DFSG NEW review for sbt-util-interface version 1.11.7-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All shipped source is Apache-2.0: LICENSE is the Apache text and each of the ten src/main/java/xsbti/*.java files carries the sbt Apache-2.0 header naming Scala Center, Lightbend and Mark Harrah, which matches the Files: * stanza; nothing non-free is present, so the licence itself is DFSG-compliant. debian/copyright is not complete, however: the upstream NOTICE that the package ships and installs records Copyright 2002-2008 EPFL, Lausanne and a BSD-style licence for portions based on the Scala compiler, and neither that holder nor that licence appears in debian/copyright, while Files: * claims the whole tree is Apache-2.0 by three holders.

Packaging

The packaging is small and correct for a pure-Java interface jar: debhelper compat 13 with javahelper and maven-repo-helper, the jar built by javac --release 8 and installed through debian/libsbt-util-interface-java.poms with --java-lib (so it lands in /usr/share/java with both symlinks) plus Maven metadata in /usr/share/maven-repo, NOTICE in the docs file, debian/clean for the build directory, and a README.source that documents how the hand-assembled orig tarball is reproduced. Build-Depends, changelog, 3.0 (quilt) source format and Standards-Version 4.7.4 are all in order. No maintainer scripts, patches or autopkgtests, none of which this package needs.

Issues

1. [blocker] [licensing] Files: * does not name the holder EPFL, Lausanne nor the BSD-style licence recorded in NOTICE

• Files: NOTICE:7-10, debian/copyright:11-17
• Basis: inferred from what was read, not seen directly
• Evidence: NOTICE: Portions based on code from the Scala compiler. Portions of the Scala library are distributed with the launcher. / Copyright 2002-2008 EPFL, Lausanne / Licensed under BSD-style license (see licenses/LICENSE_Scala); debian/copyright Files: * / Copyright: 2023, Scala Center / 2011-2022, Lightbend, Inc. / 2008-2010, Mark Harrah / License: Apache-2.0.
• Problem: The NOTICE file ships in the source package and is installed by debian/libsbt-util-interface-java.docs, so its third-party copyright and licence statement reaches every user, yet the catch-all Files: * stanza names only three holders and declares the whole tree Apache-2.0. Either the EPFL-derived portions are part of what is shipped, in which case Files: * is inaccurate and the BSD-style terms of those portions are undocumented, or they are not, in which case debian/copyright should say so; as written the two files contradict each other. The licence text the notice points to (licenses/LICENSE_Scala) is not in the repacked tarball either, so it cannot be consulted. An accurate copyright file for every shipped file is required (Policy 12.5, 12.6.1 and the machine-readable copyright specification).
• Fix: Add a Files: NOTICE stanza (or extend the Files: * Comment:) naming EPFL, Lausanne and the BSD-3-clause licence for the Scala-compiler-derived portions, with the licence text or a pointer to it, and either ship licenses/LICENSE_Scala or state that no EPFL-derived file is part of this module.

Verified

• Whole upstream tree inventoried and read: LICENSE, NOTICE, ten src/main/java/xsbti/*.java files; no subdirectory carries its own licence, and there are no built, minified, binary or PDF files in the tree.
• All ten Java files carry the identical header Copyright 2023, Scala center / Copyright 2011 - 2022, Lightbend, Inc. / Copyright 2008 - 2010, Mark Harrah / Licensed under Apache License 2.0 (see LICENSE); LICENSE is the unmodified Apache-2.0 text whose appendix is filled in with the same three holders. These match the Files: * stanza apart from the EPFL question reported above.
• NOTICE is the only file the prescan flagged; its EPFL line is the subject of the licensing issue. Its JLine and Apache Ivy paragraphs say those components are distributed with the launcher, which is not part of this source package.
• debian/copyright is DEP-5 with a valid Format: line, one Files: * stanza, a Files: debian/* stanza for the 2026 packaging holder, and one stand-alone License: Apache-2.0 paragraph pointing at /usr/share/common-licenses/Apache-2.0, which is acceptable for a common-licence text.
• Jar installation verified in the packaging: debian/libsbt-util-interface-java.poms passes --java-lib --usj-name=sbt-util-interface --artifact=target/sbt-util-interface.jar; the maven_repo_helper dh sequence inserts mh_install after dh_install, and mh_installjar installs /usr/share/java/sbt-util-interface-1.11.7.jar plus the versionless link and the /usr/share/maven-repo copy (read in /usr/bin/mh_install, /usr/bin/mh_installjar, /usr/bin/mh_installpom). debian/poms/util-interface.pom has matching groupId/artifactId/version.
• Build-Depends are complete for this build: debhelper-compat (= 13), default-jdk-headless (javac and jar), javahelper (the javahelper sequence and jh_depends, which provides ${java:Depends}) and maven-repo-helper (mh_install). Compat 13 also matches javahelper 0.82, which depends on debhelper-compat (= 13).
• Standards-Version: 4.7.4 is current: its first two components equal those of the reviewing system's Policy 4.7.4.1.
• debian/source/format is 3.0 (quilt) with no debian/patches directory; debian/changelog is a well-formed initial release to unstable closing #1139638, and its date (Tue, 09 Jun 2026) is consistent.
• No maintainer scripts, maintscripts, .install/.links files or debian/tests exist; none is needed for an Architecture: all interface jar. The empty override_dh_auto_test is harmless at compat 13.
• README.source documents exactly how the hand-assembled orig tarball is cut from the sbt 1.11.7 checkout (internal/util-interface/src/main/java, LICENSE, NOTICE), which matches the tarball contents.
• The .pc/ directory was ignored throughout.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.1.0-RC1, packaged 1.11.7), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Reproducibility: debian/rules:6 runs plain jar cf, which stores each entry's build-time mtime, so the jar is likely not bit-for-bit reproducible under Policy 4.15 unless the JDK's jar honours SOURCE_DATE_EPOCH; I could not build the package to check whether it does.

Proposed changes

None.