DFSG NEW review for node-single-file-core version 1.0.47+ds1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 0 blocker, 2 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All licences in the tree are DFSG-free: the bulk is AGPL-3+ with an upstream additional section 7 permission, and the vendored parsers and CSS minifier are Expat or BSD-3-clause, both compatible with AGPL-3; no non-free wording was found. debian/copyright is DEP-5 and handles the vendor/ derivations well, but it does not describe the whole tree accurately: modules/html-minifier.js credits htmlnano's author Kirill Maltsev, whom the file does not name; .eslintrc.js carries a MIT grant while the catch-all stanza says AGPL-3+; and the section 7 additional permission that every source file grants is not reproduced.

Packaging

The packaging is compact and mostly clean: debhelper compat 14 with plain dh, a build that turns the shipped ES sources into the bundles with all build dependencies present, correct file layout, an autopkgtest and upstream metadata. The substantive defect is that the shipped bundles inline csstree from node-css-tree while the binary package declares no Built-Using (Policy 7.8), so the archive is never told which node-css-tree source the binary was built from.

Issues

1. [important] [licensing] modules/html-minifier.js is credited to Kirill Maltsev's htmlnano but his copyright/MIT notice is missing from debian/copyright

• Files: modules/html-minifier.js:24, debian/copyright:7-10
• Basis: inferred from what was read, not seen directly
• Evidence: // Derived from the work of Kirill Maltsev - https://github.com/posthtml/htmlnano in the file; the copyright file has no stanza for modules/, only Files: * with Copyright: 2010-2022 Gildas Lormeau and License: AGPL-3+.
• Problem: htmlnano is MIT (Expat), and the file states it is derived from it, but neither the file nor debian/copyright retains Kirill Maltsev's copyright and permission notice, so the file's copyright and licence are described inaccurately and the MIT attribution that Debian must pass on is lost. Every other derived file under vendor/ (Jed Mao, Ben Briggs, Alex Bell, Domenic Denicola) has its upstream author in the copyright file, so this one was simply missed.
• Fix: Add a Files: modules/html-minifier.js stanza naming Kirill Maltsev (with htmlnano's copyright years) as well as Gildas Lormeau, with License: AGPL-3+ and Expat.

2. [important] [packaging] Binary bundles inline csstree from node-css-tree but the package has no Built-Using field (Policy 7.8)

• Files: debian/rules:9-15, debian/css-tree-shim.js:4, debian/control:14-19
• Basis: checked, in the package or with a reference tool
• Evidence: debian/css-tree-shim.js is copied to vendor/css-tree.js and rollup bundles it: export { findAll, find, generate, parse } from "/usr/share/nodejs/css-tree/dist/csstree.esm.js";; debian/control's package stanza has only Depends: ${misc:Depends}. Policy 7.8: "the Built-Using field must list the corresponding source package ... including an 'exactly equal' ('=') version relation".
• Problem: The lib/*.js objects shipped contain compiled csstree code taken from the node-css-tree source package during the build, which the package itself omits (Files-Excluded: vendor/css-tree.js). The shipped bundle is AGPL-3+, whose Corresponding Source requirement covers that incorporated code, so Policy 7.8 applies; without the field the archive need not retain the node-css-tree version the binary was actually built with.
• Fix: Add Built-Using: node-css-tree (= 3.2.1-1) (the version the build used) to the node-single-file-core stanza of debian/control.

3. [minor] [licensing] .eslintrc.js is MIT but the catch-all Files: * stanza calls it AGPL-3+

• Files: .eslintrc.js:1-23, debian/copyright:7-10
• Basis: checked, in the package or with a reference tool
• Evidence: The file begins The MIT License (MIT) / Author: Gildas Lormeau followed by the full MIT permission text; debian/copyright has no stanza for it, so Files: * applies with License: AGPL-3+.
• Problem: debian/copyright states a stricter licence than the file actually grants, so it does not accurately describe this file's licensing.
• Fix: Add Files: .eslintrc.js with Copyright: 2010-2022 Gildas Lormeau and License: Expat.

4. [minor] [licensing] AGPL-3+ stanza omits the additional section 7 permission every file grants

• Files: debian/copyright:53-56, single-file.js:17-21
• Basis: checked, in the package or with a reference tool
• Evidence: Every source header says: As additional permission under GNU AGPL version 3 section 7, you may distribute UNMODIFIED VERSIONS OF THIS file without the copy of the GNU AGPL normally required by section 4, provided you include this license notice and a URL through which recipients can access the Corresponding Source. The License: AGPL-3+ paragraph only points to /usr/share/common-licenses/AGPL-3.0.
• Problem: The files are offered under AGPL-3+ plus this permission; the permission is neither in common-licenses nor in debian/copyright, so the licence actually granted is not fully described (this understates rights; it is not a DFSG problem).
• Fix: Reproduce the section 7 permission paragraph in the stand-alone AGPL-3+ licence paragraph, or give it its own short name and use it in the stanzas.

Verified

• All 34 upstream files were examined. Every .js file carries a licence header: 24 of them Gildas Lormeau's AGPL-3+ header (v3 or later plus the section 7 permission); the prescan's 24 files with contact : gildas.lormeau <at> gmail.com are those same files, and the holder it flagged as merely similar is Gildas Lormeau, named exactly in every relevant stanza, so nothing is missing there.
• The seven vendor/ files with third-party notices are matched by their own Files: stanzas: Jed Mao, Ben Briggs, Alex Bell, Domenic Denicola (Expat), and Franck Marcia, Stoyan Stefanov, Julien Lecomte/Yahoo! Inc. (Expat and BSD-3-clause); the Expat and BSD-3-clause texts are reproduced in full. vendor/index.js is AGPL-3+ and has its own stanza.
• No built or minified file is in the tarball: single-file-core.js (2127 lines) and the other single-file-*.js files are formatted sources, and common/content-infobar-web.js is hand-written despite its three long data:image/png;base64 constants (icons embedded in the file, PNG metadata says 'Created with GIMP'); lib/ exists only after a build, as debian/README.source describes.
• vendor/css-tree.js, named by Files-Excluded, is absent from the tree; debian/rules recreates it from debian/css-tree-shim.js for the rollup build and override_dh_clean removes it again.
• The only module specifier outside the tree is the shim's absolute import; the csstree API used by the sources is exactly the four functions the shim exports (parse, generate, find, findAll), so the shim covers all call sites.
• Build dependencies exist in the archive: node-css-tree 3.2.1-1, rollup 3.30.0-7 (provides the virtual node-rollup), node-rollup-plugin-node-resolve 15.2.3+ds-3. node itself is not listed in Build-Depends but arrives with them, which Policy 4.2 says need not be listed.
• The autopkgtest dependency chain reaches an interpreter: node-jsdom depends on node-acorn, which depends on nodejs, so the #!/usr/bin/node script has /usr/bin/node in the testbed; Testsuite-Triggers: node-jsdom is declared in the .dsc.
• debian/copyright is DEP-5 with the current Format URL and the correct Source; AGPL-3.0 exists in /usr/share/common-licenses.
• Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 and is not an issue; the changelog is a proper unstable initial release that closes the ITP, with a date consistent with its weekday.
• No patches, no maintainer scripts and no debian/patches; debian/source/format is 3.0 (quilt), debian/gbp.conf and debian/upstream/metadata are consistent with the repository. .pc/ was left unread and debian/cargo-checksum.json is not present.
• The binary package installs only the five UMD bundles under lib/ and package.json; that matches the description (browser bundles for Zotero) and upstream's own package.json, which likewise defines no main.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.8.0, packaged 1.0.47+ds1), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (AGPL-3.0).

Not confirmed

• Whether node-css-tree 3.2.1-1 actually installs dist/csstree.esm.js, the absolute path the shim imports: the package is not installed on the reviewing system and its file list is not reachable with these tools; a build would show it immediately.
• vendor/css-media-query-parser.js is marked // derived from https://github.com/dryoma/postcss-media-query-parser and the MIT block it carries has had its copyright line dropped, so a holder may be missing from its stanza; no holder is named anywhere in the package, so it could not be verified here.
• The file mode of debian/tests/load-bundles (autopkgtest requires it to be executable) is not visible through the tools available.

Proposed changes

None.