The Debian NEW review of golang-github-roaringbitmap-roaring-v2 2.29.0-1 has
been completed.
Decision: ACCEPTED
Reviewer: Andrew McMillan
Review comment:
Hi,
in debian/copyright: the License: BSD-3-Clause text is truncated mid-sentence.
It ends at:
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
…and jumps straight to License: Apache-2.0, missing the closing clause OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. (compare with the
complete text at runcontainer.go:32). The embedded license is incomplete/invalid
1. Stale dependencies
golang-github-glycerine-go-unsnap-stream-dev and golang-github-tinylib-msgp-dev
are listed in both Build-Depends and Depends, but nothing in the source tree
imports or uses msgp or unsnap-stream anymore. They only appear in control,
roaring64/Makefile (dev deps target), and README.md. They should be dropped.
2. Missing build dependency
production amd64 code imports golang.org/x/sys/cpu (bitsetops_avx512_amd64.go,
popcnt_avx512_amd64.go, fillbits_vbmi2_amd64.go), but golang-golang-x-sys-dev
is absent from both Build-Depends and Depends. With no vendor/ dir and
module-aware dh-go, this is a required build dep.
3. Wrong Depends set on the -dev binary
the manually curated Depends mixes test-only/build-only deps with runtime deps:
- golang-github-stretchr-testify-dev and golang-github-google-uuid-dev are used
only in _test.go files (e.g. roaring64/bsi64_test.go for uuid), not by library
consumers — they shouldn't be runtime Depends.
- Conversely the real runtime dep golang-golang-x-sys-dev is missing.
- Notably the field uses ${misc:Depends} but not ${golang:Depends}, so
dh-golang isn't auto-populating the runtime dependency set; the hand-curated
list is what ships and it's incorrect/incomplete.
I hope this analysis is useful.
Thanks!
Full review details:
https://dfsg-new-queue.debian.org/reviews/golang-github-roaringbitmap-roaring-v2
