DFSG NEW review for node-vscode-loader version 1.0.2+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is MIT/Expat throughout. License.txt carries Microsoft's MIT grant ('Copyright (c) Microsoft Corporation'), every src/ and tests/ .ts file has a Microsoft MIT header, and the one third-party file, tests/qunit/qunit.d.ts, is covered by its own Expat stanza naming Diullei Gomes (its header says 'Definitions by: Diullei Gomes / DefinitelyTyped'). debian/copyright is DEP-5, uses Files: , debian/ and the qunit.d.ts stanza, reproduces the full Expat text, and its Files-Excluded list matches the +ds tarball: the tsc-generated JS and the browser/QUnit test files are gone, and every generator input (the .ts sources) is present. No licence or holder beyond these appears anywhere in the tree.

Packaging

The packaging is overall sound: debhelper compat 14 with a minimal dh rules file, Build-Depends satisfied (node-typescript 6.0.3-2 is in unstable; nodejs is Multi-Arch: allowed so nodejs:any is valid), current Standards-Version 4.7.4 against Policy 4.7.4.1, Vcs-* and Homepage set, a single arch:all package installing into /usr/share/nodejs/vscode-loader consistent with package.json main/types, no patches, and an autopkgtest. The one defect found is minor: the autopkgtest cannot fail, because upstream tests/run-tests.js only prints its errors and summary and exits 0, so debian/tests/node reports success even when all node tests fail.

Issues

1. [minor] [packaging] Autopkgtest always passes: tests/run-tests.js prints failures but exits 0

• Files: debian/tests/node:10, tests/run-tests.js:49, tests/run-tests.js:67-73
• Basis: checked, in the package or with a reference tool
• Evidence: debian/tests/node: set -e ... node ./run-tests.js; tests/run-tests.js:49 console.log(colors.red('[ERROR ] ' + currentTest + ': \n'), err); and :67-73 build the [FINISHED] ' + okCnt + '/' + totalCnt + ' passed. line and only console.log(str).
• Problem: Failures are collected through control.err -> runTest(err), which prints an error line and carries on; the final summary is just logged and neither the script nor Node sets a non-zero exit status. Under autopkgtest only the exit status matters (allow-stderr is set), so the test passes even if every node test fails - the package's only functional check of the compiled loader detects nothing short of a crash while requiring it. This weakens the autopkgtest that the packaging relies on instead of a build-time test run.
• Fix: Make the test fail on failure: patch tests/run-tests.js to end with something like process.exit(okCnt === totalCnt ? 0 : 1) (and preferably exit 1 on a test error), or have debian/tests/node capture the output and fail when it contains an [ERROR line or the passed count is below the total.

Verified

• Read every file under debian/ in full: control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, README.source, source/format, tests/control, tests/node.
• Read all upstream files (34): top level (License.txt, README.md, ThirdPartyNotices.txt, package.json, tsconfig.json), src/.ts, src/core/, tests/*.ts, tests/run-tests.js, tests/node-specific/** and tests/qunit/qunit.d.ts. No binary, minified or built files remain in the tree; .pc/ was ignored as instructed.
• Compared the .dsc (3.0 (quilt), no patches) and the orig tarball with the unpacked tree: the tarball's package/ has the same files, and the Files-Excluded paths (src/loader.js, loader.d.ts, css.js, css.build.js, nls.js, nls.build.js, tests/loader.test.js, css.test.js, tests/amdjs-tests, tests/ms-specific, tests/qunit/qunit.js, qunit.css, tests/run-tests.htm, dotfiles) are absent, as debian/README.source says.
• Copyright evidence: License.txt (Microsoft MIT/Expat with complete permission text), MIT headers on every src/ and tests/*.ts file, and tests/qunit/qunit.d.ts's header (Definitions by: Diullei Gomes, DefinitelyTyped). Grep for BSD/ISC/Apache/GPL/LGPL/MPL/CC/zlib/Artistic/public domain/non-commercial found nothing else; the ThirdPartyNotices.txt jQuery Foundation notice covers the QUnit js/css that the +ds repack removed, not the retained qunit.d.ts.
• The prescan listed no files; its author check found every holder in the tree (Microsoft, Diullei Gomes, Emfox Zhou) named in debian/copyright.
• copyright-format 5.2 confirms the Comment: field used in the qunit.d.ts stanza is allowed in a Files stanza; the standalone License: Expat paragraph supplies the full text (Expat is not in /usr/share/common-licenses).
• debhelper compat 14: dh_gencontrol adds relationship substvars itself; the explicit ${misc:Depends} is harmless. Read the makefile buildsystem module: with no Makefile it is not auto-selected, so the un-overridden dh_auto_test does nothing rather than failing.
• Dependencies: apt-cache shows node-typescript 6.0.3-2 in unstable (so >= 6.0.0 is satisfiable) and nodejs 24.22.1 with Multi-Arch: allowed, so nodejs:any is valid.
• Standards-Version 4.7.4 against Policy 4.7.4.1: current (first two components match).
• Install layout: package.json main ./src/loader.js and types ./src/loader.d.ts match the files installed into /usr/share/nodejs/vscode-loader; /usr/share/nodejs is the directory Debian's node resolves global modules from (it exists and holds installed modules).
• No debian/patches; 3.0 (quilt) with an empty patch set is fine, and the +ds build regenerates the removed JS via the two tsc invocations in debian/rules.
• uscan found the packaged version as the newest upstream release (upstream 1.0.2, packaged 1.0.2+ds).

Not confirmed

• The build was not run: acceptance of --ignoreDeprecations 6.0 and --noCheck by node-typescript 6.0.3, and whether tsc -p src/core/tsconfig.json emits src/loader.d.ts as debian/rules installs, were not exercised.
• File modes are not visible to the read-only tools, so the executable bit of debian/tests/node (which autopkgtest requires) could not be checked.
• Vcs-Git/Vcs-Browser targets and the bug number in the changelog were not checked (no network).

Proposed changes

None.