DFSG NEW review for cpp-progress-bar version 0.0~git20210121.487bb7c-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole source tree is MIT-licensed under the single holder Hemant Tailor. debian/copyright is in machine-readable DEP-5 format with the correct Format URL, a Files: * stanza naming the holder and MIT, a debian/* stanza, and a complete MIT License paragraph. The .gitignore, .gitattributes and the Visual Studio .sln/.vcxproj/.vcxproj.filters files are standard boilerplate carrying no separate copyright or licence notice, and are acceptably covered by the Files: * stanza. No non-free terms, vendored code, or generated/binary blobs are present.

Packaging

Packaging is clean and modern (debhelper compat 14, DEP-5 copyright, salsa-ci, Vcs-* fields, correct Standards-Version and source format). However the package installs only the example/demo executable progress_bar, and never ships the actual library — the header progress_bar.hpp and implementation progress_bar.cpp — so the package does not deliver the 'C++ class that implements a progress bar' its description promises and is not usable as a library. The upstream makefile also never references $(CXXFLAGS) or $(LDFLAGS), so the hardening flags the rules file explicitly enables are not applied to the binary.

Issues

1. [important] [packaging] The library (progress_bar.hpp/.cpp) is not installed; only the demo binary is shipped

• Files: debian/cpp-progress-bar.install, debian/control
• Basis: checked, in the package or with a reference tool
• Evidence: debian/cpp-progress-bar.install: progress_bar usr/bin; there is no -dev package and nothing installs progress_bar.hpp or progress_bar.cpp; the only target built by makefile is the demo (TARGET = progress_bar, linking main.o and progress_bar.o).
• Problem: The package's Description says it provides a 'C++ class that implements a progress bar in console applications', but the class is defined in progress_bar.hpp/progress_bar.cpp, which are never installed. The shipped /usr/bin/progress_bar is just the example program (main.cpp runs two demo bars and sleeps), not a useful tool, and its generic name risks a filename collision. As packaged, the package is unusable as a library, which appears to be its intended purpose.
• Fix: Either add a -dev binary package installing progress_bar.hpp (and a shared/static library from progress_bar.cpp), or, if the class is meant to be header-only, install the header and drop the demo binary; at minimum document the intent. Reconsider the generic binary name.

2. [minor] [packaging] Hardening flags are never used because the makefile ignores CXXFLAGS/LDFLAGS

• Files: makefile, debian/rules
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules sets export DEB_BUILD_MAINT_OPTIONS=hardening=+all, but makefile compiles/links with only $(CXX) $(CPPFLAGS) and never references $(CXXFLAGS) or $(LDFLAGS).
• Problem: The dpkg-buildflags hardening flags (stack protector, PIE, RELRO) live in CXXFLAGS and LDFLAGS, which the upstream build rules do not use, so the installed binary is built without them despite the explicit hardening=+all setting.
• Fix: Patch the makefile to use $(CXXFLAGS) in the compile rule and $(LDFLAGS) in the link rule (and $(CPPFLAGS) where appropriate), e.g. $(CXX) $(CPPFLAGS) $(CXXFLAGS) -c $^ and $(CXX) $(LDFLAGS) $(OBJ) -o $(TARGET).

Verified

• Read every file in debian/ (control, rules, changelog, copyright, install, salsa-ci.yml, source/format) and every upstream file (License.txt, README.md, makefile, main.cpp, progress_bar.cpp, progress_bar.hpp, .gitattributes, .gitignore, the .sln and both .vcxproj files) — the whole tree, not sampled.
• License.txt and debian/copyright both carry the MIT licence with 'Copyright (c) 2016 Hemant Tailor'; the standalone License: MIT paragraph reproduces the full text.
• The prescan author-check found no missing holder; its scanned files are all covered by the Files: * (Copyright: 2016 Hemant Tailor, MIT) stanza.
• The .gitattributes and .gitignore are stock Visual Studio/Git templates and the .sln/.vcxproj/.vcxproj.filters are Visual Studio 2013-generated project files; none carries its own copyright or licence notice, so they need no separate stanza.
• There is no install target in makefile; dh_auto_install's make_first_existing_target(['install']) therefore runs nothing without error (checked in /usr/share/perl5/Debian/Debhelper/Buildsystem/makefile.pm), and dh_install copies the built binary per the .install file — the build is not broken by the missing target.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20210121.487bb7c, packaged 0.0~git20210121.487bb7c).

Not confirmed

None.

Proposed changes

None.