DFSG NEW review for puppet-module-voxpupuli-fail2ban version 7.1.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5, with Format, Upstream-Name, Source, Upstream-Contact, a Files: * stanza naming both holders, a later debian/* stanza, and a stand-alone Apache-2.0 paragraph pointing at /usr/share/common-licenses/Apache-2.0 (present). All upstream files are Apache-2.0: LICENSE is the Apache-2.0 text and metadata.json declares "license": "Apache-2.0"; no other file carries a copyright notice or a different or non-free term, and there is no vendored third-party code, binary, font, image or PDF. The only upstream copyright notice, "Copyright 2014 Dennis Hoppe", is named, and the year ranges and the Vox Pupuli holder are explained in a Comment. Generated documentation (REFERENCE.md) has its source (manifests/) in the package.

Packaging

A small arch:all Puppet module packaged in the established Debian puppet-module way: files under /usr/share/puppet/modules.available/voxpupuli-fail2ban, an update-alternatives link named fail2ban (the name the manifests use) in postinst/prerm, correct runtime Depends (openvox-agent | puppet-agent, puppet-module-puppetlabs-stdlib, ${misc:Depends}), a complete .install list for the module's runtime content (manifests, templates, types, tasks, metadata.json, hiera.yaml), 3.0 (quilt) with no patches, current Standards-Version 4.7.4, and a sane initial changelog. Only nits, neither a policy violation: debhelper compat 12 is below the recommended 14 (supported by debhelper 14.5; it only makes dh_missing non-fatal), and there is no autopkgtest.

Issues

1. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

2. [minor] [packaging] uscan finds only upstream versions older than the packaged one

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: upstream 1.3.4, packaged 7.1.0
• Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
• Fix: Check where debian/watch looks and how it mangles versions.

Verified

• Prescan: it listed no files. Its author check found three holders (Dennis Hoppe, Vox Pupuli, Thomas Goirand), all named in debian/copyright, so nothing from the scan is left unaccounted for.
• Every file of the tree except .pc/ and debian/ was inventoried directory by directory; the only licence-bearing files are LICENSE (Apache-2.0) and metadata.json ("license": "Apache-2.0"). Greps for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU/LGPL, Apache, Mozilla Public, public domain, All rights reserved and non-commercial found no other notice, no differing licence and no restricted term.
• debian/copyright is machine-readable and matches copyright-format 1.0: Files: * (Dennis Hoppe 2014-2020, Vox Pupuli 2016-2026) covers the upstream tree, the later Files: debian/* (Thomas Goirand 2026) overrides the packaging, and Comment is a permitted field in a Files stanza (copyright-format 5.2).
• No LICENSE/COPYING/NOTICE/AUTHORS file exists in any subdirectory; the only external Puppet module referenced is stdlib, which is a Depends (puppet-module-puppetlabs-stdlib 9.4.1 is in the archive and within metadata.json's >=4.25.0 <11.0.0). extlib appears only in .fixtures.yml and old CHANGELOG/HISTORY entries and is called by no manifest. No binary, font, image, archive or PDF is shipped to describe.
• REFERENCE.md is puppet-strings output whose input (manifests/, types/) is in the package; CHANGELOG.md is generated from git history and is only a changelog, not a built artifact.
• The orig tarball contains no debian/ directory, the .debian.tar.xz contains exactly the ten packaging files, there is no debian/patches and .pc/applied-patches is empty, so the tree is upstream plus unpatched packaging.
• The .install list is complete for runtime: manifests/, templates/, types/, tasks/, metadata.json and hiera.yaml are all that exist under the module root besides dev files (no lib/, functions/, files/ or data/); types/ uses only Stdlib aliases, which the Depends provides, and every epp() template the manifests name is in templates/.
• tasks/*.rb are Bolt tasks that require_relative ruby_task_helper; Debian does not package that module and the Puppet module itself never uses tasks/, so no Depends is missing for the packaged Puppet module.
• hiera.yaml is installed although the module has no data/ directory; Hiera finds no data files there, so it has no runtime effect.
• Maintainer scripts follow the Debian puppet-module pattern: postinst does update-alternatives --install of alternative puppet-module-fail2ban (link /usr/share/puppet/modules/fail2ban) only on configure, prerm does --remove only on remove, both are set -e, idempotent, and keep #DEBHELPER#. /usr/share/puppet/modules exists on a system with openvox-agent, and the link name fail2ban matches the class the manifests define, while the storage directory name is irrelevant to Puppet.
• debian/control: Architecture: all, Depends openvox-agent | puppet-agent (both exist; puppet-agent is the transitional package to openvox-agent) and puppet-module-puppetlabs-stdlib plus ${misc:Depends}; no Build-Depends-Indep split is required for a single arch:all package.
• Build-Depends are debhelper-compat (= 12) and openstack-pkg-tools; the latter exists in the archive (version 155), and debian/rules includes /usr/share/openstack-pkg-tools/pkgos.make before its own %: target.
• 3.0 (quilt) source format, Standards-Version 4.7.4 (Policy here is 4.7.4.1, so the first two components are current), Vcs-Git/Vcs-Browser and Homepage set, changelog 7.1.0-1 to unstable as an initial upload closing an ITP.
• debhelper compat 12 is old but supported by debhelper 14.5 (not deprecated; only v11 is discouraged); the only change that applies is that dh_missing defaults to --list-missing rather than --fail-missing, which is why the dev files not in the .install (dotfiles, CHANGELOG.md, HISTORY.md, LICENSE) are merely listed. No override target is affected, and there is no build system so dh_auto_* steps do nothing.
• There is no debian/tests/control; Policy does not require one (it mentions autopkgtest only for the Testsuite field, 5.6.30).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• openstack-pkg-tools is not installed on the reviewing system, so /usr/share/openstack-pkg-tools/pkgos.make could not be read; its effect on the build could not be inspected. The package exists in the archive (155) and the include path is the one used by Debian OpenStack packages, so no build failure is suspected.
• The upstream Ruby spec suite (spec/, voxpupuli-test and rspec gems) was not run and is not run by the build; nothing in the package shows it would pass or fail.
• Equality of the orig tarball with the upstream v7.1.0 tag and the validity of the ITP number closed in debian/changelog could not be checked (no network or BTS access); the .dsc checksums match the shipped tarballs.