tordnsel 0.4.0-1

Package Information

Description	DNS-based list of Tor exit nodes TorDNSEL answers, over DNS and HTTP, the question "which Tor exit nodes will connect to me?". Rather than listing every Tor relay, it lists only the exits whose exit policy permits connections to a given destination, and it can test exits actively to find the addresses they really exit from. It is an authoritative DNS server for a DNSBL-style zone (over UDP and TCP) that also answers the Tor Project's form of exit list query, with an optional HTTP interface compatible with check.torproject.org's /api/ip and /torbulkexitlist and optional Prometheus metrics. It needs a local Tor client with a control port.
Maintainer	Masayuki Hatta <mhatta@debian.org>
Changed By	Masayuki Hatta <mhatta@debian.org>
Sponsor	mhatta@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/debian/tordnsel.git (browse)
Closes	#1153071
Tracker	https://tracker.debian.org/pkg/tordnsel
Uploaded	1 hour ago

New Package Report

.changes◂

Distribution	unstable
Date	Fri, 06 Nov 2026 07:08:16 +0900
Source	tordnsel
Version	0.4.0-1
Changed-By	Masayuki Hatta <mhatta@debian.org>
Architecture	source amd64

Changelog◂

tordnsel (0.4.0-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1153071)

.dsc◂

Section	net
Priority	optional
Component	main
Package-List	tordnsel deb net optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: tordnsel
Upstream-Contact: Masayuki Hatta <mhatta@mhatta.org>
Source: https://github.com/mhatta/tordnsel

Files: *
Copyright: 2007-2011 tup
           2013 David Kaloper
           2016 Arlo Breault
           2026 Masayuki Hatta
License: public-domain

Files: debian/*
Copyright: 2026 Masayuki Hatta <mhatta@debian.org>
License: public-domain

License: public-domain
 The person or persons who have associated work with this document (the
 "Dedicator" or "Certifier") hereby either (a) certifies that, to the
 best of his knowledge, the work of authorship identified is in the
 public domain of the country from which the work is published, or (b)
 hereby dedicates whatever copyright the dedicators holds in the work of
 authorship identified below (the "Work") to the public domain. A
 certifier, moreover, dedicates any copyright interest he may have in the
 associated work, and for these purposes, is described as a "dedicator"
 below.
 .
 A certifier has taken reasonable steps to verify the copyright status of
 this work. Certifier recognizes that his good faith efforts may not
 shield him from liability if in fact the work certified is not in the
 public domain.
 .
 Dedicator makes this dedication for the benefit of the public at large
 and to the detriment of the Dedicator's heirs and successors. Dedicator
 intends this dedication to be an overt act of relinquishment in
 perpetuity of all present and future rights under copyright law, whether
 vested or contingent, in the Work. Dedicator understands that such
 relinquishment of all rights includes the relinquishment of all rights
 to enforce (by lawsuit or otherwise) those copyrights in the Work.
 .
 Dedicator recognizes that, once placed in the public domain, the Work
 may be freely reproduced, distributed, transmitted, used, modified,
 built upon, or otherwise exploited by anyone for any purpose, commercial
 or non-commercial, and in any way, including by methods that have not
 yet been invented or conceived.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for tordnsel version 0.4.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 2 found

Licensing

Every upstream file is under the same public-domain dedication. debian/copyright is DEP-5 with a Files: * stanza naming tup (2007-2011), David Kaloper (2013), Arlo Breault (2016) and Masayuki Hatta (2026), a debian/* stanza, and a stand-alone License: public-domain paragraph that reproduces the top-level LICENSE (Creative Commons' Public Domain Dedication and Certification) in full. All 40-odd .hs/.hsc/.cabal sources carry -- License : Public domain (see LICENSE) and no other licence appears anywhere in the tree, so the catch-all stanza plus the debian stanza describes every file. The only term the prescan flagged, commercial or non-commercial in LICENSE:27 and debian/copyright:44, is permissive ('may be freely ... exploited by anyone for any purpose, commercial or non-commercial'), not a restriction of use, so there is no DFSG problem.

Packaging

Careful, modern packaging: debhelper compat 14 with dh-sequence-haskell and dh-sequence-single-binary, tests enabled through haskell-devscripts' DEB_ENABLE_TESTS and correctly guarded by nocheck, a systemd unit deliberately not enabled until the zone is configured (documented in README.Debian and the conffile), sysusers integration for the tordnsel user, and three autopkgtests whose dependencies match what they run. Build-Depends cover every non-boot library in the cabal file and resolve in the archive; Vcs-*, upstream/metadata, gbp.conf, salsa-ci.yml and the changelog are in order; there are no patches and no maintainer scripts.

Issues

None.

Verified ◂

LICENSE and debian/copyright:44 were both flagged by the prescan for the clause ... exploited by anyone for any purpose, commercial or non-commercial .... That wording is a permission, not a restriction: the same paragraph says the work may be freely reproduced, distributed, transmitted, used, modified, built upon, so it is a normal public-domain dedication and DFSG-free.
Tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public/Lesser, Apache License, Mozilla Public, public domain, All rights reserved, BSD, MIT, redistribut matched only the -- License : Public domain (see LICENSE) headers (all .hs/.hsc/.cabal sources, including tests/), copyright: Public domain in tordnsel.cabal, and the two files above. There is no second licence anywhere in the tree and no LICENSE/COPYING/NOTICE file in any subdirectory.
Copyright evidence matches the copyright file: file headers name tup.tuple@googlemail.com and Masayuki Hatta <mhatta@mhatta.org> (e.g. src/TorDNSEL/DNS.hs:6, src/TorDNSEL/AddressPattern.hs:6) and tordnsel.cabal says author: tup; David Kaloper and Arlo Breault are named in the copyright file for earlier upstream versions and no file names any other holder, matching dfsg-author-check's 'every holder found is named'.
debian/copyright is DEP-5 with the correct Format URL, Files: * plus Files: debian/*, and its stand-alone License: public-domain paragraph reproduces LICENSE verbatim. Since * matches /, debian/source/format, debian/tests/* and the debian/*.service file are covered by the later debian stanza.
doc/tordnsel.8 is hand-written troff shipped as source (no generator and no missing source document); doc/torel-design.md, README.md, TODO.md, ChangeLog, .github/workflows/ci.yml and .gitignore are ordinary text under the same dedication.
tests/data/descriptor-0.4.9.txt and tests/data/ns-all-0.4.9.txt are Tor 0.4.9 descriptor and consensus dumps used as unit-test fixtures by tests/TorDNSEL/*, not code; the line that matched the licence grep there is base64 signature material.
contrib/cacti-input.pl, config/tordnsel.conf.sample, config/tordnsel-init.d-script.sample, contrib/tordnsel-init.d-script.sample and contrib/tordnsel.service carry no separate licence header and fall under Files: *; the init.d samples' # Author: Jacob Appelbaum line is template boilerplate (the template tells the copier to replace it) and is not a copyright notice.
No vendored third-party code and no embedded HTML/JS/CSS: grep for <html, <script, javascript, jquery, chart.js in src/ and app/ found nothing, and the HTTP interface builds its output in TorDNSEL.Web.Internals.
No built, minified or generated files in the tree; the only .hsc files (src/TorDNSEL/Main.hsc, Util.hsc, Log/Internals.hsc) are hsc2hs sources, not its output.
debian/control: every non-boot cabal dependency is in Build-Depends; checked in the archive that libghc-network-dev 3.2.8.0 satisfies >= 3.1 and the cabal bound < 3.3, that libghc-cryptohash-sha256-dev is 0.11.102.1, that dh-sequence-haskell is provided by dh-haskell 0.6.13 and dh-sequence-single-binary by debhelper 14.5. HUnit/QuickCheck as <!nocheck> is right because /usr/share/perl5/Debian/Debhelper/Buildsystem/haskell.pm:139-141 only passes --enable-tests when DEB_ENABLE_TESTS=yes and nocheck is not set.
debian/tordnsel.sysusers is used: dh_installsysusers is in the default dh sequence from compat 14 (checked with the debhelper tool), installs it as /usr/lib/sysusers.d/tordnsel.conf and adds systemd | systemd-standalone-sysusers | systemd-sysusers to misc:Depends, which dh_gencontrol places itself at compat 14. The unit's User=/Group=tordnsel therefore gets a real system user.
override_dh_installsystemd uses --no-enable --no-start, both valid options (dh_installsystemd(1) SYNOPSIS); the unit is intentionally not enabled and the reason is documented in README.Debian and debian/tordnsel.conf. The hardening in the unit is consistent with the code: CAP_NET_BIND_SERVICE for port 53, StateDirectory/RuntimeDirectory matching the conffile, SIGHUP reload implemented at src/TorDNSEL/Main.hsc:380-440, and --verify-config implemented at Main.hsc:338-355.
Depends names ${misc:Depends} and ${shlibs:Depends} explicitly (harmless at compat 14), and Depends and Recommends both end with a trailing comma; dpkg-gencontrol re-parses relationship fields with Dpkg::Deps (deps_parse, whose split drops a trailing empty element) and rewrites them canonically, so this is not a fault.
debian/tests/control matches the three scripts: bind9-dnsutils for dig and curl for the HTTP check in serve, tor for tor-socket, tordnsel for all. The log line tor-socket waits for exists (src/TorDNSEL/NetworkState/Internals.hs:566) and the "listed" JSON key it greps exists in Web/Internals.hs:485-522.
Standards-Version 4.7.4 against Policy 4.7.4.1: same first two components, so current enough. changelog 0.4.0-1/unstable, maintainer address matching debian/control, and the changelog date (Fri, 06 Nov 2026) and README.Debian date (Thu, 05 Nov 2026) agree with the calendar. Vcs-Git/Vcs-Browser, upstream/metadata, gbp.conf (debian/latest, pristine-tar) and salsa-ci.yml are consistent with the salsa layout.
No debian/patches, and none are needed: 3.0 (quilt) with the unmodified GitHub-snapshot orig tarball (top directory mhatta-tordnsel-1d9141b, no debian/ inside).
The binary does not read cabal data-files at runtime (no Paths_tordnsel or getDataFileName anywhere), so the library and data files the Haskell install leaves in debian/tmp and debian/tordnsel.install does not ship are harmless, and haskell.pm sets dh_missing to --list-missing anyway.
README.md's Limitations section still says DNS is served over UDP only although the man page, ChangeLog 0.2.2 and debian/tests/serve all cover TCP; an upstream documentation slip, not a licensing or packaging defect.
README.md and config/tordnsel.conf.sample tell users to create the tordnsel user with adduser; the Debian package does this with debian/tordnsel.sysusers instead, the correct split, with upstream docs left unrewritten.
uscan found the packaged version as the newest upstream release (upstream 0.4.0, packaged 0.4.0).

Not confirmed ◂

Read-only review: could not build the package or run the autopkgtests, and could not inspect file modes, so I did not verify that debian/tests/{smoke,serve,tor-socket} are executable or that dh_install finds usr/bin/tordnsel in debian/tmp.
Did not check ITP bug #1153071 (no BTS access), so the changelog's Closes: is unverified.
Took the Debian tor package behaviour README.Debian describes (/run/tor/control, /run/tor/socks, debian-tor group, group-readable cookie) on trust; did not read the tor package itself.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Back to Dashboard | View all reviews for this package