DFSG NEW review for node-vvo-tzdb version 6.201.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and matches the tree. It reproduces the upstream MIT licence (CodeAgain SASU) in full for the code and for debian/, and gives raw-time-zones.json its own stanza as GeoNames-derived data under CC-BY-4.0, with the IANA tzdb part noted as public domain. The CC-BY-4.0 pointer is valid (/usr/share/common-licenses/CC-BY-4.0 exists on the reviewing system), and scripts/generate.ts confirms the provenance (IANA downloads plus geonames.org city/country files). abbreviations.json is hand-maintained (AGENTS.md), time-zones-names.json and src/countries.ts are IANA-derived, and all three are covered by the MIT stanza. No non-free terms and no unlicensed files; the pre-scan found no unnamed holder.

Packaging

Conventional debhelper 14 packaging with dh-nodejs and the single-binary add-on. Every Build-Depends exists and meets the versions used: debhelper 14.5 provides dh-sequence-single-binary, dh-nodejs 0.17.14 provides dh-sequence-nodejs-no-lerna, node-typescript 6.0.3 satisfies >= 5.6, esbuild 0.28.2 provides node-esbuild, and rollup 3.30.0, node-rollup-plugin-json 6.0.0, node-rollup-plugin-node-resolve 15.2.3 and node-rollup-plugin-dts 6.5.1 are present. debian/rules builds through debian/build.cjs (rollup plus tsc) and rewrites the staged package.json version; with dh-sequence-single-binary at compat 14, dh_auto_install stages into debian/node-vvo-tzdb, so that path is the installed file. Changelog, Vcs-*, Homepage, source format 3.0 (quilt) with no patches, and the autopkgtest hook are in order; Standards-Version 4.7.4 matches Policy 4.7.4.1's first two components. The only open point is the autopkgtest working directory, recorded under Not confirmed.

Issues

None.

Verified

• Read every file under debian/ (control, rules, changelog, copyright, clean, docs, source/format, nodejs/build, nodejs/files, tests/pkg-js/{files,test}, upstream/metadata, build.cjs, tsconfig.json, README.source); no debian/patches directory exists, so the 3.0 (quilt) source carries no patches.
• Read all 28 upstream files in the tree and grepped the whole tree with gitignore disabled for copyright/licence wording; only LICENSE and package.json ("license": "MIT") carry licensing terms.
• The pre-scan's author check listed no file: every copyright holder it found is already named in debian/copyright.
• MIT: LICENSE (CodeAgain SASU) matches the Files: * stanza, and the licence text in debian/copyright reproduces it in full.
• raw-time-zones.json: scripts/generate.ts shows it is generated from IANA tzdb files (public domain) and geonames.org city/country dumps (CC-BY-4.0); the CC-BY-4.0 stanza and GeoNames attribution are present, and /usr/share/common-licenses/CC-BY-4.0 exists.
• abbreviations.json is hand-edited, time-zones-names.json and src/countries.ts are generated from IANA data; none contains third-party code, so the MIT stanza covers them.
• No built, minified, binary or vendored third-party files in the source tree; dist/ is produced at build time from src/ by debian/build.cjs, and the data files' generator scripts/generate.ts is shipped.
• All Build-Depends resolve on the reviewing system, per apt-cache: debhelper 14.5 (dh-sequence-single-binary), dh-nodejs 0.17.14 (dh-sequence-nodejs-no-lerna), node-typescript 6.0.3, esbuild 0.28.2 (Provides node-esbuild), rollup 3.30.0, node-rollup-plugin-json 6.0.0, node-rollup-plugin-node-resolve 15.2.3, node-rollup-plugin-dts 6.5.1.
• Verified in /usr/share/perl5/Debian/Debhelper/Sequence/single_binary.pm and Buildsystem/nodejs.pm that at compat 14 with dh-sequence-single-binary dh_auto_install stages into debian/node-vvo-tzdb, so the package.json path used by the debian/rules override is the installed file.
• Standards-Version 4.7.4 has the same first two components as the current Policy version 4.7.4.1.
• The changelog is an initial unstable upload with the matching upstream version, source/format is 3.0 (quilt), and Vcs-Browser, Vcs-Git and Homepage are present.
• uscan found the packaged version as the newest upstream release (upstream 6.201.1, packaged 6.201.1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC-BY-4.0).

Not confirmed

• debian/tests/pkg-js/test: test/getTimeZones.test.ts:28 does readFileSync("raw-time-zones.json", "utf8") relative to the working directory, while debian/tests/pkg-js/files lists only test. If pkg-js-autopkgtest copies just the listed entries into its working directory, this test fails with ENOENT under autopkgtest. I could not read the pkg-js-autopkgtest runner (the package is not installed here); adding raw-time-zones.json to debian/tests/pkg-js/files would remove the risk.
• The package was not built and its tests were not run (read-only review), so the rollup/tsc build steps and the test suite were not exercised.

Proposed changes

None.