DFSG NEW review for copyright-audit version 0.0+git20260513.5255970-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 2 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 4 found

Licensing

The tree is a single GPL-3+ bash/Python program by Erich Eickmeyer (header at copyright-audit:4-17, LICENSE is verbatim GPL-3, README and snapcraft.yaml agree), with Debian packaging by Mechtilde Stehmann. debian/copyright is DEP-5, has a Files: * stanza, a debian/* stanza overriding it, and a stand-alone GPL-3+ paragraph pointing at /usr/share/common-licenses/GPL-3. Everything in the prescan is the tool's own licence-ID data or feature prose, not licence terms applied to the package. The only inaccuracy found is small: the file covered by the debian/* stanza that carries a copyright notice of its own names a different holder.

Packaging

Clean, minimal packaging: compat 14 with plain dh, 3.0 (quilt) with no patches needed, correct Vcs-*/Homepage/upstream metadata, current Standards-Version (4.7.4 against Policy 4.7.4.1), sane changelog. The one real defect is that the binary package declares no runtime dependency at all, although the installed script needs python3 (non-trivial stdlib modules, not Essential) and one of licensecheck/scancode-toolkit just to start. The help2man-generated man page also points readers at a Texinfo manual that does not exist.

Issues

1. [important] [packaging] Binary package has no Depends, so its python3 and licensecheck requirements are never installed

• Files: debian/control:1-12, copyright-audit:166-180
• Basis: checked, in the package or with a reference tool
• Evidence: debian/control has no Depends field (and no Recommends/Suggests); copyright-audit:178-180 if ! command -v python3 ... echo "Error: python3 is required.", copyright-audit:166-173 elif command -v licensecheck ... else echo "Error: No license scanner found." and exit 1.
• Problem: Policy 3.5: 'Every package must specify the dependency information about other packages that are required for the first to work correctly.' python3 is not Essential (apt-cache show python3-minimal lists no Essential field), and the embedded Python imports json, subprocess, urllib.request, xml.etree and pathlib, which are in python3, not python3-minimal; without python3 the installed command just prints an error. Without a scanner (licensecheck, present in the archive as licensecheck 3.3.9-1; scancode-toolkit is pip-only) the program also exits at copyright-audit:171 before doing anything. At compat 14 dh_gencontrol adds only the substvars the helpers produce, and dh_python3 sees no Python script (the file's shebang is #!/bin/bash), so nothing fills the gap automatically.
• Fix: Add Depends: python3, licensecheck and Recommends: decopy (used for cross-validation and to seed generate mode) to the Package stanza; Suggests: git if the git-based year inference is worth advertising. scancode-toolkit is pip-only and can stay undocumented as a dependency, only mentioned in the description/man page.

2. [important] [packaging] uscan found no upstream version

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Problem: uscan ran without an error but found no upstream release with debian/watch.
• Fix: Correct debian/watch so that uscan --report finds the upstream releases.

3. [minor] [licensing] debian/* stanza names only Mechtilde Stehmann for debian/copyright-audit.1, which states Erich Eickmeyer's copyright

• Files: debian/copyright:10-12, debian/copyright-audit.1:51
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright Files: debian/* / Copyright: Mechtilde Stehmann <mechtilde@debian.org>; the covered file says Copyright \(co 2026 Erich Eickmeyer (debian/copyright-audit.1:51), reproduced by help2man from the upstream script's --help header.
• Problem: DEP-5's Copyright field must record the holders of the files its stanza covers, and the last matching stanza is the applicable one. For debian/copyright-audit.1 that is the debian/* stanza, which names only the packager, while the man page reproduces upstream text and asserts Erich Eickmeyer's copyright. The upstream holder is named in Files: *, which this stanza overrides.
• Fix: Add 2026 Erich Eickmeyer to the Copyright of the debian/* stanza, or add a stanza for the generated man page and say in a Comment that it was generated with help2man from the program's --help.

4. [minor] [packaging] Man page's SEE ALSO points to a Texinfo manual that the package does not ship

• Files: debian/copyright-audit.1:81-93
• Basis: checked, in the package or with a reference tool
• Evidence: The full documentation for .B copyright-audit is maintained as a Texinfo manual. If the .B info and .B copyright-audit programs are properly installed at your site, the command .B info copyright-audit should give you access to the complete manual.
• Problem: This is help2man's default boilerplate; the package ships no Texinfo document and no info file (the tree has only README.md, CHANGELOG.md and CODE_OUTLINE.md), so the instruction fails for the user. The rest of the page is usable.
• Fix: Drop the Texinfo paragraph and give a real SEE ALSO (licensecheck(1), decopy(1), debian/copyright format), or regenerate the page with a --help that ends in the intended SEE ALSO text.

Verified

• Prescan file CHANGELOG.md:405 ('Non-free / DFSG detection (SSPL, BUSL, Elastic, JSON, PolyForm, CC-NC, CC-ND, and more)') is a feature bullet in the upstream changelog, not a licence applied to any file.
• Prescan file copyright-audit:791 ('cc-by-nc-1.0': 'CC-BY-NC-1.0', ...) is the SPDX-to-DEP-5 name mapping table used by the tool; string data, not a licence term for the package.
• Prescan files copyright-audit:3320-3321 ('_NONFREE_RAW = { "sspl-1.0", "busl-1.1", ...') are the licence IDs the tool reports as non-free (with a comment that AGPL-3 and CeCILL-2.1 are DFSG-free). The package's own code remains GPL-3+, so these strings impose nothing.
• Prescan holder 'Some Author' at copyright-audit:1558 is a code comment illustrating an XMP copyright regex (# Parse "Copyright 2024 Some Author" to extract the author part); no copyright holder by that name exists and nothing in debian/copyright is missing.
• Upstream notices: copyright-audit:4-17 has Copyright (C) 2026 Erich Eickmeyer and the GPL-3-or-later grant; README.md 'License: GNU General Public License v3.0 or later'; snap/snapcraft.yaml license: GPL-3.0+; debian/copyright-audit.1 reproduces the same grant. All consistent with the Files: * GPL-3+ stanza.
• LICENSE is the verbatim GPL-3 text with the FSF notice at lines 1-5; it is covered by Files: * and needs no holder of its own beyond the usual practice.
• debian/copyright is DEP-5 with Format:, Upstream-Name, Source, Files: , an overriding Files: debian/ stanza and one stand-alone License: GPL-3+ paragraph referencing /usr/share/common-licenses/GPL-3; no Files-Excluded. Later-stanza override applies as expected (a plan glob is anchored at the tree top; * reaches any depth).
• No embedded third-party code found: the script is one bash wrapper plus an embedded Python body importing only the standard library (datetime, json, os, re, subprocess, sys, fnmatch, textwrap, unicodedata, glob, xml.etree, collections, pathlib, urllib), with a single external call, git log, guarded by os.path.isdir('.git') and a try/except. The only embedded licence text is _BUILTIN_LICENSE_TEXTS at copyright-audit:403-419 (the Unsplash licence) and the standard-licence preambles generated for output; both are data the tool emits, not terms attached to the package.
• No debian/patches directory and no patches to review; debian/source/format is 3.0 (quilt). debian/rules is the minimal dh $@ with no overrides, so compat 14's behaviour is what applies.
• debian/control: Standards-Version 4.7.4 is current enough against Policy 4.7.4.1; Vcs-Git/Vcs-Browser, Homepage, Maintainer and Architecture: all are present; debian/upstream/metadata fills in Bug-Database, Repository and friends.
• debian/changelog: single unstable entry for 0.0+git20260513.5255970-1, ITP closed (#1152707), version consistent with a git snapshot.
• debian/copyright-audit.install and .manpages install the upstream script to usr/bin and the man page to man1; there is no debian/tests (no autopkgtest), which is not required by Policy.
• Read in full: every file of debian/ (changelog, control, rules, copyright, copyright-audit.install, copyright-audit.manpages, copyright-audit.1, dpb.conf, salsa-ci.yml, source/format, upstream/metadata), plus LICENSE header, README.md and snap/snapcraft.yaml; the 8 315-line script was read at its header, shell wrapper and the flagged regions and grepped across the whole file for copyright/licence notices; CHANGELOG.md and CODE_OUTLINE.md were sampled.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed

• The .dsc and the orig/debian tarballs beside the package could not be opened (reads outside the package directory are refused), so the unpacked tree was not compared with what was shipped.
• File modes are not visible in the tool output; whether copyright-audit is executable in the tarball (dh_install preserves the mode) was not checked.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: read: "../copyright-audit_0.0+git20260513.5255970-1.dsc" is not a file of the package or of the reviewing system.

Proposed changes

None.