DFSG NEW review for dart-characters version 1.4.1-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 2 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every licence actually present in the source — BSD-3-clause (the Dart code), the Unicode License V3 (the Unicode data files) and CC BY-SA 3.0 (the Wikipedia-derived Hangul text) — is DFSG-free, so there is no non-free term. However, debian/copyright is incomplete and inaccurate: its catch-all Files: * stanza attributes the whole tree to the Dart project authors under BSD-3-clause, but the six files under third_party/Unicode_Consortium/ are © Unicode, Inc. under the Unicode License V3, and the Hangul article text (third_party/Wikipedia/hangul.txt and the copy embedded in test/src/text_samples.dart) is CC BY-SA 3.0. Neither holder nor licence is named, and the Unicode License V3 text (not in /usr/share/common-licenses) is not included.

Packaging

The packaging is clean and follows current practice for a Dart source library: debhelper-compat 14 with a plain dh $@, dh-sequence-single-binary, Architecture: all with Multi-Arch: foreign, sources installed under /usr/share/dart/packages/characters/, a working autopkgtest smoke test against dart-sdk, sane changelog (1.4.1-1, unstable, ITP closure), and correct Vcs-*, Homepage and upstream/metadata fields. No Depends field is correct at compat 14, where dh_gencontrol adds the substvars itself.

Issues

1. [blocker] [licensing] Files: * does not name Unicode, Inc. and mis-licences the third_party/Unicode_Consortium data files as BSD-3-clause

• Files: debian/copyright, third_party/Unicode_Consortium/UNICODE_LICENSE.txt, third_party/Unicode_Consortium/DerivedCoreProperties.txt, third_party/Unicode_Consortium/GraphemeBreakProperty.txt, third_party/Unicode_Consortium/GraphemeBreakTest.txt, third_party/Unicode_Consortium/emoji_data.txt, third_party/Unicode_Consortium/emoji_test.txt
• Basis: checked, in the package or with a reference tool
• Evidence: UNICODE_LICENSE.txt:5 Copyright © 1991-2024 Unicode, Inc. and header UNICODE LICENSE V3; each data file carries # © 2024 Unicode®, Inc. with For terms of use and license, see https://www.unicode.org/terms_of_use.html. debian/copyright's Files: * stanza reads Copyright: 2019, the Dart project authors / License: BSD-3-clause.
• Problem: These six files are distributed under the Unicode License V3 (a DFSG-free permissive licence), copyright Unicode, Inc., not under BSD-3-clause by the Dart project authors. debian/copyright therefore names the wrong holder and the wrong licence for them, and omits the Unicode License V3 text (which is not one of /usr/share/common-licenses, so its full text must be reproduced). The generated lib/src/grapheme_clusters/table.dart and test/src/unicode_grapheme_tests.dart likewise carry the notice Licensed under the Unicode Inc. License Agreement, since their data is derived from these files.
• Fix: Add a Files: third_party/Unicode_Consortium/* stanza with Copyright: 1991-2024 Unicode, Inc. and a short name for the Unicode License V3 (e.g. Unicode-3.0), plus a stand-alone License paragraph containing the full licence text (copied from UNICODE_LICENSE.txt). Note the Unicode-licence provenance of the generated table.dart data in the same stanza or a separate one.

2. [blocker] [licensing] Wikipedia-derived Hangul text under CC BY-SA 3.0 is not described in debian/copyright

• Files: debian/copyright, third_party/Wikipedia/hangul.txt, third_party/Wikipedia/License CC BY-SA 3.0.txt, test/src/text_samples.dart
• Basis: checked, in the package or with a reference tool
• Evidence: test/src/text_samples.dart:7 /// Text is available under the [Creative Commons Attribution-ShareAlike License] and /// From: https://ko.wikipedia.org/wiki/%ED%95%9C%EA%B8%80; third_party/Wikipedia/hangul.txt is the same article text with the adjacent License CC BY-SA 3.0.txt. debian/copyright's Files: * stanza claims License: BSD-3-clause for the whole tree.
• Problem: The Hangul article text is Wikipedia content under CC BY-SA 3.0, not BSD-3-clause by the Dart project authors. debian/copyright does not name this content or its licence. CC BY-SA 3.0 is DFSG-free, but the attribution (holder and licence) must be recorded, and the Files: * stanza as written is inaccurate for these files.
• Fix: Add a Files: stanza covering third_party/Wikipedia/hangul.txt (and the embedded copy in test/src/text_samples.dart) with License: CC-BY-SA-3.0, referencing /usr/share/common-licenses/CC-BY-SA-3.0 and naming the copyright holder (Wikipedia contributors / the Wikimedia Foundation).

Verified

• The two scan-listed holders (Unicode, Inc and the Unicode®, Inc. Unicode and the Unicode Logo are registered trademarks… line) are the same entity: the second is the trademark-notice line in each Unicode data file's header, not a distinct copyright holder. Both are missing from debian/copyright.
• All Dart source files (lib/, test/, tool/, benchmark/, example/) carry Copyright (c) …, the Dart project authors and match the Files: * BSD-3-clause stanza; I grep'd the whole tree for licence/copyright wording with gitignore disabled.
• LICENSE at the tree root is the BSD-3-clause text reproduced in debian/copyright; AUTHORS lists Google LLC.
• The Unicode License V3 (UNICODE_LICENSE.txt) is a permissive, DFSG-free licence; CC BY-SA 3.0 is in /usr/share/common-licenses/CC-BY-SA-3.0.
• The Unicode data files are used only as build/test inputs by tool/ (tool/src/data_files.dart references them) and are not installed by debian/install; but they remain part of the source package and must be described.
• debian/copyright is already in machine-readable DEP-5 format with the correct Format: URL, so no replacement file is proposed.
• uscan found the packaged version as the newest upstream release (upstream 1.4.1, packaged 1.4.1).

Not confirmed

None.

Proposed changes

None.