Review: node-single-file-core 1.0.47+ds1-1

Package Information

Description	save a web page as one self-contained HTML file (browser bundles) SingleFile saves a page into a single HTML file, inlining the stylesheets, images and frames it needs. This package ships the browser bundles built from the single-file-core library, which Zotero loads when it captures a snapshot.
Maintainer	Emfox Zhou <emfox@debian.org>
Changed By	Emfox Zhou <emfox@debian.org>
Sponsor	emfox@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-single-file-core.git (browse)
Closes	#1152662
Tracker	https://tracker.debian.org/pkg/node-single-file-core
Uploaded	7 days ago

New Package Report

.changes◂

Changed-By	Emfox Zhou <emfox@debian.org>
Architecture	source all
Distribution	unstable
Date	Sat, 31 Oct 2026 00:34:13 +0800
Source	node-single-file-core
Version	1.0.47+ds1-1

Changelog◂

node-single-file-core (1.0.47+ds1-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152662)

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-single-file-core deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: single-file-core
Upstream-Contact: Gildas Lormeau <gildas.lormeau@gmail.com>
Source: https://github.com/gildas-lormeau/single-file-core
Files-Excluded: vendor/css-tree.js

Files: *
Copyright: 2010-2022 Gildas Lormeau
License: AGPL-3+

Files: vendor/index.js
Copyright: 2010-2022 Gildas Lormeau
License: AGPL-3+

Files: vendor/css-minifier.js
Copyright: 2010-2022 Gildas Lormeau
           2011-2022 Franck Marcia
           2009 Stoyan Stefanov
           2011 Julien Lecomte, Yahoo! Inc.
License: Expat and BSD-3-clause
Comment: UglifyCSS by Franck Marcia, whose CSS compressor is Stoyan Stefanov's
 port of YUI Compressor, itself carrying a BSD (revised) part by Julien
 Lecomte and Yahoo! Inc.

Files: vendor/css-font-property-parser.js
Copyright: 2010-2022 Gildas Lormeau
           2015 Jed Mao
License: Expat

Files: vendor/css-unescape.js
Copyright: 2010-2022 Gildas Lormeau
           2014 Ben Briggs
License: Expat

Files: vendor/mime-type-parser.js
Copyright: 2010-2022 Gildas Lormeau
           2017-2018 Domenic Denicola
License: Expat

Files: vendor/css-media-query-parser.js
Copyright: 2010-2022 Gildas Lormeau
License: Expat

Files: vendor/html-srcset-parser.js
Copyright: 2010-2022 Gildas Lormeau
           2015 Alex Bell
License: Expat

Files: modules/html-minifier.js
Copyright: 2010-2022 Gildas Lormeau
           2016 Kirill Maltsev
License: AGPL-3+ and Expat
Comment: The attribute tables come from htmlnano, which is MIT-licensed.

Files: debian/*
Copyright: 2026 Emfox Zhou
License: AGPL-3+

License: AGPL-3+
 On Debian systems the complete text of the GNU Affero General Public License
 version 3 can be found in /usr/share/common-licenses/AGPL-3.0.
 .
 As additional permission under GNU AGPL version 3 section 7, you may distribute
 UNMODIFIED VERSIONS OF this file without the copy of the GNU AGPL normally
 required by section 4, provided you include this license notice and a URL
 through which recipients can access the Corresponding Source.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
 this list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 3. Neither the name of the copyright holder nor the names of its contributors
 may be used to endorse or promote products derived from this software without
 specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 days ago.

Report◂

DFSG NEW review for node-single-file-core version 1.0.47+ds1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 (correct Format line) and covers the whole tree: a Files: * stanza for the 25 files carrying Gildas Lormeau's AGPL-3+ header, separate stanzas for every vendor file with other authors, and for modules/html-minifier.js and debian/*. The other holders are all named (Jed Mao, Ben Briggs, Domenic Denicola, Alex Bell, Kirill Maltsev, Franck Marcia, Stoyan Stefanov, Julien Lecomte/Yahoo! Inc.), the Expat and BSD-3-clause notices are reproduced in full, AGPL-3+ points at /usr/share/common-licenses/AGPL-3.0, and the AGPL section 7 additional permission matches the file headers. No non-free, no-modification, field-of-use or NC/ND terms exist, and the combined licences (AGPL-3+, Expat, BSD-3-clause) are compatible. The prescan's one 'similar name' hit is the Gildas Lormeau contact line, which Files: * names.

Packaging

The packaging is simple and sound. debhelper compat 14 with a plain dh sequence, Build-Depends that exist (rollup 3.30.0-7 provides node-rollup, node-css-tree 3.2.1-1, node-rollup-plugin-node-resolve 15.2.3+ds-3), the vendored csstree replaced by a build-only shim against node-css-tree and recorded with Built-Using, an autopkgtest that loads the built bundles, source format 3.0 (quilt), gbp.conf, upstream/metadata and README.source explaining the repack, and Standards-Version 4.7.4 against Policy 4.7.4.1. The build writes only the shim copy and lib/ into the tree, both removed in clean. No policy violation was found; the two open questions are recorded as unconfirmed.

Issues

None.

Verified ◂

Read debian/copyright in full: DEP-5 with Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, Upstream-Name, Upstream-Contact, Source, Files-Excluded: vendor/css-tree.js; stanzas Files: , vendor/index.js, vendor/css-minifier.js, vendor/css-font-property-parser.js, vendor/css-unescape.js, vendor/mime-type-parser.js, vendor/css-media-query-parser.js, vendor/html-srcset-parser.js, modules/html-minifier.js and debian/; standalone License paragraphs for AGPL-3+, Expat and BSD-3-clause.
The 25 files whose headers read Copyright 2010-2022 Gildas Lormeau / contact : gildas.lormeau <at> gmail.com are single-file-bootstrap.js, single-file-core.js, single-file-frames.js, single-file-helper.js, single-file-hooks-frames.js, single-file-infobar.js, single-file-util.js, single-file.js, common/content-infobar-web.js, modules/css-fonts-alt-minifier.js, modules/css-fonts-minifier.js, modules/css-matched-rules.js, modules/css-medias-alt-minifier.js, modules/css-rules-minifier.js, modules/html-images-alt-minifier.js, modules/html-minifier.js, modules/html-serializer.js, modules/index.js, modules/template-formatter.js, processors/index.js, processors/frame-tree/content/content-frame-tree.js, processors/hooks/content/content-hooks-frames-web.js, processors/hooks/content/content-hooks-frames.js, processors/lazy/content/content-lazy-loader.js and vendor/index.js. All carry AGPL-3+ plus the section 7 additional permission and are covered by Files: * (vendor/index.js also by its own stanza).
Checked the non-Gildas vendor notices against the stanzas: vendor/css-minifier.js (Gildas MIT, Franck Marcia MIT/UglifyCSS, Stoyan Stefanov cssmin.js, Copyright (c) 2011 Yahoo! Inc. BSD revised) -> Expat and BSD-3-clause; vendor/css-font-property-parser.js (Copyright (c) 2015 Jed Mao); vendor/css-unescape.js (Copyright (c) Ben Briggs); vendor/mime-type-parser.js (Copyright © 2017-2018 Domenic Denicola); vendor/html-srcset-parser.js (By Alex Bell | MIT License); modules/html-minifier.js (Gildas AGPL plus Derived from the work of Kirill Maltsev) -> AGPL-3+ and Expat. All four Expat/BSD notices are reproduced in debian/copyright.
vendor/css-media-query-parser.js carries the Gildas MIT block plus a second MIT block after derived from https://github.com/dryoma/postcss-media-query-parser; that block has no Copyright line. Its stanza gives Expat and Gildas Lormeau, which matches what the file itself states.
No non-free terms: grep for commercial/endorse/NonCommercial/NoDeriv/field-of-use/Good, not Evil/proprietary matched only AGPL-3 text in LICENSE and the ©/🚫/🈲 entries in the HTML entity table in modules/template-formatter.js.
LICENSE is the verbatim 661-line AGPL-3 text; package.json declares AGPL-3.0-or-later; .eslintrc.js and package.json carry no notice but are covered by Files: *.
No built or binary files are shipped as files in the source: the tree is .js and .json plus LICENSE. The base64 data URIs at single-file-core.js:657 and common/content-infobar-web.js:29-31 are PNG icon images embedded inside AGPL-licensed source files, as debian/README.source says; no line exceeds 2000 characters, so the files are not minified.
Files-Excluded vendor/css-tree.js is absent from the .orig.tar.gz listing, and the tarball's file list equals the unpacked tree; the .debian.tar.xz contains exactly the debian/ files reviewed.
Read debian/control, rules, changelog, source/format, gbp.conf, README.source, tests/control, tests/load-bundles and upstream/metadata in full. The autopkgtest depends on @ and node-jsdom, which is in the archive (20.0.3). Standards-Version 4.7.4 matches Policy 4.7.4.1 in its first two components.
The trailing comma ending Build-Depends in debian/control is harmless: Dpkg::Deps split drops trailing empty items, and the .dsc shows the field normalised without it. At compat 14 dh adds relationship substvars itself, so Depends: ${misc:Depends} is not a fault.
The build's absolute import /usr/share/nodejs/css-tree/dist/csstree.esm.js is confined to debian/css-tree-shim.js, which is copied to vendor/css-tree.js at build time and deleted in clean; vendor/index.js imports only ./css-tree.js, and the shim exports exactly the four csstree functions the code uses (parse, generate, find, findAll).
Built-Using is generated as node-css-tree (= <installed version>), and node-css-tree is the source package name (apt-cache shows no Source: field on it).
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.8.0, packaged 1.0.47+ds1), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (AGPL-3.0).

Not confirmed ◂

The unnamed MIT block in vendor/css-media-query-parser.js has no copyright line, so whether an additional holder (for the dryoma/postcss-media-query-parser part) should be added to that stanza could not be determined from the package; the upstream project's LICENSE is not shipped.
Whether Built-Using must also name the source packages behind csstree's own dependencies (node-css-tree depends on node-mdn-data and on a node-source-map-js provided by node-postcss): a build would show whether rollup with node-resolve inlines those imports into lib/*.js. Policy 7.8 requires every incorporated source package to be listed, and only node-css-tree is listed.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 7 days ago.

Review Information

accepted — allocated to mechtilde 6 days ago, started 6 days ago, completed 6 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.0.47+ds1-1	01ea1e24…	2026-10-31 06:07	2026-10-31 06:07	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package