DFSG NEW review for sisu-build-api version 0.0.7-5

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable, without the current Format URL
• Scan before the review: nothing found

Licensing

Every shipped file is Apache-2.0. pom.xml and all six Java files in src/main and src/test carry an explicit Apache License Version 2.0 header by Sonatype, Inc. 2008; src/main/resources/.../version.properties is a three-line resource template with no header but is trivial and covered by the Files: * stanza. No non-free terms, no embedded third-party code, no built/preferred-form-of-modification problems (only pom.xml, Java sources and one text resource, no jars or minified content). debian/copyright is machine-readable and accurate: it names the correct holders (Sonatype Inc.; Ludovic Claude for debian/*), the Apache-2.0 short name matches the actual text, and the stand-alone License paragraph points to /usr/share/common-licenses/Apache-2.0. The prescan's author check confirms every holder found in the tree is named in debian/copyright.

Packaging

Packaging is clean and follows current Debian Java practice. debian/control has complete, resolvable Build-Depends (debhelper-compat 13, default-jdk, libplexus-component-metadata-java, libplexus-utils-java — a virtual package satisfied by libplexus-utils2-java — and maven-debian-helper >= 2.2); the binary libsisu-build-api-java is Architecture all with correct substvars and Breaks/Replaces on the old libplexus-build-api-java name for the rename (Closes: #1151719, version << 1.0~ correctly covers the archived 0.0.7-4). rules uses the plain dh sequencer at compat 13; both patches have DEP-3 headers and are applied. Standards-Version 4.7.4 matches current Policy 4.7.4.1; removing the Priority field follows Policy 4.7.3. maven-debian-helper metadata (poms, maven.rules, maven.ignoreRules) is consistent with the declared dependencies. No findings warranting a sponsor's attention.

Issues

1. [important] [licensing] debian/copyright does not declare the current copyright-format 1.0 URL

• Files: debian/copyright:1
• Basis: found by the review tooling's own checks
• Evidence: Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
• Problem: The first field must be exactly Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ (copyright-format 1.0, "Format" field). Anything else, including the http:// form and the URLs of the drafts that preceded 1.0, does not declare the file to be in the current format, and a file written to a draft may also use field names and licence short names that 1.0 changed.
• Fix: Replace the line as shown under Proposed changes, then check the rest of the file against copyright-format 1.0 (for example Upstream-Name, Upstream-Contact and Source in the header, not Name or Maintainer).

Verified

• Read debian/copyright, control, rules, changelog, source/format, watch, README.source, maven.rules, maven.ignoreRules, maven.properties and libsisu-build-api-java.poms in full; read both patches and patches/series.
• debian/copyright is machine-readable (begins with a Format: field; the http:// form is handled by the report tool itself) and uses only standard copyright-format 1.0 fields: Files: * / Copyright: 2008, Sonatype Inc. / Apache-2.0; Files: debian/* / Copyright: 2009, Ludovic Claude / Apache-2.0; stand-alone Apache-2.0 License paragraph.
• Global grep (gitignore: false) for copyright/licence wording across the tree, excluding .pc and debian: only the Apache License Version 2.0 header (Sonatype, Inc. 2008) on pom.xml and all six files under src/main/java and src/test/java; version.properties has no header but is a trivial 3-line resource template, correctly covered by Files: *.
• No LICENSE/COPYING/NOTICE/AUTHORS file is shipped; that is correct because the Apache-2.0 text lives in /usr/share/common-licenses/Apache-2.0, and the whole tree is a single licence.
• Tree contains no built artifacts, minified files, jars, class files, images or fonts: only pom.xml, Java sources and the version.properties resource, so every file's preferred form for modification is present.
• Prescan (dfsg-author-check) scanned 8 files and reported 'every holder found is named in debian/copyright' - no unresolved prescan items; every listed file accounted for above.
• Both patches in patches/series carry DEP-3 headers (0001 Description+Origin, 0002 Description+Author+Forwarded: no) and are applied to the tree (EmptyScanner.java already contains setFilenameComparator added by 0002). 0001 switches metadata generation to plexus-component-metadata, matching the Build-Depends-added libplexus-component-metadata-java.
• All Build-Depends resolve in the archive: debhelper-compat 13, libplexus-component-metadata-java, libplexus-utils-java (provided by libplexus-utils2-java 3.4.2-1), maven-debian-helper 2.6.9 (>= 2.2).
• Rename mechanics checked against Policy 7.6: Breaks+Replaces libplexus-build-api-java (<< 1.0~) covers the archived old binary libplexus-build-api-java 0.0.7-4 (1.0~ compares greater than 0.0.7).
• Policy examined via policy tool: current version 4.7.4.1, so Standards-Version 4.7.4 is current (first two components match); dropping the Priority field follows A10.3 (Policy 4.7.3).
• Apt-cache confirmed libplexus-container-default1.5-java (the target of the maven.rules plexus-container-default -> 1.5.5 mapping, i.e. the ${maven:OptionalDepends} Recommends) exists.
• uscan found the packaged version as the newest upstream release (upstream 0.0.7, packaged 0.0.7).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• Could not exhaustively list reverse-dependencies on the old binary name libplexus-build-api-java (no reverse-dependency tool); the likely consumers were checked and none still depend on it (e.g. libmaven-shared-incremental-java 1.1-6 does not), so the rename without a Provides appears safe, but a full archive check would settle it.
• Package could not be built (read-only review); the build machinery is standard dh + maven-debian-helper and the previous release 0.0.7-4 built successfully, so no build issue is suspected.