DFSG NEW review for scala-parser-combinators-2.12 version 1.0.7+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is uniformly BSD-3-clause. The only copyright notices in it are LICENSE.md (EPFL 2002-2013, Typesafe 2011-2013) and the standard Scala per-file header (LAMP/EPFL 2006-2013), and all three holders are named in the Files: * stanza of the DEP-5 debian/copyright, whose licence text reproduces LICENSE.md clause for clause, including the 'Neither the name of the EPFL' endorsement clause. debian/* has its own stanza for the packager, and Files-Excluded names admin/secring.asc.enc, which is indeed absent from the repacked tree. Nothing in the source restricts use or modification, and no third-party code with a different licence is embedded.

Packaging

Competent packaging: compat 14 with debhelper 14.5, Standards-Version 4.7.4, Architecture: all, a hand-written build in debian/rules that avoids sbt, a DEP-3 patch that is minimal and explained, maven-repo-helper and javahelper wired correctly (.poms artifact name matches the jar rules produces, --java-lib puts it in /usr/share/java), a POM whose version agrees with the Debian version, and a changelog that closes the ITP. The only gap worth noting is that the upstream JUnit suite is never compiled or run and there is no autopkgtest.

Issues

1. [minor] [packaging] Upstream test suite is neither built nor run: empty override_dh_auto_test and no autopkgtest

• Files: debian/rules, shared/src/test/scala/scala/util/parsing/combinator/, jvm/src/test/scala/scala/util/parsing/combinator/
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules: override_dh_auto_test: with an empty body; the tree carries JavaTokenParsersTest.scala, JsonTest.scala, PackratParsersTest.scala, RegexParsersTest.scala, t0700.scala, t4138.scala, ... (JUnit, per import org.junit.Test) and jvm/src/test/.../t4929.scala, t9010.scala; there is no debian/tests/ directory.
• Problem: The jar is shipped on the strength of scalac succeeding alone: nothing executes the library, and the Debian patch (0001-build-against-modern-scala-2.12.patch) changes how CharArrayReader and PagedSeqReader build their CharSequence wrapper, i.e. runtime behaviour that a single reader test would exercise. No policy section is broken, but a library package with zero verification is a real quality gap a sponsor would raise.
• Fix: Either compile shared/src/test/scala + jvm/src/test/scala in an override_dh_auto_test and run them with JUnit (adding junit4 to Build-Depends and <test>-only entries as needed), or, if the suite cannot be run here, add a debian/tests/control autopkgtest that loads the installed jar and runs at least a small parser (as the scala maintainers do for their jars) instead of leaving the override empty without explanation.

Verified

• Full upstream inventory: all 58 files outside debian/ and .pc/ were enumerated and read or grepped (gitignore false throughout); no file was left unexamined.
• Pre-scan holder 'LAMP/EPFL ** \ / // __ |/ /__/ __ |': this is the standard Scala ASCII-art header on 26 .scala files under shared/src/main/scala (** / __/ __// _ | / / / _ | (c) 2006-2013, LAMP/EPFL). debian/copyright's Files: * names 2006-2013 LAMP/EPFL, so the holder is present and the pre-scan item is not an issue.
• Tree-wide grep for copyright, (c), ©, SPDX-License-Identifier, 'Licensed under', 'Permission is hereby granted', GNU/Apache/MPL names, 'public domain', 'All rights reserved' found only LICENSE.md and the Scala header — no second licence or holder exists anywhere in the tree.
• LICENSE.md: Copyright (c) 2002-2013 EPFL / Copyright (c) 2011-2013 Typesafe, Inc., BSD-3-clause with Neither the name of the EPFL nor the names of its contributors; debian/copyright's Files: * lists all three holders and the stand-alone License paragraph matches this text clause for clause.
• js/src/main/scala/.../PositionCache.scala and jvm/src/main/scala/.../PositionCache.scala carry no licence header (the jvm one only an @author Tomáš Janoušek tag); both fall under Files: *, and only the jvm copy is compiled and shipped, so no separate stanza is required.
• admin/pubring.asc is a binary OpenPGP public keyring consumed by admin/gpg.sbt/pubring settings; it is data, not a build product, and is covered by Files: *.
• admin/secring.asc.enc is absent from the tree, as the header Comment and Files-Excluded: admin/secring.asc.enc state; the +ds repack is consistent, and admin/build.sh still referring to it is dead upstream release tooling that the build never runs.
• .travis.yml carries upstream's encrypted Sonatype credentials and PGP passphrase from its retired Travis CI; they are ciphertext in source-only files and play no part in the Debian build.
• No built artefacts in the source: no .jar, .class, .pdf, minified or bundled code, no archives (orig tarball is 43 KB). The only objects the build creates are target/ and scala-parser-combinators_2.12-1.0.7.jar, both removed by override_dh_auto_clean.
• debian/copyright is DEP-5 with the exact Format URL, header fields Format/Upstream-Name/Source/Comment/Files-Excluded, Files: * before Files: debian/* (so debian/* wins for packaging files), and a stand-alone License paragraph; nothing in it is disallowed by copyright-format 1.0.
• All of debian/ was read: control, rules, changelog, source/format, patches/series + the one patch, .poms, poms/*.pom.xml, README.source, upstream/metadata, lintian-overrides, copyright. No maintainer scripts, no *.maintscript, no debian/tests.
• compat: debhelper-compat (= 14) matches debhelper 14.5 on the reviewing system, where v14 is the recommended level; at compat 14 dh_gencontrol adds ${java:Depends}/${misc:Depends} itself, so their presence in Depends is fine either way.
• debian/rules: include /usr/share/dpkg/pkg-info.mk plus VERSION = $(firstword $(subst +, ,$(DEB_VERSION_UPSTREAM))) yields 1.0.7 from 1.0.7+ds, which is exactly the jar name debian/scala-parser-combinators-2.12.poms asks for with --artifact=scala-parser-combinators_2.12-1.0.7.jar.
• maven-repo-helper's --java-lib/--usj-name semantics confirmed in mh_installjar(1): the jar is installed as /usr/share/java/$name-$version.jar with a versionless link, so the versioned/underscored /usr/share/java name and the bad-jar-name override are deliberate and consistent with the maven artifactId.
• The dh sequence addons maven_repo_helper and javahelper used by dh $@ --with ... exist on the reviewing system (/usr/share/perl5/Debian/Debhelper/Sequence/maven_repo_helper.pm).
• debian/patches/0001 is DEP-3-headed (Description, Author, Forwarded: not-needed, Last-Update) and touches two lines only, making the now non-implicit scala.Predef.arrayToCharSequence / seqToCharSequence conversions explicit; the purpose is stated in the header and in debian/README.source.
• Standards-Version 4.7.4 is current against the reviewing system's 4.7.x Policy; Vcs-Git/Vcs-Browser/Homepage/upstream metadata are present and consistent.
• uscan found the packaged version as the newest upstream release (upstream 1.0.7, packaged 1.0.7+ds).

Not confirmed

• Build-Depends scala (>= 2.12~) and Depends scala-library (>= 2.12~) cannot be satisfied from the archive as it stands: apt-cache shows only scala/scala-library 2.11.12-6 (scala-asm 9.9.0-scala-1-1 does satisfy >= 9.9.0), and nothing in NEW. debian/README.source states the package is paired with a scala 2.12 upload; if that upload is not arriving together with this one, the package neither builds nor installs.
• Consequently the hard-coded classpaths in debian/rules — /usr/share/java/scala-compiler-2.12.jar, scala-library-2.12.jar, scala-reflect-2.12.jar and /usr/share/maven-repo/org/scala-lang/modules/scala-asm/debian/scala-asm-debian.jar — could not be checked against an installed scala/scala-asm; scala is not installed on the reviewing system. A build would show whether those series-versioned jar links exist.
• Whether scalac -target:jvm-1.8 and -bootclasspath <scala-library only> work against the default-jdk-headless that the archive would install, and whether the jar jar cf writes is bit-reproducible (unsorted find input, file timestamps); a build would show it.

Proposed changes

None.