DFSG NEW review for scala-xml-2.12 version 2.3.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The only licence in the tree is Apache-2.0, which is DFSG-free, and debian/copyright includes its text/pointer and the NOTICE. The source headers are consistent: every .scala file carries the EPFL/Lightbend Apache-2.0 header. However, debian/copyright omits the third file that carries the David Pollak/WorldWide Conferencing notice, so it does not accurately attribute every file's copyright.

Packaging

The packaging is sound: debhelper compat 14, Standards-Version 4.7.4, a clean scalac build of the 2.12 source set, maven-repo-helper installing the jar and POM, NOTICE shipped in the -docs file, no patches or maintainer scripts, and a justified bad-jar-name override. The only open point is that the Scala 2.12 toolchain the package builds and runs against is not in the current archive (likely a coordinated NEW upload; see unconfirmed).

Issues

1. [blocker] [licensing] debian/copyright omits XhtmlEntities.scala from the David Pollak/WorldWide Conferencing stanza

• Files: debian/copyright:11-14, shared/src/main/scala/scala/xml/parsing/XhtmlEntities.scala:20
• Basis: checked, in the package or with a reference tool
• Evidence: XhtmlEntities.scala:20: * @author (c) David Pollak 2007 WorldWide Conferencing, LLC.; debian/copyright:11-14 names only shared/src/main/scala/scala/xml/Xhtml.scala and shared/src/main/scala/scala/xml/parsing/XhtmlParser.scala with Copyright: EPFL and Lightbend, Inc. / 2007 David Pollak, WorldWide Conferencing, LLC. The stanza's own Comment says both files carry the notice.
• Problem: XhtmlEntities.scala is part of shared/src/main/scala, so it is compiled into the shipped jar and its notice applies to the binary. The only stanza matching it is Files: *, which names EPFL and Lightbend but not David Pollak/WorldWide Conferencing; DEP-5 requires the stanza that covers a file to state its copyright holders (copyright-format 5.2). The copyright file is therefore inaccurate for that file, even though its licence (Apache-2.0) is correct.
• Fix: Add shared/src/main/scala/scala/xml/parsing/XhtmlEntities.scala to the Files list of the stanza (and change its Comment from "Both files" to "All three files"), or add a separate stanza with the same holders and Apache-2.0.

Verified

• Prescan: dfsg-author-check scanned all 135 files and found every holder name present somewhere in debian/copyright; the per-file mapping is what is incomplete (reported as the issue).
• Read every file under debian/ and the whole upstream tree; .pc/ and cargo-checksum.json were not consulted.
• LICENSE is Apache-2.0; every .scala file carries the Copyright EPFL and Lightbend, Inc. / Licensed under Apache License 2.0 header; NOTICE names EPFL and Lightbend and is installed by debian/scala-xml-2.12.docs.
• The only non-EPFL holder notices are Xhtml.scala:20, XhtmlEntities.scala:20 and XhtmlParser.scala:23, all (c) David Pollak 2007 WorldWide Conferencing, LLC; the stanza covers only the first and third (see the issue).
• No built, minified or archived files, PDFs, images or fonts; jvm/src/test/resources/scala/xml/utf16.xml is a 92-byte UTF-16 test fixture, not a binary artifact, and the other test resources are trivial XML.
• No non-free licence wording (GNU/GPL, Mozilla, Creative Commons/CC-*, non-commercial, no-modification, All rights reserved, public domain) anywhere in the tree.
• shared/src/main/scala/scala/xml/include/sax/XIncluder.scala and XIncludeFilter.scala credit/derive from Eliotte Rusty Harold's SAXXIncluder but carry the standard Scala Apache-2.0 header; no separate licence text for that code exists in the tree.
• debian/copyright begins with the correct DEP-5 Format URL, and Apache-2.0 is present in /usr/share/common-licenses.
• Packaging: debhelper compat 14; Standards-Version: 4.7.4 against Policy 4.7.4.1; maven_repo_helper sequence inserts mh_install after dh_install; no debian/patches, maintainer scripts or autopkgtests; override_dh_auto_test is deliberately empty (upstream tests need sbt/JUnit, not in Build-Depends).
• Build-Depends: scala-asm (>= 9.9.0) is satisfied by the archive's 9.9.0-scala-1-1.
• uscan found the packaged version as the newest upstream release (upstream 2.3.0, packaged 2.3.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Scala 2.12 toolchain: apt-cache lists scala and scala-library only at 2.11.12-6, so Build-Depends: scala (>= 2.12~) and Depends: scala-library (>= 2.12~) are unsatisfiable in the current archive unless a Scala 2.12 upload is waiting in NEW (debian/README.source says this package is part of that sequence). A build would show which.
• The /usr/share/java/scala-compiler-2.12.jar, scala-library-2.12.jar, scala-reflect-2.12.jar and /usr/share/maven-repo/org/scala-lang/modules/scala-asm/debian/scala-asm-debian.jar paths used in debian/rules could not be checked against installed packages, since no Scala 2.12 package is installed on the reviewing system.

Proposed changes

None.