DFSG NEW review for node-reflect-metadata version 0.2.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All eleven upstream files are Apache-2.0: the three .js builds and three .d.ts files carry Copyright (C) Microsoft. All rights reserved. with the Apache-2.0 notice, package.json has "license": "Apache-2.0", LICENSE is the complete Apache-2.0 text and CopyrightNotice.txt the matching Microsoft notice. debian/copyright is DEP-5 with a Files: * stanza (Microsoft Corporation, Ron Buckton) covering everything and a debian/* stanza (Ying-Chun Liu, Apache-2.0), and points to /usr/share/common-licenses/Apache-2.0. No other licence, holder or non-free term appears anywhere in the tree, so the file is accurate and complete.

Packaging

Small, conventional dh-nodejs package: debhelper compat 13 with dh-sequence-nodejs, automatic module install under /usr/share/nodejs, Testsuite: autopkgtest-pkg-nodejs with a working debian/tests/pkg-js/test, DEP-5 copyright, Rules-Requires-Root: no, Multi-Arch: foreign on an arch-all module, Standards-Version 4.7.4 (current for Policy 4.7.4.1), source format 3.0 (quilt) needing no patches, and a sane initial changelog. Dependencies are complete: ${misc:Depends} suffices because the nodejs runtime dependency is only added by the build system for packages installing executables, and this one installs none. No issue worth reporting was found.

Issues

minor packaging 1. debian/watch is in the old version 4 format ◂

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified ◂

• Reflect.js, ReflectLite.js, ReflectNoConflict.js, index.d.ts, no-conflict.d.ts, standalone.d.ts: each starts with Copyright (C) Microsoft. All rights reserved. and Licensed under the Apache License, Version 2.0; package.json declares "license": "Apache-2.0"; all are covered by the Files: * Apache-2.0 stanza in debian/copyright.
• LICENSE contains the full Apache-2.0 terms (ends with END OF TERMS AND CONDITIONS) and CopyrightNotice.txt is the corresponding Microsoft Apache notice; both are covered by Files: * and neither adds any other terms.
• README.md carries no licence statement (only links); AUTHORS.md (Cy Brown, Oleh Dokuka, Ron Buckton, William Buchwalter) is an authorship list, not a copyright notice, and every file's own notice names Microsoft; no holder asserted in the tree is missing from debian/copyright.
• Grep across the whole tree with gitignore: false for Copyright, (C), ©, SPDX-License-Identifier, Permission is hereby granted, GNU General/Lesser, Apache License, Mozilla Public, public domain, All rights reserved, and for restrictive wording (non-commercial, no modification, personal use, Good, not Evil, royalty): only the Apache-2.0 notices above were found.
• No embedded third-party code or vendored library: the three .js files are upstream's own builds, including their own Map/Set/WeakMap code, and carry only the Microsoft/Apache banner; no other attribution text exists in the tree.
• Reflect.js, ReflectLite.js, ReflectNoConflict.js and the .d.ts files are TypeScript compiler output (tsc-style var Reflect; (function (Reflect) {...})(Reflect || (Reflect = {}));, Object.defineProperty(exports, "__esModule", ...)), and the npm tarball carries no .ts implementation sources; the shipped JavaScript is unminified, readable and directly modifiable and is the form upstream publishes on npm, so I did not treat this as missing source (reported here only so the judgement is visible).
• debian/copyright is machine-readable, starts with the canonical Format: URL, and its Apache-2.0 reference is /usr/share/common-licenses/Apache-2.0, which exists; no replacement is needed.
• debhelper-compat (= 13) with dh-sequence-nodejs (provided by dh-nodejs 0.17.14 in the archive); the extra dh-nodejs entry is redundant but harmless. Depends: ${misc:Depends} is complete: /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm adds nodejs:any only for packages installing a binary in PATH, and none is installed; ${nodejs:Provides}/${nodejs:Version} are unused because the module name equals the binary package name and there are no components.
• /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm sub test runs debian/tests/pkg-js/test with /bin/sh -ex; the file is valid shell whose single-quoted node -e program contains no apostrophes, and it runs from the source root where ./Reflect.js and ./ReflectNoConflict.js exist.
• execute_after_dh_installdocs: dh_nodejs_autodocs works as intended: /usr/bin/dh_nodejs_autodocs with no /usr/share/perl5/Debian/nodejs/root_modules file scans the main component (main_package() is .) and installs README.md and AUTHORS.md into /usr/share/doc/node-reflect-metadata/.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match, so not an issue); debian/source/format is 3.0 (quilt) with no patches; changelog version 0.2.2-1, distribution unstable, correctly dated Tuesday 2026-11-03; Testsuite: autopkgtest-pkg-nodejs has its debian/tests/pkg-js/test; debian/upstream/metadata has valid fields; Rules-Requires-Root: no; Multi-Arch: foreign is appropriate for an arch-all JS module.
• uscan found the packaged version as the newest upstream release (upstream 0.2.2, packaged 0.2.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

• The autopkgtest-pkg-nodejs runner is not installed on the reviewing system (no autopkgtest), so I could not see from which directory it runs debian/tests/pkg-js/test; the test's require("./Reflect.js") resolves from the source root and from /usr/share/nodejs/reflect-metadata, and would only fail from some other working directory.
• No network access, so the existence of the Vcs-Git/Vcs-Browser repository and whether #1152958 is the right ITP bug could not be checked.