DFSG NEW review for puppet-module-vigie version 1.0.4

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable

Licensing

The whole tree is Apache-2.0 and DFSG-compliant. The top-level LICENSE is the complete Apache-2.0 text and metadata.json declares "license": "Apache-2.0" on the only header absent from most files. debian/copyright is machine-readable (copyright-format 1.0) with a Files: * stanza (Thomas Goirand 2021-2026 + Hewlett-Packard 2013, Apache-2.0, matching setup.py's HP notice) and a Files: debian/* stanza (Goirand 2026). Every file in the 34-file inventory is matched by those stanzas; all files are plain-text Puppet/Ruby/Python/source with no binaries, minified code, fonts, images or pre-built docs, and no Files-Excluded is needed. No non-free terms appear anywhere.

Packaging

Packaging follows the established Debian OpenStack puppet-module template (pkgos.make, debhelper-compat 11, modules installed via /usr/share/puppet/modules.available + update-alternatives). All Depends exist in the archive and each maps to classes/resources actually used (keystone, openstacklib, oslo, inifile, stdlib); puppetlabs/concat appears in metadata.json but is unused by the module, so its absence from Depends is correct. Maintainer scripts are correct and idempotent, Build-Depends are satisfiable, changelog is sane (initial release closing the ITP). Only a minor metadata version inconsistency. Standards-Version 4.7.3 is one release behind the current 4.7.4.1, whose only changes (8.4, 12.5) do not affect this package.

Issues

1. [important] [packaging] uscan found no upstream version

• Files: debian/watch
• Problem: uscan ran without an error but found no upstream release with debian/watch.
• Fix: Correct debian/watch so that uscan --report finds the upstream releases.

2. [minor] [packaging] metadata.json module version does not match the package version

• Files: metadata.json:41 (shipped to /usr/share/puppet/modules.available/vigie/metadata.json)
• Evidence: "version": "1.0.0" while the Debian package is 1.0.4 (debian/changelog).
• Problem: Everything else in the native package is versioned 1.0.4; the module that gets installed reports 1.0.0 to tooling that reads metadata.json. Cosmetic inconsistency, but trivially avoidable.
• Fix: Bump metadata.json "version" to 1.0.4 (and keep it in sync on future releases).

3. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read the complete 34-file inventory (glob incl. hidden files, excluding .pc/debian-only review); every file is plain-text () source - no binaries, minified JS/CSS, jars, DLLs, fonts, images, sounds, firmware, or pre-built docs; no .pc staging leftovers.
• LICENSE (top level) is the full Apache-2.0 text; metadata.json declares Apache-2.0.
• File-level notices: setup.py ('Copyright (c) 2013 Hewlett-Packard Development Company, L.P.' + Apache header) and manifests/wsgi/uwsgi.pp ('Copyright 2021 Thomas Goirand'). All other files carry no header but are covered by the project LICENSE - consistent with the Files: * stanza in debian/copyright.
• debian/copyright is DEP-5/copyright-format 1.0 with the exact Format: URL, one Files: * stanza (Goirand 2021-2026, HP 2013, Apache-2.0) and one Files: debian/* stanza (Goirand 2026, Apache-2.0); no files-Excluded and none needed.
• Debian Depends packages exist and are used: openvox-agent|puppet-agent|puppet, puppet-module-keystone (keystone::resource::*), puppet-module-openstacklib (openstacklib::db::mysql, openstacklib::openstackclient), puppet-module-oslo (oslo::messaging/log/db/concurrency), inifile (vigie_config provider), stdlib; concat from metadata.json is not referenced anywhere in manifests/lib, so its absence from Depends is correct.
• Maintainer scripts: postinst installs the alternative on configure; prerm and postrm only act on "remove", so they are idempotent across upgrade/configure and produce no failures.
• debian/rules overrides are consistent with a pure-data module (build/install do nothing; dh_install pulls lib, manifests, metadata.json, Rakefile, types). Build-Depends are all satisfiable.
• debian/changelog: initial release 1.0.4, distribution unstable, urgency medium, ITP closure present; salsa-ci pipeline included; no patches series needed.

Not confirmed

• Could not consult the update-alternatives(8) man page (not installed on the reviewing system); the alternatives handling behaviour above is inferred from standard dpkg semantics and matches the Debian OpenStack convention, but the concrete runtime of a purge was not exercised.
• License-file and metadata evidence covers the shipped tree; I did not diff against the upstream git history beyond the packed source (metadata.json reports a different author/source than the dsc, which is expected for a Debian-maintained module).

Proposed changes

debian/watch in version 5 format

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Source: https://salsa.debian.org/openstack-team/puppet/puppet-module-vigie.git
Matching-Pattern: refs/tags/(\d[brc\d\.]+)
Mode: git
Uversionmangle: s/\.0rc/~rc/;s/\.0b1/~b1/;s/\.0b2/~b2/;s/\.0b3/~b3/