DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: orchid 2.5.2+ds-1

Package Information

DescriptionTor client library written in pure Java

Orchid is an implementation of the Tor client protocol in pure Java, with no native code. It builds circuits through the Tor network, opens streams to exit relays and to version 3 onion services, and can serve as a SOCKS proxy. Applications use it through a SocketFactory or by opening streams directly, and can isolate their streams from each other.

Country codes in node filters (ExcludeNodes and the like) need Tor's geoip database, which the tor-geoipdb package provides.

Orchid is not a replacement for Tor Browser: it provides the Tor protocol, not the protections of a hardened browser.

MaintainerDebian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed ByMasayuki Hatta <mhatta@debian.org>
Sponsormhatta@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/java-team/orchid.git (browse)
Closes#740364
Trackerhttps://tracker.debian.org/pkg/orchid
Uploaded14 hours ago
Supersedes2.5.1+ds-1, 2.4.0+ds-1

New Package Report

.changes◂
Architecturesource all
Distributionunstable
DateSat, 07 Nov 2026 21:18:25 +0900
Sourceorchid
Version2.5.2+ds-1
Changed-ByMasayuki Hatta <mhatta@debian.org>
Changelog◂
orchid (2.5.2+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #740364)
.dsc◂
Priorityoptional
Componentmain
Package-Listliborchid-java deb java optional arch=all
Sectionjava
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Orchid
Upstream-Contact: Masayuki Hatta <mhatta@mhatta.org>
Source: https://github.com/mhatta/Orchid
Files-Excluded:
 gradle/wrapper/gradle-wrapper.jar
Comment:
 The Gradle wrapper jar is a prebuilt binary without source in the
 upstream tree; it is not needed to build the package and is removed from
 the orig tarball (hence the +ds version suffix).  doc/torspec is a git
 submodule and is not part of the upstream release tarballs.
 .
 The files named after "Files: *" below without a notice of their own carry
 no copyright header; LICENSE covers them.  Besides the holders listed,
 other people contributed to Orchid between 2009 and 2017 (see the git
 history); their contributions are under the same license.

Files: *
Copyright: 2009-2018 Bruce Leidl <bruce@subgraph.com>
           2018-2026 Masayuki Hatta <mhatta@mhatta.org>
           2009-2017 Orchid contributors
License: BSD-3-Clause

Files: src/main/java/com/subgraph/orchid/encoders/*
Copyright: 2000-2013 The Legion Of The Bouncy Castle (http://www.bouncycastle.org)
Comment: Derived from org.bouncycastle.util.encoders of the Bouncy Castle
 Crypto APIs for Java, imported upstream in 2013.
License: Expat

Files: src/main/java/com/subgraph/orchid/crypto/Curve25519.java
Copyright: 2011 Neil Alexander T.
License: BSD-2-Clause
Comment: Derived from jnacl
 (https://github.com/neilalexander/jnacl/blob/master/crypto/curve25519.java).

Files: gradlew
       gradlew.bat
Copyright: 2015-2021 the original authors (Gradle)
License: Apache-2.0

Files: debian/*
Copyright: 2026 Masayuki Hatta <mhatta@debian.org>
License: BSD-3-Clause

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
     * Redistributions of source code must retain the above copyright
       notice, this list of conditions and the following disclaimer.
     * Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.
     * Neither the name of the author nor the
       names of its contributors may be used to endorse or promote products
       derived from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: BSD-2-Clause
 Redistribution and use in source and binary forms, with
 or without modification, are permitted provided that the following
 conditions are met:
 .
  - Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
  - Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 13 hours ago.

Report◂

DFSG NEW review for orchid version 2.5.2+ds-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

Every file in the tree is under a permissive, DFSG-free licence: BSD-3-Clause for Orchid's own code (root LICENSE, held by Bruce Leidl, with the fork's and contributors' years added), Expat for the seven Bouncy Castle encoder classes, BSD-2-Clause for crypto/Curve25519.java, and Apache-2.0 for the Gradle wrapper scripts. All are mutually compatible and all are combined in the jar without conflict. debian/copyright is in DEP-5 format, has a stanza for each of those groups plus debian/*, reproduces the full text of the four licences (Apache-2.0 by reference to /usr/share/common-licenses), names every holder that appears in the tree, and its Files-Excluded entry matches the repacked tarball. No file lacks a licence, there is no non-free wording, and no built or unmodifiable file is shipped in place of its source.

Packaging

The packaging is clean and idiomatic for a Java library: debhelper compat 14 with a single dh invocation, javahelper and maven-repo-helper add-ons, a correct Build-Depends/Build-Depends-Indep split with the test-only dependencies marked <!nocheck>, a javac build that produces the dependency-free jar plus a generated POM that mh_install deploys to /usr/share/java and /usr/share/maven-repo, a no-network autopkgtest, Vcs-* fields, an upstream/metadata file and a valid initial changelog. Standards-Version 4.7.4 matches the current Policy (4.7.4.1). Sources import nothing outside the JDK, so nothing is missing from the build dependencies, and the build/test overrides are the correct -indep ones.

Issues

None.

Verified ◂
  • Read all of debian/ in full: control, rules, changelog, copyright, source/format, README.source, gbp.conf, salsa-ci.yml, liborchid-java.poms, liborchid-java.docs, pom.xml.in, tests/control, tests/smoke, upstream/metadata. There are no maintainer scripts, no debian/compat file and no patches (no debian/patches at all); .pc/ was ignored.
  • Enumerated the complete upstream tree (~360 files, matching the scan's 361) and read the root LICENSE. The only third-party-origin code is src/main/java/com/subgraph/orchid/encoders/*.java (7 files, header: Copyright (c) 2000-2013 The Legion Of The Bouncy Castle ... Licensed under the MIT license) and crypto/Curve25519.java (header: Copyright (c) 2011, Neil Alexander T. followed by the 2-clause BSD text); each has its own debian/copyright stanza with matching holder and short name (Expat, BSD-2-Clause).
  • gradlew and gradlew.bat carry SPDX-License-Identifier: Apache-2.0 and a Gradle copyright line; the Files: gradlew / gradlew.bat stanza names the original authors and Apache-2.0, whose full text is referenced in /usr/share/common-licenses/Apache-2.0.
  • The BSD-3-Clause text in debian/copyright is verbatim the same as LICENSE; the Files: * stanza's holders (Bruce Leidl 2009-2018, Masayuki Hatta 2018-2026, Orchid contributors) cover the many units with no header of their own, as its Comment says. The scan reported no holder missing from debian/copyright and I found none.
  • All licences in the jar (BSD-3-Clause, Expat, BSD-2-Clause, Apache-2.0) are permissive and mutually compatible. A keyword sweep for GPL/Affero/CC0/Unlicense/non-commercial/research-only/all-rights-reserved/Licensed under wording found nothing outside LICENSE and debian/copyright (the only hits were hex strings containing 'cc0').
  • samples/android/app/src/main/res/raw/isrg_root_x1.pem and isrg_root_x2.pem are base64 DER ISRG/Let's Encrypt root certificates, referenced by the sample app's network security config; they are certificate data with no copyright notice to carry, present in the source package only, and not third-party program code.
  • The CC BY-SA 4.0 mention in data/README, README.md, tools/update-geoip.sh and CountryCodeService.java is about the IPFire geoip database, which the package does not ship: src/main/resources contains only version.properties, data/geoip is downloaded at run time and is gitignored. test/com/subgraph/orchid/geoip/CountryCodeServiceTest.java says its ranges are made up, so no CC BY-SA data is reproduced.
  • src/main/java/com/subgraph/orchid/directory/FallbackDirectoryList.java is generated by the shipped tools/gen-fallback-dirs.py from Tor's fallback_dirs.inc; its content is factual relay addresses, ports, fingerprints and nicknames (likewise the fingerprints in TrustedAuthorities.java), not a copyrightable work of another party.
  • No built files are in the tree: no jar, class, archive, PDF, image or minified file. The only prebuilt binary, gradle/wrapper/gradle-wrapper.jar, is absent from orchid_2.5.2+ds.orig.tar.xz (checked the archive's member listing), matching Files-Excluded in debian/copyright and debian/README.source; the +ds version suffix and the changelog version agree.
  • Main sources import only java., javax. and their own packages (checked with a negative-lookahead import grep), and test sources only junit, easymock and hamcrest, so the library is dependency-free as claimed, the test classpath in debian/rules is right, and no Build-Depends is missing. junit4, libhamcrest-java, libeasymock-java, libobjenesis-java and libbyte-buddy-java all exist in the archive.
  • debian/rules: compat 14 is declared as debhelper-compat in control; the build and install sequences run arch and indep sub-sequences (verified in /usr/share/perl5/Debian/Debhelper/Sequence/root_sequence.pm), so override_dh_auto_build-indep and override_dh_auto_test-indep do run; dh skips dh_auto_test's override under nocheck at compat 13+, and rules checks it again explicitly. maven-repo-helper's addon (Sequence/maven_repo_helper.pm) inserts mh_install after dh_install, and --java-lib --usj-name=orchid installs /usr/share/java/orchid.jar, as the autopkgtest expects.
  • The autopkgtest smoke script's assertions match the code: TorConfigImpl sets safeLogging = true in its constructor and exposes getSafeLogging(); OrchidSocketFactory.unresolvedAddress returns InetAddress.getByAddress(host, {240,0,0,1}), whose toString() is host/240.0.0.1; the generated POM version is the upstream version, so /usr/share/maven-repo/org/mhatta/orchid//orchid-.pom and the smoke test's grep are consistent.
  • Upstream's Gradle jar task copies LICENSE into META-INF; the Debian-built jar does not, but dh_installdocs installs debian/copyright as /usr/share/doc/liborchid-java/copyright, which contains the BSD-3, Expat and BSD-2 notices, so the notice requirements of those licences are met for the binary package.
  • debian/control: Section java, Architecture all, no over-tight or versioned dependencies, Homepage matches Upstream-Contact/Source, Maintainer address is the one the Java team's packages use (checked against libcommons-io-java), Standards-Version 4.7.4 equals the current Policy 4.7.4.1, Suggests tor-geoipdb matches the library's /usr/share/tor/geoip lookup.
  • debian/changelog: one entry, distribution unstable, urgency medium, syntactically valid date, 2.5.2+ds-1; debian/upstream/metadata has Bug-Database, Bug-Submit, Repository and Repository-Browse; debian/tests/control gives a no-network test with Restrictions: allow-stderr; debian/source/format is 3.0 (quilt) and no patch is needed.
  • uscan found the packaged version as the newest upstream release (upstream 2.5.2, packaged 2.5.2+ds).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
  • Nothing could be built or executed (read-only review, no shell): the build and the autopkgtest are taken as passing, as instructed.
  • The changelog's Closes: #740364 (presumably the orchid ITP) and the existence of the salsa repository in Vcs-Git/Vcs-Browser could not be checked offline.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 13 hours ago.

Review Information

accepted — allocated to mechtilde 7 hours ago, started 7 hours ago, completed 7 hours ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.5.1+ds-1 28968daa… 2026-11-07 19:30 2026-11-07 19:30 mechtilde accepted VIEW
2.4.0+ds-1 e97ec33f… 2026-11-07 19:30 2026-11-07 19:30 mechtilde accepted VIEW

Back to Dashboard | View all reviews for this package