DFSG NEW review for node-side-channel version 1.1.1+~cs3.0.4-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All upstream code, tests and declarations are under the MIT/Expat licence, and every LICENSE file (root, side-channel-list, side-channel-map, side-channel-weakmap) names Jordan Harband; the component years 2019 and 2024 are covered by the Copyright: 2019-2024, Jordan Harband in the Files: * stanza. debian/copyright is DEP-5, its Format line is current, it has correct stanzas for upstream (Files: *) and packaging (Files: debian/*), and it reproduces the full Expat text. The prescan's author check found no holder missing from the file, and there are no binary, generated or minified files and no non-free terms.

Packaging

The packaging is mostly conventional (3.0 (quilt), debhelper compat 13, js-team dh-nodejs, correct Provides/Breaks/Replaces for the modules taken over from node-deep-equal, autopkgtest configured), but debian/rules replaces dh_installdocs with a call to dh_nodejs_autodocs alone and never runs dh_installdocs. The resulting binary package therefore has no /usr/share/doc/node-side-channel/copyright and no changelog.Debian.gz (Policy 12.5 and 12.7), and the component doc directories that dh_nodejs_autodocs creates get dangling copyright symlinks.

Issues

1. [blocker] [packaging] override_dh_installdocs omits dh_installdocs, so the binary package ships no copyright file

• Files: debian/rules:10-11
• Basis: checked, in the package or with a reference tool
• Evidence: override_dh_installdocs: / dh_nodejs_autodocs auto_dispatch; dh_nodejs_autodocs(1) synopsis is override_dh_installdocs: dh_installdocs then dh_nodejs_autodocs, and /usr/bin/dh_nodejs_autodocs only installs README-like files, creating ln -s "../$pkg/copyright" for component doc dirs. dh_installdocs(1) FILES: debian/copyright The copyright file is installed into all packages.
• Problem: An override of dh_installdocs replaces debhelper's own invocation, so debhelper never installs debian/copyright or the Debian changelog. The binary package would ship /usr/share/doc/node-side-channel-list/, -map/ and -weakmap/ (created by dh_nodejs_autodocs) with a copyright symlink to ../node-side-channel/copyright that points nowhere, and /usr/share/doc/node-side-channel/ would contain only README.md and the upstream CHANGELOG.md. This violates Policy 12.5 (every package must have a verbatim copy of its licence in /usr/share/doc/PACKAGE/copyright) and 12.7 (a non-native package must ship changelog.Debian.gz).
• Fix: Run debhelper's command before the helper: override_dh_installdocs:\n\tdh_installdocs\n\tdh_nodejs_autodocs auto_dispatch.

Verified

• Read the whole source tree except .pc/: four index.js files, index.d.ts/list.d.ts, four package.json, four LICENSE, README/CHANGELOG and the four test/index.js files; all are hand-written JavaScript/declarations and documentation, no generated, minified or binary files.
• The four LICENSE files are the MIT/Expat text with Copyright (c) 2019 (side-channel, side-channel-weakmap) and Copyright (c) 2024 (side-channel-list, side-channel-map) held by Jordan Harband; Files: * with Copyright: 2019-2024, Jordan Harband and License: Expat matches this, and debian/* is attributed to Yadd. The full Expat text is present, as required (it is not in /usr/share/common-licenses).
• Prescan: it listed no built files and its author check reported every holder found is named in debian/copyright; confirmed against the four LICENSE files and package.json license fields.
• Compared the unpacked tree with the .dsc and the four tarballs: the tree is exactly the main orig tarball plus the three component tarballs under their component directories, no files added or missing.
• debian/copyright uses the current DEP-5 Format URL, and the proposed_copyright/Format-line checks do not apply.
• debian/control dependencies and the js-team setup: debhelper-compat 13, dh-sequence-nodejs (provided by dh-nodejs 0.17.13, which depends on nodejs), all test/runtime modules named exist in the archive (node-call-bound, node-object-inspect, node-es-errors, node-tape); node-get-intrinsic is a virtual package currently provided by node-deep-equal.
• Provides: ${nodejs:Provides} is populated by the nodejs debhelper buildsystem install step from each component's package.json version (read in /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm), so the component modules are declared as provided.
• debian/patches/series is empty, debian/source/format is 3.0 (quilt); no patches to review.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components agree, so it is current enough.
• Changelog: version 1.1.1+~cs3.0.4-1, distribution unstable, initial release, ITP closure; no packaging-level problem seen.
• debian/tests is the usual pkg-js setup (autopkgtest-pkg-nodejs.conf with extra_depends=node-tape, pkg-js/test running tape test/*.js); the component test scripts under debian/nodejs/*/test are run by the nodejs debhelper buildsystem at build time.
• uscan found the packaged version as the newest upstream release (upstream 1.1.1+~cs3.0.4, packaged 1.1.1+~cs3.0.4).

Not confirmed

• Could not build or run the package or its autopkgtest; the autopkgtest-pkg-nodejs runner (pkg-js-tools) is not installed on the reviewing system, so how debian/tests/pkg-js/test is executed could not be inspected.
• The archive currently has node-deep-equal 2.2.3+ds1+~cs43.15.94-1 only; this package's Breaks/Replaces: node-deep-equal (<< 2.2.3+ds1+~cs43.15.94-3~) assumes a newer node-deep-equal upload (which would drop the embedded side-channel module). Since node-get-intrinsic is currently only provided by node-deep-equal, installability depends on that upload; apt-cache found no such newer version in the archive or NEW queues, but the lists can be out of date, so this is not reported as an issue.
• Whether node-get-intrinsic should eventually come from its own source package rather than being provided by node-deep-equal; not a fault of this package.
• debian/watch looks at github.com/ljharb/side-channel-weakmap, but the Source field of debian/copyright names github.com/ljharb/side-channel. Whether these are the same upstream was not checked.
• debian/watch looks at github.com/ljharb/side-channel-weakmap, but Repository in debian/upstream/metadata names github.com/ljharb/side-channel. Whether these are the same upstream was not checked.

Proposed changes

None.