Review: node-svgtofont 6.5.3+~cs5.1.6-1

Package Information

Description	converts SVG icons to TTF/EOT/WOFF/WOFF2/SVG font formats svgtofont reads a collection of SVG vector icons and bundles them into multi-format web font files (TTF, EOT, WOFF, WOFF2, and SVG). It automatically generates corresponding style sheets, helper templates, and preview pages to streamline the integration of custom icon fonts into web applications and frontend projects.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Jérémy Lal <kapouer@melix.org>
Sponsor	kapouer@melix.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-svgtofont.git (browse)
Closes	#1150807
Tracker	https://tracker.debian.org/pkg/node-svgtofont
Uploaded	17 days ago

New Package Report

.changes◂

Changed-By	Jérémy Lal <kapouer@melix.org>
Architecture	source all
Distribution	unstable
Date	Mon, 19 Oct 2026 14:15:57 +0200
Source	node-svgtofont
Version	6.5.3+~cs5.1.6-1

Changelog◂

node-svgtofont (6.5.3+~cs5.1.6-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1150807)
     Thanks to Andrew Lee (李健秋) for the initial setup.

.dsc◂

Package-List	node-svgtofont deb javascript optional arch=all
Section	javascript
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: svgtofont
Upstream-Contact: https://github.com/jaywcjlove/svgtofont/issues
Source: https://github.com/jaywcjlove/svgtofont
 https://github.com/jaywcjlove/auto-config-loader
 https://github.com/jaywcjlove/image2uri

Files: *
Copyright: 2018 小弟调调™
License: Expat

Files: image2uri/*
Copyright: 2020 小弟调调™
License: Expat

Files: auto-config-loader/*
Copyright: 2023 小弟调调
License: Expat

Files: debian/*
Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 17 days ago.

Report◂

DFSG NEW review for node-svgtofont version 6.5.3+~cs5.1.6-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 1 found

Licensing

Licensing is DFSG-compliant. Every file in the tree is MIT/Expat: the three LICENSE files (root, image2uri, auto-config-loader) carry identical MIT text, and a full-tree grep found no other licence wording (no GPL/LGPL/Apache/MPL, no non-commercial/no-modification terms, no minified or compiled blobs). debian/copyright is machine-readable DEP-5 (exact Format URL), with correct catch-all and component stanzas whose holders and years match each LICENSE file, and the full Expat text is included (MIT is not in /usr/share/common-licenses). The only defect is that the debian/* stanza omits Jérémy Lal, the author of every patch and of the changelog; reported as minor.

Packaging

Packaging is of good quality. dh-nodejs layout is correct: image2uri is a root module, auto-config-loader is handled as a lerna workspace and bundled under node-svgtofont/node_modules/auto-config-loader, and every debian/nodejs//build config is honored per the installed dh-nodejs source. All Build-Depends/Depends names resolve in the archive (checked with apt-cache), patches carry DEP-3 headers with appropriate Forwarded: not-needed, tests use the standard Testsuit autopkgtest-pkg-nodejs mechanism, compat 14 is used without need for substvars, and Standards-Version 4.7.4 matches current Policy 4.7.4.1. I could not build the package here, so build-time type resolution is listed as unconfirmed, not as a fault.

Issues

minor licensing 1. debian/* stanza omits a copyright holder (Jérémy Lal) ◂

Files: debian/copyright:21-22, debian/patches/*.patch (Author headers), debian/changelog:5
Basis: checked, in the package or with a reference tool
Evidence: Files: debian/* says Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>, but every patch header says Author: Jérémy Lal <kapouer@melix.org> and the changelog entry (version 6.5.3+~cs5.1.6-1) is by Jérémy Lal <kapouer@melix.org>.
Problem: debian/copyright should name all copyright holders of the files it covers (Policy 12.5, copyright-format 5.2). The six patches and the changelog are Jérémy Lal's work but he is not listed, so the debian/* stanza is incomplete. Purely a completeness issue, not a legal blocker.
Fix: Add Jérémy Lal to the Copyright: line of the Files: debian/* stanza, e.g. Copyright: 2026 Andrew Lee (李健秋) <ajqlee@debian.org>, Jérémy Lal <kapouer@melix.org>.

Verified ◂

debian/copyright read in full: DEP-5 machine-readable, exact Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, stanzas Files: *, Files: image2uri/*, Files: auto-config-loader/*, Files: debian/*, no Files-Excluded, full Expat text quoted inline.
All three LICENSE files read: root Copyright (c) 2018 小弟调调™, image2uri 2020 小弟调调™, auto-config-loader 2023 小弟调调; all are the standard MIT text, matching the holders/years in debian/copyright.
Whole tree (excluding .pc and debian/) grepped for Copyright, (C), ©, and for GPL/LGPL/Apache/MPL/SPDX/public-domain/Licensed-under wording: nothing beyond the three LICENSE files and README references to the MIT license; no restrictive terms.
Glob for compiled/minified artefacts (min.js, .jar, .class, .so, .exe, .dll, .pyc, archives, .map): none found; the built output lib/, dist/ and component lib/ are build artefacts listed in debian/clean and generated from the shipped src/ (TypeScript preferred form present).
image2uri/test/imgs/uiw.bm (the prescan's unknown binary) is a bitmap test fixture sitting next to uiw.bmp/uiw.png/uiw.jpg/uiw.gif/uiw.ico/uiw.webp/... of the same uiw test image in the MIT-licensed image2uri repo; test data, not an issue. examples/*/favicon.png are likewise MIT-covered demo assets.
Prescan author check (124 files, 3 holders) reported every holder found is named in debian/copyright; confirmed by reading the LICENSE files.
Standards-Version 4.7.4 vs current Policy 4.7.4.1 (policy tool): fine; first two components already 4.7.
Every Build-Depends/Depends name resolves in the archive (apt-cache): node-yargs 17.7.3, node-cheerio 1.2.0, node-chalk 5.6.2, node-expect (Provided by jest 29.6.2), node-fetch 3.3.2, node-fs-extra 10.1.0, node-ini 7.0.0, node-jsonc-parser 3.3.1, node-lodash.merge (via node-lodash-packages 4.6.9 types), node-nunjucks 3.2.4, node-svg2ttf 6.1.0 (with node-types-svg2ttf 5.0.3), node-svgicons2svgfont/node-ttf2eot/node-ttf2woff (via node-webfont 12.0.0), node-svgo 3.3.5, node-typescript 6.0.3, woff2 1.0.2, dh-nodejs 0.17.14 (>= 0.17.14 satisfied).
dh-nodejs build graph checked against the installed Debian::Debhelper::Buildsystem::nodejs: debian/nodejs//build honored per component; root_modules: image2uri installs it at /usr/share/nodejs/image2uri; auto-config-loader resolved as a lerna workspace (auto-config-loader/core, packages ["core"]) and bundled under node-svgtofont/node_modules/auto-config-loader; main package installed at /usr/share/nodejs/svgtofont.
Autopkgtest wiring: Testsuit: autopkgtest-pkg-nodejs with debian/tests/pkg-js/test (pkgjs-run pretest; node --test test/index.test.js), the location the buildsystem picks up; fix-test.patch moves the suite to node:test + expect (jest removed).
All six patches (ts6.patch, fix-test.patch, less-loaders.patch, fix-svgicons2svgfont-import.patch, use-chalk.patch, replace-ttf2woff2-by-woff2-call.patch) have DEP-3 Description/Author/Forwarded/Last-Update headers; Forwarded: not-needed is right for the Debian dependency/chalk/woff2 swaps; the ttf2woff2->woff2_compress call (patch) matches the woff2 binary shipped by the woff2 package and is consistent with the autopkgtest expecting a generated svgtofont.woff2.
debian/rules: include /usr/share/dpkg/default.mk, %: dh $@, execute_before_dh_installman guarded by filter nodoc,$(DEB_BUILD_OPTIONS) with help2man in Build-Depends < !nodoc>; correct for compat 14; node-expect < !nocheck> consistent with dh skipping dh_auto_test under nocheck at compat 13+.
No vendored third-party copies with separate licences beyond the two declared base components; no embedded Debian-already-shipped libraries.
debian/clean lists lib/, dist/, image2uri/lib/, auto-config-loader/core/lib/ and the example output dirs, matching the build steps (tsc, cp -r src/website lib/, cp -r src/styles lib/).
uscan found the packaged version as the newest upstream release (upstream 6.5.3+~cs5.1.6, packaged 6.5.3+~cs5.1.6).

Not confirmed ◂

The package could not be built on this reviewing system; build/test success, and TS type resolution of the component imports against Debian's packages (e.g. svgicons2svgfont types inside node-webfont 12.0.0, node-ini bundled types for the @types/ini extlink) are not exercised here.
Two package.json version ranges differ from the Debian versions linked (fs-extra ~11.2.0 vs node-fs-extra 10.1.0; cheerio ~1.0.0 vs node-cheerio 1.2.0). The extlinks are unversioned so the build links Debian's versions; only the stable fs-extra/cheerio APIs seem used, but whether every call is compatible was not verified at runtime.

Proposed changes ◂

None.

Uploader's response to the LLM review

I'm fine with the current copyright notice for debian/* - I think the most important thing is that there is one,
not that we always add ourselves to it.

— Jérémy Lal (kapouer), 17 days ago

Review Information

accepted — allocated to awm 15 days ago, started 15 days ago, completed 15 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
6.5.3+~cs5.1.6-1	a3123db6…	2026-10-19 12:12	2026-10-19 12:12	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package