DFSG NEW review for node-quickselect version 3.0.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Upstream is a single ISC-licensed JavaScript library by Vladimir Agafonkin; the tree contains no other copyright holders, no vendored third-party code, no minified or built artefacts, and no restrictions beyond ISC. debian/copyright is DEP-5 and matches the evidence: Files: * (ISC, 2024 Vladimir Agafonkin) covers the upstream files, debian/* is attributed to Edward Betts under ISC, and the full ISC text is reproduced (ISC is not in /usr/share/common-licenses). The only defect is a stray ': ' at the start of the Source field value.

Packaging

Standard dh-nodejs packaging: debhelper-compat 14, dh $@, dh-sequence-single-binary so the nodejs buildsystem installs straight into the package build dir, Standards-Version 4.7.4 (current Policy is 4.7.4.1, same first two components), Architecture: all with Multi-Arch: foreign, correct Section and Vcs-* fields, Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/test, upstream/metadata present, and a clean initial-release changelog. The only nit is the malformed Source field in debian/copyright, noted under licensing.

Issues

1. [minor] [licensing] debian/copyright Source field value starts with a stray colon, making it a malformed URL

• Files: debian/copyright:4
• Basis: checked, in the package or with a reference tool
• Evidence: Source: : https://github.com/mourner/quickselect
• Problem: The DEP-5 Source field is supposed to hold the URL of the upstream source; the value here begins with ': ', so it is not a valid URL and anything parsing it gets a broken value. It is a typo, not a missing attribution.
• Fix: Change the line to Source: https://github.com/mourner/quickselect.

Verified

• The pre-scan found no copyright holder missing from debian/copyright: the only notice in the tree is Copyright (c) 2024, Vladimir Agafonkin in LICENSE, which Files: * names.
• LICENSE and package.json ("license": "ISC") both declare ISC; the ISC text in debian/copyright matches LICENSE word for word apart from the copyright line, which is carried in the Copyright field.
• All upstream files are plain, hand-written text: index.js (2 KB), index.d.ts, test.js, bench.js, eslint.config.js, tsconfig.json, package.json, package-lock.json, README.md, LICENSE, .gitignore, .github/workflows/node.yml. No minified JS, no archives, no binaries, no fonts or images.
• index.d.ts is generated by tsc but its input (index.js plus tsconfig.json, which lists index.js in files and sets emitDeclarationOnly) is shipped, so it has its preferred form for modification; package-lock.json is generated by npm from the shipped package.json. Both are upstream-shipped and covered by Files: *.
• package-lock.json only records dependency metadata and integrity hashes; it embeds no third-party source code, so no extra stanzas are needed.
• Testsuite autopkgtest-pkg-nodejs is backed by debian/tests/pkg-js/test (node --test test.js), and debian/nodejs/build contains a comment only, which dh-nodejs accepts as 'no compilation needed'.
• dh-nodejs at compat 14 installs the module itself into the package build directory (auto_install_dir uses tmpdir(package) at compat 14), so the absence of debian/node-quickselect.install does not leave the package empty; package.json is always installed by the nodejs buildsystem even though package.json#files lists only index.js and index.d.ts, so the ESM "type": "module" marker reaches /usr/share/nodejs/quickselect/.
• Source format is 3.0 (quilt) with no debian/patches directory; dpkg-source accepts that, and .pc/ was ignored as instructed.
• uscan found the packaged version as the newest upstream release (upstream 3.0.0, packaged 3.0.0).

Not confirmed

• Whether pkg-js-autopkgtest runs debian/tests/pkg-js/test in the installed module directory or in the unpacked source tree. test.js is not installed (package.json#files limits installation to index.js and index.d.ts), so the test would fail if it runs against /usr/share/nodejs/quickselect. pkg-js-autopkgtest is not installed on the reviewing system, so the mechanism could not be read; an autopkgtest run would settle it.

Proposed changes

None.