DFSG NEW review for node-mock-geolocation version 1.0.11-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

debian/copyright is DEP-5: Files: * gives Expat with the three upstream holders and a Comment explaining that upstream's 1.0.11 tarball declares MIT only in package.json and ships no licence text (reproduced in full in the stand-alone License: Expat paragraph), and Files: debian/* gives Edward Betts/Expat. The only licence anywhere in the tree is Expat/MIT, so there is no incompatibility, nothing non-free, no third-party code, and no file lacking a licence: the npm package licence in package.json covers the upstream files, and the packaging files are covered by the debian/* stanza. The scan's minified file is generated from src/geolocate.js, which is shipped.

Packaging

Modern, correct nodejs packaging: compat 14 with dh $@, dh-nodejs with dh-sequence-nodejs-no-lerna and dh-sequence-single-binary, terser in Build-Depends for the dist rebuild in rules, 3.0 (quilt), a real autopkgtest (autopkgtest-pkg-nodejs plus debian/tests/pkg-js/test and a substantive geolocation.cjs), a valid DEP-5 copyright, current Standards-Version 4.7.4, Vcs-* and Homepage set, and a sane initial changelog. Build-Depends are all satisfiable and the runtime dependency handling is standard. No issues worth reporting.

Issues

None.

Verified

• dist/geolocate.min.js, the minified file the scan flagged, is not a built file without source: src/geolocate.js (225 lines) is present, dist/geolocate.js is a copy of it, and debian/rules regenerates both from src/geolocate.js with terser in override_dh_auto_build, so the preferred form for modification is in the package.
• No file in the upstream tarball carries a copyright or licence header; the only upstream licence statement is package.json's "license": "MIT". debian/copyright handles this correctly: the Files: * Comment records that the release omits the licence text, and the stand-alone License: Expat paragraph reproduces the full text. The holders named (2016 2GIS, 2014-2015 Mstislav Zhivodkov, 2015 Thomas Mayrhofer) match the package's author field and upstream's later LICENSE.md; the pre-review author scan found no holder that debian/copyright omits.
• All 10 upstream files and every file under debian/ were read in full or in the ranges needed. No binary, image, font, sound or archive files are in the tree. index.html is a demo; it loads the 2GIS Maps API from http://maps.api.2gis.ru at runtime but embeds no third-party code, and it is not installed (debian/nodejs/files installs only index.js, src/, dist/, plus package.json, which dh-nodejs installs automatically).
• debian/copyright is machine-readable and needs no replacement: Format is the current 1.0 URL, Comment is allowed in a Files stanza, Files: * is followed by Files: debian/* so the latter wins for packaging, and /usr/share/common-licenses is not referenced (Expat text is inline, as required). No Files-Excluded, and no repacked-away files are named.
• Build-Depends are satisfiable (apt-cache): dh-sequence-nodejs-no-lerna is provided by dh-nodejs 0.17.14, dh-sequence-single-binary by debhelper 14.5, terser is a real binary package (from node-terser), and unstable's nodejs 24.22 satisfies nodejs (>= 18).
• The test really runs: the nodejs dh buildsystem's test step executes debian/tests/pkg-js/test (it is what dh_auto_test runs), which is why nodejs <!nocheck> is right; dh itself skips dh_auto_test under nocheck at compat 13+. The same script is the autopkgtest-pkg-nodejs test, and require-SKIP correctly suppresses the generic bare-require test for a module that needs browser globals.
• At compat 14 the binary's Depends: ${misc:Depends} is correct; dh-nodejs adds nodejs:any only when the package installs a /usr/bin link, and this package installs no command (compare node-mkdirp, which likewise has no Depends).
• Standards-Version 4.7.4 is current against Policy 4.7.4.1; source format is 3.0 (quilt) with no patches; the changelog is correctly dated/signed (1.0.11-1, unstable) and matches the upstream version; debian/upstream/metadata fields are valid; Vcs-* and Homepage agree with the copyright Source.
• uscan found the packaged version as the newest upstream release (upstream 1.0.11, packaged 1.0.11).

Not confirmed

• The changelog closes Debian bug #1152411 as the ITP; I could not check the bug report itself.
• The 2016 2GIS notice and the 2015 Thomas Mayrhofer holder in debian/copyright come from upstream's later LICENSE.md and git history, which are not in the 1.0.11 tarball; nothing in the shipped files confirms them, but nothing contradicts them and the licence (Expat/MIT) is the same in package.json.

Proposed changes

None.