DFSG NEW review for deal.ii version 9.8.0-2

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

The licensing is DFSG-compliant: the bulk of the tree is dual-licensed LGPL-2.1-or-later or Apache-2.0 WITH LLVM-exception, examples and a few library files are LGPL-2.1+, p4est-setup.sh is GPL-2.0+, doxygen-awesome.css is MIT/Expat, and the step-53 topography data is documented public-domain SRTM data. A sweep of SPDX identifiers across the tree (excluding .pc/ and debian/) found only LGPL-2.1-or-later, GPL-2.0-or-later and the default dual licence, all mapped to stanzas. debian/copyright is machine-readable and almost fully accurate, but three typos in the file list of the LGPL-2.1+ Files: stanza leave three LGPL-2.1+-only files (source/base/init_finalize.cc, include/deal.II/sundials/arkode_stepper.h, source/sundials/arkode_stepper.cc/.inst.in) unmatched, so they fall under the Files: * catch-all and are reported as also Apache-licensed. This is an overstatement (no Apache grant exists on those files) but no file is non-free.

Packaging

Packaging is of good quality: clean dh-based compat-13 rules with hardening defaults, sensible three-way binary split (dev/shared/doc), Multi-Arch set, upstream patches in quilt with DEP-3-style headers up to date for 9.8.0, sane autopkgtests, current Standards-Version (4.7.3 vs current 4.7.4.1), Vcs-* pointing at salsa, and build-dependencies that exist in the archive (spot-checked the exotic ones). The only wrinkle is a stale get-orig-source make target hardcoding VERSION := 9.7.1.

Issues

1. [minor] [licensing] Typos in the LGPL-2.1+ Files stanza of debian/copyright leave three LGPL-only files described as dual-licensed

• Files: debian/copyright, Files: stanza at lines 46-61
• Basis: checked, in the package or with a reference tool
• Evidence: The stanza lists include/deal.II/sundials/arcode_stepper.h (no such file; the real one is arkode_stepper.h), include/deal.II/source/base/init_finalize.cc (no such include path; the file is source/base/init_finalize.cc), and source/sundails/arkode_stepper.* (no sundails dir; it is source/sundials/). The actual files carry the LGPL-only header: Inplace...modify it under the terms of the GNU Lesser General Public License...version 2.1...or (at your option) any later version. (init_finalize.cc) or SPDX-License-Identifier: LGPL-2.1-or-later (arkode_stepper.h, arkode_stepper.cc, arkode_stepper.inst.in).
• Problem: Because of the typos these four paths do not match the later LGPL-2.1+ stanza, so they are matched by the Files: * catch-all and recorded as 'LGPL-2.1+ or Apache-2.0 with LLVM exceptions'. They carry no Apache grant, so debian/copyright overstates their licence. The dead include/deal.II/sundials/arcode_stepper.h pattern also masks that the whole intended set is not actually covered.
• Fix: Correct the three patterns to include/deal.II/sundials/arkode_stepper.h, source/base/init_finalize.cc and source/sundials/arkode_stepper.*.

2. [minor] [packaging] get-orig-source target in debian/rules hardcodes stale VERSION 9.7.1

• Files: debian/rules (VERSION := 9.7.1 in the get-orig-source block)
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules ends with VERSION := 9.7.1 and get-orig-source: fetching dealii-$(VERSION).tar.gz / dealii-$(VERSION)-offline_documentation.tar.gz and writing deal.ii_$(VERSION).orig.tar.xz, while the package being uploaded is deal.ii-9.8.0.
• Problem: Running make -f debian/rules get-orig-source would download the 9.7.1 tarballs and produce a misnamed orig for a different release; the maintenance helper is out of date.
• Fix: Update VERSION to 9.8.0 (or derive it from the changelog).

3. [minor] [packaging] Files-Excluded is set but the version carries no repack suffix

• Files: debian/copyright, debian/changelog, debian/watch
• Basis: found by the review tooling's own checks
• Evidence: 9.8.0-2
• Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
• Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified

• Prescan archive file examples/step-53/topography.txt.gz: SRTM topography data, documented as public-domain NASA data processed by D. Sarah Stamps in the in-tree examples/step-53/topography.license (quoted: data 'in the public domain'); it is the only archive/compressed file in the tree. Not an issue.
• Prescan binary doc/doxygen/deal.II/images/steps/developer/step-32-2d-temperature.webm: a movie generated from the free step-32 example (referenced from examples/step-32/doc/results.dox, downloaded from dealii.org and copied by debian/rules); generated documentation media from the package's own example program. No provenance or licensing concern.
• Prescan holder 'C. Geuzaine' in step-97/98 SVGs: the match is the generator stamp Creator: GL2PS 1.4.2, (C) 1999-2020 C. Geuzaine inside the SVG <desc> metadata of Gmsh/GL2PS output; it attributes the producing tool, not the image content, which is deal.II's own example output. Covered by Files: *.
• Prescan holder 'The Linux Foundation and its contributors' at LICENSE.md:96: it is the verbatim Developer Certificate of Origin 1.1 text quoted inside deal.II's own dual-licensed LICENSE.md; licenses the DCO document, not the tree. LICENSE.md is covered by Files: *.
• Prescan 'possibly named' matches are covered: examples/step-98/step-98.cc (1998-2026 by the deal.II authors), doc/external-libs/p4est-setup.sh (The University of Texas System is named in the p4est-setup.sh stanza), contrib/utilities/generate_lapack_templates ({year} by the deal.II authors) all fall under Files: *.
• SPDX sweep of the whole tree (excluding .pc/ and debian/): 1887 files carry Apache-2.0 WITH LLVM-exception OR LGPL-2.1-or-later; the only other identifiers are LGPL-2.1-or-later (examples/* and the library files in the LGPL-2.1+ stanza), GPL-2.0-or-later (p4est-setup.sh), and LGPL-2.1-or-later on the netcdf cmake files — all mapped to stanzas. No GPL-3, CC, AGPL, or field-of-use terms anywhere.
• No minified CSS/JS, no compiled artifacts (.jar/.class/.so/.dll/.pyc/e-*.o) in the source; the only compressed file is topography.txt.gz. bundled/ is excluded via Files-Excluded and no longer present; the doc images/png/svg/gif/webm are generated deal.II documentation output.
• The three prescan-archives/Files-Excluded claims were checked: bundled absent from the tree and the get-orig-source logic removes it; debian/watch findings are outside this review.
• Build-Depends spot-checked in the archive: libmagicenum-dev, libgmsh-dev, libtrilinos-trilinosss-dev (>=17.0.0), trilinos-all-dev, gmsh, petsc-dev, slepc-dev, mpi-default-dev all exist; Trilinos 17.0.0+dfsg-5 matches the (>= 17.0.0) pin.
• Sampled text files across directories for licence headers beyond the SPDX sweep; document bodies (doc/news, CMake config files) carry the default dual SPDX or standard deal.II headers.
• uscan found the packaged version as the newest upstream release (upstream 9.8.0, packaged 9.8.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2, LGPL-2.1).

Not confirmed

• Whether debian/tests scripts are executable could not be checked (file modes not visible via read); the scripts are unchanged from previous uploads, so a failure is unlikely.

Proposed changes

None.