• Files: biosig4c++/t210/sopen_medilog.c:28-32, biosig4c++/t210/sopen_medilog.c:60-66

• Basis: checked, in the package or with a reference tool

• Evidence:

     Source - https://stackoverflow.com/a/52989329
     Posted by KamilCuk, modified by community. See post 'Timeline' for change history
     Retrieved 2026-09-30, License - CC BY-SA 4.0
  */
  void *memmem(...)
  ``` and ```
  \tThis implemenation is based on https://github.com/excitoon/ecg-tools
  \tspecifically medilog-dump commit 5d2626bbe3c6e42fd1e82cd057d144ab9ee0ab1d
  ```; the file's only copyright notice is `Copyright (C) 2026 Alois Schloegl`.
  

• Problem: The file is presented as GPL-3+ by Files: *, but it contains code under CC BY-SA 4.0 (a share-alike licence with an attribution requirement) and a reimplementation of a third-party project whose copyright holder and licence are not given. Neither the CC BY-SA 4.0 statement nor the ecg-tools authors appear in debian/copyright, and if ecg-tools is not GPL-compatible the whole medilog reader must be dealt with. Policy 12.5 requires the copyright file to record all of this.

• Fix: Record the CC BY-SA 4.0 snippet (or replace memmem with a locally written one, which is ten lines) and ask upstream to state ecg-tools' licence and holders; add both to debian/copyright.

4. [important] [packaging] uscan reports a warning for debian/watch

• Files: debian/watch

• Basis: found by the review tooling's own checks

• Evidence:

  The following paragraph isn't well formatted, skipping it: << ==EOF==
  #Source: https://sf.net/@PACKAGE@/
  #Matching-Pattern: @PACKAGE@-(\d[\d.]+).src@ARCHIVE_EXT@
  #Uversion-Mangle: s/.src//
  ==EOF==
  

• Problem: uscan must run without errors or warnings and find the upstream releases.

• Fix: Correct debian/watch so that uscan --report runs cleanly.

5. [minor] [licensing] t240's licence is a guess: the files say only 'subject to BSD license', no BSD text ships, and their ASN.1 input is missing

• Files: debian/copyright:44-87, biosig4c++/t240/ANY.c:1-4, biosig4c++/t240/Address.c:1-5
• Basis: inferred from what was read, not seen directly
• Evidence: Copyright (c) 2004 Lev Walkin <vlm@lionet.info>. All rights reserved. / Redistribution and modifications are permitted subject to BSD license. — no clause text; debian/copyright says License: BSD-4-clause with Comment: ... Assuming BSD-4-clause ... is meant and an uninstantiated text (This product includes software developed by the <organization>.). Address.c says Generated by asn1c-0.9.21 ... From ASN.1 module "FEF-IntermediateDraft" found in "../annexb-snacc-122001.asn1", and that file is not in the package (t241 does ship its four .asn1 inputs).
• Problem: Which BSD variant applies cannot be determined from the package, and the choice matters: an advertising clause (BSD-4-clause) is an extra restriction that the FSF holds incompatible with the GPL, yet these ASN.1 sources are compiled into the GPL-3+ libbiosig4 (WITH_FEF is set in biosig4c++/Makefile.in:355,491). The FEF decoder also lacks its preferred form for modification.
• Fix: Obtain asn1c 0.9.21's own licence text (or the statement upstream received from Lev Walkin), ship it, name the variant found, and ship annexb-snacc-122001.asn1 alongside the generated code.

6. [minor] [packaging] Symbols files are named for the former libbiosig2 package, so debhelper never reads them

• Files: debian/libbiosig2.symbols.amd64:1, debian/libbiosig2.symbols.arm64, debian/libbiosig2.symbols.mips64el, debian/libbiosig2.symbols.ppc64, debian/libbiosig2.symbols.ppc64el, debian/libbiosig2.symbols.s390x, debian/control:47
• Basis: checked, in the package or with a reference tool
• Evidence: The files are debian/libbiosig2.symbols.<arch> and start libbiosig.so.2 libbiosig2 #MINVER#; debian/control builds Package: libbiosig4. dh_makeshlibs(1) FILES: debian/package.symbols / debian/package.symbols.arch — package is the binary package name.
• Problem: With no debian/libbiosig4.symbols, dpkg-gensymbols is not run at all, so the package falls back to a plain SONAME-based shlibs entry and loses the per-symbol minimum versions; the five empty arch files are dead weight, and ppc64 is not even a Debian architecture. The amd64 file would also fail now, since it documents libbiosig.so.2 after the SONAME bump to 4.
• Fix: Rename to debian/libbiosig4.symbols (dropping the arch suffix, or keeping only arches that need it), regenerate its header from the current library, and delete the empty files.

7. [minor] [packaging] not-installed still excludes libbiosig3.so after the SONAME bump to 4

• Files: debian/not-installed:1-2

• Basis: checked, in the package or with a reference tool

• Evidence:

  # A symlink that does not match Debian's conventions for shared libraries
  usr/lib/*/libbiosig3.so
  ``` while biosig4c++/Makefile.in has `SONAMEVERSION ?= 4` and the changelog says `SONAME was bumped from 3 to 4`.
  

• Problem: The exclusion names a file the build no longer produces, so whatever unbalanced symlink the upstream install target now creates under the new name is not excluded — or, if none is created, the entry is dead. Either way the file no longer describes the build.

• Fix: Update the glob to the current name (or drop the entry after checking that d-shlibmove consumes everything).

8. [minor] [packaging] provide_header.patch stops biosigmodule.c from including the real header and duplicates its declarations instead

• Files: debian/patches/provide_header.patch:11-19, biosig4c++/python/biosigmodule.c:5-37, biosig4c++/python/biosigmodule.h:24
• Basis: checked, in the package or with a reference tool
• Evidence: The patch turns #if defined(_WIN32) into #if 1 // defined(_WIN32), so the #else #include <biosig.h> branch is now dead and the module compiles against hand-written typedef void HDRTYPE; plus extern prototypes for sopen_extended/sread/serror2/asprintf_hdr2json/…; biosigmodule.h then tests #if BIOSIG_VERSION>30002, a macro defined only in biosig.h, which is now undefined.
• Problem: The patch is named for providing the header but achieves the opposite: the module is compiled without any declaration from biosig.h, so a change of a prototype or of BIOSIG_VERSION in the library is not caught at build time, and the C-API pointer count (PyBiosig_API_pointers) silently drops the TOML entry point. A missing -I.. in the pybuild invocation is the actual cause.
• Fix: Drop the patch and pass the include directory to the Python build (e.g. setup.py include_dirs=['..'] in the upstream python/ setup, or PYBUILD/environment CPPFLAGS), so #include <biosig.h> works and the conditional stays as upstream wrote it; forward the include-path fix upstream.

Verified

• biosig4matlab/t310_ERDSMaps/Manual/erds.pdf is the scan's only document, and its source biosig4matlab/t310_ERDSMaps/Manual/erds.tex sits next to it; not a missing-source problem.
• biosig4matlab/t250_ArtifactPreProcessingQualityControl/resample_matrix.mat is a MATLAB data file loaded by biosig4matlab/t200_FileAccess/sload.m:1436 (x = load('resample_matrix.mat')); data, not a built artifact.
• biosig4matlab/t310_ERDSMaps/erdscolormap.mat is a MATLAB colour-map data file loaded by biosig4matlab/t310_ERDSMaps/plotErdsMap.m:135 and plotCombiMap.m:125; data, not a built artifact.
• biosig4matlab/t310_ERDSMaps/sample.gdf is a GDF recording shipped as sample data for the ERDS-mapping demo in the same directory; data, not a built artifact.
• biosig4matlab/t450_MultipleTestStatistic/gFWE.m is ordinary .m source (608 lines); it is flagged only for containing Latin-1 bytes instead of UTF-8.
• biosig4matlab/viewer/utils/detcolor.mat is a MATLAB data file loaded at biosig4matlab/viewer/sviewer.m:216 (Data.detcolor = load('detcolor.mat')); data, not a built artifact.
• biosig4matlab/viewer/utils/sviewer.fig is a MATLAB GUIDE figure definition; its hand-written code companion is biosig4matlab/viewer/sviewer.m in the parent directory.
• biosig4matlab/viewer/utils/sviewer_channel.fig is a MATLAB GUIDE figure definition with its hand-written companion biosig4matlab/viewer/utils/sviewer_channel.m beside it.
• biosig4matlab/viewer/utils/sviewer_channel_conf.fig is a MATLAB GUIDE figure definition with its companion biosig4matlab/viewer/utils/sviewer_channel_conf.m beside it (called from sviewer.m:1445).
• biosig4matlab/viewer/utils/sviewer_display.fig is a MATLAB GUIDE figure definition with its companion biosig4matlab/viewer/utils/sviewer_display.m beside it.
• biosig4matlab/viewer/utils/sviewer_fileinfo.fig is a MATLAB GUIDE figure definition with its companion biosig4matlab/viewer/utils/sviewer_fileinfo.m beside it (called from sviewer.m:1623).
• No non-free terms: greps for non-commercial, no-modification, field-of-use, research-only and CC-*-NC/-ND wording found only the standard GPL/LGPL body text; the only CC statement in the tree is the CC BY-SA 4.0 snippet reported above.
• Compiled licences are mutually compatible: GPL-2+ (t210, t220, mex/mexSLOAD.cpp), GPL-3+ (the rest), LGPL-2.1+/LGPL-3+ (win32/, t210/axon_structs.h), zlib (XMLParser/), MIT and public domain — all usable in the GPL-3+ libbiosig4.
• Licence texts present: top-level COPYING, biosig4matlab/LICENSE and biosig4c++/python/LICENSE are GPL-3; biosig4c++/t210/LICENSE is GPL-2, consistent with the GPL-2+ headers of t210.
• No Files-Excluded is needed: nothing in the tree has to be removed for DFSG reasons.
• Sampled file headers across biosig4c++, biosig4matlab (t2xx, t3xx, t4xx, t5xx, viewer, eeglab, maybe-missing, demo), tools/ and the bindings; not every one of the 921 files was read.
• Packaging read in full: control, rules, changelog, source/format, README.source, TODO, clean, docs, not-installed, install/links/manpages/examples files, symbols files, patches/series and the patch, tests/control, upstream/metadata, salsa-ci.yml.
• Standards-Version 4.7.4 against Policy 4.7.4.1 — current; debhelper compat 14, which adds the relationship substvars itself and makes dh_missing fail on uninstalled files.
• Build-Depends checked against the archive: python3-numpy-dev (also Provides dh-sequence-numpy3), libb64-dev, dh-octave, python3-build, d-shlibs all exist; ${octave:Depends}/${devlibs:Depends}/${python3:Depends} are supplied by dh-octave, d-shlibs and dh-python.
• Patches series applies to the tree as unpacked (biosig4c++/python/biosigmodule.c shows the patched #if 1).
• Not reviewed: debian/watch (checked separately).
• uscan found the packaged version as the newest upstream release (upstream 4.0.0, packaged 4.0.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed

• The ASN.1 and nomenclature files in biosig4c++/t241/*.asn1 and biosig4c++/11073-10102-AnnexB.i reproduce text from ISO/IEEE 11073 and CEN standards; Alois Schloegl licenses his extraction GPL-3+, but whether the underlying standard text may be redistributed cannot be established from the package.
• I did not diff the unpacked tree against biosig_4.0.0.orig.tar.xz, and did not build or run anything.

Proposed changes

None.