DFSG NEW Queue

DFSG, Licensing & New Packages Team

orchid 2.4.0+ds-1

Package Information

DescriptionTor client library written in pure Java

Orchid is an implementation of the Tor client protocol in pure Java, with no native code. It builds circuits through the Tor network, opens streams to exit relays and to version 3 onion services, and can serve as a SOCKS proxy. Applications use it through a SocketFactory or by opening streams directly, and can isolate their streams from each other.

Country codes in node filters (ExcludeNodes and the like) need Tor's geoip database, which the tor-geoipdb package provides.

Orchid is not a replacement for Tor Browser: it provides the Tor protocol, not the protections of a hardened browser.

MaintainerDebian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed ByMasayuki Hatta <mhatta@debian.org>
Sponsormhatta@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/java-team/orchid.git (browse)
Closes#740364
Trackerhttps://tracker.debian.org/pkg/orchid
Uploaded1 day ago

New Package Report

.changes◂
Changed-ByMasayuki Hatta <mhatta@debian.org>
Architecturesource all
Distributionunstable
DateTue, 03 Nov 2026 22:38:50 +0900
Sourceorchid
Version2.4.0+ds-1
Changelog◂
orchid (2.4.0+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #740364)
.dsc◂
Componentmain
Package-Listliborchid-java deb java optional arch=all
Sectionjava
Priorityoptional
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Orchid
Upstream-Contact: Masayuki Hatta <mhatta@mhatta.org>
Source: https://github.com/mhatta/Orchid
Files-Excluded:
 gradle/wrapper/gradle-wrapper.jar
Comment:
 The Gradle wrapper jar is a prebuilt binary without source in the
 upstream tree; it is not needed to build the package and is removed from
 the orig tarball (hence the +ds version suffix).  doc/torspec is a git
 submodule and is not part of the upstream release tarballs.
 .
 The files named after "Files: *" below without a notice of their own carry
 no copyright header; LICENSE covers them.  Besides the holders listed,
 other people contributed to Orchid between 2009 and 2017 (see the git
 history); their contributions are under the same license.

Files: *
Copyright: 2009-2018 Bruce Leidl <bruce@subgraph.com>
           2018-2026 Masayuki Hatta <mhatta@mhatta.org>
           2009-2017 Orchid contributors
License: BSD-3-Clause

Files: src/main/java/com/subgraph/orchid/crypto/Curve25519.java
Copyright: 2011 Neil Alexander T.
License: BSD-2-Clause
Comment:
 From https://github.com/neilalexander/jnacl (crypto/curve25519.java).

Files: gradlew
       gradlew.bat
Copyright: 2015-2021 the original authors (Gradle)
License: Apache-2.0

Files: debian/*
Copyright: 2026 Masayuki Hatta <mhatta@debian.org>
License: BSD-3-Clause

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
     * Redistributions of source code must retain the above copyright
       notice, this list of conditions and the following disclaimer.
     * Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.
     * Neither the name of the author nor the
       names of its contributors may be used to endorse or promote products
       derived from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: BSD-2-Clause
 Redistribution and use in source and binary forms, with
 or without modification, are permitted provided that the following
 conditions are met:
 .
  - Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
  - Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for orchid version 2.4.0+ds-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 1 minor; 1 more from the model's own knowledge, under Not confirmed
  • debian/watch: old format (version 4)
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

Everything the tree states is DFSG-free and the DEP-5 copyright file matches it: BSD-3-Clause for the project (LICENSE is reproduced verbatim in the stand-alone paragraph), BSD-2-Clause for the jnacl-derived Curve25519.java with its own stanza and full text, Apache-2.0 for the Gradle wrapper scripts with a pointer to /usr/share/common-licenses/Apache-2.0. The only prebuilt binary upstream shipped (gradle-wrapper.jar) is excluded, named in Files-Excluded, and absent; no other binaries, no generated-without-source code, and the CC BY-SA geoip database is documented but not shipped. One doubt remains about the seven files of com.subgraph.orchid.encoders, which read as Bouncy Castle's encoder package with its notice stripped; that is recorded as a recalled issue and is the only thing that could make the file inaccurate.

Packaging

The packaging is clean: debhelper compat 14, a working rules file that compiles with javac --release 8 and runs the JUnit suite with a proper nocheck guard, the jar installed and published through maven-repo-helper's .poms mechanism with --java-lib/--usj-name, a correct +ds repack documented in README.source, an autopkgtest that exercises the installed jar, and Standards-Version 4.7.4 against Policy 4.7.4.1. Dependencies are right for a dependency-free Java library, the changelog closes the ITP, and there are no patches or maintainer scripts to get wrong.

Issues

minor packaging 1. debian/watch is in the old version 4 format ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: version=4
  • Problem: Version 5 is the current format of debian/watch.
  • Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
  • Read every file under debian/: control, rules, changelog, copyright, source/format, tests/control, tests/smoke, upstream/metadata, gbp.conf, salsa-ci.yml, README.source, liborchid-java.docs, liborchid-java.poms, pom.xml; source format 3.0 (quilt), no patches, no maintainer scripts, no debian/compat.
  • debian/copyright is DEP-5 with the right Format URL: header (Upstream-Name, Upstream-Contact, Source, Files-Excluded: gradle/wrapper/gradle-wrapper.jar, Comment), Files: * BSD-3-Clause (Leidl, Hatta, contributors), Files: src/main/java/com/subgraph/orchid/crypto/Curve25519.java BSD-2-Clause, Files: gradlew gradlew.bat Apache-2.0, Files: debian/* BSD-3-Clause, plus stand-alone License paragraphs carrying the full BSD-3 and BSD-2 texts and an Apache-2.0 notice pointing at /usr/share/common-licenses/Apache-2.0 (which exists).
  • Notices in the tree agree with the stanzas: LICENSE is the same BSD-3-Clause text; Curve25519.java:4-27 carries the BSD-2-Clause notice of Neil Alexander T. and links the jnacl original; gradlew:4 (Copyright © 2015-2021 the original authors) and gradlew.bat:2 carry the Apache-2.0 notice.
  • Walked the whole tree (343 files) and globbed for jar/class/png/pdf/zip/gz/so/exe: no binary or built file of any kind. gradle/wrapper/gradle-wrapper.jar is in Files-Excluded, named in README.source, and absent from both orchid_2.4.0+ds.orig.tar.xz (root Orchid-2.4.0/) and the unpacked tree; the +ds version and the dsc agree with this.
  • All other source files are headerless and covered by Files: *, as the copyright file's Comment states; no (C), ©, SPDX, GPL, LGPL, MPL, CC or "all rights reserved" text was found anywhere else in the tree.
  • Tor's geoip database (IPFire Location, CC BY-SA 4.0) is described in data/README, README.md:231 and src/main/java/com/subgraph/orchid/geoip/CountryCodeService.java:22 but is not shipped: data/ contains only its README, and test/com/subgraph/orchid/geoip/CountryCodeServiceTest.java:17 says its ranges are made up.
  • src/main/java/com/subgraph/orchid/directory/FallbackDirectoryList.java is generated data (relay addresses/keys from Tor's fallback_dirs.inc) with its generator tools/gen-fallback-dirs.py shipped; it carries no third-party code.
  • The three licences combined in the one jar (BSD-3-Clause, BSD-2-Clause; Apache-2.0 only in the two wrapper scripts, which are not installed) are mutually compatible.
  • Jar installation: debian/liborchid-java.poms holds debian/pom.xml --has-package-version --java-lib --artifact=build/orchid.jar --usj-name=orchid, which is exactly the pattern documented in /usr/share/doc/maven-repo-helper/tutorial.html:117; mh_install (maven-repo-helper 1.7.1, /usr/bin/mh_install) picks --artifact out of the .poms and runs mh_installjar --java-lib, giving /usr/share/java/orchid.jar and its versioned link plus the /usr/share/maven-repo entries.
  • --with javahelper,maven-repo-helper resolves: load_sequence_addon rewrites - to _ (/usr/share/perl5/Debian/Debhelper/SequencerUtil.pm:479), so maven_repo_helper.pm and jh_maven_repo_helper.pm are loaded and mh_install is inserted after dh_install, before dh_missing.
  • debhelper-compat (= 14) is the recommended level of debhelper 14.5 on this system (debhelper tool); Standards-Version: 4.7.4 matches Policy 4.7.4.1 from the policy tool.
  • override_dh_auto_test-indep tests nocheck itself, and at compat 13+ dh skips that target under nocheck anyway; Build-Depends-Indep marks the test-only libraries <!nocheck>, which is consistent.
  • autopkgtest smoke only needs default-jdk-headless and liborchid-java, and the APIs it calls exist: OrchidSocketFactory.unresolvedAddress (OrchidSocketFactory.java:93) and TorConfigImpl.getSafeLogging() defaulting to true (TorConfigImpl.java:40); its version assertion holds because debian/rules writes version=2.4.0 into the jar's version.properties and ApplicationProperties.parseVersion returns it.
  • Changelog is a well-formed initial release in unstable closing the ITP; Vcs-Git/Vcs-Browser/Homepage/upstream-metadata point at the same upstream; salsa-ci.yml uses the standard Debian recipe.
  • uscan found the packaged version as the newest upstream release (upstream 2.4.0, packaged 2.4.0+ds).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
  • Whether javahelper's jh_depends (javahelper is not installed on the reviewing system) emits a non-empty ${java:Depends} for this package; the library has no runtime dependencies, so an empty value would be correct in any case.
  • The build test classpath has no asm jar although libbyte-buddy-java 1.18.14 depends on libasm-java, while debian/rules puts byte-buddy on TEST_CP; I could not run the tests, and nothing in debian/ shows whether any test mocks a class rather than an interface.
  • Whether this is a fault: com/subgraph/orchid/encoders/* is Bouncy Castle's encoder package, but debian/copyright names Bruce Leidl and BSD-3-Clause. The model reported it as a blocker licensing issue from its own knowledge of something outside the package, which it did not check with a tool, so it is not counted among the issues. Files: src/main/java/com/subgraph/orchid/encoders/Base64.java, src/main/java/com/subgraph/orchid/encoders/Base64Encoder.java, src/main/java/com/subgraph/orchid/encoders/Hex.java, src/main/java/com/subgraph/orchid/encoders/HexEncoder.java, src/main/java/com/subgraph/orchid/encoders/Encoder.java, src/main/java/com/subgraph/orchid/encoders/EncoderException.java, src/main/java/com/subgraph/orchid/encoders/DecoderException.java, debian/copyright:18-23.
    Evidence: Base64Encoder.java:11 protected final byte[] encodingTable =, Base64Encoder.java:31 protected byte padding = (byte)'=';, Base64Encoder.java:196 private int nextI(byte[] data, int i, int finish), Base64Encoder.java:288 throw new IOException("invalid characters encountered at end of base64 data");, Base64.java:8 private static final Encoder encoder = new Base64Encoder();; debian/copyright Files: * / Copyright: 2009-2018 Bruce Leidl / License: BSD-3-Clause.
    Problem: The seven files are the text of org.bouncycastle.util.encoders (Base64, Base64Encoder, Hex, HexEncoder, Encoder, EncoderException, DecoderException) with the package renamed and the copyright/licence header removed: same protected encodingTable/decodingTable/padding fields, same private nextI/decodeLastBlock/ignore methods, same exception classes extending IllegalStateException, same error strings. Bouncy Castle's code is under its own MIT-style licence, which requires the copyright notice and permission text to be retained, and whose holder is The Legion of the Bouncy Castle Inc. — not Bruce Leidl under BSD-3-Clause. As written, debian/copyright misstates both the holder and the licence of these files (Policy 12.5; copyright-format 6.5).
    Fix: Add a Files: src/main/java/com/subgraph/orchid/encoders/* stanza naming The Legion of the Bouncy Castle Inc. with a stand-alone License paragraph holding the Bouncy Castle licence text, or have upstream replace these classes with an implementation of their own (as it did for Keccak and Ed25519); ask upstream to restore the notice either way, and check the rest of the tree for other code imported from Bouncy Castle.
Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Template: Github
Compression: xz
Dist: https://github.com/mhatta/Orchid
Dversionmangle: auto
Repack: yes
Repacksuffix: +ds

Uploader's response to the LLM review

The uploader was emailed about the review 1 day ago.

Back to Dashboard | View all reviews for this package