DFSG NEW review for jackson-modules-base version 2.18.11-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All the source is under free licences and the tree is DFSG-clean, but debian/copyright does not accurately describe every file: four Blackbird source files are held by Data Geekery GmbH and are not named by any stanza, whose Files: * catch-all attributes everything to FasterXML, LLC. The ASM/INRIA BSD text found in three META-INF/LICENSE files is a third-party dependency notice, not a copyright claim over any file in the tree. No non-free terms, no built binaries and no bundled third-party sources were found.

Packaging

Packaging is clean and follows the Java Team's maven-debian-helper pattern: DEP-5 copyright, 3.0 (quilt) source format, debhelper-compat 13 with an autodetected maven buildsystem, correct Build-Depends, one arch:all binary, sound changelog and Vcs-* fields, Standards-Version 4.7.4 against Policy 4.7.4.1. The only gap is the absence of any autopkgtest.

Issues

1. [blocker] [licensing] debian/copyright omits Data Geekery GmbH as copyright holder of four Blackbird files

• Files: blackbird/src/main/java/com/fasterxml/jackson/module/blackbird/util/CheckedFunction.java:2, blackbird/src/main/java/com/fasterxml/jackson/module/blackbird/util/CheckedSupplier.java:2, blackbird/src/main/java/com/fasterxml/jackson/module/blackbird/util/Sneaky.java:2, blackbird/src/main/java/com/fasterxml/jackson/module/blackbird/util/Unchecked.java:2, debian/copyright:8-10
• Evidence: Copyright (c), Data Geekery GmbH, contact@datageekery.com (four files); the Files: * stanza says Copyright: 2012-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>.
• Problem: The catch-all stanza attributes the whole tree to FasterXML, LLC only. These four files are a different copyright holder, so debian/copyright is inaccurate and incomplete for the sources it covers (Policy 4.5, machine-readable copyright-format 1.0). The licence itself (Apache-2.0) is compatible and correctly identified.
• Fix: Add a stanza before the catch-all, e.g. Files: blackbird/src/main/java/com/fasterxml/jackson/module/blackbird/util/* / Copyright: Data Geekery GmbH / License: Apache-2.0.

2. [minor] [packaging] No autopkgtest

• Files: debian/tests/control
• Evidence: debian/ contains no tests/ directory, so the package declares no test for the archive's autopkgtest runners.
• Problem: Nothing exercises the installed module in the archive's test infrastructure; a future dependency or JDK change that breaks the module would not be caught. This is practice, not a Policy requirement, so it is minor.
• Fix: Add a small debian/tests/control with a smoke test (e.g. compile and run a class that registers libjackson2-module-jaxb-annotations-java on an ObjectMapper) plus its script.

3. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Evidence: 2.18.11-1
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• debian/copyright is DEP-5 with the correct Format URL, Upstream-Name/Source/Upstream-Contact, a Files-Excluded naming mvnw* and .mvn/* (neither present in the tree, so consistent), and an Apache-2.0 stanza referring to /usr/share/common-licenses/Apache-2.0.
• The top-level LICENSE is the full Apache-2.0 text; each module's src/main/resources/META-INF/LICENSE/NOTICE repeats the Apache-2.0 Jackson notice. All module main sources sampled (afterburner, blackbird, guice, guice7, jaxb, mrbean, no-ctor-deser, osgi, paranamer, android-record, jakarta-xmlbind) carry the project Apache-2.0 terms and, apart from the Data Geekery files noted above, no per-file copyright holder.
• INRIA, France Telecom in afterburner/blackbird/mrbean src/main/resources/META-INF/LICENSE occurs inside the ASM BSD-3-clause text under the heading Additional licensing information exists for following 3rd party library dependencies. ASM is only a Maven dependency (org.objectweb.asm imports, shaded at build); no ASM source is bundled and no file in the tree is INRIA-copyrighted, so no stanza is required. The same text in mrbean's LICENSE is the identical ASM notice.
• No built artifacts found: no .jar, .class, .so, .dll, .exe, .pyc or minified js/css anywhere in the tree.
• docs/javadoc/* (afterburner, blackbird, guice, jakarta-xmlbind, jaxb, mrbean, no-ctor-deser, osgi, paranamer, versions 2.8-2.12) is pre-generated Javadoc HTML committed by upstream; it is not installed by the binary package, it documents sources present in the tree, and its only binary assets are the standard Javadoc images (background.gif, tab.gif, titlebar.gif, titlebar_end.gif).
• blackbird/GenBlackbirdAccess.java is a plain Java source whose own comment states it is not compiled or shipped with Blackbird, just here for maintainer reference; it is therefore not a built file, though it carries no licence header and is covered by Files: *.
• @author tags (Eugene Petrenko in mrbean/TypeBuilder.java, Eran Leshem in android-record sources) are contributor attributions without a copyright claim, covered by the Files: * Apache-2.0 stanza.
• debian/rules uses dh $@; maven-debian-helper provides the third-party maven buildsystem, which debhelper's Dh_Buildsystems autoselects (third-party buildsystems are auto-selected when --buildsystem is absent), so no --buildsystem option is needed.
• Build-Depends binaries exist in the archive (e.g. libjackson2-core-java 2.18.11-1, libreplacer-java, libbuild-helper-maven-plugin-java, libmaven-bundle-plugin-java); Standards-Version 4.7.4 matches current Policy 4.7.4.1, and debian/changelog is a well-formed initial 2.18.11-1 unstable entry closing bugs.
• Files-Excluded targets (mvnw*, .mvn/*) are absent from the tree, so the repacking is consistent with debian/copyright.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.3, packaged 2.18.11), which is not a fault of the package.

Not confirmed

• The jaxb pom depends on jakarta.activation:jakarta.activation-api:1.2.2 (the javax.activation namespace) while Build-Depends names libjakarta-activation-java (2.0.0, jakarta.activation namespace) and the source imports javax.activation.DataHandler/DataSource; whether those imports resolve during the build (perhaps transitively through libjaxb-api-java -> libactivation-java) could only be settled by a build.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: glob: " /usr/share/perl5/Debian/Debhelper/Buildsystem/maven*.pm" is not a file of the package or of the reviewing system.

Proposed changes

None.