php-spomky-labs-aes-key-wrap 7.0.0-1

Package Information

Description	${phpcomposer:description} This library provides an implementation of the RFC 3394 (Advanced Encryption Standard (AES) Key Wrap Algorithm) and the RFC 5649 (Advanced Encryption Standard (AES) Key Wrap with Padding Algorithm).
Maintainer	Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed By	David Prévot <taffit@debian.org>
Sponsor	taffit@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/php-team/pear/php-spomky-labs-aes-key-wrap.git (browse)
Tracker	https://tracker.debian.org/pkg/php-spomky-labs-aes-key-wrap
Uploaded	2 hours ago

New Package Report

.changes◂

Date	Sun, 08 Nov 2026 10:50:22 +0100
Source	php-spomky-labs-aes-key-wrap
Version	7.0.0-1
Changed-By	David Prévot <taffit@debian.org>
Architecture	source all
Distribution	unstable

Changelog◂

php-spomky-labs-aes-key-wrap (7.0.0-1) unstable; urgency=medium
 .
   * Initial release (php-web-token-jwt-library build-dependency)

.dsc◂

Section	php
Priority	optional
Component	main
Package-List	php-spomky-labs-aes-key-wrap deb php optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: PHP AES Key Wrap
Source: https://github.com/Spomky-Labs/aes-key-wrap
Upstream-Contact: Florent Morselli <florent.morselli@spomky-labs.com>

Files: *
Copyright: 2014-2016 Spomky-Labs
License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is furnished
 to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for php-spomky-labs-aes-key-wrap version 7.0.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The upstream tree is entirely under the Expat (MIT) licence, which is DFSG-free, and Files: * reproduces its text correctly. The single Files: * stanza, however, attributes every file in the source to Spomky-Labs, 2014-2016, which is wrong for the Debian packaging files written by David Prévot in 2026 (control, rules, changelog, install, clean, gbp.conf, patches, tests/control, ...). No Files: debian/* stanza states their copyright holder. Nothing else in the tree carries a different licence.

Packaging

Standard php-team packaging: debhelper compat 14, dh-sequence-phpcomposer substvars (${phpcomposer:Debian-require} etc.) feeding the binary's Depends/Provides, Architecture: all with Multi-Arch: foreign, a phpab-generated autoloader installed as usr/share/php/AESKW/autoload.php plus its pkg-php-tools mapping, and a minimal, well-formed autopkgtest. The one quilt patch only adapts the test annotations to the PHPUnit 13 API present in unstable, and debhelper skips the test hook/override under nocheck at compat 14. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1. Apart from the copyright gap, I found nothing a sponsor would require changed.

Issues

blocker licensing 1. debian/copyright has no Files: debian/* stanza and attributes the Debian packaging to Spomky-Labs ◂

Files: debian/copyright:5-7, debian/patches/0001-Compatibility-with-recent-PHPUnit-13.patch:1, debian/changelog:5
Basis: checked, in the package or with a reference tool
Evidence: Files: * / Copyright: 2014-2016 Spomky-Labs; the patch is From: =?utf-8?q?David_Pr=C3=A9vot?= <david@tilapin.org> and the changelog trailer is -- David Prévot <taffit@debian.org> Sun, 08 Nov 2026. Per copyright-format 6.9 Files: * matches paths at any depth, including debian/*, and it is the only stanza.
Problem: Every Debian packaging file (debian/control, rules, changelog, install, clean, gbp.conf, README.source, tests/control, upstream/metadata, source/format and the quilt patch) was written by David Prévot in 2026 and is therefore covered by the catch-all stanza with a copyright holder and year that are false for them, and the packaging's own copyright is not stated. That makes debian/copyright an inaccurate description of the copyright in the source (Policy 12.5, copyright-format 5.2/5.3).
Fix: Add a later stanza before the stand-alone licence paragraphs, for example Files: debian/* / Copyright: 2026 David Prévot <taffit@debian.org> / License: Expat (the packaging is already covered by the Expat text in the file).

Verified ◂

Upstream tree read in full (38 files, excluding .pc/): src/ (5 files), tests/ (6), doc/ (3), .github/ (10), plus composer.json, LICENSE, README.md, Makefile and the tooling configs. No file carries a licence notice other than LICENSE (MIT, Copyright (c) 2014-2016 Spomky-Labs) and the $header string in .php_cs.dist (Copyright (c) 2014-2020 Spomky-Labs); the year drift on the latter is minor and both holders are named by Files: *, so no other stanza is needed.
composer.json declares "license": "MIT" and its only required extensions (ext-mbstring, ext-openssl) are the ones src/AESKW.php actually uses (mb_*, openssl_encrypt/decrypt); no embedded third-party code and no vendored library in the tree.
No non-free wording, field-of-use or no-modification term anywhere in the tree (grep for (c), copyright, SPDX-License-Identifier, Licensed under, GPL, Apache, MPL, public domain, All rights reserved found only LICENSE and .php_cs.dist).
No Files-Excluded in debian/copyright, and nothing in the tree is an excluded-orig artifact; the orig tarball's 38 files match the unpacked tree (debian/ aside).
src/autoload.php and vendor/ are not shipped upstream: debian/rules generates them (phpab in override_dh_auto_build, phpab in execute_before_dh_auto_test) and debian/clean removes both plus the two generated templates — no built file lacks its generator input.
tests/*.php are the package's own tests; the RFC 3394/5649 sample vectors they contain come from the RFCs' test vectors, not copied implementation code.
The quilt patch (0001-Compatibility-with-recent-PHPUnit-13.patch) only replaces @test docblocks with #[\PHPUnit\Framework\Attributes\Test]; the system's phpunit is 13.4.5+ds-1 (apt-cache), so the attribute exists. Clear purpose, From/Date/Subject present.
debian/control: compat 14 <debhelper-compat (= 14)>; binary Architecture: all, Multi-Arch: foreign, Depends: ${phpcomposer:Debian-require} and Provides/Breaks/Replaces/Suggests from dh_phpcomposer substvars (correct at compat 14); phpab and phpunit <!nocheck> both exist in unstable (apt-cache), as does php-mbstring; missing ${misc:Depends} is not an issue at compat 14.
Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1 in its first two components; 3.0 (quilt) source format with a single patch applied.
debian/tests/control runs phpab + phpunit against the installed package autoloader with Restrictions: allow-stderr, rw-build-tree, and declares phpab, phpunit and pkg-php-tools, matching its Test-Command; @ includes the package itself.
debian/install puts the built src/ tree at usr/share/php/AESKW and the mapping file at usr/share/pkg-php-tools/autoloaders/, whose content spomky-labs aes-key-wrap AESKW/autoload.php matches composer name spomky-labs/aes-key-wrap (cf. the reference mapping /usr/share/pkg-php-tools/autoloaders/jsonlint).
uscan found the packaged version as the newest upstream release (upstream 7.0.0, packaged 7.0.0).

Not confirmed ◂

The autoloader mapping file is named debian/autoloaders/spomky-labs-pki-aes-key-wrap, with a pki component that matches nothing in this package (composer package is aes-key-wrap). I could not determine how pkg-php-tools keys these files — pkg-php-tools is not installed on the reviewing system (no man page, no /usr/share/doc/pkg-php-tools), so I could not read the reader. If lookup is by content the name is harmless; if it is by file name, autoload resolution of spomky-labs/aes-key-wrap (used by the autopkgtest) would miss it. Renaming it to debian/autoloaders/spomky-labs-aes-key-wrap costs nothing.
Tests and build were not run (read-only review).

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-09 18:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package