DFSG NEW review for cutest version 1.5-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The source is under the zlib licence, which is DFSG-free, and debian/copyright is DEP-5 and complete. Its Files: * stanza (Zlib, 2002-2003 Asim Jalis) covers every upstream file, including index.html, style.css and make-tests.sh, and its Files: debian/* stanza names the packaging holder. The zlib permission text in debian/copyright reproduces the terms in license.txt including all three restrictions, which is required since zlib is not in /usr/share/common-licenses. No file carries a conflicting or additional notice, and the only other names in the tree (the README CREDITS list) are acknowledgements, not copyright claims.

Packaging

The packaging is a clean dh 14 single-binary package: static library and header built and installed by explicit rules and install files, an autopkgtest that compiles and runs against the installed header, a sane changelog, and current Vcs-*/Standards-Version fields. One Policy 10.2 point needs fixing: the static-only library is compiled with -fPIC, which Policy forbids for static libraries unless the exception is discussed on debian-devel and recorded in README.Debian; neither was done.

Issues

1. [minor] [packaging] Static-only library is compiled with -fPIC, contrary to Policy 10.2

• Files: debian/rules:8
• Basis: checked, in the package or with a reference tool
• Evidence: $(CC) $(CPPFLAGS) $(CFLAGS) -fPIC -c CuTest.c -o CuTest.o in override_dh_auto_build; the package builds only libcutest.a and ships no README.Debian.
• Problem: Policy 10.2 (Libraries) says: 'As to the static libraries ... the static version must not be compiled with the "-fPIC" flag. Any exception to this rule should be discussed on the mailing list debian-devel@lists.debian.org, and the reasons for compiling with the "-fPIC" flag must be recorded in the file README.Debian.' No shared library is built here, and no README.Debian documents an exception.
• Fix: Drop -fPIC from the CuTest.c compile, or, if the relocatable code is wanted (e.g. because downstream links the archive into a shared object), obtain consensus on debian-devel and record the reason in debian/README.Debian.

Verified

• The pre-review scan listed no files: its author check reports that every copyright holder it found is named in debian/copyright, so there is nothing from it left unexplained.
• Read every upstream file (AllTests.c, CuTest.c, CuTest.h, CuTestTest.c, README.txt, index.html, license.txt, make-tests.sh, style.css) and every file under debian/; the unpacked tree matches the member lists of cutest_1.5.orig.tar.xz (9 files, no debian/) and cutest_1.5-1.debian.tar.xz.
• Copyright and licence evidence: license.txt:19 Copyright (c) 2003 Asim Jalis and index.html:169-171 Copyright (c) 2002-2003, Asim Jalis ... All rights reserved. agree with the Files: * Copyright field; the zlib text in debian/copyright is the same terms as license.txt (the three numbered restrictions are all present), and the file's Files: * pattern covers every path including index.html, style.css and make-tests.sh.
• README.txt:205-211 lists Dave Glowacki, Tobias Lippert, Eli Bendersky and Andrew Brown as contributors of 'useful code changes'; that is an acknowledgement list, no file notice names them and upstream's own license names only Asim Jalis, so debian/copyright does not omit a documented holder.
• index.html's embedded JavaScript is only Google ad-client configuration (google_ad_client etc.) plus a mailto obfuscator; the ad code itself is loaded from an external URL, so no third-party source is embedded. The page also states CuTest is 'distributed under the zlib/libpng license'.
• CuTest.c:218 uses fabs(3), so the archive needs libm; debian/tests/compile-link links -lcutest -lm, and both include styles (<cutest/CuTest.h> with no -I, and "CuTest.h" with -I/usr/include/cutest) are exercised.
• debian/libcutest-dev.install puts the header in /usr/include/cutest/ and the archive in usr/lib/${DEB_HOST_MULTIARCH}/; dh_install expands such variables at compat 13 and later (dh_install(1), EXAMPLES), so the installed paths are correct, and Multi-Arch: same is consistent with the identical header plus per-architecture archive.
• Build sequencing: with --buildsystem=none (Dh_Buildsystems.pm:112 returns undef, so dh_auto_* are no-ops) and compat 14, dh_missing scans debian/tmp only, which does not exist without --sourcedir, so the CuTest.o/AllTests artifacts left in the source tree by override_dh_auto_build and override_dh_auto_test cannot trigger dh_missing's --fail-missing default; $(CC), $(AR), $(CFLAGS) and $(CPPFLAGS) are supplied by make's defaults, build-essential and /usr/share/dpkg/buildflags.mk.
• debian/tests/control (Tests: compile-link, Depends: @, build-essential) is a valid autopkgtest; build-essential supplies cc and the libc headers.
• Standards-Version 4.7.4 against Policy 4.7.4.1: first two components match, so it is current enough. changelog is cutest (1.5-1) unstable, initial release closing #1152460, dated 29 Oct 2026 (a Thursday).
• The Maintainer address debian-med-packaging@lists.alioth.debian.org is still what current Debian Med packages in the archive use (apt-cache show bcftools).
• Zlib is not in /usr/share/common-licenses, so reproducing its full text in debian/copyright is required and is done; the licence is DFSG-free and GPL-compatible.
• uscan found the packaged version as the newest upstream release (upstream 1.5, packaged 1.5).

Not confirmed

• File modes are not visible through the available tools, so I could not confirm that debian/tests/compile-link carries the executable bit that autopkgtest requires.

Proposed changes

None.