DFSG NEW review for php-mock-mockery version 1.5.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The package is a small PHP library (three class files plus tests and CI config) licensed in its entirety under WTFPL version 2, which is DFSG-free. debian/copyright is machine-readable DEP-5, names both actual authors (Markus Malkusch and Michał Bundyra), and reproduces the full WTFPL text, which is required since WTFPL is not in /usr/share/common-licenses. The only 'extra' holder the scan flagged, Sam Hocevar, is the author of the WTFPL licence text itself (the Copyright (C) 2004 Sam Hocevar line inside LICENSE), not a copyright holder of the package's code, and he is already named in the reproduced licence text in debian/copyright.

Packaging

Standard pkg-php-tools packaging using dh-sequence-phpcomposer and debhelper-compat 14 with a plain dh $@. All build dependencies (phpab, php-mockery, php-mock-integration, phpunit, dh-sequence-phpcomposer) exist in the archive. Arch:all with Multi-Arch: foreign is correct for a PHP library, Standards-Version 4.7.4 is current, and an autopkgtest runs the test suite. The rules override builds the autoloader with phpab and runs phpunit; override_dh_auto_test and execute_before_dh_auto_test are correctly skipped by dh in a nocheck build at compat 14, matching the <!nocheck> marking on phpunit and php-mock-integration. No patches, no maintainer scripts to get wrong, and a correct clean file removes the generated autoloaders.

Issues

None.

Verified ◂

• Sam Hocevar is not a missing copyright holder: the scan's line LICENSE:4 is the Copyright (C) 2004 Sam Hocevar <sam@hocevar.net> line that is part of the WTFPL licence document itself, which upstream ships verbatim as LICENSE and which debian/copyright reproduces in full in its License: WTFPL paragraph (line 14). He is therefore already named in debian/copyright.
• No minified/built/preferred-form problems: the only PHP sources are classes/{PHPMockery,MockDisabler,ExpectationProxy}.php and tests/PHPMockeryTest.php, all plain source; classes/autoload.php is generated at build time from these sources by phpab and is not shipped in the source tarball.
• All upstream files carry a WTFPL @license header or are covered by the Files: * stanza (composer.json declares "license": "WTFPL", README.md states the project is WTFPL); the .github/workflows YAML files carry no headers but are covered by the catch-all stanza.
• WTFPL is not a standard short name in copyright-format 7.1, but a non-standard short name with the full text included is acceptable and is the common Debian practice for this licence.
• uscan found the packaged version as the newest upstream release (upstream 1.5.0, packaged 1.5.0).

Not confirmed ◂

None.

Proposed changes ◂

None.