Review: cpp-progress-bar 0.0~git20210121.487bb7c-2

Package Information

Description	C++ Progress Bar C++ class that implements a progress bar in console applications on both Linux and Windows platforms. The progress bar works by referencing an index that keeps updating when processing through a piece of code. Key features 1. Control the number of updates the progress bar makes. 2. Ability to adjust the style of the progress bar. 3. Length of the progress bar displayed on screen adapts to the width of the console.
Maintainer	Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed By	Andreas Tille <tille@debian.org>
Sponsor	tille@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/med-team/cpp-progress-bar.git (browse)
Popcon Installs	2
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/cpp-progress-bar
Uploaded	2 days ago

New Package Report

.changes◂

Architecture	source amd64
Distribution	unstable
Date	Thu, 05 Nov 2026 07:32:26 +0100
Source	cpp-progress-bar
Version	0.0~git20210121.487bb7c-2
Changed-By	Andreas Tille <tille@debian.org>

Changelog◂

cpp-progress-bar (0.0~git20210121.487bb7c-2) unstable; urgency=medium
 .
   * Add libcpp-progress-bar-dev binary package to enable building vg against it
   * Add debian/upstream/metadata

.dsc◂

Component	main
Package-List	cpp-progress-bar deb science optional arch=any libcpp-progress-bar-dev deb libdevel optional arch=any
Section	science
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: cpp_progress_bar
Source: https://github.com/vgteam/cpp_progress_bar

Files: *
Copyright: 2016 Hemant Tailor
License: MIT

Files: debian/*
Copyright: 2026 Andreas Tille <tille@debian.org>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 days ago.

Report◂

DFSG NEW review for cpp-progress-bar version 0.0~git20210121.487bb7c-2

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the canonical Format URL and covers the tree correctly. The only copyright notice in the source is Copyright (c) 2016 Hemant Tailor in License.txt, reproduced verbatim (MIT, full text, as MIT is not in /usr/share/common-licenses) and named by Files: *; the later Files: debian/* stanza (2026 Andreas Tille, MIT) matches the changelog and overrides the catch-all for the packaging. Nothing in the tree is under a non-free term, there is no vendored third-party code, no file lacks a licence, and the MIT licensing of everything is DFSG-compliant. The prescan's author check found no holder missing from debian/copyright.

Packaging

Small, conventional packaging: debhelper compat 14, 3.0 (quilt) with no patches, correct binary split (demo binary in cpp-progress-bar, header plus static library, built -fPIC, in a Multi-Arch: same libdevel package), correct ${DEB_HOST_MULTIARCH} expansion in the .install file, no maintainer scripts, current Standards-Version, sane changelog. Two minor defects remain: the shipped /usr/bin/progress_bar is compiled by the upstream makefile without CXXFLAGS or LDFLAGS, so it is built unoptimised and without stack protection/RELRO despite hardening=+all, and it is installed with no manual page (Policy 12.1).

Issues

minor packaging 1. upstream makefile ignores CXXFLAGS and LDFLAGS, so /usr/bin/progress_bar is built unoptimised and without hardening ◂

Files: makefile:10, makefile:14, makefile:18, debian/rules:8, debian/rules:13-16
Basis: checked, in the package or with a reference tool
Evidence:

makefile compiles and links with only CPPFLAGS:
```
progress_bar : $(OBJ)
	@$(CXX) $(CPPFLAGS) $(OBJ) -o $(TARGET)
main.o : main.cpp
	@$(CXX) $(CPPFLAGS) -c $^
```
while debian/rules says export DEB_BUILD_MAINT_OPTIONS=hardening=+all and override_dh_auto_build: dh_auto_build.
Problem: debhelper exports dpkg-buildflags' variables (CPPFLAGS, CXXFLAGS, LDFLAGS) into the build environment, but the upstream rules never reference CXXFLAGS or LDFLAGS, so g++ is invoked at -O0, without -fstack-protector-strong and without -Wl,-z,relro,-z,now for the program installed in /usr/bin. -D_FORTIFY_SOURCE=2 from CPPFLAGS is inert without optimisation. hardening=+all therefore only affects the static library, which debian/rules compiles itself with $(CXXFLAGS).
Fix: Patch makefile (DEP-3, forwarded upstream) to use $(CXXFLAGS) in both compile rules and $(CXXFLAGS) $(LDFLAGS) on the link line, or replace dh_auto_build here with explicit main.o/progress_bar commands that pass $(CXXFLAGS) and $(LDFLAGS).

minor packaging 2. /usr/bin/progress_bar is installed with no manual page ◂

Files: debian/cpp-progress-bar.install:1
Basis: checked, in the package or with a reference tool
Evidence: progress_bar usr/bin; debian/ has no man page, no *.manpages file and no call to dh_installman.
Problem: Policy 12.1: each program should have an associated manual page in the same package or a dependency, and "If no manual page is available, this is considered as a bug". The package ships an installed user-facing command with nothing documenting it.
Fix: Add progress_bar(1) (the README documents the class and the demo's behaviour) and install it, e.g. via debian/manpages or dh_installman; alternatively stop shipping the demo program.

Verified ◂

Read the whole tree: 11 upstream files (License.txt, README.md, main.cpp, makefile, progress_bar.cpp, progress_bar.hpp, C++ Progress Bar.sln, C++ Progress Bar.vcxproj, C++ Progress Bar.vcxproj.filters, .gitattributes, .gitignore) and every file under debian/ (changelog, control, copyright, both .install files, rules, salsa-ci.yml, source/format, upstream/metadata, watch).
Prescan: its author check lists no missing holder and names no file to account for. The only copyright notice in the tree is Copyright (c) 2016 Hemant Tailor in License.txt, which Files: * names.
A tree-wide grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby/GNU General Public/GNU Lesser/Apache License/Mozilla Public/public domain/All rights reserved finds only License.txt and debian/copyright; no LICENSE/COPYING/NOTICE anywhere else and no embedded third-party code.
The MIT text in debian/copyright matches License.txt word for word and is given in full (MIT is not in /usr/share/common-licenses); Files: debian/* (2026 Andreas Tille) correctly overrides the catch-all for the packaging and matches the changelog authorship.
C++ Progress Bar.sln, the two .vcxproj files, .gitattributes and .gitignore are plain-text Visual Studio/git configuration, not built files, minified code or binaries; they are upstream files under Files: *.
libcpp_progress_bar.a usr/lib/${DEB_HOST_MULTIARCH} is not a bug: debhelper expands ${DEB_*} in config files from compat 13 on (debhelper(7), "Substitutions in debhelper config files"; Dh_Lib::_variable_substitution), so the library lands in /usr/lib/.
dh_auto_install is a no-op here (makefile has no install target, so dh_auto_clean/skip applies) and dh_install falls back to the source directory, where ./progress_bar and ./libcpp_progress_bar.a exist after the build; nothing in the tree suggests a build failure.
Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components equal) is current; debhelper-compat (= 14) matches the reviewing system's debhelper 14.5 recommended level.
Binary split and architecture: demo binary in Architecture: any cpp-progress-bar; header in /usr/include plus a -fPIC static library in libcpp-progress-bar-dev, Architecture: any with Multi-Arch: same, which is the correct setting for an arch-dependent static library under the multiarch path.
No patches and no debian/patches with 3.0 (quilt), no maintainer scripts, no autopkgtests (optional), no debian/compat; changelog distribution unstable, version 0.0~git20210121.487bb7c-2, dates and weekdays consistent, ITP closed in -1.
uscan found the packaged version as the newest upstream release (upstream 0.0~git20210121.487bb7c, packaged 0.0~git20210121.487bb7c).

Not confirmed ◂

Nothing was built or run (not possible here); the hardening finding rests on the makefile and rules text, not on inspecting the produced binary.
File modes under debian/ could not be inspected with the available tools; were an .install file executable, dh_install would run it as a script and dh-exec would have to be in Build-Depends. The contents give no reason to expect this.

Proposed changes ◂

None.

Uploader's response to the LLM review

This is exactly the same source code as reviewed last week, just another binary package. IMHO accepting should be easy.

— Andreas Tille (tille), 2 days ago

Review Information

accepted — allocated to awm 2 days ago, started 2 days ago, completed 2 days ago.

Final Comment

Hi Andreas,

Yes: accepting is easy. The issues the LLM comes up with seem worth addressing, if true. If they're not true it is good to include the information in your comment rather than "same source as last week" since I might have reviewed 100 or more packages since then, and they all kind of blur over time...

Thanks!

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.0~git20210121.487bb7c-1	d36fd4cc…	2026-10-24 22:18	2026-10-24 22:19	awm	accepted	VIEW

Back to Dashboard | View all reviews for this package