DFSG NEW review for node-formatjs version 0~git20261027.d800cee4a-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 2 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

The licences actually present are free and mutually compatible (Expat, BSD-3-Clause, Unicode-3.0), so the source is DFSG-compliant, but debian/copyright does not describe it accurately. The catch-all stanza gives four Rust crates and two Python packages, all declaring BSD-3-Clause, as Expat, and one generated Rust file is mislabelled in the same way. In addition, packages/cli-lib/pseudo_locale.ts says it is based on mozilla-central's MPL-2.0 L10nRegistry.jsm but is covered only by Expat, and the third-party brand logos under docs/public/img fall under the same Expat catch-all without any licence statement.

Packaging

The packaging is of good quality. It uses debhelper compat 14 with dh-nodejs, a documented offline build that only writes under debian/build, no Debian patches, a complete Build-Depends whose packages all exist in the archive, autopkgtest via Testsuite: autopkgtest-pkg-nodejs with tests that exercise both the build tree and the installed modules, and Standards-Version 4.7.4 against Policy 4.7.4.1.

Issues

1. [blocker] [licensing] debian/copyright describes the BSD-3-Clause Rust crates and Python packages as Expat

• Files: debian/copyright:6-8, debian/copyright:15-21, crates/formatjs_intl/Cargo.toml:7, crates/formatjs_intl_macros/Cargo.toml:7, crates/icu_messageformat/Cargo.toml:7, crates/intl_getcanonicallocales/Cargo.toml:7, python/intl/BUILD.bazel:49, python/icu_messageformat/BUILD.bazel:38
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright:6-8 has Files: * / Copyright: 2023 FormatJS / License: Expat, while crates/icu_messageformat/Cargo.toml:7 says license = "BSD-3-Clause" (the same line is in formatjs_intl, formatjs_intl_macros and intl_getcanonicallocales) and python/intl/BUILD.bazel:49 and python/icu_messageformat/BUILD.bazel:38 say license = "BSD-3-Clause",. debian/copyright:15-21 also puts crates/intl_getcanonicallocales/aliases_generated.rs under License: Expat and Unicode-3.0 although it belongs to the BSD-3-Clause crate.
• Problem: The licence of these files is stated wrongly, so debian/copyright does not meet Policy 12.5 or the machine-readable format. All the licences are free, so this is not a DFSG problem, but the BSD-3-Clause text that the file already carries is Oath Inc.'s wording and cannot simply be reused for FormatJS's own crates.
• Fix: Add Files stanzas for crates/formatjs_intl/*, crates/formatjs_intl_macros/*, crates/icu_messageformat/*, crates/intl_getcanonicallocales/*, python/intl/* and python/icu_messageformat/* with Copyright: 2023 FormatJS and License: BSD-3-clause, and add a BSD-3-Clause text naming FormatJS. Change the stanza for the three generated Rust files so that aliases_generated.rs is BSD-3-clause and Unicode-3.0.

2. [important] [licensing] packages/cli-lib/pseudo_locale.ts is based on MPL-2.0 Mozilla L10nRegistry.jsm but is declared Expat only

• Files: packages/cli-lib/pseudo_locale.ts:99-101, debian/copyright:6-8
• Basis: inferred from what was read, not seen directly
• Evidence: The comment above transformString and its FLIPPED_MAP tables reads Based on: https://hg.mozilla.org/mozilla-central/file/a1f74e8c8fb72390d22054d6b00c28b1a32f6c43/intl/l10n/L10nRegistry.jsm#l425. debian/copyright names no Mozilla holder and has no MPL stanza, so Files:* makes the file Expat/2023 FormatJS.
• Problem: mozilla-central is under MPL-2.0, whose file-level copyleft means a port of that code must remain MPL-2.0 and carry Mozilla's notice; debian/copyright is therefore inaccurate for this file. cli-lib is not among the eight modules built into node-formatjs, so there is no licence-combination problem in the binary.
• Fix: Add a Files stanza for packages/cli-lib/pseudo_locale.ts with the Mozilla copyright and License: MPL-2.0, pointing at /usr/share/common-licenses/MPL-2.0, or replace the copied code with an independently written implementation.

3. [important] [licensing] Third-party brand logos in docs/public/img are covered only by the Expat catch-all and carry no licence notice

• Files: docs/public/img/google.svg, docs/public/img/microsoft.svg, docs/public/img/firefox.png, docs/public/img/chrome.png, docs/public/img/react.svg, docs/public/img/yahoo.svg, debian/copyright:6-8, debian/copyright:57-59
• Basis: inferred from what was read, not seen directly
• Evidence: Only docs/public/img/js.svg has its own stanza and an embedded MIT text; every other image has no copyright or licence comment, so Files: * applies Copyright: 2023 FormatJS / License: Expat to logos such as google.svg, microsoft.svg, firefox.png, chrome.png, react.svg and yahoo.svg.
• Problem: These are third-party logos and screenshots, not FormatJS's Expat code, so debian/copyright states a copyright holder and licence that do not apply. The files are documentation assets only and are not installed in node-formatjs, but they are shipped in the source package.
• Fix: Record the actual source and licence of each group of images in Files stanzas (for example the icon set the SVGs come from and its licence), or remove them from the package, for instance by excluding docs/public/img from the source.

4. [minor] [licensing] The native/hermes/package/THIRD_PARTY_NOTICES.html stanza invents a licence short name without giving any licence text or holder

• Files: debian/copyright:61-68, native/hermes/package/LICENSE.md:1-3
• Basis: checked, in the package or with a reference tool
• Evidence: License: third-party-notices is followed only by a descriptive paragraph (This file reproduces third-party copyright and license notices ...), and Copyright: Various third-party authors; see the notices in this file. names no holder. The directory's own LICENSE.md is MIT License / Copyright (c) 2023 FormatJS.
• Problem: copyright-format 6.7 requires a stand-alone License stanza to contain the licence text or a pointer to /usr/share/common-licenses when the short name is not a standard one, and 6.6 requires each Copyright line to end with a holder. The file is a compilation of notices, not a work licensed under the notices it reproduces.
• Fix: Give the file Copyright: 2023 FormatJS and License: Expat (as native/hermes/package/LICENSE.md does for the directory) and move the description of the third-party notices into a Comment, or reproduce the Apache-2.0, Zlib and Unicode texts the stanza refers to.

5. [minor] [packaging] uscan finds only upstream versions older than the packaged one

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: upstream 0~git20261027.06104b2, packaged 0~git20261027.d800cee4a
• Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
• Fix: Check where debian/watch looks and how it mangles versions.

Verified

• Read every file under debian/ (control, rules, changelog, copyright, README.source, clean, docs, install, source/format, tests/pkg-js/{files,polyfills.cjs,test}, nodejs/{main,additional_components,root_modules,build,build.cjs,cldr.py,test}, the eight packages/*/install files, upstream/metadata); debian/watch was left to the separate check.
• debian/copyright is DEP-5 with the correct Format line and no Files-Excluded; its 33 per-package LICENSE.md files were read: all are MIT/Expat with FormatJS holders except packages/intl-messageformat and packages/react-intl, whose BSD-3-Clause stanzas match their LICENSE.md text and file headers (Yahoo 2011-2015, Oath 2019/2023).
• The Yahoo 2015 headers in the six extract-*.ts scripts, the Yahoo headers in packages/intl-messageformat, packages/react-intl, the 2019 V8 header in packages/intl-datetimeformat/tests/format-range.test.ts, and the MIT notice in docs/public/img/js.svg are all covered by their stanzas.
• packages/intl-localematcher/abstract/languageMatching.ts is CLDR data and is correctly under Unicode-3.0; the other committed generated Rust files have in-tree generators (crates/intl_getcanonicallocales/scripts/aliases.ts and packages/ecma402-abstract/scripts/regex-gen.ts, the latter named in the file's @generated from regex-gen.ts header).
• The 17 third-party holders the scan lists all occur in native/hermes/package/THIRD_PARTY_NOTICES.html, a compilation of notices that debian/copyright:61-68 points to; they are not holders of code in the tree. The two Company hits are string fragments in tests (packages/eslint-plugin-formatjs/tests/emoji-utils.test.ts:33 and no-emoji.test.ts:55), not copyright holders.
• crates/formatjs_intl/testdata/en_fr.postcard and crates/icu_messageformat/testdata/fr_pl.postcard are ICU4X BlobDataProvider test fixtures; the icu4x-datagen 2.3.0 command, CLDR tag and marker list are recorded in crates/formatjs_intl/provider.test.rs:283-291 and the same comment in crates/icu_messageformat/provider.test.rs. They are test data, are not installed, and are not a built artifact whose source is missing.
• A tree-wide search for non-commercial, no-modification, Good-not-Evil and similar terms found nothing; a search for GPL, LGPL, Apache, MPL, CC-BY and public-domain wording found only the notices inside THIRD_PARTY_NOTICES.html. No vendored third-party library or minified JS was found.
• Every Build-Depends name exists in the archive: nodejs 24.22.0, node-typescript 6.0.3, node-unicode-17.0.0, unicode-cldr-core 48.2-2, rollup 3.30.0, node-rollup-plugin-dts 6.5.1, node-esbuild (esbuild 0.28.2), node-fast-glob (node-globby), node-fs-extra, node-json-stable-stringify, node-regenerate, node-serialize-javascript, dh-nodejs 0.17.14 (providing dh-sequence-nodejs-no-lerna), dh-sequence-single-binary (debhelper 14.5), python3 and tzdata.
• Standards-Version 4.7.4 matches Policy 4.7.4.1's significant first two components; compat 14 makes the relationship substvars and the nocheck handling automatic, so the minimal rules and Provides: ${nodejs:Provides} are correct.
• The build writes only under debian/build (debian/clean removes it); cldr.py reads /usr/share/unicode/cldr/common (unicode-cldr-core) and build.cjs reads /usr/share/zoneinfo/tzdata.zi (tzdata), both Build-Depends; every generator path named in debian/nodejs/build.cjs exists in the tree.
• The eight components in debian/nodejs/main plus additional_components all have a debian/nodejs/packages/*/install file whose glob and @formatjs/ destination match debian/nodejs' install code, and all eight READMEs installed by debian/node-formatjs.install exist; no debian/patches directory or series is needed.
• The tests in debian/tests/pkg-js require the eight built modules and plural-rules locale data; debian/nodejs/test runs them against debian/build/node_modules during the build, and Testsuite: autopkgtest-pkg-nodejs reruns the same script against the installed modules.

Not confirmed

• packages/fast-memoize/README.md:3 says it is just a fork of fast-memoize, but its LICENSE.md and debian/copyright name only FormatJS; whether the upstream npm package's copyright notice must also be retained could not be checked, as no copy of fast-memoize is on the reviewing system.
• The exact licence and provenance of the brand logos and screenshots in docs/public/img could not be determined without opening the images.

Proposed changes

None.