DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: orchid 2.5.1+ds-1

New Package Report

.changes◂
Architecturesource all
Distributionunstable
DateFri, 06 Nov 2026 17:03:38 +0900
Sourceorchid
Version2.5.1+ds-1
Changed-ByMasayuki Hatta <mhatta@debian.org>
Changelog◂
orchid (2.5.1+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #740364)
.dsc◂
Sectionjava
Priorityoptional
Componentmain
Package-Listliborchid-java deb java optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Orchid
Upstream-Contact: Masayuki Hatta <mhatta@mhatta.org>
Source: https://github.com/mhatta/Orchid
Files-Excluded:
 gradle/wrapper/gradle-wrapper.jar
Comment:
 The Gradle wrapper jar is a prebuilt binary without source in the
 upstream tree; it is not needed to build the package and is removed from
 the orig tarball (hence the +ds version suffix).  doc/torspec is a git
 submodule and is not part of the upstream release tarballs.
 .
 The files named after "Files: *" below without a notice of their own carry
 no copyright header; LICENSE covers them.  Besides the holders listed,
 other people contributed to Orchid between 2009 and 2017 (see the git
 history); their contributions are under the same license.

Files: *
Copyright: 2009-2018 Bruce Leidl <bruce@subgraph.com>
           2018-2026 Masayuki Hatta <mhatta@mhatta.org>
           2009-2017 Orchid contributors
License: BSD-3-Clause

Files: src/main/java/com/subgraph/orchid/encoders/*
Copyright: 2000-2013 The Legion Of The Bouncy Castle (http://www.bouncycastle.org)
Comment: Derived from org.bouncycastle.util.encoders of the Bouncy Castle
 Crypto APIs for Java, imported upstream in 2013.
License: Expat

Files: src/main/java/com/subgraph/orchid/crypto/Curve25519.java
Copyright: 2011 Neil Alexander T.
License: BSD-2-Clause
Comment: Derived from jnacl
 (https://github.com/neilalexander/jnacl/blob/master/crypto/curve25519.java).

Files: gradlew
       gradlew.bat
Copyright: 2015-2021 the original authors (Gradle)
License: Apache-2.0

Files: debian/*
Copyright: 2026 Masayuki Hatta <mhatta@debian.org>
License: BSD-3-Clause

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
     * Redistributions of source code must retain the above copyright
       notice, this list of conditions and the following disclaimer.
     * Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.
     * Neither the name of the author nor the
       names of its contributors may be used to endorse or promote products
       derived from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: BSD-2-Clause
 Redistribution and use in source and binary forms, with
 or without modification, are permitted provided that the following
 conditions are met:
 .
  - Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
  - Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for orchid version 2.5.1+ds-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 1 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

debian/copyright is DEP-5, and every file in the tree falls under one of its five Files stanzas. The bulk is BSD-3-Clause (LICENSE, reproduced verbatim in the copyright file), with correct overrides for the Bouncy Castle derived encoders/* (Expat, header agrees), crypto/Curve25519.java (BSD-2-Clause, jnacl) and gradlew/gradlew.bat (Apache-2.0), and debian/*. No non-free wording, no other licence notices and no built artifacts are in the tree; the one prebuilt binary, gradle/wrapper/gradle-wrapper.jar, is gone as Files-Excluded and README.source say. The only files whose copyright the file does not describe are the two ISRG root certificates in the Android sample, which are public trust anchors and not copyrightable subject matter.

Packaging

Clean, conventional Java-team packaging: debhelper compat 14, dh $@ --with javahelper,maven-repo-helper, the library compiled with javac --release 8 into build/orchid.jar and installed by mh_install as /usr/share/java/orchid.jar plus the Maven module; tests compiled and run in the build (with the redundant but harmless nocheck guard), a small autopkgtest, Standards-Version 4.7.4 against Policy 4.7.4.1, no patches, +ds repack documented in README.source. One inaccuracy: debian/pom.xml still declares 2.4.0 while the package is 2.5.1, and the .poms line asserts to maven-repo-helper that the two are the same.

Issues

minor packaging 1. debian/pom.xml declares version 2.4.0 while the package is 2.5.1, and liborchid-java.poms tells maven-repo-helper (--has-package-version) that they are equal ◂
  • Files: debian/pom.xml:7, debian/liborchid-java.poms:1
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/pom.xml: <version>2.4.0</version>; debian/liborchid-java.poms: debian/pom.xml --has-package-version --java-lib --artifact=build/orchid.jar --usj-name=orchid; debian/changelog version 2.5.1+ds-1
  • Problem: maven-repo-helper documents --has-package-version as "to indicate that the original version of the POM is the same as the upstream part of the version for the package" (/usr/share/doc/maven-repo-helper/reference.html), and the upstream part here is 2.5.1, so the flag states something false. mh_installpom(1) installs the POM at the version found in it and mh_installjar's --usj-version defaults to that same version, and the .poms line overrides neither with --set-version or --usj-version; so the Maven module in /usr/share/maven-repo and the versioned jar in /usr/share/java carry the 2.4.0 label for 2.5.1 code, and the hint that maven-repo-helper records for packagers of dependent packages is wrong. Nothing breaks at run time (the versionless /usr/share/java/orchid.jar link is unaffected), so this is metadata accuracy, not a build or policy failure.
  • Fix: Set <version>2.5.1</version> in debian/pom.xml, or add --set-version=2.5.1 --usj-version=2.5.1 to the line in debian/liborchid-java.poms; then --has-package-version is true and the installed Maven metadata matches the code.
Verified ◂
  • Read all of debian/ (control, rules, copyright, changelog, README.source, gbp.conf, salsa-ci.yml, source/format, tests/control, tests/smoke, liborchid-java.docs, liborchid-java.poms, pom.xml, upstream/metadata), the .dsc
  • : the .dsc matches debian/control, and the orig tarball has the expected single top directory.
  • The prescan's author check found no holder missing from debian/copyright; I confirmed the only third-party notices in the tree are the three the copyright file names: Bouncy Castle (src/main/java/com/subgraph/orchid/encoders/*, Expat, header at Base64.java:5-8), jnacl (src/main/java/com/subgraph/orchid/crypto/Curve25519.java:4-5, BSD-2-Clause) and the Gradle wrapper (gradlew:4-18, gradlew.bat:2-16, Apache-2.0), each with matching licence text in the stanzas.
  • Grep of the whole tree (gitignore false) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GPL/LGPL/MPL, Creative Commons/CC BY, public domain, All rights reserved, non-commercial, no modification and share-alike found no notice or licence beyond those above; no file in the tree carries non-free terms.
  • No built artifacts in the tree: glob for jar/class/war/zip/pdf/png/jpg/fonts/dex/apk/pyc found none, and gradle/wrapper/gradle-wrapper.jar is absent, so Files-Excluded and the +ds repack agree with what was shipped.
  • samples/android/app/src/main/res/raw/isrg_root_x1.pem and isrg_root_x2.pem are ISRG (Let's Encrypt) root CA certificates, pinned by samples/android/app/src/main/res/xml/network_security_config.xml and explained in samples/android/README.md and README.md; public trust anchors with no third-party licence to record, and covered by Files: *.
  • No CC BY-SA data is shipped: data/ holds only README, which says Tor's geoip database (CC BY-SA 4.0, made by IPFire) is fetched at run time by tools/update-geoip.sh, and src/main/resources holds only version.properties.
  • src/main/java/com/subgraph/orchid/directory/FallbackDirectoryList.java is generated code, and its header names the generator (tools/gen-fallback-dirs.py, present in the package) and the upstream input (Tor's src/app/config/fallback_dirs.inc), so it is in its preferred form for modification.
  • README.md acknowledges improvements from bitcoinj, peergos and geo-gs; grep for those names finds only two comments (directory/DirectoryServer.java:20, directory/DirectoryServerImpl.java:78) pointing at a commit in the geo-gs fork of Orchid, which is under the same BSD-3 terms; no code under a different notice.
  • gradle/wrapper/gradle-wrapper.properties and samples/android/gradle/wrapper/gradle-wrapper.properties are seven lines of generated wrapper configuration with no notice; I did not treat them as needing their own stanza.
  • The jar debian/rules builds contains the Bouncy Castle and jnacl derived classes; /usr/share/doc/liborchid-java/copyright, installed automatically, reproduces both notices, so the binary-form conditions of Expat and BSD-2-Clause are met.
  • Packaging checks: compat 14 (debhelper 14.5, the recommended level); at compat 14 dh itself skips overrides of dh_auto_test under nocheck, so the ifeq (,$(filter nocheck,...)) in override_dh_auto_test-indep is redundant but not wrong; Standards-Version 4.7.4 is current against Policy 4.7.4.1; --has-package-version and the other .poms options are recognised by mh_install/mh_installjar (/usr/bin/mh_install:82), and mh_install is what the maven_repo_helper sequence adds.
  • The autopkgtest's API calls exist and behave as asserted: ApplicationProperties.getVersion (src/main/java/com/subgraph/orchid/ApplicationProperties.java:60), TorConfigImpl.getSafeLogging with safeLogging = true in the constructor (config/TorConfigImpl.java:40), OrchidSocketFactory.unresolvedAddress returning InetAddress.getByAddress(host, 240.0.0.1) whose toString() begins with the host name (sockets/OrchidSocketFactory.java:97-101).
  • Suggests: tor-geoipdb matches what CountryCodeService searches (/usr/share/tor/geoip among others, geoip/CountryCodeService.java:56-61), and no geoip resource is bundled behind the classpath fallback.
  • uscan found the packaged version as the newest upstream release (upstream 2.5.1, packaged 2.5.1+ds).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
  • I could read the maven-repo-helper man pages and the mh_install/mh_installjar/mh_cleanpom scripts, but not run them, so the exact installed paths for the 2.4.0 issue (orchid-2.4.0.jar, /usr/share/maven-repo/org/mhatta/orchid/2.4.0/) are read off mh_installpom(1) and mh_installjar(1) rather than seen in a build.
  • javahelper is not installed on the reviewing system, so I could not see what jh_depends does when there is no debian/liborchid-java.classpath file (whether ${java:Depends} comes out empty); nothing in debian/ is a javahelper input file, so the --with javahelper may be doing nothing at all.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 day ago.

Review Information

accepted — allocated to mechtilde 7 hours ago, started 7 hours ago, completed 7 hours ago.

Final Comment

Superseded by review of later version

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.5.2+ds-1 79e58a19… 2026-11-07 19:29 2026-11-07 19:30 mechtilde accepted VIEW
2.4.0+ds-1 e97ec33f… 2026-11-07 19:30 2026-11-07 19:30 mechtilde accepted VIEW

Back to Dashboard | View all reviews for this package