Review: secsipidx 2.0.0-1

Package Information

Description	Secure SIP Identity Extensions - IETF STIR and SHAKEN Secure SIP/Telephony Identity Extensions Overview Applications and libraries implementing STIR and SHAKEN (RFC8224, RFC8588), used in SIP/VoIP services: • RFC8224 - https://tools.ietf.org/html/rfc8224 • RFC8588 - https://tools.ietf.org/html/rfc8588 This package contains CLI tool and HTTP API server for checking or Building SIP identitysecsipidx
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Victor Seva <vseva@debian.org>
Sponsor	vseva@debian.org
Distribution	experimental
Architecture	any
VCS	git: https://salsa.debian.org/go-team/packages/secsipidx.git (browse)
Popcon Installs	9
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/secsipidx
Uploaded	8 hours ago

New Package Report

.changes◂

Date	Wed, 04 Nov 2026 12:20:06 +0100
Source	secsipidx
Version	2.0.0-1
Changed-By	Victor Seva <vseva@debian.org>
Architecture	source amd64
Distribution	experimental

Changelog◂

secsipidx (2.0.0-1) experimental; urgency=medium
 .
   * New upstream version 2.0.0
   * remove already applied patches upstream
   * golang-github-redis-go-redis-dev as Build-Depends
   * d/copyright: update years
   * bump API from 1 to 2

.dsc◂

Component	main
Package-List	libsecsipid-dev deb libdevel optional arch=any libsecsipid2t64 deb libs optional arch=any secsipidx deb comm optional arch=any
Section	libdevel
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: secsipidx
Upstream-Contact: daniel@asipto.com
Source: https://github.com/asipto/secsipidx

Files: *
Copyright: 2019-2026  asipto.com
License: BSD-3-clause

Files: debian/*
Copyright: 2020-2026 Victor Seva <vseva@debian.org>
License: BSD-3-clause
Comment: Debian packaging is licensed under the same terms as upstream

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted (subject to the limitations in the disclaimer
 below) provided that the following conditions are met:
 .
     * Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
 .
     * Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
 .
     * Neither the name of the copyright holder nor the names of its
     contributors may be used to endorse or promote products derived from this
     software without specific prior written permission.
 .
 NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY
 THIS LICENSE. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
 CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
 CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 hours ago.

Report◂

DFSG NEW review for secsipidx version 2.0.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 4 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The upstream licence (Clear BSD, DFSG-free) covers all upstream files and the full text is in debian/copyright, so nothing here is non-free. The file is not accurate for every file, though: secsipid/system_cas.go says on its first line that it was copied out of Go's crypto/x509 and is verbatim Go code, which is Copyright The Go Authors under Go's BSD-3-clause-style licence, yet Files: * attributes it to asipto.com alone. The Clear BSD text is also filed under the short name BSD-3-clause. Both are fixable by editing debian/copyright; no upstream file needs to change.

Packaging

The packaging is sound: debhelper compat 13 with dh-golang, correct Build-Depends (all present in the archive), a symbols file matching the exported C API, working t64 handling, autopkgtest via autopkgtest-pkg-go, salsa CI, and a current Standards-Version (4.7.4 against Policy 4.7.4.1). The remaining problems are cosmetic or nomenclature: two description typos and a t64 suffix on a library whose soname (2) is new and was never part of the time_t transition.

Issues

important licensing 1. Files: * credits copied Go crypto/x509 code in secsipid/system_cas.go to asipto.com only, omitting The Go Authors ◂

Files: secsipid/system_cas.go:3, debian/copyright:6-8
Basis: checked, in the package or with a reference tool
Evidence: secsipid/system_cas.go:3 /** Copied and pasted from go standard library: "crypto/x509" package!! **/; the bodies of loadSystemRoots, readUniqueDirectoryEntries, isSameDirSymlink and the certFiles/certDirectories tables match /usr/lib/go-1.27/src/crypto/x509/root.go and root_linux.go, whose headers read // Copyright 2015 The Go Authors. All rights reserved. and // Use of this source code is governed by a BSD-style license; /usr/share/doc/golang-1.27-src/copyright names © 2009, 2010, The Go Authors under License: Go. debian/copyright has only Files: * / Copyright: 2019-2026 asipto.com.
Problem: About 90 lines of the package are third-party code from another copyright holder, distributed under Go's BSD-3-clause-style licence (which also carries a patent grant). The copyright file names neither the holder nor that licence for this file, so it does not accurately describe every file; Policy 12.5 and copyright-format 5.2 require the copyright notice and licence of each group of files to be recorded.
Fix: Add a Files stanza, placed after Files: *, for secsipid/system_cas.go with Copyright: 2011, 2015 The Go Authors and a License short name covering the Go/BSD-3-clause terms (with its text, as it is not in /usr/share/common-licenses), and keep it in the report to upstream so the provenance stays visible.

minor licensing 2. Clear BSD licence is given the short name BSD-3-clause in debian/copyright ◂

Files: debian/copyright:8, debian/copyright:12, debian/copyright:15
Basis: checked, in the package or with a reference tool
Evidence: LICENSE:1 The Clear BSD License; README.md:343 License: \BSD 3-Clause Clear License`; the License paragraph in debian/copyright contains NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY THIS LICENSE., which is the Clear BSD clause and is not in the plain 3-clause text. copyright-format 7.1 says the listed short names must not be used to refer to any other licenses`.
Problem: The stanza names, and the full text included, describe the Clear BSD licence (SPDX BSD-3-Clause-Clear), but the short name given is BSD-3-clause, which per copyright-format 7.1 means the plain 3-clause licence. Parsers and readers are told the wrong licence; the terms themselves are correct and free.
Fix: Use the short name BSD-3-Clause-Clear in the Files: *, debian/* and stand-alone License stanzas (an arbitrary short name is allowed by copyright-format 7.1 where no standard one exists).

minor licensing 3. secsipidx.1 is credited to asipto.com although it says it was written by Victor Seva for Debian ◂

Files: secsipidx.1:97-99, debian/copyright:6-8
Basis: inferred from what was read, not seen directly
Evidence: This manual page was written by Victor Seva <vseva@debian.org>, for the Debian project (and may be used by others). The man page sits at the top of the source tree, so the Files: * stanza (Copyright: 2019-2026 asipto.com) is the one that matches it.
Problem: The file names a different author from the one the catch-all stanza credits. Writing a work does not transfer its copyright, so unless Victor Seva assigned it, the holder for this file is not asipto.com, and the Debian packaging stanza (Files: debian/*) does not reach it either.
Fix: Add a stanza for secsipidx.1 naming Victor Seva (with the Debian years or none), licensed BSD-3-Clause-Clear, or state in debian/copyright that upstream credits it to asipto.com.

minor packaging 4. Package descriptions contain typos, including the concatenation 'Building SIP identitysecsipidx' ◂

Files: debian/control:42, debian/control:57
Basis: checked, in the package or with a reference tool
Evidence: debian/control:42 Building SIP identitysecsipidx (missing space and a stray package name, plus a capital mid-sentence); debian/control:57 This package contains headers ans static libs.
Problem: These are the user-visible long descriptions shown by apt and packages.debian.org; the first is broken text and the second is misspelled (also - C headers files in the synopsis at line 52).
Fix: Reword to e.g. This package contains the CLI tool and HTTP API server for checking or building SIP identity headers. and This package contains the C headers and static libraries.

minor packaging 5. libsecsipid2t64 uses the time_t-transition t64 suffix for soname 2, which is new and was never part of the transition ◂

Files: debian/control:59, debian/control:61, debian/libsecsipid2t64.symbols:1
Basis: inferred from what was read, not seen directly
Evidence: Makefile.defs sets LIBVERMAJ ?= 2, and debian/libsecsipid2t64.symbols starts libsecsipid.so.2 libsecsipid2t64 #MINVER#; the previous package was libsecsipid1t64 shipping libsecsipid.so.1 (changelog 1.3.2-2.1 renamed it for the transition). Provides: ${t64:Provides} therefore expands to Provides: libsecsipid2 (= 2.0.0-1) — confirmed as the mechanism from the archive's libsecsipid1t64, which has Provides: libsecsipid1 (= 1.3.2-4).
Problem: The t64 suffix marks a package renamed because its library kept its soname across the 64-bit time_t transition. A new soname (libsecsipid.so.2) has never existed with 32-bit time_t, so it needs no rename: the package should be libsecsipid2, and the generated Provides: libsecsipid2 advertises a package name nothing depends on. The suffix also forces the lintian override package-name-doesnt-match-sonames that a correctly named package would not need.
Fix: Rename the binary package to libsecsipid2, drop the Provides: ${t64:Provides} and adapt Replaces/Breaks (no file overlap with libsecsipid1t64 remains once the soname changed), and remove debian/libsecsipid2t64.lintian-overrides.

Verified ◂

Read all of debian/ except debian/watch (out of scope): control, rules, changelog, copyright, gbp.conf, source/format, upstream/metadata, salsa-ci.yml, the three .install files, .manpages, .symbols and .lintian-overrides. There are no patches, maintainer scripts or debian/tests.
Read every upstream file: LICENSE, Makefile, Makefile.defs, README.md, go.mod, go.sum, main.go, main_test.go, secsipidx.1, .gitignore, .github/FUNDING.yml, .github/workflows/{go.yml,release.yaml}, csecsipid/{csecsipid.go,libsecsipid.h,Makefile,secsipid-1.pc,secsipid.h}, secsipid/{.gitignore,cache.go,cache_redis.go,secsipid.go,secsipid_test.go,system_cas.go} (large Go files sampled at the head and at each function boundary). The tree holds no binary, archive, image, font or minified file, and no PDF.
The pre-scan's author check reports every holder it found is named in debian/copyright; that check does not read the Copied and pasted comment, which is why the Go Authors gap above was found by reading the file rather than by it.
csecsipid/libsecsipid.h is generated (/* Code generated by cmd/cgo; DO NOT EDIT. */) from csecsipid/csecsipid.go, which is in the package; csecsipid/Makefile rebuilds it with go build -buildmode=c-shared, so its preferred form is present. The C API it declares matches the 13 entries in debian/libsecsipid2t64.symbols.
The fixtures named in secsipid/.gitignore (dummyCA.pem, dummyInterCA.pem, dummyCRLFile.crl, http_example.com_foo, http_localhost:5555_foo) are generated by the test suite and are not shipped.
No vendored third-party code: there is no vendor/ directory; go.mod/go.sum are checksums only and the dependencies come from Debian's golang-*-dev packages.
The upstream LICENSE is the Clear BSD licence, which is DFSG-free (it adds a patent disclaimer, not a restriction); the copyright years there (2019-2020) against 2019-2026 in debian/copyright are ordinary year drift.
Standards-Version 4.7.4 is current against Policy 4.7.4.1 (first two components match).
Build-Depends all exist: golang-github-redis-go-redis-dev 9.17.2-1, golang-github-gomagedon-expectate-dev 1.3.1-1 (with golang-github-google-go-cmp-dev), golang-github-google-uuid-dev, golang-any, dpkg-dev >= 1.22.5 for ${t64:Provides}.
dh-golang (Buildsystem/golang.pm) sets GO111MODULE=off and GOPROXY=off by default, so build-time dependency resolution uses /usr/share/gocode and ignores the versions pinned in go.mod.
The expectate dependency is marked <!nocheck> correctly: the golang buildsystem's test stage runs go test -v on the build targets, so the test dependency is real at build time.
Built-Using: ${misc:Built-Using} is populated by dh_golang, as the archive's libsecsipid1t64 shows (Built-Using: golang-1.27 (= 1.27.1-2), golang-github-google-uuid (= 1.6.0-1)).
.pc/ (quilt bookkeeping) was ignored throughout, as instructed; there is no debian/cargo-checksum.json.
uscan found the packaged version as the newest upstream release (upstream 2.0.0, packaged 2.0.0).

Not confirmed ◂

Whether secsipid/cache_redis.go compiles unchanged against Debian's go-redis 9.17.2 while go.mod asks for v9.23.0: GOPATH mode does not enforce the pin, so only a build would show it.
The autopkgtest generated for Testsuite: autopkgtest-pkg-go was not run, and no autopkgtest was available to inspect.
Whether Victor Seva assigned the copyright of secsipidx.1 to asipto: the man page's AUTHOR paragraph is the only statement in the package, and it does not say.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 5 hours ago, started 5 hours ago, completed 5 hours ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
2.0.0-1	1f92b77a…	2026-11-04 11:17	2026-11-04 11:17	dfsg-transition	rejected	VIEW

Back to Dashboard | View all reviews for this package