Review: php-web-token-jwt-framework 4.2.5-1

Package Information

Description	${phpcomposer:description} Core library of the JWT Framework. JWT Framework is a complete implementation of the JOSE (JSON Object Signing and Encryption) specifications, providing robust tools for creating, signing, encrypting, and validating JSON Web Tokens.
Maintainer	Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed By	David Prévot <taffit@debian.org>
Sponsor	taffit@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/php-team/pear/php-web-token-jwt-framework.git (browse)
Tracker	https://tracker.debian.org/pkg/php-web-token-jwt-framework
Uploaded	2 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Sun, 08 Nov 2026 14:57:00 +0100
Source	php-web-token-jwt-framework
Version	4.2.5-1
Changed-By	David Prévot <taffit@debian.org>
Architecture	source all

Changelog◂

php-web-token-jwt-framework (4.2.5-1) unstable; urgency=medium
 .
   * Initial release (Symfony build-dependency)

.dsc◂

Section	php
Priority	optional
Component	main
Package-List	php-web-token-jwt-library deb php optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: JWT Framework
Upstream-Contact: Florent Morselli <https://github.com/Spomky>
Source: https://github.com/web-token/jwt-framework

Files: *
Copyright: 2014-2024 Spomky-Labs
           2012 Matyas Danter
           2016-2022 Paragon Initiative Enterprises.
           2014 Steve "Sc00bz" Thomas <steve@tobtu.com>
License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
 THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for php-web-token-jwt-framework version 4.2.5-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 12 found

Licensing

All upstream files are under the Expat (MIT) licence. The four holders named in file notices (Spomky-Labs; 2012 Matyas Danter for src/Library/Core/Util/Ecc/; Paragon Initiative Enterprises and Steve "Sc00bz" Thomas for src/Library/Core/Util/Base64UrlSafe.php) are all listed, the licence text is reproduced in full, and no non-free or missing-licence wording exists in the tree. debian/copyright is DEP-5 with the correct Format URL. The one gap is that it has no stanza for debian/, so the Debian packaging is attributed to upstream.

Packaging

Standard PHP-team packaging: debhelper compat 14 with dh-sequence-phpcomposer, one arch:all Multi-Arch: foreign binary, a build-dependency layout that matches what rules and the tests use, no patches, an autopkgtest with rw-build-tree, and a sane initial changelog; Standards-Version 4.7.4 against Policy 4.7.4.1 is current. The only real defect is an undeclared runtime dependency of the shipped JKU/X5U code on php-symfony-cache.

Issues

minor licensing 1. debian/copyright has no debian/* stanza, so the Debian packaging is attributed to Spomky-Labs ◂

Files: debian/copyright:6-9, debian/changelog:5
Basis: checked, in the package or with a reference tool

Evidence:

Files: *
Copyright: 2014-2024 Spomky-Labs
           2012 Matyas Danter
           2016-2022 Paragon Initiative Enterprises.
           2014 Steve "Sc00bz" Thomas <steve@tobtu.com>

Problem: In DEP-5 a Files pattern is matched at every depth (* also matches /), so this catch-all paragraph covers debian/rules, debian/control and the rest of the packaging as well. Those files were written by the uploader (David Prévot, debian/changelog), not by Spomky-Labs, so the copyright statement is wrong for them. Policy 12.5 requires the copyright file to carry the package's copyright information; the usual machine-readable layout has a separate Files: debian/* paragraph. Nothing here affects DFSG compliance.
Fix: Add a Files: debian/* paragraph after the catch-all one: Copyright: 2026 David Prévot <taffit@debian.org> and License: Expat (matching the packaging licence used in the PHP team's other packages).

minor packaging 2. php-web-token-jwt-library does not depend on php-symfony-cache/php-psr-cache although shipped UrlKeySetFactory needs them ◂

Files: src/Library/KeyManagement/UrlKeySetFactory.php:7-10,23, src/Library/KeyManagement/JKUFactory.php:11, debian/control:24-27, src/Library/composer.json:44-49
Basis: checked, in the package or with a reference tool

Evidence:

use Psr\Cache\CacheItemPoolInterface;
use Symfony\Component\Cache\Adapter\NullAdapter;
...
        $this->cacheItemPool = new NullAdapter();

Problem: The installed class instantiates Symfony's NullAdapter unconditionally in its constructor, so new JKUFactory($client) and new X5UFactory($client) (and the bundle's jku_source/x5u services) fail with "Class "Symfony\Component\Cache\Adapter\NullAdapter" not found" unless php-symfony-cache is present. Depends/Suggests are generated from src/Library/composer.json, which lists neither psr/cache nor symfony/cache; its only relevant entry is "symfony/http-client": "To enable JKU/X5U support." in suggest, and apt-cache shows php-symfony-http-client does not pull php-symfony-cache. So the advertised JKU/X5U feature breaks on an otherwise complete installation.
Fix: Add php-symfony-cache (which Depends php-psr-cache) to the binary package's Depends, or at least to Recommends; the generated Suggests: php-symfony-http-client alone is not enough for the feature it advertises. Forward the incomplete require/suggest section of src/Library/composer.json upstream.

Verified ◂

Whole tree scanned (gitignore false; .pc/ and debian/cargo-checksum.json absent) for Copyright/(C)/©/SPDX/Licensed under/MIT/BSD/GPL/Apache/MPL/public domain/All rights reserved: the only holders are Spomky-Labs, Matyas Danter, Paragon Initiative Enterprises and Steve "Sc00bz" Thomas, all listed in debian/copyright; the prescan author check agrees.
root LICENSE and src/{Bundle,Experimental,Library}/LICENSE are identical Expat/MIT texts; the stanza reproduces the same permission text in full. The 2014-2017 vs 2014-2024 year difference is ordinary drift.
debian/copyright starts with the correct Format URL, is otherwise valid DEP-5 (Upstream-Name, Source, one Files paragraph, standalone Expat text), so no replacement file is proposed.
Standards-Version 4.7.4 equals the policy tool's 4.7.4.1 in its first two components; Section php, Multi-Arch: foreign and Architecture: all are right for an arch:all PHP library.
Build-Depends names resolve: debhelper-compat (= 14) and dh-sequence-phpcomposer (provided by pkg-php-tools 1.50), phpab 1.29.4, php-brick-math, php-psr-clock, php-symfony-console/framework-bundle/http-client/yaml/dependency-injection. php-spomky-labs-pki-framework (1.6.3-1) and php-spomky-labs-aes-key-wrap (7.0.0-1) are in NEW, so their absence from the archive is not a fault.
debian/install semantics checked against dh_install(1): debian/autoloaders lands in usr/share/pkg-php-tools/autoloaders/ (matching /usr/share/pkg-php-tools/autoloaders/jsonlint), and the autoloaders line web-token jwt-library Jose/Component/autoload.php matches the format of that example; src/Library/* lands in usr/share/php/Jose/Component.
debian/rules: dh with --sourcedirectory=src/Library (honoured by dh_phpcomposer for the composer substvars), the generated autoload.php is registered by the autoloaders file, and the symlinks/templates created at build time are all removed by debian/clean. Hooks at compat 14 skip dh_auto_test under nocheck.
debian/tests/control: autopkgtest present with allow-stderr, rw-build-tree and the phpabtpl/phpab/phpunit tooling in Depends; Testsuite-Triggers in the .dsc matches it. No maintainer scripts, no patches (debian/patches absent), source format 3.0 (quilt), changelog distribution unstable with an initial-release entry.
The package ships no generated documentation, minified code or PDFs; the only generated file (src/Library/autoload.php) is regenerated from src/Library by phpab in override_dh_auto_build.
tests/Component/KeyManagement/EC/DER/prime256v1-cert.der is an X.509 certificate fixture read by CertificateTest.php:310 and JWKFactoryTest.php:43,103; not a built file.
tests/Component/KeyManagement/EC/DER/570-ec-sect571r1-cert.der is an X.509 certificate fixture for a sect571r1 key; no test currently references it, so it is unused test data, not a built file.
tests/Component/KeyManagement/RSA/DER/512b-rsa-example-cert.der is an X.509 certificate fixture read by CertificateTest.php:205.
tests/Component/KeyManagement/RSA/DER/1024b-rsa-example-cert.der is an X.509 certificate fixture read by CertificateTest.php:218 and JWKFactoryTest.php:85.
tests/Component/KeyManagement/RSA/DER/2048b-rsa-example-cert.der is an X.509 certificate fixture read by CertificateTest.php:231.
tests/Component/KeyManagement/RSA/DER/4096b-rsa-example-cert.der is an X.509 certificate fixture read by CertificateTest.php:244.
tests/Component/KeyManagement/RSA/DER/8192b-rsa-example-cert.der is an X.509 certificate fixture read by CertificateTest.php:257.
tests/Component/KeyManagement/RSA/DER/16k-rsa-example-cert.der is an X.509 certificate fixture read by CertificateTest.php:270.
tests/Component/KeyManagement/RSA/DER/32k-rsa-example-cert.der is an X.509 certificate fixture read by CertificateTest.php:283 and JWKFactoryTest.php:121,138.
tests/Component/KeyManagement/RSA/frank4dd-cacert.der is a copy of the Frank4DD test CA certificate (the same certificate appears inline as an x5c value in CertificateTest.php); it is unused test data, not a built file.
tests/Component/Console/Sample/CertRSA.p12 and tests/Component/KeyManagement/P12/CertRSA.p12 are PKCS#12 keystore test fixtures read by KeyConversionCommandTest.php:70 and JWKFactoryTest.php:25.
All twelve scan hits are certificates or PKCS#12 test data, have no preferred form for modification, and are covered by the catch-all Files stanza.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 4.2.7, packaged 4.2.5), which is not a fault of the package.

Not confirmed ◂

The two tests excluded by --exclude-filter (AnalyzeCommandTest, CommandHelpCompatibilityTest, in debian/rules and debian/tests/control) are the only ones booting the Symfony test kernel; no reason for their exclusion is given in debian/. I could not determine whether they fail for a Debian-specific environment reason or for a genuine command/help regression.
.ci-tools/phpunit.xsd is PHPUnit 12.3's configuration schema (the file says so itself) and carries no copyright or licence notice. If it is a verbatim copy of PHPUnit's phpunit.xsd, its BSD-3-Clause attribution would not fit the Expat stanza; I could not compare it with PHPUnit's copy. It is not installed in the binary package.
CODE_OF_CONDUCT.md is an adapted Contributor Covenant v1.4 text with its own attribution links; the upstream project publishes that text under CC BY 4.0. The file carries no licence notice itself, is not installed, and I could not check the upstream licensing.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Review Information

accepted — allocated to mechtilde 1 hour ago, started 1 hour ago, completed 0 hours ago.

Final Comment

Back to Dashboard | View all reviews for this package