Review: orchid 2.5.2+ds-1
Package Information
| Description | Tor client library written in pure Java Orchid is an implementation of the Tor client protocol in pure Java, with no native code. It builds circuits through the Tor network, opens streams to exit relays and to version 3 onion services, and can serve as a SOCKS proxy. Applications use it through a SocketFactory or by opening streams directly, and can isolate their streams from each other. Country codes in node filters (ExcludeNodes and the like) need Tor's geoip database, which the tor-geoipdb package provides. Orchid is not a replacement for Tor Browser: it provides the Tor protocol, not the protections of a hardened browser. |
|---|---|
| Maintainer | Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> |
| Changed By | Masayuki Hatta <mhatta@debian.org> |
| Sponsor | mhatta@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/java-team/orchid.git (browse) |
| Closes | #740364 |
| Tracker | https://tracker.debian.org/pkg/orchid |
| Uploaded | 14 hours ago |
| Supersedes | 2.5.1+ds-1, 2.4.0+ds-1 |
New Package Report
.changes
| Architecture | source all |
|---|---|
| Distribution | unstable |
| Date | Sat, 07 Nov 2026 21:18:25 +0900 |
| Source | orchid |
| Version | 2.5.2+ds-1 |
| Changed-By | Masayuki Hatta <mhatta@debian.org> |
Changelog
orchid (2.5.2+ds-1) unstable; urgency=medium . * Initial release. (Closes: #740364)
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | liborchid-java deb java optional arch=all |
| Section | java |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Orchid
Upstream-Contact: Masayuki Hatta <mhatta@mhatta.org>
Source: https://github.com/mhatta/Orchid
Files-Excluded:
gradle/wrapper/gradle-wrapper.jar
Comment:
The Gradle wrapper jar is a prebuilt binary without source in the
upstream tree; it is not needed to build the package and is removed from
the orig tarball (hence the +ds version suffix). doc/torspec is a git
submodule and is not part of the upstream release tarballs.
.
The files named after "Files: *" below without a notice of their own carry
no copyright header; LICENSE covers them. Besides the holders listed,
other people contributed to Orchid between 2009 and 2017 (see the git
history); their contributions are under the same license.
Files: *
Copyright: 2009-2018 Bruce Leidl <bruce@subgraph.com>
2018-2026 Masayuki Hatta <mhatta@mhatta.org>
2009-2017 Orchid contributors
License: BSD-3-Clause
Files: src/main/java/com/subgraph/orchid/encoders/*
Copyright: 2000-2013 The Legion Of The Bouncy Castle (http://www.bouncycastle.org)
Comment: Derived from org.bouncycastle.util.encoders of the Bouncy Castle
Crypto APIs for Java, imported upstream in 2013.
License: Expat
Files: src/main/java/com/subgraph/orchid/crypto/Curve25519.java
Copyright: 2011 Neil Alexander T.
License: BSD-2-Clause
Comment: Derived from jnacl
(https://github.com/neilalexander/jnacl/blob/master/crypto/curve25519.java).
Files: gradlew
gradlew.bat
Copyright: 2015-2021 the original authors (Gradle)
License: Apache-2.0
Files: debian/*
Copyright: 2026 Masayuki Hatta <mhatta@debian.org>
License: BSD-3-Clause
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
* Neither the name of the author nor the
names of its contributors may be used to endorse or promote products
derived from this software without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: BSD-2-Clause
Redistribution and use in source and binary forms, with
or without modification, are permitted provided that the following
conditions are met:
.
- Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
https://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License, Version 2.0
can be found in "/usr/share/common-licenses/Apache-2.0".
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 13 hours ago.
Report
DFSG NEW review for orchid version 2.5.2+ds-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
Every file in the tree is under a permissive, DFSG-free licence: BSD-3-Clause for Orchid's own code (root LICENSE, held by Bruce Leidl, with the fork's and contributors' years added), Expat for the seven Bouncy Castle encoder classes, BSD-2-Clause for crypto/Curve25519.java, and Apache-2.0 for the Gradle wrapper scripts. All are mutually compatible and all are combined in the jar without conflict. debian/copyright is in DEP-5 format, has a stanza for each of those groups plus debian/*, reproduces the full text of the four licences (Apache-2.0 by reference to /usr/share/common-licenses), names every holder that appears in the tree, and its Files-Excluded entry matches the repacked tarball. No file lacks a licence, there is no non-free wording, and no built or unmodifiable file is shipped in place of its source.
Packaging
The packaging is clean and idiomatic for a Java library: debhelper compat 14 with a single dh invocation, javahelper and maven-repo-helper add-ons, a correct Build-Depends/Build-Depends-Indep split with the test-only dependencies marked <!nocheck>, a javac build that produces the dependency-free jar plus a generated POM that mh_install deploys to /usr/share/java and /usr/share/maven-repo, a no-network autopkgtest, Vcs-* fields, an upstream/metadata file and a valid initial changelog. Standards-Version 4.7.4 matches the current Policy (4.7.4.1). Sources import nothing outside the JDK, so nothing is missing from the build dependencies, and the build/test overrides are the correct -indep ones.
Issues
None.
Verified ◂
- Read all of debian/ in full: control, rules, changelog, copyright, source/format, README.source, gbp.conf, salsa-ci.yml, liborchid-java.poms, liborchid-java.docs, pom.xml.in, tests/control, tests/smoke, upstream/metadata. There are no maintainer scripts, no debian/compat file and no patches (no debian/patches at all); .pc/ was ignored.
- Enumerated the complete upstream tree (~360 files, matching the scan's 361) and read the root LICENSE. The only third-party-origin code is src/main/java/com/subgraph/orchid/encoders/*.java (7 files, header:
Copyright (c) 2000-2013 The Legion Of The Bouncy Castle ... Licensed under the MIT license) and crypto/Curve25519.java (header:Copyright (c) 2011, Neil Alexander T.followed by the 2-clause BSD text); each has its own debian/copyright stanza with matching holder and short name (Expat, BSD-2-Clause). - gradlew and gradlew.bat carry
SPDX-License-Identifier: Apache-2.0and a Gradle copyright line; theFiles: gradlew/gradlew.batstanza names the original authors and Apache-2.0, whose full text is referenced in /usr/share/common-licenses/Apache-2.0. - The BSD-3-Clause text in debian/copyright is verbatim the same as LICENSE; the Files: * stanza's holders (Bruce Leidl 2009-2018, Masayuki Hatta 2018-2026, Orchid contributors) cover the many units with no header of their own, as its Comment says. The scan reported no holder missing from debian/copyright and I found none.
- All licences in the jar (BSD-3-Clause, Expat, BSD-2-Clause, Apache-2.0) are permissive and mutually compatible. A keyword sweep for GPL/Affero/CC0/Unlicense/non-commercial/research-only/all-rights-reserved/
Licensed underwording found nothing outside LICENSE and debian/copyright (the only hits were hex strings containing 'cc0'). - samples/android/app/src/main/res/raw/isrg_root_x1.pem and isrg_root_x2.pem are base64 DER ISRG/Let's Encrypt root certificates, referenced by the sample app's network security config; they are certificate data with no copyright notice to carry, present in the source package only, and not third-party program code.
- The CC BY-SA 4.0 mention in data/README, README.md, tools/update-geoip.sh and CountryCodeService.java is about the IPFire geoip database, which the package does not ship: src/main/resources contains only version.properties, data/geoip is downloaded at run time and is gitignored. test/com/subgraph/orchid/geoip/CountryCodeServiceTest.java says its ranges
are made up, so no CC BY-SA data is reproduced. - src/main/java/com/subgraph/orchid/directory/FallbackDirectoryList.java is generated by the shipped tools/gen-fallback-dirs.py from Tor's fallback_dirs.inc; its content is factual relay addresses, ports, fingerprints and nicknames (likewise the fingerprints in TrustedAuthorities.java), not a copyrightable work of another party.
- No built files are in the tree: no jar, class, archive, PDF, image or minified file. The only prebuilt binary, gradle/wrapper/gradle-wrapper.jar, is absent from orchid_2.5.2+ds.orig.tar.xz (checked the archive's member listing), matching Files-Excluded in debian/copyright and debian/README.source; the +ds version suffix and the changelog version agree.
- Main sources import only java., javax. and their own packages (checked with a negative-lookahead import grep), and test sources only junit, easymock and hamcrest, so the library is dependency-free as claimed, the test classpath in debian/rules is right, and no Build-Depends is missing. junit4, libhamcrest-java, libeasymock-java, libobjenesis-java and libbyte-buddy-java all exist in the archive.
- debian/rules: compat 14 is declared as debhelper-compat in control; the
buildandinstallsequences run arch and indep sub-sequences (verified in /usr/share/perl5/Debian/Debhelper/Sequence/root_sequence.pm), so override_dh_auto_build-indep and override_dh_auto_test-indep do run; dh skips dh_auto_test's override undernocheckat compat 13+, and rules checks it again explicitly. maven-repo-helper's addon (Sequence/maven_repo_helper.pm) inserts mh_install after dh_install, and--java-lib --usj-name=orchidinstalls /usr/share/java/orchid.jar, as the autopkgtest expects. - The autopkgtest smoke script's assertions match the code: TorConfigImpl sets
safeLogging = truein its constructor and exposes getSafeLogging(); OrchidSocketFactory.unresolvedAddress returns InetAddress.getByAddress(host, {240,0,0,1}), whose toString() ishost/240.0.0.1; the generated POM version is the upstream version, so /usr/share/maven-repo/org/mhatta/orchid//orchid-.pom and the smoke test's grep are consistent. - Upstream's Gradle jar task copies LICENSE into META-INF; the Debian-built jar does not, but dh_installdocs installs debian/copyright as /usr/share/doc/liborchid-java/copyright, which contains the BSD-3, Expat and BSD-2 notices, so the notice requirements of those licences are met for the binary package.
- debian/control: Section java, Architecture all, no over-tight or versioned dependencies, Homepage matches Upstream-Contact/Source, Maintainer address is the one the Java team's packages use (checked against libcommons-io-java), Standards-Version 4.7.4 equals the current Policy 4.7.4.1, Suggests tor-geoipdb matches the library's /usr/share/tor/geoip lookup.
- debian/changelog: one entry, distribution unstable, urgency medium, syntactically valid date,
2.5.2+ds-1; debian/upstream/metadata has Bug-Database, Bug-Submit, Repository and Repository-Browse; debian/tests/control gives a no-network test with Restrictions: allow-stderr; debian/source/format is 3.0 (quilt) and no patch is needed. - uscan found the packaged version as the newest upstream release (upstream
2.5.2, packaged2.5.2+ds). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- Nothing could be built or executed (read-only review, no shell): the build and the autopkgtest are taken as passing, as instructed.
- The changelog's
Closes: #740364(presumably the orchid ITP) and the existence of the salsa repository in Vcs-Git/Vcs-Browser could not be checked offline.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 13 hours ago.
Review Information
accepted — allocated to mechtilde 7 hours ago, started 7 hours ago, completed 7 hours ago.