DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: node-moo 0.5.2-1

New Package Report

.changes◂
Architecturesource all
Distributionunstable
DateSun, 31 May 2026 00:33:23 -0400
Sourcenode-moo
Version0.5.2-1
Changed-ByJoseph Nahmias
Changelog◂ 
node-moo (0.5.2-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1138501)
.dsc◂
Priorityoptional
Componentmain
Package-Listnode-moo deb javascript optional arch=all
Sectionjavascript
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: moo
Upstream-Contact: https://github.com/no-context/moo/issues
Source: https://github.com/no-context/moo

Files: *
Copyright: 2012 - 2017, Tim Radvan <tim@tjvr.org>
License: BSD-3-Clause

Files: test/kurt.py
Copyright: 2012, Tim Radvan
License: LGPL-3.0+

Files: debian/*
Copyright: 2026, Joseph Nahmias <jello@debian.org>
License: BSD-3-Clause

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 3. Neither the name of the University nor the names of its contributors
    may be used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE HOLDERS OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: LGPL-3.0+
 This package is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 3 of the License, or (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.
 .
 You should have received a copy of the GNU Lesser General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
Comment:
 On Debian systems, the complete text of the GNU Lesser General
 Public License can be found in "/usr/share/common-licenses/LGPL-3".

Review Information

rejected — allocated to siretart 17 hours ago, started 17 hours ago, completed 2 hours ago.

Final Comment

Thanks for your work on this package. I've identified several policy
compliance issues that should be addressed before the package is
uploaded to the archive.

Missing documentation: test/kurt-tokens.txt is a large (11k+ lines)
test oracle file that contains a tokenized LGPL-3.0+ copyright and
license header (lines 2-32). This file is entirely undocumented in
debian/copyright, which is a significant documentation gap for a
file carrying a secondary license.

Verbatim accuracy: The wildcard "Files: *" entry in debian/copyright
lists "2012 - 2017". However, the main library code (BSD-3-Clause)
only dates back to 2017. The 2012 date belongs exclusively to the
LGPL-licensed kurt test files. Mixing these in the main entry is
inaccurate and misrepresents the main project's history.

Secondary license presence: test/snapshots/test.js.snap contains
verbatim LGPL-3.0+ license text as part of its snapshot data. While
this is generated data, it confirms the presence of LGPL-licensed
content that isn't fully acknowledged in the current copyright file.

-rt

Public Notes

17 hours ago ● public

copyright-grep

Command: rg -i '(licen[cs]e|copyr|©)' --heading
Exit code: 0

LICENSE
BSD 3-Clause License
Copyright (c) 2017, Tim Radvan (tjvr)
* Redistributions of source code must retain the above copyright notice, this
* Redistributions in binary form must reproduce the above copyright notice,
* Neither the name of the copyright holder nor the names of its
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

package.json
  "license": "BSD-3-Clause",

package-lock.json
        "validate-npm-package-license": "^3.0.1"
        "spdx-license-ids": "^3.0.0"
        "spdx-license-ids": "^3.0.0"
    "spdx-license-ids": {
      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.4.tgz",
    "validate-npm-package-license": {
      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",

test/kurt.py
# Copyright (C) 2012 Tim Radvan
# terms of the GNU Lesser General Public License as published by the Free
# Software Foundation, either version 3 of the License, or (at your option) any
# A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
# You should have received a copy of the GNU Lesser General Public License
# along with Kurt. If not, see <http://www.gnu.org/licenses/>.

debian/copyright.generated
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Copyright: 2017, Tim Radvan <tim@tjvr.org>
License: BSD-3-Clause
Copyright: 2012, Tim Radvan\\
License: BSD-3-clause
Comment: No explicit license found, using license(s) from:
 LICENSE
Copyright: 2012, Tim Radvan
License: BSD-3-clause
Comment: No explicit license found, using license(s) from:
 LICENSE
Files: LICENSE
Copyright: 2017, Tim Radvan (tjvr)
License: BSD-3-clause
Copyright: 2012, Tim Radvan
License: LGPL-3+
Copyright: 2026, Joseph Nahmias <jello@debian.org>
License: BSD-3-Clause
License: BSD-3-Clause
 1. Redistributions of source code must retain the above copyright
 2. Redistributions in binary form must reproduce the above copyright
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
License: BSD-3-clause
Comment: Add the corresponding license text here
License: LGPL-3+
Comment: Add the corresponding license text here

debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Copyright: 2012 - 2017, Tim Radvan <tim@tjvr.org>
License: BSD-3-Clause
Copyright: 2012, Tim Radvan
License: LGPL-3.0+
Copyright: 2026, Joseph Nahmias <jello@debian.org>
License: BSD-3-Clause
License: BSD-3-Clause
 1. Redistributions of source code must retain the above copyright
 2. Redistributions in binary form must reproduce the above copyright
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
License: LGPL-3.0+
 License as published by the Free Software Foundation; either
 version 3 of the License, or (at your option) any later version.
 Lesser General Public License for more details.
 You should have received a copy of the GNU Lesser General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
 Public License can be found in "/usr/share/common-licenses/LGPL-3".

test/kurt-tokens.txt
COMMENT "# Copyright (C) 2012 Tim Radvan"
COMMENT "# terms of the GNU Lesser General Public License as published by the Free"
COMMENT "# Software Foundation, either version 3 of the License, or (at your option) any"
COMMENT "# A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more"
COMMENT "# You should have received a copy of the GNU Lesser General Public License"
COMMENT "# along with Kurt. If not, see <http://www.gnu.org/licenses/>."

test/__snapshots__/test.js.snap
  "COMMENT \\"# Copyright (C) 2012 Tim Radvan\\"",
  "COMMENT \\"# terms of the GNU Lesser General Public License as published by the Free\\"",
  "COMMENT \\"# Software Foundation, either version 3 of the License, or (at your option) any\\"",
  "COMMENT \\"# A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more\\"",
  "COMMENT \\"# You should have received a copy of the GNU Lesser General Public License\\"",
  "COMMENT \\"# along with Kurt. If not, see <http://www.gnu.org/licenses/>.\\"",

Back to Dashboard | View all reviews for this package