DFSG NEW review for node-jspath version 0.4.0+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

All upstream files are DFSG-free. The upstream LICENSE is the standard MIT/Expat text and covers the whole repository (no per-file notices exist anywhere else except the dual-licence header in lib/jspath.js). lib/jspath.js is dual-licensed 'MIT and GPL'; Debian distributes it under the MIT option, which is DFSG-free and compatible. The minified bundle jspath.min.js is listed in Files-Excluded and is absent from the unpacked tree and the +ds orig tarball, so the repack is consistent. debian/copyright is machine-readable (DEP-5), with an accurate Files: * catch-all, an explicit lib/jspath.js override, and full Expat and GPL-2+ licence paragraphs.

Minor inaccuracy: the Debian packaging files are covered only by the Files: * catch-all, which attributes their copyright to the upstream holders rather than to the Debian packager.

Packaging

Clean, conventional pkg-js-tools packaging: debhelper-compat 14, dh-sequence-nodejs plus dh-sequence-single-binary, dh $@ rules with default hardening, 3.0 (quilt) with no unneeded patches, Arch all, no maintainer scripts needed, a real autopkgtest (debian/tests/pkg-js/test loads the installed module and checks four queries) wired via Testsuite: autopkgtest-pkg-nodejs, and a correct initial-release changelog (0.4.0+ds-1, Closes: #1149193). Runtime Depends is correctly empty because jspath has no runtime dependencies (matching current node-* practice, which does not pin nodejs itself). Vcs-* and Homepage point at the right salsa/github locations; Standards-Version 4.7.4 is current. No build failure, policy or upgrade risk identified.

Issues

1. [minor] [licensing] debian/* packaging files not attributed to the Debian maintainer

• Files: debian/copyright (Files: * and Files: lib/jspath.js stanzas only)
• Evidence: The file has no Files: debian/* stanza, so debian/rules, debian/control, debian/changelog etc. fall under Files: * and are recorded as Copyright: 2012, Dmitry Filatov ... 2012, Marat Dulin.
• Problem: Copyright of the Debian packaging files is misattributed to the upstream authors; they are in fact written by the Debian maintainer (Emfox Zhou, per changelog/Uploaders).
• Fix: Add a trailing Files: debian/* stanza, e.g. Copyright: 2026, Emfox Zhou <emfox@debian.org> with License: Expat (referencing the existing Expat paragraph).

Verified

• Read debian/copyright in full; it is DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/), with Files: *, Files: lib/jspath.js, and standalone Expat and GPL-2+ License paragraphs; the 'Expat or GPL-2+' and GPL-2+/Expat short names and free-text notes are valid under copyright-format 1.0.
• Grepped the whole tree (gitignore:false) for Copyright/©/'(c)'/licensed/SPDX/public-domain/All rights/third-party copy strings; the only licence statements anywhere are LICENSE (MIT/Expat) and the dual MIT+GPL header of lib/jspath.js. All ~44 files are plain text/JSON; no binaries, fonts, images, minified JS, archives or vendored code.
• Expected jspath.min.js: absent from the unpacked tree and from the +ds orig tarball listing; consistent with Files-Excluded and the watch Repack/Repacksuffix: +ds.
• LICENSE text matches the Expat paragraph in debian/copyright verbatim; lib/jspath.js header matches the separate stanza (holders Filatov Dmitry + Marat Dulin).
• Upstream LICENSE names only Dmitry Filatov; Marat Dulin is credited 'With parts by' in the lib/jspath.js header and as a contributor in package.json, so his inclusion as a holder is supported.
• package-lock.json holds only devDependency metadata (nodeunit/istanbul/uglify-js etc.), no code; these are not shipped, so no additional licences apply.
• Packaging: debian/control, rules, changelog, source/format (3.0 quilt, no patches), salsa-ci.yml, gbp.conf, upstream/metadata and tests/pkg-js/test read and checked.
• Read all debian/ files and every file of the tree; no maintainer scripts, install/dirs/links or patches are present and none are needed.
• uscan found the packaged version as the newest upstream release (upstream 0.4.0, packaged 0.4.0+ds).

Not confirmed

• Did not build the package or run the autopkgtest (read-only review); build success and installability are inferred, not executed.
• Only the repacked +ds tarball is available on disk, so jspath.min.js's presence in the un-repacked upstream tarball is inferred from debian/watch (Repack: yes) and Files-Excluded rather than observed.

Proposed changes

None.