage set, single Architecture: all binary node-earcut, Testsuite: autopkgtest-pkg-nodejs; at compat 14 the missing explicit Depends/substvars are added by dh_gencontrol, so that is not a fault.
• changelog: initial release 3.2.4+ds1-1 to unstable, Closes: #1152464, correct date/weekday; source/format 3.0 (quilt) with dgit's generated single patch is the documented patches-applied merge workflow, consistent with README.source and the Dgit field in the .dsc.
• Orig tarball contents match the unpacked tree apart from .pc/ and debian/, so the source package ships no extra upstream file beyond what debian/copyright describes.
• uscan found the packaged version as the newest upstream release (upstream 3.2.4, packaged 3.2.4+ds1).

Not confirmed

• rollup.config.js line 1 imports @rollup/plugin-terser and debian/nodejs/extlinks lists @rollup/plugin-terser, but the Build-Depends is node-rollup-plugin-terser, which the archive has as 7.0.2 (upstream TrySound/rollup-plugin-terser, i.e. the unscoped rollup-plugin-terser; Depends node-jest-worker/node-serialize-javascript, not @rollup/pluginutils). I could not inspect that .deb, so I cannot confirm whether it also provides /usr/share/nodejs/@rollup/plugin-terser. A clean build would show nodepath: @rollup/plugin-terser not found in nodejs directories and rollup Could not resolve "@rollup/plugin-terser"; if so, patch the import and extlinks to rollup-plugin-terser.
• debian/tests/pkg-js/files lists only test, while test/test.js imports ../src/earcut.js (and ../src only exists outside the copied directory); the pkg-js autopkgtest runner and its handling of relative source imports are not installed on the reviewing system, so I could not confirm whether the autopkgtest needs src added to that file. The build-time run of the same script happens in the source root and is fine.
• Upstream's right to license test/fixtures/*.json under ISC cannot be verified from the package: they are plain coordinate arrays with no provenance note, and the packager's own exclusion of bench/ rests on unconfirmed MVT provenance for other data. No evidence of a different licence exists in the tree, so debian/copyright's Files: * ISC is the only claim available.

Proposed changes

None.