libcentres-java_1.4-1_amd64.changes REJECTED

[Andrew McMillan]

Hi,

Several of these issues might be incorrect: please advise if they are wrong so I can ignore them on a future upload. In particular I did not attempt to build the package, so the assertions about FTBFS on current buildds may be incorrect however the licensing issues #3 and #4 below need fixing before I can accept.


1. [packaging] Build fails: pom pins javac source/target 1.7, but default-jdk is OpenJDK 25

 - Files: `pom.xml:64-66`, `debian/control:11`
 - Evidence: `pom.xml` `maven-compiler-plugin` configuration `<source>1.7</source><target>1.7</target>`; `Build-Depends: default-jdk`; apt-cache shows default-jdk -> openjdk-25-jdk.
 - Problem: javac since JDK 20 errors with "Source option 7 is no longer supported. Use 8 or later." The parent pom's compiler configuration propagates to the `core`, `cdk` and `opsin` modules, so `mvn package` cannot compile any main source on the current unstable toolchain (Build-Depends `default-jdk`). maven-debian-helper (2.6.9) does not rewrite pom compiler settings, and `debian/maven.properties` only sets `maven.test.skip=true`. This is a build failure on current archive buildds.
 - Fix: Add a quilt patch raising the compiler `source`/`target` (or use `maven.compiler.release`) to 8 or higher, and bump the compiler plugin as needed.

2. [packaging] cdk module's shade plugin builds an uberjar that embeds the whole CDK

 - Files: `cdk/pom.xml:94-107`, `debian/libcentres-java.poms`, `debian/clean:1`
 - Evidence: `maven-shade-plugin` execution bound to `package` with `<finalName>centres</finalName>` (no `shadedArtifactAttached`), so it replaces the module's main artifact; `debian/clean` contains `cdk/dependency-reduced-pom.xml` (a shade by-product), proving the plugin runs during the Debian build; `libcentres-java.poms` installs `cdk/pom.xml`'s jar with no option to install the unshaded artifact.
 - Problem: The installed centres-cdk jar would bundle a full copy of CDK (LGPL-2.1 code) even though CDK is already packaged as `libcdk-java` and is a Build-Depends/Runtime-Depends of this package. That contradicts Policy 4.13 (embedded code copies) and makes the BSD-2 attribution in `debian/copyright` for that jar incomplete, since the embedded CDK classes are not covered by it.
 - Fix: Disable the shade plugin for the Debian build (or build and install the unshaded jar) so the package relies on the CDK classes from `libcdk-java`; verify the installed jar's contents.

3. [licensing] BSD-2-clause License stanza in debian/copyright is truncated

 - Files: `debian/copyright:36`
 - Evidence: Stanza ends `...ARISING IN ANY WAY OUT OF THE USE OF THIS`; the LICENSE file (lines 22-23) continues `...OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.`
 - Problem: BSD-2-clause is not in `/usr/share/common-licenses`, so the complete text must be reproduced in
 `debian/copyright` (copyright-format 6.7) and thus in the binary package's copyright file. The last sentence of the warranty disclaimer is missing.
 - Fix: Append the missing final sentence to the `License: BSD-2-clause` stanza.

4. [licensing] Root pom.xml declares LGPL-3.0 while actual license is BSD-2

 - Files: `pom.xml:26-31`
 - Evidence: `<licenses><license><name>GNU Lesser General Public License, Version 3.0</name>` while the top-level `LICENSE` (BSD-2) and `README.md` say "BSD 2-Clause", and `debian/copyright` attributes `pom.xml` to BSD-2-clause.
 - Problem: Leftover upstream metadata: this pom is installed by maven-debian-helper (`libcentres-java.poms`), so the shipped `/usr/share/maven-repo/.../centres-1.4.pom` advertises LGPL-3.0, contradicting the package's copyright and the actual license grant.
 - Fix: Fix the `<licenses>` block upstream to BSD-2 (or document the mismatch with a Comment in `debian/copyright` and contact upstream).

5. [packaging] Outdated Standards-Version (4.7.0, current is 4.7.4.1)

 - Files: `debian/control:15`
 - Evidence: `Standards-Version: 4.7.0`; Policy tool reports Debian Policy version 4.7.4.1.
 - Problem: The Standards-Version does not reflect the current Policy; section 4.1 requires a maintainer to aim for conformance with the latest Policy, and newer 4.7.x releases contain relevant clarifications.
 - Fix: Bump Standards-Version to 4.7.4.1 after checking the A10 upgrading checklist.


Thanks!

Further information may be found at:
   https://dfsg-new-queue.debian.org/reviews/libcentres-java

What to do next:

Unless the review says otherwise, this is a request for changes to this
upload and not a rejection of the package itself. Please fix the points
raised and upload again in the usual way, saying in the changelog what
has changed. The reviewer is told when a package they have reviewed is
uploaded again, and will normally look at it ahead of the rest of their
queue.

If anything in the review is unclear, or you believe it is mistaken,
please reply to this email. Your reply goes to the reviewer, and that is
the normal first step.

Questions about uploading again:
   https://dfsg-new-queue.debian.org/docs/FAQ#resubmit
Common reasons for rejection:
   https://dfsg-new-queue.debian.org/docs/FAQ/REJECT

Regards, Andrew McMillan
Member of the DFSG, Licensing & New Packages Team



===

Please feel free to respond to this email if you don't understand why
your files were rejected, or if you upload new files which address our
concerns.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261012/d2948083/attachment.sig>