DFSG NEW review for pg-hint-plan-19 version 1.9.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

DFSG-compliant. The package is NTT BSD-3-Clause (COPYRIGHT, copied into the Files: * stanza with its full text), and the three flex-lexer sources (query_scan.l, query_scan.h, query_scan_int.h) carry the PostgreSQL licence, which has its own stanza and full text. Both licences are DFSG-free and mutually compatible, every file is matched by a stanza, and a tree-wide scan found no other licence, restriction or copyright holder. The only defect is that the Debian packaging files are not given their own copyright holder, so Files: * names the wrong entity for debian/*.

Packaging

Good quality. Build-Depends is complete and current (debhelper-compat 13, postgresql-19 and postgresql-server-dev-19 <!nocheck>, postgresql-common-dev, flex, architecture-is-64-bit); the minimal dh $@ --with pgxs_loop rules with PG_SUPPORTED_VERSIONS=19 and the generated debian/control from control.in follow the Debian PostgreSQL team's practice; Vcs-*, Homepage, Standards-Version (4.7.4 against Policy 4.7.4.1, first two components current) and the autopkgtest (installcheck via pg_buildext, hypopg test self-skipping) are all in order; the source tree is clean (flex output query_scan.c removed by debian/clean). The one thing a sponsor would raise is debian/patches/explain, which edits the regression suite's expected output with no DEP-3 header or stated reason.

Issues

1. [minor] [licensing] debian/copyright gives no copyright holder or licence for the Debian packaging (debian/*)

• Files: debian/copyright:5-8, debian/rules, debian/patches/explain
• Evidence: The only stanza that can match debian/* is the catch-all Files: * with Copyright: Copyright (c) 2012-2026, NIPPON TELEGRAPH AND TELEPHONE CORPORATION and License: BSD-3-Clause; there is no Files: debian/* stanza.
• Problem: The catch-all attributes every file, including the work of the Debian maintainers (debian/rules, debian/control, debian/patches/explain, ...), to NTT under BSD-3-Clause. Those files are not NTT's work, so the Copyright field names the wrong holder for this part of the source; the DEP-5 spec shows a Files: debian/* stanza precisely for this case (copyright-format 5.2.1; Policy 4.5, 12.5).
• Fix: Add a Files: debian/* stanza (before or after Files: *) naming the Debian PostgreSQL Maintainers / Christoph Berg as copyright holders and their packaging licence.

2. [minor] [packaging] debian/patches/explain has no DEP-3 header and does not say why it rewrites the test expectations

• Files: debian/patches/explain:1, debian/patches/series:1
• Evidence: The file begins directly with --- a/expected/ut-J.out; there is no Description:, Origin: or Forwarded: field, and the patch only deletes repeated LOG: pg_hint_plan: / used hint: / not used hint: blocks from expected/ut-J.out, ut-S.out and ut-W.out.
• Problem: A patch that changes the regression suite's expected output with no stated reason cannot be judged: it may record a real behavioural difference between upstream's PostgreSQL and Debian's, or hide one. DEP-3 headers are the established way to record what a patch does, where it came from and whether it was forwarded upstream.
• Fix: Add a DEP-3 header (Description plus Origin/Forwarded, and Bug-Debian if applicable) explaining why that LOG output is not produced in the Debian build, forward the change upstream, or drop the patch if it is no longer needed.

Verified

• Read all of debian/ in full: changelog, control, control.in, copyright, rules, pgversions, clean, gitlab-ci.yml, watch (not reviewed), source/format, patches/series and the only patch, tests/control and tests/installcheck, plus the .dsc and both tarballs beside the tree.
• Full tree listing (hidden files included, .pc/ excluded): the unpacked tree matches pg-hint-plan-19_1.9.0.orig.tar.gz (single top directory ossc-db-pg_hint_plan-d41ed23) with nothing added or missing; there is no debian/cargo-checksum.json.
• No built artefact is shipped: no .o/.so/.a/.class/.jar/.pyc/PDF/firmware/archive. The only generated source, query_scan.c, is produced by flex from query_scan.l and is deleted at build time by debian/clean:1.
• Licence scan over the whole tree (Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU, Apache, MPL, public domain, All rights reserved, LGPL, MIT, ISC, zlib, non-commercial, no modification, Creative Commons) found only two licences: NTT BSD-3-Clause (COPYRIGHT, Makefile:4, pg_hint_plan.c:6, docs/conf.py:10, SPECS/pg_hint_plan19.spec:2, docs/locale *.po headers) and the PostgreSQL licence.
• query_scan.l:19-20, query_scan.h:9-10 and query_scan_int.h:13-14 carry Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group / Portions Copyright (c) 1994, Regents of the University of California (the PostgreSQL licence, DFSG-free), matched by the second debian/copyright stanza with the full text; the same text is upstream's COPYRIGHT.postgresql.
• docs/locale/ja/LC_MESSAGES/*.po carry an NTT copyright header and This file is distributed under the same license as the pg_hint_plan package.; the Julien Rouhaud ... 2023 / Tatsuro Yamada ... 2026 lines are gettext translator comments, and the files fall under the Files: * stanza.
• data/data.csv (an integer list) and typedefs.list (a plain list of type names) are upstream plain-text inputs, not generated binaries; docs/requirements.txt is a pip-compile lock file (plain text).
• The prescan's dfsg-author-check reported that all holders named in the tree are declared in debian/copyright (3 declared).
• Build-Depends all resolve in the archive: postgresql-19 (19rc1-1), postgresql-server-dev-19 (19rc1-1), postgresql-common-dev (293; Replaces postgresql-server-dev-all (<< 269) and provides pg_buildext/dh_make_pgxs), debhelper-compat 13, flex, architecture-is-64-bit (provided by architecture-properties).
• postgresql-19-pg-hint-plan is the new binary of this upload (absent from the archive, as expected); the archived sibling postgresql-18-pg-hint-plan (1.8.0-3) shows ${postgresql:Depends}/${postgresql:Breaks} expanding as postgresql-18 / postgresql-18-jit-llvm, so the substitution pattern is sound.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components match, so it is current.
• debian/control omits Testsuite, which is correct: dpkg adds Testsuite: autopkgtest to the .dsc, and it is present there (Policy 5.6.30).
• Tests split is right and self-guarding: debian/tests/installcheck runs pg_buildext installcheck, the ut-* tests LOAD the extension themselves, ut-init.sql uses the contrib extensions btree_gist/btree_gin (shipped by postgresql-19, which Provides postgresql-contrib-19), and sql/hypopg.sql:4-9 quits when hypopg is not installed.
• No maintainer scripts or *.maintscript exist, and none are needed (pure extension package).
• debian/control.in differs from debian/control only by the PGVERSION placeholders (=19), as intended; debian/gitlab-ci.yml and .github/workflows/test.yml are CI configuration that fetch from the network at build/CI time, not instructions to the reader, and nothing in the package asks for a licence or other file to be fetched.
• expected/R_sample.out is not named by the Makefile REGRESS list or by any test (it is a stale upstream file, e.g. it still mentions t1.c1/t2.c1 from an older schema); upstream dead weight, not a packaging defect.
• uscan found the packaged version as the newest upstream release (upstream 1.9.0, packaged 1.9.0).

Not confirmed

• What debian/patches/explain is for. It deletes LOG: pg_hint_plan: used hint:/not used hint: blocks from expected/ut-J.out, ut-S.out and ut-W.out, which means the Debian build is expected not to emit them, but the patch says nothing; only an installcheck against Debian's postgresql-19 would show whether the patch is still needed or masks a real difference.
• Whether --with pgxs_loop resolves to the dh addon: postgresql-common-dev is not installed on the reviewing system, so the addon module could not be read there; it is inferred from postgresql-common-dev's Replaces of postgresql-server-dev-all and from the identical pattern in the archived pg-hint-plan-18 package.
• The -b 19 branch named in Vcs-Git could not be checked against the salsa repository.
• The provenance of the orig tarball (a GitHub archive of commit d41ed23) was not assessed: repacking is checked separately by the watch/uscan program.

Proposed changes

None.