DFSG NEW Queue

DFSG, Licensing & New Packages Team

php-archive-tar 1.6.1-1

Package Information

Description${phppear:summary}

${phppear:description}

MaintainerDebian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed ByDavid Prévot <taffit@debian.org>
Sponsortaffit@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/php-team/pear/php-archive-tar.git (browse)
Trackerhttps://tracker.debian.org/pkg/php-archive-tar
Uploaded3 hours ago

New Package Report

.changes◂
Sourcephp-archive-tar
Version1.6.1-1
Changed-ByDavid Prévot <taffit@debian.org>
Architecturesource all
Distributionunstable
DateSat, 31 Oct 2026 21:04:41 +0100
Changelog◂ 
php-archive-tar (1.6.1-1) unstable; urgency=medium
 .
   * Initial release (php-pear dependency, cf. #1152703)
.dsc◂
Package-Listphp-archive-tar deb php optional arch=all
Sectionphp
Priorityoptional
Componentmain
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Archive_Tar
Upstream-Contact: Vincent Blavet <vincent@phpconcept.net>
Source: https://github.com/pear/Archive_Tar

Files: *
Copyright: 1997-2008 Vincent Blavet <vincent@phpconcept.net>
License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
  * Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 .
  * Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for php-archive-tar version 1.6.1-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: No
  • Issues: 0 blocker, 2 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 10 found

Licensing

The only licence in the tree is 2-clause BSD (Archive/Tar.php:8-29, package.xml's New BSD License, composer.json's BSD-2-Clause), which is DFSG-free; debian/copyright is DEP-5, reproduces the licence text in full, and there are no non-free terms, no licence-less files and no vendored third-party code. The one defect is accuracy: Archive/Tar.php:36 credits 1997-2010 The Authors in addition to 1997-2008 Vincent Blavet, and only Blavet is recorded in the Files: * Copyright field, so the contributors the source itself names as holders are not represented.

Packaging

Modern, mostly conventional PHP packaging: 3.0 (quilt) with a single DEP-3 patch, debhelper compat 14 with %: dh $@, working dh_installchangelogs and execute_before_dh_computeautosubstvars hooks, Vcs-*, Homepage, gbp.conf, a README.source explaining the pregenerated files, and an autopkgtest. Three defects: the binary declares no dependency on anything that provides the PEAR base class Archive_Tar extends, while its Breaks/Replaces make the archive's php-pear (the PEAR.php provider) uninstallable alongside it; both the build and the autopkgtest run phpunit tests, which cannot execute the PHPT suite in tests/ (upstream CI uses pear run-tests), so no test runs at all; and the hand-maintained substvars-static has drifted from debian/control.

Issues

important licensing 1. Files: * omits the copyright holder 1997-2010 The Authors credited in Archive/Tar.php ◂
  • Files: debian/copyright:6-7, Archive/Tar.php:9-11, Archive/Tar.php:36
  • Basis: checked, in the package or with a reference tool
  • Evidence: Archive/Tar.php:36: * @copyright 1997-2010 The Authors; the file's own grant at Archive/Tar.php:9-11: Copyright (c) 1997-2008, / Vincent Blavet <vincent@phpconcept.net>; debian/copyright: Files: * / Copyright: 1997-2008 Vincent Blavet <vincent@phpconcept.net>.
  • Problem: The source names two copyright lines for its only implementation file, but debian/copyright records one holder and the shorter year range. The authors listed in composer.json and package.xml (Greg Beaver, Michiel Rook, Drew Webber) are precisely the contributors the file's The Authors tag refers to, so a holder the file asserts is missing from the copyright file; the review's own author check flags the same line.
  • Fix: Add 1997-2010 The Authors to the Copyright field of the Files: * stanza (or add a Files: Archive/Tar.php stanza after it, which then wins for that file).
important packaging 2. Depends brings in php-common only, but Archive_Tar extends PEAR and loads PEAR.php from php-pear, which this package also Breaks ◂
  • Files: debian/control, debian/php-archive-tar.substvars-static, debian/patches/0001-Break-circular-dependency.patch, debian/tests/control, Archive/Tar.php:44-45, Archive/Tar.php:59
  • Basis: inferred from what was read, not seen directly
  • Evidence: Archive/Tar.php:44-45 if (!class_exists('PEAR')) { / require_once 'PEAR.php'; and :59 class Archive_Tar extends PEAR; substvars-static phpcomposer:Debian-require=php-common, php-common (i.e. Depends: php-common); the patch removes "pear/pear-core-minimal": "^1.10.0alpha2" from composer.json require; debian/tests/control itself adds php-pear. apt-cache show php-common gives Depends: psmisc (>= 22.15-1~) only, while php-pear ships the PEAR base class and Peovides: php-archive-tar, php-console-getopt, php-structures-graph, php-xml-util; php-net-smtp, whose classes also need the PEAR base class, has Depends: php-pear, php-common.
  • Problem: Nothing in the binary's Depends provides /usr/share/php/PEAR.php, so php-archive-tar cannot be loaded on a system without php-pear (PHP dies declaring class Archive_Tar extends PEAR), contrary to Policy 3.5 (each package must depend on the packages it needs). The Breaks: php-pear (<< 1:1.10.18+t)/Replaces make this worse: the only php-pear in the archive is 1:1.10.18+submodules+notgz-1, which sorts below 1:1.10.18+t, so installing this package today forces php-pear (the PEAR.php provider) off the system. The dependency that upstream declares for this, pear/pear-core-minimal (Debian's php-pear), was removed by the patch to break the php-pear cycle, but the package it excuses is still needed.
  • Fix: Depend on the package that ships the PEAR base class (php-pear) and break the planned cycle on php-pear's side instead (e.g. keep the transitional php-pear free of a dependency on php-archive-tar, or move PEAR.php into a separate base package both can depend on). If a php-pear version at or above 1:1.10.18+t that still ships PEAR.php is uploaded at the same time, drop php-pear from Depends only together with that upload and say so in README.source.
minor packaging 3. phpunit tests cannot run the PHPT suite in tests/, so neither the build test nor the autopkgtest executes any test ◂
  • Files: debian/rules, debian/tests/control, tests/big.phpt, tests/dirtraversal.phpt, .github/workflows/build.yml
  • Basis: inferred from what was read, not seen directly
  • Evidence: Every test in tests/ is a PEAR PHPT file starting with --TEST-- (18 of them) and needs a PHPT runner; there is no phpunit.xml and no PHPUnit test class anywhere in the tree; upstream's own CI runs pear run-tests -qr tests/. debian/rules: override_dh_auto_test: / phpunit tests; debian/tests/control: Test-Command: phpunit tests.
  • Problem: PHPUnit only collects PHPUnit test cases, and tests/ contains none, so pointing it at that directory finds nothing to run (PHPUnit's default is not to fail on an empty suite). The 18 PEAR tests, which are the only coverage of extraction, symlink attacks, path traversal and >8G handling, are therefore never executed, and the autopkgtest reports success while testing nothing.
  • Fix: Run the suite with its own runner in both places, e.g. pear run-tests -qr tests/ (php-pear is already in Build-Depends and in tests/control), or install the .phpt files and run them with php-src's run-tests.php; drop phpunit from Build-Depends/tests Depends if nothing else uses it.
minor packaging 4. debian/php-archive-tar.substvars-static has drifted from debian/control: four referenced ${phpcomposer:...} variables are undefined and php-common is listed twice ◂
  • Files: debian/control, debian/php-archive-tar.substvars-static
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/control uses ${phpcomposer:Debian-recommend}, ${phpcomposer:Debian-provide}, ${phpcomposer:Debian-replace} and ${phpcomposer:Debian-conflict}; the static file defines none of them and only has phpcomposer:Debian-require=php-common, php-common.
  • Problem: dpkg-gencontrol warns substitution variable ${...} used, but is not defined for each and substitutes nothing (/usr/share/perl5/Dpkg/Substvars.pm, substvars()), so Recommends and Provides come out empty and Breaks/Replaces are left with dangling empty entries; the duplicated php-common in Depends shows the file no longer matches composer.json after the patch and that the pregenerated data can silently disagree with the packaging.
  • Fix: Regenerate the file with the debian/rules update target (or add the four assignments, empty as appropriate, and drop the four references from debian/control), and remove the duplicate php-common.
Verified ◂
  • Read all of debian/ (control, rules, copyright, changelog, install, docs, clean, gbp.conf, README.source, source/format, source/lintian-overrides, lintian-overrides, tests/control, patches/series and the one patch, upstream/{changelog,metadata}, autoload.php, autoload.php.tpl, archive_tar.reg, php-archive-tar.substvars-static, autoloaders/php-archive-tar, overrides/php-archive-tar) and the whole upstream tree (Archive/Tar.php, docs/Archive_Tar.txt, scripts/phptar.in, all of tests/, package.xml, composer.json, README.md, SECURITY.md, sync-php4, .gitignore, .github/).
  • Licence sweep with grep for Copyright, (C), ©, SPDX-License-Identifier, All rights reserved, BSD/New BSD, Licen[cs]e, GNU, Apache, Mozilla, public domain, Permission is hereby granted, non-commercial, Good, not Evil, Creative Commons over the tree (excluding .pc/ and debian/cargo-checksum.json): notices only in Archive/Tar.php, package.xml (New BSD License) and composer.json (BSD-2-Clause); the GNU hits are the words GNU TAR/GNU ZIP in docs/Archive_Tar.txt. No other holder, no vendored third-party code, no non-free clause.
  • debian/copyright is DEP-5 with the required Format/Upstream-Name/Source header; its BSD-2-clause text is complete (both clauses and the disclaimer) and matches the grant in Archive/Tar.php; the licence is DFSG-free, so no replacement copyright file is proposed.
  • tests/big.tar.bz2 is the >8G-member fixture used by tests/big.phpt; tests/dir_permissions.tar by tests/dir_permissions.phpt; tests/evil_symlink_win.tar by tests/evil_symlink_win.phpt; tests/out_of_path_relative.tar by tests/out_of_path_relative.phpt; tests/out_of_path_symlink.tar by tests/out_of_path_fnames.phpt; tests/relativesymlink.tar by tests/relativesymlink.phpt; tests/testpax.tar by tests/pax.phpt; tests/testperms.tar by tests/permissions.phpt; tests/testsymlink.tar by tests/symlink.phpt and tests/symlink_disallow.phpt. All are required test data, not built artefacts.
  • tests/hamidTARtester2.tar, which the scan could not identify, is the crafted ../../..-traversal archive read by tests/dirtraversal.phpt; it is test data (a tar with an atypical header), not a built program or library.
  • Other test data: tests/testblock1/a.txt and tests/testblock1/bugTriggeringPng.png, tests/testblock2/.gitignore, tests/testblock3/1024bytes.txt and 1024bytes.txt/randombytes.txt, tests/text-0.txt (used by tests/512nbytesfile.phpt and tests/invalidblock.phpt); tests/phpt_test.php.inc and tests/setup.php.inc are the PEAR test harness and its loader, carrying no separate notice.
  • Pregenerated files in debian/ all have their generator and input in the package: debian/archive_tar.reg from pear install package.xml (rules update), debian/autoload.php from phpab over Archive/Tar.php with debian/autoload.php.tpl, debian/upstream/changelog from package.xml; nothing lacks its preferred form for modification.
  • Packaging mechanics checked: debian/source/format 3.0 (quilt); the single patch has DEP-3 headers (From/Date/Subject/Forwarded/Description) and does what its name says; debhelper compat 14 with %: dh $@, and dh_computeautosubstvars (used by the execute_before_ hook) is a real debhelper command (/usr/bin/dh_computeautosubstvars); dh_installchangelogs uses debian/upstream/changelog correctly; changelog is a valid initial unstable upload; Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components equal, not an issue); Vcs-Git/Vcs-Browser/Homepage consistent with gbp.conf; README.source documents the pregenerated-file workflow.
  • debian/autoloaders/php-archive-tar and debian/overrides/php-archive-tar use the same three-field format as the pkg-php-tools data installed on the reviewing system (/usr/share/pkg-php-tools/{autoloaders,overrides}/jsonlint), so installing them under usr/share/pkg-php-tools matches existing practice.
  • Dependency fields for the finding above were checked with apt-cache: php-common 2:102~ (Depends: psmisc (>= 22.15-1~)), php-pear 1:1.10.18+submodules+notgz-1 (Provides: php-archive-tar, php-console-getopt, php-structures-graph, php-xml-util), php-net-smtp (Depends: php-pear, php-common), php-bz2, phpunit.
  • uscan found the packaged version as the newest upstream release (upstream 1.6.1, packaged 1.6.1).
Not confirmed ◂
  • php-common's file list is not available to this review: the missing-dependency finding assumes it does not ship /usr/share/php/PEAR.php. Its control depends only on psmisc and describes itself as common utilities, and php-net-smtp, which likewise needs the PEAR base class, depends on php-pear; if php-common did ship PEAR.php, the issue would reduce to the Breaks/Replaces point.
  • PHPUnit is not installed on the reviewing system, so its handling of tests/ (finding no test case files and exiting with success) was not observed; only the package facts (PHPT-only suite, no phpunit.xml, no PHPUnit test class, upstream CI using pear run-tests) were checked.
Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until , because the review found serious issues.

Back to Dashboard | View all reviews for this package