DFSG NEW review for node-mapbox-jsonlint-lines-primitives version 2.0.3-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

All licences in the tree are free: the upstream LICENSE and README state MIT (Expat) for Zachary Carter's code, and the only third-party file, web/json2.js, is Douglas Crockford's JSON.org json2.js, which is public domain. The tree is therefore DFSG-compliant, but debian/copyright does not describe every file: its Files: * stanza attributes web/json2.js to Zachary Carter under MIT, while that file is a separate work whose own public-domain notice has been stripped, so it carries no copyright or licence statement at all.

Packaging

Packaging is clean and small: debhelper compat 14 with a minimal dh $@, the pkg-js-tools no-lerna sequence loading the nodejs_no_lerna buildsystem, jison added to rebuild lib/jsonlint.js from src/, the single-binary add-on ensuring dh_auto_install writes straight into the package instead of debian/tmp, and debian/nodejs/files restricting the installed tree to lib/. The DEP-5 copyright, 3.0 (quilt) format with no patches, autopkgtest set-up for the pkg-js framework, Vcs-*, Standards-Version 4.7.4 and the initial-release changelog are all in order. No packaging issue found.

Issues

1. [blocker] [licensing] debian/copyright attributes web/json2.js to Zachary Carter under MIT; it is Douglas Crockford's public-domain json2.js and carries no licence notice

• Files: web/json2.js, debian/copyright:6-8
• Basis: inferred from what was read, not seen directly
• Evidence: web/json2.js starts at line 1 with /*jslint evil: true, strict: false */, then the /*members ...*/ list and // Create a JSON object only if one does not already exist. We create the methods in a closure to avoid creating global variables. — no copyright or licence header anywhere in its 334 lines; the body (quote(string), the escapable/cx regular expressions, str(key, holder), the JSON.parse/stringify shims) is the JSON.org json2.js, whose header states "Public Domain. NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK." debian/copyright says Files: * / Copyright: 2012 Zachary Carter / License: MIT, and only debian/* has a further stanza. web/jsonlint.html:6 loads the file.
• Problem: Files: * in debian/copyright is anchored at the top of the tree and covers web/json2.js, so the copyright file states that this 334-line third-party polyfill is Zachary Carter's MIT code. It is not: it is a separate work by Douglas Crockford distributed as public domain, it has no licence or copyright notice of its own, and naming the wrong holder and the wrong licence for a shipped source file makes debian/copyright inaccurate (Policy 12.5, and copyright-format 1.0 requires every file to be covered by a Files stanza with its actual holder and licence).
• Fix: Add a stanza before/after Files: * that matches it, e.g. Files: web/json2.js with Copyright: 2002-2011 Douglas Crockford and License: public-domain, plus a stand-alone License: public-domain paragraph saying that the JSON.org json2.js is in the public domain and carries no warranty. No licence text needs to be reproduced, but the holder and the public-domain status must be recorded.

Verified

• Prescan's minified-code file: web/jsonlint.js is the browser bundle built by scripts/bundle.js (which concatenates lib/jsonlint.js) and piped through uglify-js by the upstream Makefile; its source (lib/jsonlint.js, itself generated from src/jsonlint.y and src/jsonlint.l) is in the package, and it is not installed — debian/nodejs/files lists only lib, as debian/README.source says.
• Prescan's author check: the only holder it found is Zachary Carter, which debian/copyright's Files: * names; no other copyright line or holder was found in the tree (grep for Copyright, (C), ©, SPDX, MIT/GNU/Apache/MPL/public-domain wording).
• lib/jsonlint.js is jison output ('parser generated by jison 0.4.18') and is regenerated at build time from src/jsonlint.y and src/jsonlint.l by debian/nodejs/build (jison src/jsonlint.y src/jsonlint.l --module-name jsonlint -o lib/jsonlint.js), so its preferred form is present.
• LICENSE and README.md both state MIT, Copyright (C) 2012 Zachary Carter; the standalone License: MIT paragraph in debian/copyright is the Expat text and matches them.
• The remaining files (Makefile, package.json, package-lock.json, .gitignore, .nvmrc, .github/workflows/{ci,npm-release}.yml, scripts/bundle.js, lib/formatter.js, web/jsonlint.html, test/all-tests.js, test/strict-mode.mjs, test/fails/.json, test/passes/.json) contain no licence text other than comments; the test JSON files are upstream test fixtures. lib/formatter.js only credits its origin by URL.
• web/json2.js, the file raised as an issue, is in the upstream orig tarball and is not installed in the binary package.
• No patches: debian/patches and debian/source/options do not exist; source format is 3.0 (quilt), and the tree matches upstream besides debian/.
• Build-Depends resolve in unstable: jison 0.4.17 (provides the jison CLI), dh-nodejs 0.17.14 (also Provides dh-sequence-nodejs-no-lerna, so the no-lerna nodejs buildsystem is loaded instead of the lerna one), debhelper 14.5 (Provides dh-sequence-single-binary). At compat 14 dh_gencontrol adds ${misc:Depends} itself, so the single ${misc:Depends} plus nodejs:any in Depends is fine.
• The single-binary add-on passes --destdir=debian// to dh_auto_install (dh_auto_install(1) says so), so the pkg-js install step writes into the package and does not leave files in debian/tmp for dh_missing.
• The jison build step would be followed by the test step running debian/tests/pkg-js/test (Debian::Debhelper::Buildsystem::nodejs::test); those tests only use Node built-ins, so no dev-dependency from package.json is needed at build time.
• autopkgtest: debian/tests/control is correctly absent for Testsuite: autopkgtest-pkg-nodejs (the value is in lintian's known-testsuites and pkg-js-tools supplies the framework); debian/tests/pkg-js/test runs the upstream tests and debian/tests/pkg-js/files lists test.
• Standards-Version 4.7.4 agrees with the reviewing system's Policy 4.7.4.1 in the first two components; changelog is an initial release to unstable closing #1152254 and Vcs-Git/Vcs-Browser/Homepage point at the right places.
• web/jsonlint.js and lib/jsonlint.js were read; web/json2.js was read in full; the test fixtures and the whole tree were inventoried (53 files), not just sampled.
• uscan found the packaged version as the newest upstream release (upstream 2.0.3, packaged 2.0.3).

Not confirmed

• lib/formatter.js (installed in the binary) says only Manual formatter taken straight from https://github.com/umbrae/jsonlintdotcom and names no holder or licence; debian/copyright attributes it to Zachary Carter/MIT like the rest of the tree. Whether the jsonlintdotcom project's author holds copyright and under what licence could not be checked from the package, and no reference tool covers it.
• debian/nodejs/build passes --module-name jsonlint to jison; jison is not installed on the reviewing system, so whether the packaged jison 0.4.17 CLI accepts that option could not be checked from its manual page or source. A build would show it.

Proposed changes

None.