DFSG NEW review for node-protocol-buffers-schema version 3.6.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 (correct Format URL) with two stanzas: Files: * (2014 Mathias Buus, Expat) and debian/* (2026 Edward Betts, Expat), plus a standalone Expat paragraph reproducing the full MIT notice. Every upstream file is the author's own MIT/Expat JavaScript, test schema/text data or README, and the only copyright notices in the tree are the LICENSE file's Copyright (c) 2014 Mathias Buus and matching statements in package.json/README; the prescan's holder check agrees there is no unlisted holder. No non-free terms, no separately licensed vendored code, no generated or minified files, and the Expat licence is DFSG-free.

Packaging

Minimal, current and correct: debhelper-compat 14 with a one-line dh $@ rules, dh-nodejs auto-install to /usr/share/nodejs with dh-sequence-single-binary and the no-lerna sequence, complete Build-Depends (debhelper-compat, dh-nodejs, both addons and node-tape <!nocheck>; all resolvable in unstable), one Architecture: all binary with no runtime dependencies needed (package.json has no dependencies), autopkgtest via Testsuite: autopkgtest-pkg-nodejs and debian/tests/pkg-js/test, Standards-Version 4.7.4 against Policy 4.7.4.1, changelog initial release to unstable, and the Debian delta in a single 3.0-quilt patch.

Issues

None.

Verified

• Prescan: the author check reported every holder found is named in debian/copyright; I confirmed the only holder notices in the tree are Copyright (c) 2014 Mathias Buus (LICENSE:1-3), "author": "Mathias Buus" (package.json) and the MIT line in README.md, plus debian/copyright itself. No other file listed by the scan.
• Full inventory of the upstream tree: 11 top-level files (.gitignore, .travis.yml, LICENSE, README.md, example.js, example.proto, index.js, package.json, parse.js, stringify.js, tokenize.js), test/index.js and 33 .proto/.json fixtures; all matched by Files: *, with debian/* covered by its own stanza. .pc/ ignored throughout.
• Licensing: LICENSE is the standard MIT text, package.json declares "license": "MIT", README ends with MIT; debian/copyright's Expat paragraph is the same permission notice in full, so the short name and text are accurate. No LICENSE/COPYING/NOTICE in any subdirectory, and no dependencies/vendored code in package.json.
• No built, minified, bundled or generated files: all JavaScript is hand-written source (parse.js, stringify.js, tokenize.js, index.js, example.js, test/index.js); test/fixtures/* are small hand-written .proto files and their parser output JSON.
• test/fixtures/complex.proto carries only schema declarations of this project (java_package com.mafintosh.generated) and test/fixtures/search.proto a two-line schema; no third-party notices, treated as upstream MIT test data. test/fixtures/pheromon-trajectories.proto is a 7-line test schema used by the non-primitive packed should throw test.
• Packaging files read in full: control, rules, changelog, node-protocol-buffers-schema.docs (README.md only), source/format (3.0 quilt), upstream/metadata, tests/pkg-js/test, patches/series and patches/dgit-changes. No maintscripts, install files, .maintscript or gbp.conf; none are needed for a pure arch:all module.
• Build mechanism checked against the installed dh-nodejs 0.17.14: the nodejs buildsystem installs to /usr/share/nodejs and, in its test step, links the main package to node_modules/protocol-buffers-schema before running debian/tests/pkg-js/test, so the patch's require('protocol-buffers-schema') resolves at build time; it adds nodejs:any to ${misc:Depends} only when a /usr/bin link is made, and this package declares no bin, so the empty Depends is correct at compat 14.
• The single patch reproduces the whole Debian delta (test/index.js normalises parse output through JSON to cope with null-prototype option maps under tape 5, and test/fixtures/reserved.json's stale "options": [] becomes {}); it applies cleanly to the orig tarball's files, and upstream code itself is unchanged.
• Autopkgtest: Testsuite: autopkgtest-pkg-nodejs is served by autodep8's nodejs generator (Test-Command /usr/share/pkg-js-autopkgtest/runner, Depends @builddeps@), and pkg-js-autopkgtest 0.17.14 is in unstable; node-tape (in Build-Depends with <!nocheck>) supplies the tape binary and module, and debian/tests/pkg-js/test is tape test/*.js.
• All Build-Depends exist in unstable: debhelper 14.5 provides dh-sequence-single-binary, dh-nodejs 0.17.14 provides dh-sequence-nodejs-no-lerna, node-tape 5.6.1 is present; debhelper compat 14 is current practice.
• Standards-Version 4.7.4: first two components match the reviewing system's Policy 4.7.4.1, so no issue.
• uscan found the packaged version as the newest upstream release (upstream 3.6.1, packaged 3.6.1).

Not confirmed

• The ITP bug number #1152436 in debian/changelog and the Salsa VCS URLs could not be checked (no network access).

Proposed changes

None.