Review: php-spomky-labs-pki-framework 1.6.3-1

Package Information

Description	PKI Framework ${phpcomposer:description}.
Maintainer	Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed By	David Prévot <taffit@debian.org>
Sponsor	taffit@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/php-team/pear/php-spomky-labs-pki-framework.git (browse)
Tracker	https://tracker.debian.org/pkg/php-spomky-labs-pki-framework
Uploaded	2 hours ago

New Package Report

.changes◂

Date	Sun, 08 Nov 2026 10:50:22 +0100
Source	php-spomky-labs-pki-framework
Version	1.6.3-1
Changed-By	David Prévot <taffit@debian.org>
Architecture	source all
Distribution	unstable

Changelog◂

php-spomky-labs-pki-framework (1.6.3-1) unstable; urgency=medium
 .
   * Initial release (php-web-token-jwt-library dependency)

.dsc◂

Section	php
Priority	optional
Component	main
Package-List	php-spomky-labs-pki-framework deb php optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: PKI Framework
Source: https://github.com/Spomky-Labs/pki-framework
Upstream-Contact: Florent Morselli <florent.morselli@spomky-labs.com>

Files: *
Copyright: 2016-2019 Joni Eskelinen
           2022 Spomky-Labs
License: Expat

Files: tests/assets/cacert.pem
Copyright: 2015 Mozilla Foundation
License: MPL-2.0

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is furnished
 to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: MPL-2.0
 On Debian systems, the full text of the Mozilla Public License Version 2.0
 can be found in the file `/usr/share/common-licenses/MPL-2.0'.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for php-spomky-labs-pki-framework version 1.6.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The package is DFSG-compliant. debian/copyright is DEP-5 with the correct Format URL; its Files: * stanza (Expat) names exactly the two holders of the upstream LICENSE (2016-2019 Joni Eskelinen, 2022 Spomky-Labs), and the single file with different terms, tests/assets/cacert.pem (the Mozilla CA bundle, MPL-2.0), has its own stanza pointing at /usr/share/common-licenses/MPL-2.0, which exists. A tree-wide search for copyright and licence wording found no other notice: all source, tests, configuration files and the packaging are covered by the MIT text reproduced in the file. Everything shipped is source (PHP, Markdown, YAML/NEON config) plus openssl-generated test keys and certificates; no built artefacts, no minified code, no non-free terms, no third-party code that would need a separate notice.

Packaging

Packaging is sound and follows pkg-php-tools practice: debhelper compat 14 (provided by debhelper 14.5) with dh-sequence-phpcomposer from pkg-php-tools 1.50; Build-Depends matches composer.json's requires (brick/math via php-brick-math, ext-mbstring via phpunit) and marks test-only dependencies <!nocheck>, which dh honours because it skips the dh_auto_test hook and override at compat 13 and later; a generated src/autoload.php plus the /usr/share/pkg-php-tools/autoloaders entry are installed at the right paths; the single quilt patch is DEP-3 complete and points at its upstream commit; an autopkgtest exists; Standards-Version 4.7.4 corresponds to the reviewing system's Policy 4.7.4.1. Changelog, source format and gbp configuration are consistent with the tarballs.

Issues

None.

Verified ◂

Read in full: debian/control, rules, changelog, copyright, install, clean, gbp.conf, README.source, source/format, tests/control, patches/series, patches/0001-fix-x509-fix-PHP-8.6-deprecation-of-spl_object_hash.patch, autoloaders/spomky-labs-pki-framework, upstream/metadata, and the package's LICENSE, composer.json, README.md and phpunit.xml.dist.
The prescan reported no holder missing from debian/copyright (3 declared authors, all holders named); I re-checked against LICENSE and composer.json: both list Joni Eskelinen (original developer) and Spomky-Labs, matching Files: *.
Case-insensitive tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU/GNU Lesser General Public, Apache License, Mozilla Public, public domain, All rights reserved matched only LICENSE, README.md (licence section), composer.json ("license": "MIT"), debian/copyright, and unrelated (b)(c) RFC-step comments in src/X509/CertificationPath/PathValidation/PathValidator.php. No PHP file carries an @author, @license or third-party header; no src file references another project.
tests/assets/cacert.pem is the standard Mozilla CA bundle (## Certificate data from Mozilla as of: Wed Apr 20 03:12:05 2016, ## Conversion done with mk-ca-bundle.pl version 1.25), i.e. test data whose MPL-2.0 stanza and common-licenses pointer are correct; the stated 2015 year is minor drift.
tests/assets/ac/acme-ac.pem, tests/assets/certs/{certs,keys,.csr,.sig}, ec/, rsa/, rfc8410/ and public_key.pem are openssl-generated test keys, certificates and signatures (tests/assets/ac/make-ac.php, tests/assets/rsa/README.md documents the openssl commands used): test data with no copyrightable text; the binary PEM/DER/SIG material was recorded, not opened.
CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, .github/, ecs.php, rector.php, phpstan.neon, phpstan-baseline.neon, Makefile, .editorconfig, .gitattributes and .gitignore fall in the Files: * MIT stanza. CODE_OF_CONDUCT.md states it is adapted from the Contributor Covenant, version 1.4, and carries that attribution; that text is published under a free Creative Commons Attribution licence, so it raises no DFSG problem. debian/copyright has no separate Files: debian/* stanza; Files: * covers the packaging files, which contain no notices.
No built files in the tree: src/autoload.php is generated by phpab in override_dh_auto_build and removed by debian/clean; phpstan-baseline.neon is a checked-in configuration file, not a compiled artefact.
Orig tarball contains the whole upstream tree including tests/ and .gitattributes (consistent with README.source: the signed tag, not the tests-less tarball, is imported); the debian tarball adds only debian/.
Build dependency check: debhelper 14.5 Provides debhelper-compat (= 14); pkg-php-tools 1.50 Provides dh-sequence-phpcomposer and ships phpabtpl; phpab, phpunit 13.4.5 (which itself Depends on php-mbstring), php-brick-math (0.14.8 and 1.0.0), php-xdebug, php-intl, php-bcmath, php-gmp, ca-certificates and openssl all exist in the archive lists, so nothing in Build-Depends or debian/tests/control is missing; the test-only ones are correctly marked <!nocheck>.
debian/autoloaders/spomky-labs-pki-framework uses the three-field format of installed autoloader entries (compare /usr/share/pkg-php-tools/autoloaders/jsonlint: seld jsonlint Seld/JsonLint/autoload.php), and debian/autoloaders usr/share/pkg-php-tools lands it as /usr/share/pkg-php-tools/autoloaders/… per dh_install(1) EXAMPLES (plugins usr/share/my-prog installs as usr/share/my-prog/plugins/); src/* installs the namespace tree under /usr/share/php/SpomkyLabs/Pki, matching the autoloader path and the sed in rules.
Patch 0001 has DEP-3 headers (From, Date, Subject, Origin with the upstream commit URL, Bug) and is listed in series; it is already upstream, which the Origin field records. Standards-Version 4.7.4 against Policy 4.7.4.1 (same 4.7), so current.
At compat 14 dh does not run execute_before_dh_auto_test or override_dh_auto_test under DEB_BUILD_OPTIONS=nocheck, so the phpunit run and its setup are correctly guarded; the autopkgtest declares rw-build-tree for the vendor/ and debian/*.tpl scratch files its Test-Command writes, and its dependencies include the explicitly needed phpab and pkg-php-tools (php-brick-math and php-mbstring come in through the binary package's Depends and @).
No maintainer scripts, no .maintscript, no binary package split, Architecture: all with Multi-Arch: foreign consistent with the other pkg-php-pear packages (php-brick-math), no missing ${misc:Depends} problems.
uscan found the packaged version as the newest upstream release (upstream 1.6.3, packaged 1.6.3).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (MPL-2.0).

Not confirmed ◂

The build, the PHPUnit run and the autopkgtest were not executed (read-only review); no missing dependency, path or generated file was found that would make them fail in a clean chroot.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Review Information

accepted — allocated to mechtilde 1 hour ago, started 1 hour ago, completed 1 hour ago.

Final Comment

Back to Dashboard | View all reviews for this package