DFSG NEW review for swoval version 2.1.12+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5: a header with Upstream-Name/Source/Files-Excluded, a Files: * stanza (Ethan Atkins, Expat), a separate stanza for the top-level LICENSE (Google/AngularJS, Expat, with a Comment explaining the copied notice) and one for debian/*, plus a complete Expat licence paragraph. The tree holds exactly one licence text — that MIT LICENSE — and no file carries a conflicting notice; the code's MIT licence is also declared in project/com/swoval/Build.scala:64 and debian/poms/file-tree-views.pom. Nothing is non-free, no built artefacts remain, and the JNI libraries and minified npm output dropped by the +dfsg repack have their sources in the tarball.

Packaging

Compat 14 with the javahelper and maven-repo-helper dh sequences, jh_build installing /usr/share/java/swoval-file-tree-views.jar, Maven POM plus ignore rules for the test-scope dependencies, a fallback test run both at build time and as autopkgtest, Standards-Version 4.7.4 (Policy 4.7.4.1), Vcs-* fields and a sane initial changelog. The odd-looking --without=single-binary, the explicit ${misc:Depends} and the nocheck guard are all correct at compat 14, and the POM/jar/maven-repo wiring is consistent. No policy violation or real defect found.

Issues

None.

Verified

• The pre-scan listed no files of its own; its dfsg-author-check found the three holders recorded in debian/copyright (Ethan Atkins, Google/AngularJS, Juan Manuel Méndez Rey) and no missing holder.
• Read all of debian/ (control, rules, changelog, clean, copyright, .docs, .poms, poms/file-tree-views.pom, maven.ignoreRules, README.source, salsa-ci.yml, source/format, tests/{control,fallback,FallbackTest.java}, upstream/metadata, gbp.conf, watch); the .debian.tar.xz carries no debian/patches either.
• Inventoried the whole upstream tree (219 files: files/js, files/jvm incl. src/main/native, nio-js, project, scalagen, testing, utilities, code-style, .github, root dotfiles). The only licence text is LICENSE (MIT, Copyright (c) 2010-2018 Google, Inc. http://angularjs.org), matched by the Files: LICENSE stanza; no source file carries a copyright/licence header, and the project declares MIT in project/com/swoval/Build.scala:64.
• grep over the tree for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU/LGPL/Apache/MPL/BSD, public domain, All rights reserved, non-commercial, no-derivative, proprietary: no non-free term and no second licence anywhere.
• No built files in the tree: no .jar, .class, .so, .node, minified JS, PDF or archive. files/js/npm and files/jvm/src/main/resources/native are absent from the orig tarball; their sources are present (files/js/src; files/jvm/src/main/native/{posix,apple,windows}/.cc and Makefile), and include/jni/.h are javah output of the Java sources that are present.
• Dropping the JNI libraries does not break the library: DirectoryListers.init() catches UnsatisfiedLinkError/ExceptionInInitializerError and FileTreeViews falls back to NioDirectoryLister; debian/tests/FallbackTest.java checks exactly that and is run at build time and in autopkgtest.
• The only in-tree third-party credit is /** Taken from shapeless */ at testing/shared/src/main/scala/com/swoval/test/package.scala:122, for a five-line type-inequality helper in test-only code that the package build does not compile; not worth an issue, recorded here.
• The AngularJS notice in LICENSE is not a wrong holder: Files: LICENSE gives 2010-2018 Google, Inc. with Expat and its Comment says the file was copied from AngularJS, while the code is covered by Files: * under the MIT the POM declares.
• Packaging wiring checks out: javahelper 0.82 Provides dh-sequence-javahelper and maven-repo-helper 1.13 Provides dh-sequence-maven-repo-helper (apt-cache); dh translates '-' to '_' when loading addons (SequencerUtil.pm:482), so mh_install reads debian/libswoval-file-tree-views.poms — jh_build places the jar in /usr/share/java and mh_installjar (--java-lib --usj-name) links it into /usr/share/maven-repo.
• dh $@ --without=single-binary is correct at compat 14: dh(1) and debhelper-compat-upgrade-checklist document it as the way to keep dh_auto_install on debian/tmp and silence the implicit single-binary warning; nothing here uses dh_auto_install.
• Depends: ${java:Depends}, ${misc:Depends}, is harmless: jh_depends derives dependencies only from the jar (it references only java.* and its own classes) and dpkg-gencontrol deletes a relationship field that expands to nothing (Dpkg::Deps::deps_parse skips an all-empty value; /usr/bin/dpkg-gencontrol:357). A binary with no Depends field is allowed at compat 14.
• autopkgtest is sound: the spec guarantees the cwd is the unpacked source root, so Test-Command: debian/tests/fallback resolves; the test compiles into $WORK and does not write the source tree; Depends names default-jdk-headless and libswoval-java explicitly.
• Standards-Version 4.7.4 against Policy 4.7.4.1 — current; changelog 2.1.12+dfsg-1 on unstable, dated Wed 28 Oct 2026 (a Wednesday), initial release closing an ITP; Vcs-Git/Vcs-Browser/Homepage present; Multi-Arch: foreign is permitted for this arch:all pure-Java library (Policy 5.6.34.2).
• debian/poms/file-tree-views.pom (com.swoval:file-tree-views:2.1.12, MIT) and debian/maven.ignoreRules (dropping com.swoval:testing_2.12 and com.lihaoyi:utest_2.12) are consistent with each other and with the built jar name.
• uscan found the packaged version as the newest upstream release (upstream 2.1.12, packaged 2.1.12+dfsg).

Not confirmed

• code-style/intellij-java-google-style.xml is a 598-line IntelliJ scheme export (name GoogleStyle, including recent CLion/CIDR options) with no copyright or licence notice; whether it derives from Google's Apache-2.0 google-java-format scheme rather than being upstream's own export cannot be settled from the package, and it is not built into the binary.
• Whether the --has-package-version flag in debian/libswoval-java.poms gives the intended maven metadata: its documented meaning (the POM version equals the upstream part of the package version) does not hold here (POM 2.1.12 vs 2.1.12+dfsg), but maven-repo-helper's cleaner is a Java program I could not run, so the resulting installed POM could not be inspected.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: read: "/home/review/dfsg-review.md" is not a file of the package or of the reviewing system.

Proposed changes

None.