DFSG NEW review for node-idb-keyval version 6.3.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is entirely Apache-2.0, which is DFSG-compliant and whose full text is correctly pointed to in /usr/share/common-licenses, and no non-free terms or unlicensed files exist. However debian/copyright is incomplete: lib/size-report.js carries a Google Inc. copyright notice but falls under Files: *, which names only Jake Archibald, and the Debian-authored test helper files added by debian/patches/dgit-changes are likewise attributed to him.

Packaging

The packaging is small and sound: debhelper compat 14 with a bare dh $@, dh-nodejs build instructions via debian/nodejs/build, Build-Depends that match the rollup config and test needs (including test-only dependencies marked <!nocheck>), DEP-5 copyright, a working Vcs-*, Standards-Version 4.7.4 against Policy 4.7.4.1, a sane source format and a custom autopkgtest that exercises the built module in Chromium. No packaging fault worth reporting was found.

Issues

1. [blocker] [licensing] debian/copyright omits the Google Inc. copyright holder for lib/size-report.js

• Files: lib/size-report.js:2, debian/copyright:6-8
• Basis: checked, in the package or with a reference tool
• Evidence: lib/size-report.js: * Copyright 2019 Google Inc. All Rights Reserved. and Licensed under the Apache License, Version 2.0; debian/copyright's catch-all is Files: * / Copyright: 2016, Jake Archibald / License: Apache-2.0, and there is no stanza for lib/size-report.js.
• Problem: lib/size-report.js is an upstream source file (a build helper, not generated), so it is in the source package and is covered by Files: *, which names the wrong holder. DEP-5 requires the Copyright field to record the copyright holders of the matched files; the file's own notice names Google Inc., which the debian/copyright does not.
• Fix: Add a stanza before or after Files: *, e.g. Files: lib/size-report.js with Copyright: 2019 Google Inc. and License: Apache-2.0 (the existing stand-alone Apache-2.0 paragraph already covers the text).

2. [minor] [licensing] Debian-authored test files are attributed to the upstream author

• Files: test/type-checks.ts, test/mocha.d.ts, debian/patches/dgit-changes
• Basis: checked, in the package or with a reference tool
• Evidence: debian/patches/dgit-changes adds test/type-checks.ts and test/mocha.d.ts as Debian changes; debian/copyright's Files: * says Copyright: 2016, Jake Archibald for everything outside debian/*.
• Problem: These two files (and the rewritten tail of test/index.ts) originate in the Debian delta, not upstream, yet debian/copyright attributes them to Jake Archibald. That is an inaccurate copyright statement for files shipped in the source package.
• Fix: Add a Files: test/type-checks.ts test/mocha.d.ts (and, if desired, test/index.ts) stanza naming the Debian contributor, or otherwise record the Debian authorship of these files.

Verified

• Read every file under debian/: changelog, clean, control, copyright, rules, watch (not reviewed), source/format, patches/series and dgit-changes, nodejs/build, nodejs/extlinks, tests/pkg-js/{test,run-tests.cjs,files}, upstream/metadata.
• Inventoried the whole upstream tree (including dotfiles .gitignore, .nvmrc, .prettierignore, .prettierrc.json); no built artifacts, minified code, archives, binaries, fonts, images or vendored third-party libraries are present. dist/ is absent and is generated from src/index.ts by rollup -c at build time (debian/nodejs/build).
• The prescan's only listed file, lib/size-report.js, is upstream Node build tooling whose source is itself present; its sole problem is the missing Google Inc. copyright stanza reported above.
• Grepped the tree for copyright/licence markers (Copyright, (C), ©, SPDX, Licensed under, Apache License, GNU, MIT, public domain, All rights reserved, Google, Mozilla, Workbox): only LICENCE, debian/copyright and lib/size-report.js carry notices. The README's mention of Mozilla async-storage is an attribution link, with no copied code or separate licence in the tree.
• size-tests/*.js, test/index.html, test/index.ts, test/type-checks.ts and test/mocha.d.ts are hand-written upstream/test inputs, not generated output.
• The whole tree is Apache-2.0; LICENCE matches package.json's "license": "Apache-2.0", and the stand-alone License paragraph points to /usr/share/common-licenses/Apache-2.0, where the full text is supplied.
• Standards-Version 4.7.4 has the same first two components as the installed Policy 4.7.4.1, so it is current enough.
• debhelper-compat (= 14) is the recommended level; ${misc:Depends} is the only substvar needed, and dh_gencontrol adds relationship substvars itself at compat 14.
• Each build and test dependency corresponds to an import in rollup.config.js, debian/tests/pkg-js/run-tests.cjs or debian/tests/pkg-js/test: del, glob, rollup plugins (babel, commonjs, node-resolve, terser, typescript, json, node-polyfills), tslib, typescript, rollup, chai, mocha, chromium; node-rollup-plugin-json and node-rollup-plugin-node-polyfills are test-only and correctly marked <!nocheck>. apt-cache confirms dh-sequence-nodejs-no-lerna is provided by dh-nodejs and dh-sequence-single-binary by debhelper, and that chai/mocha provide the node-types-chai/node-types-mocha virtuals the test tsconfig needs.
• debian/source/format is 3.0 (quilt); the single dgit-changes patch is listed in patches/series, documents its purpose, and applies the Debian test-harness delta to upstream files; no Files-Excluded are declared and no excluded file remains in the tree.
• Autopkgtest is declared as Testsuite: autopkgtest-pkg-nodejs; debian/tests/pkg-js/test runs a TypeScript check plus a custom Chromium-based runner, and debian/tests/pkg-js/files copies test/, generic-tsconfig.json and the runner for it.
• changelog is a valid initial release for 6.3.0-1 to unstable with a bug closure; Vcs-Git/Vcs-Browser, Homepage and upstream/metadata are consistent.
• uscan found the packaged version as the newest upstream release (upstream 6.3.0, packaged 6.3.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Could not build the package or run its autopkgtest here; the rollup build and the Chromium/rollup-based browser test were checked statically only.
• The exact dependencies that pkg-js-autopkgtest installs for the implicit nodejs test suite could not be inspected because that package is not installed on this reviewing system, so the test's runtime availability of chromium and the rollup plugins was not observed.
• No attempt was made to contact upstream or the bug report referenced by the changelog.

Proposed changes

None.