php-async-aws-kms 1.12.1-1

Package Information

Description	AsyncAws Kms - AsyncAws component ${phpcomposer:description}. API client for KMS. AsyncAws is a wrapper around Symfony's HTTP client and makes sure the asynchronous features are properly used. AsyncAws also handles authentication, exceptions and provide input and result objects.
Maintainer	Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed By	David Prévot <taffit@debian.org>
Sponsor	taffit@debian.org
Distribution	experimental
Architecture	all
VCS	git: https://salsa.debian.org/php-team/pear/php-async-aws-kms.git (browse)
Tracker	https://tracker.debian.org/pkg/php-async-aws-kms
Uploaded	2 hours ago

New Package Report

.changes◂

Date	Wed, 04 Nov 2026 17:38:24 +0100
Source	php-async-aws-kms
Version	1.12.1-1
Changed-By	David Prévot <taffit@debian.org>
Architecture	source all
Distribution	experimental

Changelog◂

php-async-aws-kms (1.12.1-1) experimental; urgency=medium
 .
   * Initial release (new symfony dependency)

.dsc◂

Component	main
Package-List	php-async-aws-kms deb php optional arch=all
Section	php
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: AsyncAws Kms
Source: https://github.com/async-aws/kms
Upstream-Contact: Jérémy Derussé <jeremy@derusse.com>

Files: *
Copyright: 2021 Jérémy Derussé
           2021 Tobias Nyholm
License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is furnished
 to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for php-async-aws-kms version 1.12.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The upstream tree is uniformly MIT/Expat licensed: LICENSE is the MIT text naming Jérémy Derussé and Tobias Nyholm, debian/copyright reproduces the same terms verbatim as License: Expat, and no file carries a different or non-free notice. The copyright file is DEP-5 and correct for upstream, but its single Files: * stanza also covers debian/, crediting the packaging (written by David Prévot in 2026) to the two 2021 upstream authors, so it does not accurately describe every file.

Packaging

Standard php-team packaging: debhelper compat 14 with dh-sequence-phpcomposer, test-only build dependencies marked <!nocheck> (dh skips override_dh_auto_test for nocheck at this level), generated autoload files made in override_dh_auto_build and removed via debian/clean, ${phpcomposer:*} substvars, Multi-Arch: foreign for an arch:all library, Vcs-*/Homepage/upstream metadata present, Standards-Version 4.7.4 (Policy 4.7.4.1), and an autopkgtest that runs only the mock-based unit suite. All build dependencies exist in the archive.

Issues

important licensing 1. debian/copyright has no stanza for debian/* and credits the packaging to the upstream authors ◂

Files: debian/copyright:6-9, debian/changelog:5, debian/control:4
Basis: checked, in the package or with a reference tool
Evidence: Files: * / Copyright: 2021 Jérémy Derussé / 2021 Tobias Nyholm, while the packaging is -- David Prévot <taffit@debian.org> Wed, 04 Nov 2026 (debian/changelog:5) and Uploaders: David Prévot <taffit@debian.org> (debian/control:4).
Problem: The catch-all stanza is the only one in the file and names only the two upstream authors with 2021, so every packaging file (debian/rules, control, changelog, install, clean, gbp.conf, README.source, tests/control, upstream/metadata) is declared to be upstream's copyright. That is inaccurate: Policy 12.5 requires debian/copyright to carry the package's copyright information, and copyright-format 5.2 expects a stanza for Debian's own files when their holder differs from the upstream one.

Fix:

Add a stanza after Files: *:

Files: debian/*
Copyright: 2026 David Prévot <taffit@debian.org>
License: Expat

Verified ◂

Prescan item (copyright holders): the only copyright notice outside debian/ is LICENSE:3 Copyright (c) 2021 Jérémy Derussé, Tobias Nyholm, which the Files: * stanza names; a tree-wide grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby/GNU .../Apache License/Mozilla Public/public domain/All rights reserved matched only LICENSE and debian/copyright, so no holder is missing.
LICENSE is plain MIT (Expat); the Expat paragraph in debian/copyright reproduces its terms and the notice verbatim, so no /usr/share/common-licenses reference is needed.
No DFSG problem found: grep for non-commercial/no-derivative/field-of-use wording and for "generated/do not edit" markers returned nothing; debian/copyright is DEP-5 with the correct Format line and no Files-Excluded is needed (the unpacked tree matches the .orig tarball, both containing LICENSE, Makefile, tests/, .github/ and .gitattributes).
No vendored or embedded third-party code: the whole tree is 96 files, src/ imports only AsyncAws\Core (php-async-aws-core), the tests use Symfony\Component\HttpClient\MockHttpClient from that package's dependencies, and there is no LICENSE/COPYING/NOTICE/AUTHORS file besides the top-level LICENSE.
No binary, font, image or minified files; the only generated files (src/autoload.php, vendor/autoload.php, debian/autoload*.tpl) are created by debian/rules and removed through debian/clean, and none is present in the unpacked tree.
The docblock URLs under src/ point at AWS documentation as references in comments; they are not copyright or licence notices.
Packaging read in full: control (compat 14 via debhelper-compat, dh-sequence-phpcomposer, ${phpcomposer:Debian-require/suggest/replace/conflict/provide}, M-A foreign, Section php), rules, changelog (1.12.1-1, experimental, initial release), install (src/* to /usr/share/php/AsyncAws/Kms), clean, source/format (3.0 quilt, no patches so no DEP-3 review), tests/control (allow-stderr, rw-build-tree, only tests/Unit, MockHttpClient so no network), gbp.conf, README.source, upstream/metadata.
All build dependencies resolve in the archive: php-async-aws-core 1.30.0-1, php-symfony-error-handler and php-symfony-phpunit-bridge 7.4.22/8.1.10, phpunit 13.4.5, phpab 1.29.4, pkg-php-tools 1.50 (which Provides dh-sequence-phpcomposer).
Standards-Version 4.7.4 has the same first two components as the reviewing system's Policy 4.7.4.1, and the test-only Build-Depends are correctly marked <!nocheck> since dh skips override_dh_auto_test for nocheck at compat 14.
tests/Integration/KmsClientTest.php needs a running localstack container (Makefile) and is deliberately not part of the build or autopkgtest test command, which run only phpunit tests/Unit.
uscan found the packaged version as the newest upstream release (upstream 1.12.1, packaged 1.12.1).

Not confirmed ◂

pkg-php-tools is not installed on the reviewing system, so I could not read dh_phpcomposer/phpabtpl and confirm that the phpabtpl --require async-aws/kms in debian/tests/control resolves against the installed package; the package is assumed to build and its tests to pass.
Upstream composer.json pins phpunit ^11.5.42 while the archive has 13.4.5; the unit tests use the ordinary PHPUnit and Symfony-bridge API, so I expect them to run unchanged, but I could not execute them.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-06 18:03 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package