DFSG NEW review for node-svgtofont version 6.5.3+~cs5.1.6-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

The tree is entirely MIT (Expat). The root, image2uri and auto-config-loader components each carry an MIT LICENSE; source scans found no other licence headers or third-party vendored code (no node_modules; image2uri and auto-config-loader are the author's own separate repos bundled as components, all MIT). debian/copyright is machine-readable DEP-5 with a Files: * catch-all (2018 holder) overridden by image2uri/* (2020) and auto-config-loader/* (2023) stanzas, plus one Expat standalone paragraph with full text. All copyright holders found by the prescan are named. The only binary files are test fixtures (image2uri/test/imgs/uiw.*) used as input by image2uri's tests; they are the author's own data from the same repo and pose no DFSG problem. Full MIT text is reproduced because Expat is not in /usr/share/common-licenses.

Packaging

Packaging is generally clean (debhelper 14, dh-sequence-nodejs, single binary, DEP-3 patches, pkg-js-tools extlinks/root_modules wiring, woff2 shelling out to /usr/bin/woff2_compress). One real defect: the runtime modules ttf2eot and ttf2woff are imported at runtime (and statically at load) by src/utils.ts for EOT/WOFF generation and are listed in debian/nodejs/extlinks, but debian/control lacks node-webfont (the package providing node-ttf2eot/node-ttf2woff) in both Build-Depends and Depends. Without it the installed symlinks dangle and the CLI fails to load. An autopkgtest may also fail because 'expect' (node-expect) is only a <!nocheck> Build-Depends (see unconfirmed).

Issues

1. [important] [packaging] Missing runtime dependency on node-webfont (provides ttf2eot/ttf2woff)

• Files: debian/control (Depends and Build-Depends), debian/nodejs/extlinks, src/utils.ts:9-10
• Basis: inferred from what was read, not seen directly
• Evidence: src/utils.ts: import ttf2eot from 'ttf2eot'; import ttf2woff from 'ttf2woff'; used by createEOT/createWOFF, called from index.ts:418-419; package.json depends on ttf2eot ~3.1.0 and ttf2woff ~3.0.0. debian/nodejs/extlinks links ttf2eot and ttf2woff, but control Depends/Build-Depends list none of node-webfont/node-ttf2eot/node-ttf2woff (apt-cache: node-webfont provides node-ttf2eot=3.1.0 and node-ttf2woff=3.0.0).
• Problem: The code statically imports ttf2eot and ttf2woff at load time, so the installed package must resolve these modules: the extlinks entries create symlinks to /usr/share/nodejs/ttf2eot and /usr/share/nodejs/ttf2woff, which only exist if the providing package node-webfont is installed. With no Depends entry, the CLI (and the EOT/WOFF code paths) fail with MODULE_NOT_FOUND.
• Fix: Add node-webfont to both Build-Depends (so dh-nodejs can link the modules at build time) and Depends.

2. [minor] [licensing] Binary test fixtures have no explicit licence notice

• Files: image2uri/test/imgs/uiw.bm, uiw.bmp, uiw.gif, uiw.ico, uiw.jpeg, uiw-jpeg, uiw.jpg, uiw.png, uiw.svg, uiw.webp
• Basis: checked, in the package or with a reference tool
• Evidence: These are test inputs to image2uri/test/index.test.ts (each reads imgs/uiw. and checks the resulting data URI); the prescan flagged only uiw.bm (raw bitmap) as unrecognised binary. No per-file licence text exists.
• Problem: Bare binary fixtures with no embedded notice, but they are the author's own data from the same MIT repo covered by the image2uri/* stanza; not a DFSG concern.
• Fix: None required; recorded for completeness.

Verified

• debian/copyright is DEP-5 machine-readable; Format, Files stanzas, Copyright holders and the standalone Expat paragraph all present and correct (checked in full).
• Root, image2uri and auto-config-loader each ship a matching MIT LICENSE; all source files scanned for Copyright/(C)/©/SPDX/licence wording found no additional or conflicting licences.
• Prescan copyright-holder check: every holder found is named in debian/copyright (小弟调调 2018/2020/2023 and the Debian uploader).
• No embedded third-party code or node_modules; bundled image2uri and auto-config-loader are the author's own components, all MIT.
• Prescan binary image2uri/test/imgs/uiw.bm identified; it and sibling uiw.* are image2uri test fixtures, not minified code or program blobs.
• Packaging: debhelper-compat 14, dh-sequence-nodejs + dh-sequence-single-binary, hardening via dpkg defaults, DEP-3 patch headers (all Forwarded: not-needed), ttf2woff2 node addon replaced by an external /usr/bin/woff2_compress call.
• Runtime Depends cover every remaining import (fs-extra, yargs, chalk, svgo, cheerio, svg2ttf, svgicons2svgfont, nunjucks, ini, jsonc-parser, lodash.merge, node-fetch, woff2); auto-config-loader and image2uri are bundled and linked via debian/nodejs/root_modules and extlinks.
• Standards-Version 4.7.4 is current; debian files (manpages, gbp.conf, source/format 3.0 quilt, clean, nodejs build) are coherent; changelog distribution/version/urgency sane with a real bug closure (#1150807).
• uscan found the packaged version as the newest upstream release (upstream 6.5.3+~cs5.1.6, packaged 6.5.3+~cs5.1.6).

Not confirmed

• Whether dh-nodejs auto-adds node-webfont to the binary Depends at build time (dh-nodejs not installed here to observe); if it does, the finding still requires node-webfont in Build-Depends for build-time linking.
• Whether the pkg-js-tools autopkgtest environment installs node-expect (only a Build-Depends <!nocheck>), so the import { expect } from 'expect' in test/index.test.js resolves; the runner is pkgjs-run pretest; node --test test/index.test.js.

Proposed changes

None.