DFSG NEW review for node-pbf version 5.1.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

DFSG-compliant and accurately described. debian/copyright is DEP-5/1.0; its BSD-3-Clause text matches LICENSE (Copyright 2026 Mapbox), and the Files: index.js stanza correctly names the Expat portions borrowed from dpw/node-buffer-more-ints (2012 David Wragg) and feross/buffer (Feross Aboukhadijeh), with the full Expat text supplied. Every upstream file is covered by Files: * (plus the index.js override), the generated test fixtures have their .proto inputs and generator in the package, and no non-free terms or third-party embedded libraries were found.

Packaging

Modern, conventional pkg-js packaging: compat 14 with a minimal dh rules file, dh-nodejs install/build lists, a tsc build step that generates the installed index.d.ts, the test-only dependency correctly marked <!nocheck>, autopkgtest wired, and sane changelog/Vcs/Standards-Version fields. Only a minor Policy 12.1 bug: the /usr/bin/pbf program has no manual page. The runtime/Build-Depends on node-resolve-protobuf-schema could not be confirmed against the archive (see Not confirmed).

Issues

1. [minor] [packaging] No manual page is shipped for the installed /usr/bin/pbf command

• Files: debian/nodejs/install:4, package.json:29-31
• Basis: checked, in the package or with a reference tool
• Evidence: debian/nodejs/install installs line bin, and package.json has "bin": { "pbf": "bin/pbf" }; dh-nodejs' auto_bin_links creates /usr/bin/pbf from it. There is no man page anywhere in the tree and debian/rules has no dh_installman.
• Problem: Policy 12.1: "Each program, utility, and function should have an associated manual page included in the same package or a dependency... If no manual page is available, this is considered as a bug". The package installs a user-facing command, pbf, with only the README as documentation.
• Fix: Add a pbf.1 (the README's "Proto Schema to JavaScript" usage is enough) under debian/ or upstream and install it with dh_installman.

Verified

• Read all of debian/ except debian/watch (out of scope) and .pc/: control, rules, changelog, copyright, clean, source/format, nodejs/{build,install,extlinks}, node-pbf.docs, tests/pkg-js/{test,files}, upstream/metadata.
• Licence evidence: only LICENSE and debian/copyright contain licence text; a tree-wide search for Copyright/(C)/©/SPDX-License-Identifier/GPL/LGPL/Apache/MPL/CC/All rights reserved/public domain found nothing else. The BSD-3-Clause paragraph in debian/copyright matches LICENSE apart from the copyright line.
• index.js:63 (64-bit int handling is based on github.com/dpw/node-buffer-more-ints (MIT-licensed)) and index.js:737 (Buffer code below from https://github.com/feross/buffer, MIT-licensed) correspond to the Files: index.js stanza, which names 2012 David Wragg and Feross Aboukhadijeh and uses BSD-3-Clause and Expat; both licences are free and compatible, and the Expat notice is reproduced in full.
• package.json's author field (Konstantin Kaefer) is a maintainer credit with no copyright notice or licence grant; the upstream LICENSE names Mapbox, so no holder is missing from debian/copyright.
• The .js files in test/fixtures/ are compiled output from the adjacent .proto files by compile.js/compileRaw (generator present in the package); the fixtures carry no generated-code header but their preferred form is present.
• test/fixtures/12665.vector.pbf (the scan's binary file) is a binary Mapbox Vector Tile used as test data by test/pbf.test.js:356,376 and bench/bench.html:20; it is input data, not built code, and is covered by the Files: * stanza (Mapbox, BSD-3-Clause).
• package-lock.json holds only npm metadata (its license fields concern devDependencies that are not vendored or shipped); .github/workflows reference GitHub actions but embed no third-party code.
• Build/install: debian/nodejs/build runs tsc (node-typescript), generating index.d.ts which debian/nodejs/install installs and debian/clean removes; package.json bin makes dh-nodejs install /usr/bin/pbf. No patches, no maintainer scripts.
• Tests: debian/tests/pkg-js/test is node --test test/*.test.js and dh_auto_test runs it during the build; the only non-builtin import in the tests is resolve-protobuf-schema (test/compile.test.js:4), supplied by node-resolve-protobuf-schema <!nocheck>. protobufjs and protocol-buffers are used only by bench/bench.js and bench/bench-tiles.js, which are not built or run.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match); compat 14; Architecture: all; Depends ${misc:Depends}, node-resolve-protobuf-schema, nodejs:any; Section javascript, Homepage and both Vcs fields present and consistent; changelog version 5.1.2-1, unstable, ITP #1152628 closed, date Fri 30 Oct 2026 is a real Friday.
• uscan found the packaged version as the newest upstream release (upstream 5.1.2, packaged 5.1.2).

Not confirmed

• node-resolve-protobuf-schema, in Build-Depends (<!nocheck>) and Depends, is not in the archive lists nor among the binaries of uploads in the NEW queue as of 2026-10-30T20:07Z. It is the module imported by bin/pbf and test/compile.test.js:4; if it is not itself in NEW, the build (dh_auto_test) and the installed package are uninstallable.
• The pkg-js-autopkgtest runner (package pkg-js-autopkgtest) is not installed on the reviewing system, so I could not read how it handles debian/tests/pkg-js/files. The test files import ../index.js and ../compile.js, while files lists only test; whether those resolve in the autopkgtest working directory is unverified (autodep8's generated test does install @builddeps@, so resolve-protobuf-schema is present there).
• test/fixtures/12665.vector.pbf is binary and was not opened; its contents and any data provenance beyond the upstream repository were not inspected.

Proposed changes

None.