orchid 2.4.0+ds-1
Package Information
| Description | Tor client library written in pure Java Orchid is an implementation of the Tor client protocol in pure Java, with no native code. It builds circuits through the Tor network, opens streams to exit relays and to version 3 onion services, and can serve as a SOCKS proxy. Applications use it through a SocketFactory or by opening streams directly, and can isolate their streams from each other. Country codes in node filters (ExcludeNodes and the like) need Tor's geoip database, which the tor-geoipdb package provides. Orchid is not a replacement for Tor Browser: it provides the Tor protocol, not the protections of a hardened browser. |
|---|---|
| Maintainer | Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> |
| Changed By | Masayuki Hatta <mhatta@debian.org> |
| Sponsor | mhatta@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/java-team/orchid.git (browse) |
| Closes | #740364 |
| Tracker | https://tracker.debian.org/pkg/orchid |
| Uploaded | 1 day ago |
New Package Report
.changes
| Changed-By | Masayuki Hatta <mhatta@debian.org> |
|---|---|
| Architecture | source all |
| Distribution | unstable |
| Date | Tue, 03 Nov 2026 22:38:50 +0900 |
| Source | orchid |
| Version | 2.4.0+ds-1 |
Changelog
orchid (2.4.0+ds-1) unstable; urgency=medium . * Initial release. (Closes: #740364)
.dsc
| Component | main |
|---|---|
| Package-List | liborchid-java deb java optional arch=all |
| Section | java |
| Priority | optional |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Orchid
Upstream-Contact: Masayuki Hatta <mhatta@mhatta.org>
Source: https://github.com/mhatta/Orchid
Files-Excluded:
gradle/wrapper/gradle-wrapper.jar
Comment:
The Gradle wrapper jar is a prebuilt binary without source in the
upstream tree; it is not needed to build the package and is removed from
the orig tarball (hence the +ds version suffix). doc/torspec is a git
submodule and is not part of the upstream release tarballs.
.
The files named after "Files: *" below without a notice of their own carry
no copyright header; LICENSE covers them. Besides the holders listed,
other people contributed to Orchid between 2009 and 2017 (see the git
history); their contributions are under the same license.
Files: *
Copyright: 2009-2018 Bruce Leidl <bruce@subgraph.com>
2018-2026 Masayuki Hatta <mhatta@mhatta.org>
2009-2017 Orchid contributors
License: BSD-3-Clause
Files: src/main/java/com/subgraph/orchid/crypto/Curve25519.java
Copyright: 2011 Neil Alexander T.
License: BSD-2-Clause
Comment:
From https://github.com/neilalexander/jnacl (crypto/curve25519.java).
Files: gradlew
gradlew.bat
Copyright: 2015-2021 the original authors (Gradle)
License: Apache-2.0
Files: debian/*
Copyright: 2026 Masayuki Hatta <mhatta@debian.org>
License: BSD-3-Clause
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
* Neither the name of the author nor the
names of its contributors may be used to endorse or promote products
derived from this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: BSD-2-Clause
Redistribution and use in source and binary forms, with
or without modification, are permitted provided that the following
conditions are met:
.
- Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License, Version 2.0
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 day ago.
Proposes a replacement debian/watch:
debian/watch in version 5 format
Report
DFSG NEW review for orchid version 2.4.0+ds-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 1 minor; 1 more from the model's own knowledge, under Not confirmed
- debian/watch: old format (version 4)
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
Everything the tree states is DFSG-free and the DEP-5 copyright file matches it: BSD-3-Clause for the project (LICENSE is reproduced verbatim in the stand-alone paragraph), BSD-2-Clause for the jnacl-derived Curve25519.java with its own stanza and full text, Apache-2.0 for the Gradle wrapper scripts with a pointer to /usr/share/common-licenses/Apache-2.0. The only prebuilt binary upstream shipped (gradle-wrapper.jar) is excluded, named in Files-Excluded, and absent; no other binaries, no generated-without-source code, and the CC BY-SA geoip database is documented but not shipped. One doubt remains about the seven files of com.subgraph.orchid.encoders, which read as Bouncy Castle's encoder package with its notice stripped; that is recorded as a recalled issue and is the only thing that could make the file inaccurate.
Packaging
The packaging is clean: debhelper compat 14, a working rules file that compiles with javac --release 8 and runs the JUnit suite with a proper nocheck guard, the jar installed and published through maven-repo-helper's .poms mechanism with --java-lib/--usj-name, a correct +ds repack documented in README.source, an autopkgtest that exercises the installed jar, and Standards-Version 4.7.4 against Policy 4.7.4.1. Dependencies are right for a dependency-free Java library, the changelog closes the ITP, and there are no patches or maintainer scripts to get wrong.
Issues
minor packaging 1. debian/watch is in the old version 4 format ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence:
version=4 - Problem: Version 5 is the current format of
debian/watch. - Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
- Read every file under
debian/: control, rules, changelog, copyright, source/format, tests/control, tests/smoke, upstream/metadata, gbp.conf, salsa-ci.yml, README.source, liborchid-java.docs, liborchid-java.poms, pom.xml; source format 3.0 (quilt), no patches, no maintainer scripts, no debian/compat. debian/copyrightis DEP-5 with the right Format URL: header (Upstream-Name,Upstream-Contact,Source,Files-Excluded: gradle/wrapper/gradle-wrapper.jar, Comment),Files: *BSD-3-Clause (Leidl, Hatta, contributors),Files: src/main/java/com/subgraph/orchid/crypto/Curve25519.javaBSD-2-Clause,Files: gradlew gradlew.batApache-2.0,Files: debian/*BSD-3-Clause, plus stand-alone License paragraphs carrying the full BSD-3 and BSD-2 texts and an Apache-2.0 notice pointing at/usr/share/common-licenses/Apache-2.0(which exists).- Notices in the tree agree with the stanzas:
LICENSEis the same BSD-3-Clause text;Curve25519.java:4-27carries the BSD-2-Clause notice of Neil Alexander T. and links the jnacl original;gradlew:4(Copyright © 2015-2021 the original authors) andgradlew.bat:2carry the Apache-2.0 notice. - Walked the whole tree (343 files) and globbed for jar/class/png/pdf/zip/gz/so/exe: no binary or built file of any kind.
gradle/wrapper/gradle-wrapper.jaris in Files-Excluded, named in README.source, and absent from bothorchid_2.4.0+ds.orig.tar.xz(rootOrchid-2.4.0/) and the unpacked tree; the+dsversion and the dsc agree with this. - All other source files are headerless and covered by
Files: *, as the copyright file's Comment states; no(C),©, SPDX, GPL, LGPL, MPL, CC or "all rights reserved" text was found anywhere else in the tree. - Tor's geoip database (IPFire Location, CC BY-SA 4.0) is described in
data/README,README.md:231andsrc/main/java/com/subgraph/orchid/geoip/CountryCodeService.java:22but is not shipped:data/contains only its README, andtest/com/subgraph/orchid/geoip/CountryCodeServiceTest.java:17says its rangesare made up. src/main/java/com/subgraph/orchid/directory/FallbackDirectoryList.javais generated data (relay addresses/keys from Tor's fallback_dirs.inc) with its generatortools/gen-fallback-dirs.pyshipped; it carries no third-party code.- The three licences combined in the one jar (BSD-3-Clause, BSD-2-Clause; Apache-2.0 only in the two wrapper scripts, which are not installed) are mutually compatible.
- Jar installation:
debian/liborchid-java.pomsholdsdebian/pom.xml --has-package-version --java-lib --artifact=build/orchid.jar --usj-name=orchid, which is exactly the pattern documented in/usr/share/doc/maven-repo-helper/tutorial.html:117;mh_install(maven-repo-helper 1.7.1,/usr/bin/mh_install) picks--artifactout of the .poms and runsmh_installjar --java-lib, giving/usr/share/java/orchid.jarand its versioned link plus the /usr/share/maven-repo entries. --with javahelper,maven-repo-helperresolves:load_sequence_addonrewrites-to_(/usr/share/perl5/Debian/Debhelper/SequencerUtil.pm:479), somaven_repo_helper.pmandjh_maven_repo_helper.pmare loaded andmh_installis inserted afterdh_install, beforedh_missing.debhelper-compat (= 14)is the recommended level of debhelper 14.5 on this system (debhelper tool);Standards-Version: 4.7.4matches Policy 4.7.4.1 from the policy tool.override_dh_auto_test-indeptestsnocheckitself, and at compat 13+ dh skips that target undernocheckanyway;Build-Depends-Indepmarks the test-only libraries<!nocheck>, which is consistent.- autopkgtest
smokeonly needsdefault-jdk-headlessandliborchid-java, and the APIs it calls exist:OrchidSocketFactory.unresolvedAddress(OrchidSocketFactory.java:93) andTorConfigImpl.getSafeLogging()defaulting to true (TorConfigImpl.java:40); its version assertion holds becausedebian/ruleswritesversion=2.4.0into the jar'sversion.propertiesandApplicationProperties.parseVersionreturns it. - Changelog is a well-formed initial release in
unstableclosing the ITP; Vcs-Git/Vcs-Browser/Homepage/upstream-metadata point at the same upstream;salsa-ci.ymluses the standard Debian recipe. - uscan found the packaged version as the newest upstream release (upstream
2.4.0, packaged2.4.0+ds). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- Whether javahelper's
jh_depends(javahelper is not installed on the reviewing system) emits a non-empty${java:Depends}for this package; the library has no runtime dependencies, so an empty value would be correct in any case. - The build test classpath has no asm jar although
libbyte-buddy-java1.18.14 depends onlibasm-java, whiledebian/rulesputs byte-buddy onTEST_CP; I could not run the tests, and nothing indebian/shows whether any test mocks a class rather than an interface. - Whether this is a fault: com/subgraph/orchid/encoders/* is Bouncy Castle's encoder package, but debian/copyright names Bruce Leidl and BSD-3-Clause. The model reported it as a blocker licensing issue from its own knowledge of something outside the package, which it did not check with a tool, so it is not counted among the issues. Files:
src/main/java/com/subgraph/orchid/encoders/Base64.java,src/main/java/com/subgraph/orchid/encoders/Base64Encoder.java,src/main/java/com/subgraph/orchid/encoders/Hex.java,src/main/java/com/subgraph/orchid/encoders/HexEncoder.java,src/main/java/com/subgraph/orchid/encoders/Encoder.java,src/main/java/com/subgraph/orchid/encoders/EncoderException.java,src/main/java/com/subgraph/orchid/encoders/DecoderException.java,debian/copyright:18-23.
Evidence:Base64Encoder.java:11protected final byte[] encodingTable =,Base64Encoder.java:31protected byte padding = (byte)'=';,Base64Encoder.java:196private int nextI(byte[] data, int i, int finish),Base64Encoder.java:288throw new IOException("invalid characters encountered at end of base64 data");,Base64.java:8private static final Encoder encoder = new Base64Encoder();; debian/copyrightFiles: */Copyright: 2009-2018 Bruce Leidl/License: BSD-3-Clause.
Problem: The seven files are the text oforg.bouncycastle.util.encoders(Base64, Base64Encoder, Hex, HexEncoder, Encoder, EncoderException, DecoderException) with the package renamed and the copyright/licence header removed: same protectedencodingTable/decodingTable/paddingfields, same privatenextI/decodeLastBlock/ignoremethods, same exception classes extending IllegalStateException, same error strings. Bouncy Castle's code is under its own MIT-style licence, which requires the copyright notice and permission text to be retained, and whose holder is The Legion of the Bouncy Castle Inc. — not Bruce Leidl under BSD-3-Clause. As written,debian/copyrightmisstates both the holder and the licence of these files (Policy 12.5; copyright-format 6.5).
Fix: Add aFiles: src/main/java/com/subgraph/orchid/encoders/*stanza naming The Legion of the Bouncy Castle Inc. with a stand-alone License paragraph holding the Bouncy Castle licence text, or have upstream replace these classes with an implementation of their own (as it did for Keccak and Ed25519); ask upstream to restore the notice either way, and check the rest of the tree for other code imported from Bouncy Castle.
Proposed: debian/watch in version 5 format ◂
debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.
Version: 5
Template: Github
Compression: xz
Dist: https://github.com/mhatta/Orchid
Dversionmangle: auto
Repack: yes
Repacksuffix: +ds
Uploader's response to the LLM review
The uploader was emailed about the review 1 day ago.