DFSG NEW review for node-uplot version 1.6.32+ds1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 1 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable

Licensing

debian/copyright is in DEP-5 format 1.0 and correctly documents the main library (Expat, Leon Sorokin) and demos/lib/ASAP-optimized.js, but it does not describe the vendored third-party files under demos/lib. In particular demos/lib/placement.min.js is a minified copy of the third-party MIT placement.js library, carries no copyright or licence notice, and is covered by the blanket Files: * stanza attributing it to Leon Sorokin. Several other files (uDSV.iife.min.js, sgg.js, ASAP-simple.js) and the Chartist.js/gist-derived paths in src/ are likewise unattributed. The licences involved are all free, so nothing is non-free, but debian/copyright is inaccurate and incomplete as required by Policy 12.5 and the machine-readable format.

Packaging

The packaging is mostly conventional and sensible (dh, buildsystem nodejs, DEP-5 copyright, autopkgtest-pkg-nodejs, valid Build-Depends), but debian/clean omits the generated file dist/uPlot.min.css that rollup.config.js writes on every build, which leaves the tree dirty and makes a source build (dpkg-buildpackage without -b/-B, or gbp buildpackage) fail against the 3.0 (quilt) orig tarball. The rest of debian/ (control, rules, changelog, gbp.conf, tests, upstream/metadata) is in order.

Issues

1. [blocker] [licensing] debian/copyright misattributes and omits vendored third-party files in demos/lib

• Files: debian/copyright:9-11, demos/lib/placement.min.js:1, demos/lib/uDSV.iife.min.js:1, demos/lib/sgg.js:1, demos/lib/ASAP-simple.js:1
• Evidence: placement.min.js begins // https://tobyzerner.github.io/placement.js/dist/index.js followed by the whole minified body and contains no Copyright or licence text; uDSV.iife.min.js begins /*! https://github.com/leeoniya/uDSV (v0.5.3) */; sgg.js begins // https://github.com/mljs/savitzky-golay-generalized; debian/copyright has Files: * / Copyright: 2022 Leon Sorokin <leeoniya@gmail.com> / License: Expat.
• Problem: The Files: * stanza assigns every file outside debian/ - including these vendored files - to Leon Sorokin under Expat. demos/lib/placement.min.js is a minified copy of the third-party MIT-licensed placement.js (per the URL), so its copyright holder is not Leon Sorokin and the Expat notice, which the licence requires be preserved in all copies, is absent from the file; it is also shipped only in minified form without its source. uDSV.iife.min.js and sgg.js likewise come from other projects, and ASAP-simple.js carries no copyright or licence statement at all. These files are part of the source package Debian distributes, so Policy 12.5 and the machine-readable copyright format require debian/copyright to name their holders and licences (and the corresponding stanzas from the other Projects' stanzas to be broken out).
• Fix: Give each vendored file its own Files stanza with the correct copyright holder and licence (with the notice text), or, since they are demo-only vendored bundles, exclude them from the tarball (add them to Files-Excluded and repack) and make debian/copyright say so. Do not leave them under the blanket Leon Sorokin stanza.

2. [important] [packaging] debian/clean omits the generated dist/uPlot.min.css

• Files: debian/clean:1, rollup.config.js:14
• Evidence: rollup.config.js:14 fs.writeFileSync('./dist/uPlot.min.css', minicss); executes unconditionally whenever rollup loads the config; debian/clean contains only dist/*.js.
• Problem: The build (debian/nodejs/build runs rollup -c --bundleConfigAsCjs, which the nodejs buildsystem runs in the source tree) generates dist/uPlot.esm.js, uPlot.cjs.js, uPlot.iife.js, uPlot.iife.min.js and dist/uPlot.min.css. Only the *.js files are cleaned, so dist/uPlot.min.css is left behind after the build. Building the source package (dpkg-buildpackage without -b/-B, or gbp buildpackage, which this package's debian/gbp.conf configures) then fails: the 3.0 (quilt) format refuses a non-empty diff against the orig tarball (see dpkg-source(1), 'Building' for 3.0 (quilt): 'When the diff is non-empty, the build fails unless --single-debian-patch or --auto-commit has been used'). It also leaves the working tree dirty and would ship the file if dist/ is installed.
• Fix: Add dist/*.css (or dist/*.min.css) to debian/clean so the generated CSS is removed like the generated JS.

3. [minor] [licensing] Third-party code adapted into src/ is not attributed

• Files: src/paths/monotoneCubic.js:7, src/paths/catmullRomCentrip.js:8
• Evidence: monotoneCubic.js:7-8 // Monotone Cubic Spline interpolation, adapted from the Chartist.js implementation: + a github.com/gionkunz/chartist-js URL; catmullRomCentrip.js:8 // adapted from https://gist.github.com/nicholaswmin/c2661eb11cad5671d816 (MIT).
• Problem: Both files are covered only by the blanket Files: * stanza (Leon Sorokin/Expat). The Expat/MIT terms require the original copyright and permission notice to be retained for derived code, so the upstream holders (Chartist.js and the gist author) should be recorded. The licences are compatible, so this is a completeness/accuracy matter, not a DFSG violation.
• Fix: Add the upstream copyright holders and the applicable notice to debian/copyright (e.g. a Files stanza for src/paths/monotoneCubic.js), or note the adaptations there.

Verified

• debian/copyright is machine-readable (DEP-5) with an exact Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ first line; every stanza, the standalone Expat paragraph and Files-Excluded: were read.
• Full file inventory taken with glob; greps for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby granted/GNU/Apache/MPL/public domain/All rights reserved and for adapted/ported/based on/min.js across the whole tree (excluding .pc/), and LICENSE (upstream) plus docs/README.md, README.md and package.json read.
• Every demos/lib/*.js header read; demos/lib/placement.min.js, uDSV.iife.min.js and sgg.js confirmed from their first lines and checked to contain no copyright/licence text.
• debian/control, rules, changelog, clean, gbp.conf, source/format, nodejs/build, nodejs/extlinks, tests/pkg-js/test and upstream/metadata read; no debian/patches directory exists.
• Build-Depends names checked against the archive: debhelper 14.5 provides dh-sequence-single-binary, dh-nodejs 0.17.13 provides dh-sequence-nodejs, rollup 3.30.0 and node-rollup-plugin-terser 7.0.2 exist. Standards-Version 4.7.4 vs current Policy 4.7.4.1 is not a problem.
• Binary/other files recorded by name and not opened: dist/uPlot.d.ts (text), img/.png, uPlot.png, perf.png, demos/data/.csv|json, bench/data.json, bench/results.json.
• uscan found the packaged version as the newest upstream release (upstream 1.6.32, packaged 1.6.32+ds1).

Not confirmed

• Whether demos/ and bench/ (and hence the vendored files in demos/lib) are installed into the binary package: this depends on pkg-js-tools/dh-nodejs, which is not installed on the reviewing system, and I could not read its install rules. They are definitely present in the source package, which is what the copyright finding rests on.
• Whether Debian's node-rollup-plugin-terser 7.0.2 provides the '@rollup/plugin-terser' import used by rollup.config.js: the package's Provides list (node-ascjs, node-smob) is consistent with @rollup/plugin-terser, and debian/nodejs/extlinks names '@rollup/plugin-terser', so the mapping probably exists, but I could not confirm it; a build would show it.

Proposed changes

None.