php-xml-util 1.4.5-1

Package Information

Description	${phppear:summary} ${phppear:description}
Maintainer	Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed By	David Prévot <taffit@debian.org>
Sponsor	taffit@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/php-team/pear/php-xml-util.git (browse)
Tracker	https://tracker.debian.org/pkg/php-xml-util
Uploaded	3 hours ago

New Package Report

.changes◂

Source	php-xml-util
Version	1.4.5-1
Changed-By	David Prévot <taffit@debian.org>
Architecture	source all
Distribution	unstable
Date	Sat, 31 Oct 2026 21:04:41 +0100

Changelog◂

php-xml-util (1.4.5-1) unstable; urgency=medium
 .
   * Initial release (php-pear dependency, cf. #1152703)

.dsc◂

Package-List	php-xml-util deb php optional arch=all
Section	php
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Archive_Tar
Upstream-Contact: Chuck Burgess <ashnazg@php.net>
Source: https://github.com/pear/Archive_Tar

Files: *
Copyright: 2003-2008 Stephan Schmidt <schst@php.net>
License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
  * Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 .
  * Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 2 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for php-xml-util version 1.4.5-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 2 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The code is free software, but debian/copyright is not an accurate description of this package: it is the copyright file of a different PEAR package (Archive_Tar), naming Archive_Tar as upstream and its GitHub repository as source. It also states BSD-2-clause, whereas every upstream file carries the three-clause New BSD licence (the 'name of the author may not be used to endorse' condition), which the file's License stanza omits. The packaging files under debian/ are not attributed to their author. No non-free terms were found.

Packaging

The packaging is conventional pkg-php-tools/PEAR packaging: compat 14, Standards-Version 4.7.4, a debhelper-compat Build-Depends, well-formed DEP-3 patches, a native-vs-quilt 3.0 source format, an autopkgtest, gbp.conf, upstream metadata and a generated registry/autoloader. The only open question is the Breaks/Replaces bound against php-pear, which the archive cannot currently satisfy.

Issues

blocker licensing 1. debian/copyright names Archive_Tar as the upstream package and its repository as Source ◂

Files: debian/copyright:1-4
Basis: checked, in the package or with a reference tool
Evidence: Upstream-Name: Archive_Tar and Source: https://github.com/pear/Archive_Tar; the package is XML_Util: composer.json says "name": "pear/xml_util", debian/control has Homepage: https://github.com/pear/XML_Util, and package.xml:3 has <name>XML_Util</name>.
Problem: The machine-readable copyright file describes a different source package. A consumer (or a licence scanner) reading it learns the wrong upstream project and the wrong place to obtain the source, so the file does not accurately describe the copyright and licensing of the files shipped (copyright-format 1.0, fields Upstream-Name and Source).
Fix: Set Upstream-Name: XML_Util and Source: https://github.com/pear/XML_Util; keep Upstream-Contact.

blocker licensing 2. Licence is BSD-3-Clause but debian/copyright declares BSD-2-clause and omits the third condition ◂

Files: debian/copyright:5-27, XML/Util.php:11-42, examples/example.php:14-46, examples/example2.php:14-46
Basis: checked, in the package or with a reference tool
Evidence: debjava/copyright says License: BSD-2-clause and lists only the two redistribution conditions; the source header has a third, * The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission., and composer.json declares "license": "BSD-3-Clause".
Problem: The short name and the reproduced licence text do not match the licence the files are actually under; the clause that distinguishes BSD-3-clause from BSD-2-clause is missing from the copyright file. This is an inaccurate copyright/licence description (Policy 12.5, copyright-format 6.7/7.1).
Fix: Use License: BSD-3-Clause with the complete three-clause text (the two redistribution conditions, the no-endorsement condition and the disclaimer).

minor licensing 3. Files: * attributes debian/ (packaging, generated autoloader and registry) to Stephan Schmidt alone ◂

Files: debian/copyright:5-6, debian/autoload.php, debian/php-xml-util.substvars-static, debian/xml_util.reg
Basis: checked, in the package or with a reference tool
Evidence: Only one stanza exists, Files: * / Copyright: 2003-2008 Stephan Schmidt <schst@php.net>, which also matches debian/*; the packaging and the generated files come from David Prévot (changelog and patches 0004/0005 author, Uploaders).
Problem: The catch-all stanza states a copyright holder and year range for files he did not write, so the file is inaccurate for debian/.
Fix: Add a Files: debian/* stanza naming the Debian packaging copyright holder (David Prévot) and the licence of the packaging.

Verified ◂

Read all of debian/ (control, rules, changelog, copyright, install, docs, clean, gbp.conf, README.source, both lintian-overrides files, autoload.php, autoload.php.tpl, autoloaders/, overrides/, substvars-static, xml_util.reg, source/format, tests/control, upstream/changelog, upstream/metadata, all five patches and series).
Accounted for all upstream files: XML/Util.php, examples/example.php, examples/example2.php, the 20 files in tests/ (which carry no licence header), README.md, composer.json, package.xml, phpunit.xml.dist, .travis.yml, .gitattributes, .gitignore. The only copyright notice is Copyright (c) 2003-2008 Stephan Schmidt <schst@php.net> in XML/Util.php and both examples; tests/ has no holder, matching the prescan's author check ('every holder found is named').
package.xml's <license>PHP License</license> entries occur only in the historical <changelog> releases (pre-1.0 up to 1.2.0a1); the current release entry and the <license> of the package say BSD, consistent with the file headers.
examples/example.php is reported as non-UTF-8 by the reader; its header read via :raw shows the same 2003-2008 Stephan Schmidt New BSD notice, and debian/lintian-overrides carries national-encoding for it. It is plain PHP source, not a built or binary file.
No non-free wording (non-commercial, no-modification, field-of-use) appears anywhere in the tree; no LICENSE/COPYING/NOTICE files exist; no code is vendored from another project.
Patches 0001-0003 are upstream commits already carried as origin URLs; 0004 and 0005 fix the test suite for PHPUnit 13 and a class/file-name mismatch, and all apply in series order (the tree shows their effect, e.g. tests/AbstractUnitTests.php deleted).
dh_computeautosubstvars is a debhelper command in the compat-14 root sequence (checked in /usr/share/perl5/Debian/Debhelper/Sequence/root_sequence.pm), so execute_before_dh_computeautosubstvars in debian/rules does run; the package deliberately does not build-depend on pkg-php-tools (see debian/README.source and the source lintian override), shipping pre-generated substvars and registry instead.
Autopkgtest only needs php-pear and phpunit, both in Build-Depends with <!nocheck>, and phpunit 13 is the archive version; the test command bootstraps the installed /usr/share/php/XML/Util/autoload.php from the source tree.
uscan found the packaged version as the newest upstream release (upstream 1.4.5, packaged 1.4.5).

Not confirmed ◂

Breaks: php-pear (<< 1:1.10.18+t) and Replaces: php-pear (<< 1:1.10.18+t): the archive has only php-pear 1:1.10.18+submodules+notgz-1, which sorts below 1:1.10.18+t, and that php-pear still Provides php-xml-util. Until a php-pear at 1:1.10.18+t (dropping the bundled copy) is uploaded, installing this package would remove php-pear; the intended coordinated transition could not be verified from the package alone.
debian/watch looks at github.com/pear/xml_util, but the Source field of debian/copyright names github.com/pear/archive_tar. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-03 20:03 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package