DFSG NEW review for bucklespring version 2.0.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The tree is DFSG-free: GPL-2+ throughout, with the GPL-2 text in LICENSE and the pointer to /usr/share/common-licenses/GPL-2 in debian/copyright, sources for every generated artefact (man pages, systemd units, udev rule, synthesised clips) present in the tree, and no non-free, field-of-use or no-modification terms anywhere. debian/copyright is DEP-5 with a stanza per contributor and clip set, but two stanzas do not name every holder the covered files themselves name: the generated man pages carry Ico Doornekamp's copyright and debian/po carries four translators', and both are overridden by stanzas that leave them out. That makes the file incomplete rather than wrong about any licence.

Packaging

Good quality: debhelper compat 14 with hardening and two build profiles that are gated consistently in control and rules, working and idempotent alternatives/udev/systemd-user-unit/debconf integration, correct Multi-Arch and dependency fields, a current Standards-Version and a changelog that closes its bugs. The one defect found is factual: the bucklespring-data-synth description calls beeper one of the generated clip sets and says make-clips.py makes it, though it was recorded by mejs.

Issues

1. [important] [licensing] debian/copyright's man/* stanza omits Ico Doornekamp, whose copyright the two .1 pages carry

• Files: debian/copyright:34-36, man/buckle-x11.1:176-177, man/buckle-libinput.1:204-205
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: Files: man/* / Copyright: 2016-2017 Dominik George <nik@naturalnet.de> / 2026 Barak A. Pearlmutter <bap@debian.org>; the pages it matches contain .SH COPYRIGHT / Copyright \(co 2016\-2025 Ico Doornekamp and .SH AUTHOR / Written by Ico Doornekamp.
• Problem: DEP-5 stanzas replace earlier ones for the files they match (copyright-format 6.9), so this stanza, not the Files: * stanza that names Ico Doornekamp, is the one that describes man/*. The two .1 pages are generated from the program's own --help and --version output, so most of their text and the copyright line in them are Ico's; the Copyright field therefore does not describe the copyright of these files.
• Fix: Add 2016-2025 Ico Doornekamp <ico@zevv.nl> to the Copyright field of the Files: man/* stanza.

2. [minor] [licensing] debian/copyright's debian/* stanza names no debconf translator, whose copyright is stated in debian/po

• Files: debian/copyright:78-80, debian/po/ca.po:2, debian/po/de.po:3, debian/po/es.po:2,8, debian/po/pt.po:5
• Basis: checked, in the package or with a reference tool
• Evidence: debian/po/ca.po: # Copyright © 2026 poc senderi <pocsenderi@protonmail.com>; de.po: # Helge Kreutzmann <debian@helgefjell.de>, 2026.; es.po: # Copyright (C) 2026 Software in the Public Interest, Inc. and Fierro Viejo <fierroviejo@fierroviejo.com>, 2026.; pt.po: # SPDX-FileCopyrightText: 2026 Américo Monteiro <a_monteiro@gmx.com>. The Files: debian/* stanza lists only Dominik George, Chris Hofstaedtler, Andreas Tille and Barak A. Pearlmutter, and its four po files' licence is settled by # This file is distributed under the same license as the bucklespring package.
• Problem: The later Files: debian/* stanza replaces Files: * for debian/po, so the copyright holders stated in the translation files appear nowhere in debian/copyright. The licence is right (GPL-2+, same as the package), but the copyright record for those four files is incomplete; a Files: debian/po/* stanza is the usual Debian form.
• Fix: Add the translators (and SPI for es.po) to the debian/* Copyright field, or add a separate Files: debian/po/* stanza listing them.

3. [minor] [packaging] bucklespring-data-synth description calls the recorded beeper set one of the generated ones

• Files: debian/control:139-147, tools/make-clips.py:169-172, debian/copyright:63-64
• Basis: checked, in the package or with a reference tool
• Evidence: debian/control: This package contains the clip sets which are generated rather than recorded: ... and "beeper", a single beep ... and They are made by tools/make-clips.py in the source, so any of them can be remade or altered.; tools/make-clips.py: SETS = { "piano": piano, "drums": drums, "slapstick": slapstick, }; debian/copyright: Files: clips/beeper/* / Copyright: 2020 mejs <https://github.com/mejs> with The single beep ... Recorded on a fork of this project.
• Problem: beeper is a recording by mejs and cannot be regenerated or altered with tools/make-clips.py, which offers only piano, drums and slapstick. The description thus contradicts debian/copyright and misleads users about what the package contains and what the script can remake.
• Fix: Reword the stanza: describe piano, drums and slapstick as the generated sets made by tools/make-clips.py, and name beeper separately as a recording contributed on a fork (or move it to another data package).

4. [minor] [packaging] uscan finds only upstream versions older than the packaged one

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: upstream 1.5.1, packaged 2.0.0
• Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
• Fix: Check where debian/watch looks and how it mangles versions.

Verified

• Read every file in debian/ (control, rules, changelog, copyright, all six .install files, both .alternatives, .dirs, all .lintian-overrides, postinst, postrm, config, templates, the po headers, both README.Debian, source/format, upstream/metadata); there is no debian/patches or debian/tests, and source/format is 3.0 (quilt).
• debian/copyright is DEP-5 with the canonical Format URL, nine Files stanzas and one stand-alone GPL-2+ License paragraph that refers to /usr/share/common-licenses/GPL-2; every short name used matches the licence text (README.md, main.c:475-477 and tray.c:216 all say GPL v2 or later, so GPL-2+ is right).
• Inventoried all 32 non-clip upstream files and the 7 clip directories; apart from the two stanza omissions reported above, every file is matched by a stanza that states its holder and licence. LICENSE is the verbatim GPL-2 text, whose only notice (FSF) is the licence itself.
• clips/bucklespring, clips/vain-qwertz, clips/sequential and clips/beeper are recordings with their own per-set stanza and holder; clips/drums, clips/piano and clips/slapstick are generated by tools/make-clips.py, which is shipped and can remake them, so their preferred form for modification is present (README.md and debian/control agree).
• man/.1 are generated by help2man from the programs' --help/--version; the .h2m include files and the update-man rule (Makefile.am:124-146) are in the tree, and man/.service.8 document the units. systemd/.service and udev/.rules are generated at build time from the shipped .in files.
• The images img/buckle.gif, img/icon.png, img/icon128.ico and img/model-m.jpg are documentation artwork listed in EXTRA_DIST (Makefile.am:147-148), installed by no binary package, and covered by Files: * (Ico Doornekamp); they were recorded by name and not opened. mac/lib/pkgconfig/openal.pc is a 109-byte pkg-config stub for macOS builds, also only in EXTRA_DIST.
• scan-mac.c is macOS-only and built by no Debian binary; the copyright file's Comment discloses its two sources (VirtualBox's DarwinKeyboard.cpp and a blog post). No other file contains a third-party licence statement; playback uses libsndfile/OpenAL and no library is embedded.
• The prescan's author check found no holder unnamed in debian/copyright; I confirmed Ico Doornekamp, Barak A. Pearlmutter, Dominik George, vain, SequentialDesign and mejs are all named there. The stanza-level omissions reported above were not visible to that check.
• The orig tarball is a git snapshot (barak-bucklespring-c94ea63) with no configure or Makefile.in; at compat 14 dh runs dh_autoreconf automatically (SequencerUtil.pm:392-393) and debhelper Depends dh-autoreconf, which Depends autoconf, automake, autopoint and libtool, so autoconf/automake need not be in Build-Depends and a clean unstable chroot has them. pkgconf supplies pkg.m4.
• Build profiles are consistent between control and rules; --bindir=/usr/games and the default unit/udev directories match the .install paths; the alternatives Dependents lines are 3-tuples as dh_installalternatives(1) requires; dh_installsystemduser --no-enable is a valid option; Standards-Version 4.7.4 matches the reviewing Policy's 4.7.4.1.
• Maintainer scripts are idempotent: the debconf question defaults to false at medium priority, postinst re-creates or removes /etc/bucklespring/uaccess from the answer and re-triggers udev only where /run/udev and udevadm exist, postrm cleans the flag and directory again. Both flavours carry Breaks+Replaces against the old bucklespring; all arch:all data packages are Multi-Arch: foreign. gnome-shell-extension-appindicator named in Suggests exists (66-1).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• The orig tarball extracts to barak-bucklespring-c94ea63/ while Homepage and debian/upstream/metadata name https://github.com/zevv/bucklespring; whether 2.0.0 exists there and whether this snapshot matches it could not be checked without network access.
• The binary contents of img/* and of the several hundred clips/**/*.flac were not inspected; that the clips are lossless FLAC is stated only by README.md and debian/copyright.
• scan-mac.c's copied keycode table and event-tap callback: their provenance and licensing (VirtualBox is GPL-2; the linked blog post states no licence) rest on the maintainer's Comment; I did not verify either upstream text or whether the table is copyrightable.
• debian/watch looks at github.com/zevv/@package@, but the Source field of debian/copyright names github.com/zevv/bucklespring. Whether these are the same upstream was not checked.
• debian/watch looks at github.com/zevv/@package@, but Repository in debian/upstream/metadata names github.com/zevv/bucklespring. Whether these are the same upstream was not checked.

Proposed changes

None.