DFSG NEW review for node-resolve-protobuf-schema version 2.1.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every upstream file is covered by the DEP-5 Files: * stanza, whose holder (2014 Mathias Buus) and Expat/MIT licence match LICENSE, package.json, README.md and the only copyright notices in the tree; the Debian files are covered by the debian/* stanza (2026 Edward Betts, Expat). The full Expat text is included, no file carries a conflicting or absent licence, and there is no third-party embedded code. The prescan found no missing holder and no file needing a separate stanza.

Packaging

Standard node-team packaging: debhelper compat 14 with dh $@, dh-sequence-nodejs-no-lerna and dh-sequence-single-binary (both present in the archive), correct Build-Depends including node-tape <!nocheck> for the build-time test, runtime Depends on node-protocol-buffers-schema, a working autopkgtest-pkg-nodejs setup, a valid DEP-12 upstream/metadata and a sane initial changelog closing the ITP. Only a single, clearly explained dgit delta patch is applied, and the source format is 3.0 (quilt).

Issues

None.

Verified

• Read every upstream file (index.js, LICENSE, README.md, package.json, .gitignore, .travis.yml, test/index.js, test/a.proto, test/b.proto, test/c.proto) and every file under debian/ except .pc/ (ignored per instructions); grepped the whole tree for copyright, (C), ©, SPDX, GNU, Apache, Mozilla, public-domain, all-rights-reserved and MIT wording with gitignore disabled.
• The prescan listed no file at all and no missing copyright holder: both holders it knows of are named in debian/copyright. Nothing from the scan therefore needs a separate ruling.
• debian/copyright is DEP-5 with the canonical Format URL. Files: * (Copyright 2014 Mathias Buus, License Expat) covers every upstream file, and the later debian/* stanza (2026 Edward Betts, Expat) covers the packaging including debian/patches/dgit-changes. The stand-alone Expat paragraph reproduces the full MIT text; no licence outside /usr/share/common-licenses needs reproducing.
• LICENSE says The MIT License (MIT), package.json has "license": "MIT" and README.md ends with MIT; the Expat short name is the correct DEP-5 name for that text. No other copyright or licence notice exists anywhere in the tree, and no file is under a non-DFSG term.
• The only upstream runtime require is protocol-buffers-schema, shipped in Debian as node-protocol-buffers-schema; there is no vendored third-party code.
• node-protocol-buffers-schema is not yet in the archive: apt-cache reports it is built by source package node-protocol-buffers-schema 3.6.1-1 waiting in NEW, so the Build-Depends/Depends is satisfiable once accepted, not a fault.
• Dependencies exist in the archive: dh-sequence-single-binary is provided by debhelper 14.5, dh-sequence-nodejs-no-lerna by dh-nodejs 0.17.14, and node-tape 5.6.1 is available; debhelper compat 14 is provided by debhelper 14.5.
• The trailing commas at the end of the Build-Depends and Depends lists are harmless: dpkg parses them (Perl split drops the empty final item), and the .dsc's Build-Depends is normalised without one.
• debian/rules is a plain dh $@ at compat 14; the nodejs/no-lerna sequence makes dh_auto_{configure,build,test,install,clean} use the nodejs buildsystem, which links node_modules and runs debian/tests/pkg-js/test during the build, so node-tape <!nocheck> is the right form.
• The single dgit delta patch (debian/patches/dgit-changes, in series) only changes test/index.js from require('../') to require('resolve-protobuf-schema') so the test targets the installed module; it is applied in the tree.
• Autopkgtest: Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/test (tape test/index.js); pkg-js-autopkgtest 0.17.14 exists in the archive to run it, deriving node-tape from the package.json devDependencies.
• debian/source/format is 3.0 (quilt); the orig tarball contains only the nine upstream files seen in the tree, and the debian tarball contains only the packaging seen.
• changelog: version 2.1.0-1 matching upstream 2.1.0, distribution unstable, urgency medium, initial release closing #1152454. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.x. debian/upstream/metadata has valid DEP-12 fields, and Homepage/Vcs-* are present.
• uscan found the packaged version as the newest upstream release (upstream 2.1.0, packaged 2.1.0).

Not confirmed

• Whether Debian bug #1152454 closed by the changelog is the matching ITP was not checked (no access to the BTS), and the salsa Vcs-Git repository could not be inspected.

Proposed changes

None.