DFSG NEW review for duckdb version 2.0.0+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 5 blocker, 9 important, 4 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 104 found (37 not listed by the scan, so not checked)

Licensing

Two of the extensions compiled into libduckdb.so carry the TPC's non-free terms: extension/tpch/dbgen is under the TPC End User License Agreement 2.2 (no fee for distribution, restrictions on publishing results), and extension/tpcds/dsdgen carries the TPC 'Legal Notice' which reserves all rights and grants nothing. Neither is described in debian/copyright, whose Files: * stanza calls the whole tree Expat/Stichting DuckDB Foundation. Beyond that the file is substantially incomplete: several files with other holders and other licences (BSD-3-Clause termcolor and Redis sds, Unicode data tables, Apache-2.0 with Swift Runtime Library Exception, the Unlicense portion of miniz, the Lucent notice in re2, zlib in concurrentqueue) are all covered only by the catch-all, and the third-party test data (AdventureWorks, Chinook/Sakila) is not addressed at all.

Packaging

The packaging structure is competent: quilt with twelve well-headed patches, system libraries used for zstd/xxhash/snappy/lz4/brotli/yyjson/mbedtls/mariadb/libpq, compat 14 with correct dh overrides, a correct library/-dev/CLI split, a manpage, README.source and README.Debian, and an autopkgtest suite that builds its checks out of the source. What blocks it is that the non-free TPC dbgen/dsdgen code is deliberately built in (-DBUILD_EXTENSIONS="autocomplete;tpch;tpcds" -DLINK_CORE_EXTENSIONS=TRUE), plus two autopkgtest defects (the ui test proxies to ui.duckdb.org and so needs the internet; the quack and ui tests open TCP ports without Restrictions: isolation-container) and an unnecessary embedded copy of SQLite 3.38.1.

Issues

1. [blocker] [licensing] extension/tpch/dbgen is the non-free TPC End User License Agreement and is compiled into libduckdb.so

• Files: extension/tpch/dbgen/LICENSE:60,86,141; extension/tpch/dbgen/rng64.cpp:12-29; extension/tpch/dbgen/CMakeLists.txt; debian/rules (BUILD_EXTENSIONS, LINK_CORE_EXTENSIONS); debian/copyright:7-9
• Basis: checked, in the package or with a reference tool
• Evidence: LICENSE: restricted, non-exclusive, revocable license to install and use; c. Public Disclosure: You may not publicly disclose any performance results produced while using the Software; d. You may not charge a fee for the distribution of this Software. rng64.cpp: This is an unpublished copyright work Gradient Systems, Inc., All Rights Reserved, THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF GRADIENT SYSTEMS, INC.
• Problem: This is not a free licence: it forbids charging a fee for distribution (DFSG 1), restricts what may be published about use (a field-of-use restriction), and grants only a revocable licence. debian/rules builds tpch with -DBUILD_EXTENSIONS="autocomplete;tpch;tpcds" -DLINK_CORE_EXTENSIONS=TRUE, so extension/tpch/dbgen/CMakeLists.txt's objects end up in libduckdb.so and the CLI; the TPC queries (answers/, queries/, include/tpch_constants.hpp) are TPC material too. debian/copyright has no stanza for any of it - the Files: * stanza claims it is Expat, Stichting DuckDB Foundation.
• Fix: Repack extension/tpch out of the source (record it in a Files-Excluded: field) and drop tpch from BUILD_EXTENSIONS, or remove the benchmark extension; if any TPC file stays, give it its own stanza with the TPC licence text and holder.

2. [blocker] [licensing] extension/tpcds/dsdgen carries the TPC 'Legal Notice', which reserves all rights and grants no permission to copy or distribute

• Files: extension/tpcds/dsdgen/include/dsdgen-c/release.h:1-39; extension/tpcds/dsdgen/dsdgen-c/*.cpp (e.g. genrand.cpp:1-35, StringBuffer.cpp:1-35, 108 files); extension/tpcds/dsdgen/tpcds.idx; debian/rules; debian/copyright:7-9
• Basis: checked, in the package or with a reference tool
• Evidence: This document and associated source code (the "Work") is a part of a benchmark specification maintained by the TPC. The TPC reserves all right, title, and interest to the Work as provided under U.S. and international laws - followed only by a No Warranty section and Contributors: Gradient Systems, with no grant of any right to use, copy, modify or distribute.
• Problem: With no licence grant at all this fails DFSG 1 and 3 (no permission to distribute, let alone modified versions), so the source package contains non-free material. dsdgen is also built into libduckdb.so through the same BUILD_EXTENSIONS/LINK_CORE_EXTENSIONS flags, and tpcds.idx, schema/ and queries/ are TPC-distributed data. debian/copyright does not mention the tree at all (Files: * says Expat).
• Fix: Repack extension/tpcds out of the source and remove tpcds from BUILD_EXTENSIONS (the same treatment as tpch), or drop the package.

3. [blocker] [licensing] Files: * names only Stichting DuckDB Foundation while src/ contains MIT code from CWI, Martin Ankerl and salesforce.com

• Files: debian/copyright:7-9; src/include/duckdb/storage/compression/alp/algorithm/{alp.hpp,LICENSE}; src/include/duckdb/storage/compression/alprd/algorithm/{alprd.hpp,LICENSE}; src/common/checksum.cpp:11-13; src/common/types/hash.cpp:80-82,121; src/include/duckdb/execution/merge_sort_tree.hpp:26-45
• Basis: checked, in the package or with a reference tool
• Evidence: MIT License / Copyright (c) 2023 CWI, Azim Afroozeh, Leonardo Xavier Kuffo Rivero; // MIT License / // Copyright (c) 2018-2021 Martin Ankerl; // MIT License Text: / // Copyright 2022 salesforce.com, inc.
• Problem: The licence (Expat) happens to match, but the copyright statement is false for these compiled-in files: they name CWI/Azim Afroozeh/Leonardo Kuffo Rivero, Martin Ankerl and salesforce.com, none of which appear in debian/copyright. The ALP/ALPRD LICENSE files are shipped in-tree and are the only evidence of those holders.
• Fix: Add stanzas for the ALP/ALPRD algorithm directories, src/common/checksum.cpp and src/common/types/hash.cpp, and src/include/duckdb/execution/merge_sort_tree.hpp, naming those holders.

4. [blocker] [licensing] BSD-3-Clause files are declared Expat: test/sqlite/termcolor.hpp (Ihor Kalnytskyi) and third_party/hyperloglog/sds.{cpp,hpp} (Sanfilippo, Oran Agra, Redis Labs)

• Files: test/sqlite/termcolor.hpp:8; third_party/hyperloglog/sds.cpp:1-18; third_party/hyperloglog/sds.hpp:1-18; debian/copyright:7-9 (Files: * -> Expat) and :72-74 (third_party/hyperloglog/* -> 2012 Art.sy, Expat)
• Basis: checked, in the package or with a reference tool
• Evidence: termcolor.hpp: :copyright: (c) 2013 by Ihor Kalnytskyi / :license: BSD, see LICENSE for details - and there is no LICENSE file under test/sqlite/. sds.cpp: Copyright (c) 2006-2015, Salvatore Sanfilippo, Copyright (c) 2015, Oran Agra, Copyright (c) 2015, Redis Labs, Inc with the three-clause BSD text including Neither the name of Redis nor the names of its contributors may be used to endorse.
• Problem: Both are BSD-3-Clause (an endorsement-clause licence that also obliges reproducing its notice), not Expat, and neither holder is named. The hyperloglog stanza is right for hyperloglog.cpp (Art.sy, Expat) but wrong for sds.cpp/sds.hpp, which are a vendored Redis SDS with a different licence; sds is compiled into libduckdb.so.
• Fix: Split third_party/hyperloglog/* into a stanza for sds.{cpp,hpp} with its holders and BSD-3-Clause, and add a stanza for test/sqlite/termcolor.hpp with Ihor Kalnytskyi and BSD-3-Clause (its licence text is not in the tree).

5. [blocker] [licensing] Unicode data licences are unrecorded: utf8proc_data.cpp (UCD) and extension/icu/collation/generated/collation_data.cpp (CLDR 48, UCD 17.0.0)

• Files: third_party/utf8proc/LICENSE:59-90; third_party/utf8proc/utf8proc_data.cpp (no header); extension/icu/collation/generated/collation_data.cpp:5-6; debian/copyright:121-123
• Basis: checked, in the package or with a reference tool
• Evidence: utf8proc LICENSE third section: ## Unicode data license ## / Copyright (c) 1991-2007 Unicode, Inc. All rights reserved. Distributed under the Terms of Use in http://www.unicode.org/copyright.html. requiring the notice and permission text to accompany copies and modifications to be marked. collation_data.cpp: generated ... from Unicode Consortium data (CLDR release-48, UCD 17.0.0).
• Problem: The generated data files are derived from Unicode Consortium data under the Unicode data licence, which is not Expat and is not in /usr/share/common-licenses, so its text and holder must be in debian/copyright. The utf8proc stanza (Expat, 2009-2019 Steven G. Johnson et al.) covers only the code; Unicode, Inc. is not named anywhere, and the CLDR-derived collation tables have no stanza at all.
• Fix: Add a stanza covering third_party/utf8proc/utf8proc_data.cpp and extension/icu/collation/generated/collation_data.cpp with Copyright: 1991-2007 Unicode, Inc. and a stand-alone licence paragraph reproducing the Unicode data licence.

6. [important] [licensing] third_party/jemalloc/include/msvc_compat/C99/stdint.h is BSD-3-Clause (Alexander Chemeris) under the BSD-2-Clause jemalloc stanza

• Files: third_party/jemalloc/include/msvc_compat/C99/stdint.h:4-24; debian/copyright:22-26
• Basis: checked, in the package or with a reference tool
• Evidence: Copyright (c) 2006-2008 Alexander Chemeris; clause 3. The name of the author may be used to endorse or promote products derived from this software without specific prior written permission.
• Problem: The jemalloc stanza (BSD-2-Clause, Jason Evans/Mozilla/Facebook) is right for jemalloc's own files but not for this vendored MSVC compatibility header, which is a three-clause BSD file from another author.
• Fix: Add a stanza for third_party/jemalloc/include/msvc_compat/C99/stdint.h with Alexander Chemeris and BSD-3-Clause (or reword the jemalloc stanza and add a later, more specific one).

7. [important] [licensing] third_party/concurrentqueue/lightweightsemaphore.h is zlib-licensed (Jeff Preshing), not BSD-2-Clause or BSL-1.0

• Files: third_party/concurrentqueue/lightweightsemaphore.h:52-67; third_party/concurrentqueue/LICENSE:1-6; debian/copyright:48-50
• Basis: checked, in the package or with a reference tool
• Evidence: LICENSE: Jeff Preshing's semaphore implementation (used in the blocking queue) which has a zlib license (embedded in lightweightsempahore.h); the header carries Copyright (c) 2015 Jeff Preshing and the zlib wording This software is provided 'as-is' ... The origin of this software must not be misrepresented.
• Problem: The vendored file is explicitly excluded from the concurrentqueue licence and is under zlib, which is neither of the two licences the stanza names, and Jeff Preshing is not named. The file is compiled into libduckdb.so.
• Fix: Add a later Files: third_party/concurrentqueue/lightweightsemaphore.h stanza with Copyright: 2015 Jeff Preshing and License: Zlib.

8. [important] [licensing] third_party/re2/util/{rune.cc,utf.h} carry the Lucent/Plan 9 notice, not BSD-3-Clause, and Lucent Technologies is unnamed

• Files: third_party/re2/util/rune.cc:1-13; third_party/re2/util/utf.h:1-13; debian/copyright:101-103
• Basis: checked, in the package or with a reference tool
• Evidence: The authors of this software are Rob Pike and Ken Thompson. Copyright (c) 2002 by Lucent Technologies. Permission to use, copy, modify, and distribute this software for any purpose without fee is hereby granted, provided that this entire notice is included ...
• Problem: This is a different (permissive) grant from the three-clause BSD text in the re2 stanza, and it is the notice that must be reproduced; its holder, Lucent Technologies, is absent from debian/copyright.
• Fix: Add a stanza for third_party/re2/util/rune.cc and third_party/re2/util/utf.h naming Rob Pike, Ken Thompson and Lucent Technologies, with their notice as the licence text.

9. [important] [licensing] third_party/miniz/miniz.cpp contains Martin Raiber's Expat code and an Unlicense public-domain portion, declared Expat only

• Files: third_party/miniz/miniz.cpp:576-602 (Unlicense), :2883-2889 (Martin Raiber); debian/copyright:85-87
• Basis: checked, in the package or with a reference tool
• Evidence: This is free and unencumbered software released into the public domain ... For more information, please refer to <http://unlicense.org/>; and Copyright 2013-2014 RAD Game Tools and Valve Software / Copyright 2010-2014 Rich Geldreich and Tenacious Software LLC / Copyright 2016 Martin Raiber.
• Problem: The stanza names neither Martin Raiber nor the public-domain (Unlicense) portion, so it misstates both the holders and the terms of part of the file. Both are free, but the file is compiled in and its copyright must be accurate.
• Fix: Add Martin Raiber to the miniz stanza and mention the Unlicense/public-domain part (a separate Files: stanza or a Comment:), with the Unlicense text if it is to be represented as a licence.

10. [important] [licensing] tools/swift/* is declared 'Apache Arrow Authors, Apache-2.0 or Expat' but is Stichting DuckDB Foundation Expat plus Apple's Apache-2.0 with Swift Runtime Library Exception

• Files: debian/copyright:133-135; tools/swift/duckdb-swift/LICENSE; tools/swift/duckdb-swift/Sources/DuckDB/Types/IntHuge.swift:1-20; tools/swift/duckdb-swift/Sources/DuckDB/Database.swift:1-22
• Basis: checked, in the package or with a reference tool
• Evidence: duckdb-swift/LICENSE: Copyright 2018-2024 Stichting DuckDB Foundation + Expat, and every Swift source has Copyright © 2018-2024 Stichting DuckDB Foundation; IntHuge.swift instead has Copyright (c) 2014 - 2021 Apple Inc. and the Swift project authors / Licensed under Apache License v2.0 with Runtime Library Exception.
• Problem: The holder is wrong for the bulk of the directory (it is the DuckDB Foundation, not Apache Arrow), the 'or Expat' disjunction does not exist for IntHuge.swift, and the Swift Runtime Library Exception that accompanies Apple's Apache-2.0 text is not represented at all. (The Swift tree is not built by this package, but it ships in the source.)
• Fix: Replace the stanza with Copyright: 2018-2024 Stichting DuckDB Foundation + License: Expat for tools/swift/* and a later stanza for IntHuge.swift with Apple Inc./Swift project authors, Apache-2.0 and the Runtime Library Exception (text included, as it is not in common-licenses).

11. [important] [licensing] MIT/BSL files covered only by Files: *: extension_external/ui/third_party/httplib and extension_external/*/database-connector/test/catch

• Files: extension_external/ui/third_party/httplib/httplib.hpp:1-13 and LICENSE; extension_external/{mysql,postgres,sqlite}/database-connector/test/catch/{catch.hpp,LICENSE.txt}; debian/copyright:68-70, 44-46, 7-9
• Basis: checked, in the package or with a reference tool
• Evidence: httplib.hpp: Copyright (c) 2023 Yuji Hirose. All rights reserved. / MIT License / taken from: https://github.com/yhirose/cpp-httplib/blob/v0.14.3/httplib.h (a modified copy). catch.hpp: Copyright (c) 2022 Two Blue Cubes Ltd. / Distributed under the Boost Software License, Version 1.0. plus SPDX-License-Identifier: BSL-1.0.
• Problem: The third_party/httplib/* and third_party/catch/* stanzas are anchored at those paths, so the copies inside extension_external/ fall through to Files: * (DuckDB Foundation, Expat). These are third-party code with their own holders and, for catch, a different licence. The ui httplib copy is compiled into the shipped ui extension.
• Fix: Add stanzas for extension_external/ui/third_party/httplib/* (yhirose, Expat) and extension_external//database-connector/test/catch/ (Two Blue Cubes Ltd, BSL-1.0).

12. [important] [licensing] Third-party test data (AdventureWorks, Chinook, Sakila, walmart sales) is not addressed by debian/copyright

• Files: test/sqlserver/data/*.csv.gz; extension_external/sqlite/data/db/chinook.db; extension_external/sqlite/data/db/sakila.db; test/sql/window/walmart.csv.gz; debian/copyright:7-9
• Basis: inferred from what was read, not seen directly
• Evidence: test/sqlserver/test_sqlserver.test_slow and test/sqlserver/scrape.py retrieve Microsoft's AdventureWorks tables (Address, Employee, Person, ... as Address.csv.gz etc.); extension_external/sqlite/data/db/ holds chinook.db and sakila.db plus sakila-examples.sql; the Files: * stanza attributes all of it to Stichting DuckDB Foundation under Expat.
• Problem: These are sample data sets from other projects with their own terms, not DuckDB-authored files, and the copyright file says nothing about them. Whether the AdventureWorks/Sakila terms are DFSG-free I could not check offline, but the attribution is certainly wrong as written.
• Fix: Establish the provenance and licence of each data set and record it in its own stanza (or remove the data sets, which no shipped test uses).

13. [important] [packaging] The autopkgtest 'ui' test needs the internet: it proxies through the extension to https://ui.duckdb.org

• Files: debian/tests/ui (last line); extension_external/ui/src/http_server.cpp:182-192,293-317; extension_external/ui/src/include/settings.hpp:9
• Basis: checked, in the package or with a reference tool
• Evidence: debian/tests/ui: run curl -sf -o /dev/null http://localhost:4213/; the server routes GET /.* to HandleGet, which does httplib::Client client(remote_url); ... auto result = client.Get(req.path, req.params, headers); and sets status 500 when the fetch fails; #define UI_REMOTE_URL_SETTING_DEFAULT "https://ui.duckdb.org".
• Problem: curl -sf fails on the 500 that a network-less testbed produces, and in a networked one the test depends on a third-party web service being up. Debian autopkgtests must be hermetic; this one also masked as a UI test while testing an external site, and no restriction or documentation warns of the dependency.
• Fix: Test a purely local endpoint instead (e.g. curl -sf http://localhost:4213/info), or run start_ui and assert on the local token/info responses; keep the remote UI out of the test.

14. [important] [packaging] quack and ui autopkgtests open TCP ports without Restrictions: isolation-container

• Files: debian/tests/control; debian/tests/quack (port 28391); debian/tests/ui (port 4213); extension_external/ui/src/http_server.cpp:209 (server.listen("localhost", local_port))
• Basis: checked, in the package or with a reference tool
• Evidence: debian/tests/control declares only Restrictions: allow-stderr, while both scripts start a server on a fixed local port and connect to it; the autopkgtest specification says isolation-container is for tests that want to start services or open network TCP ports and that this commonly fails in a simple chroot/schroot.
• Problem: On schroot-based runners these two tests can fail for reasons unrelated to the package, and the fixed port 28391 can also clash with another test on a shared testbed. The restriction is what tells the runner to use a container.
• Fix: Add Restrictions: allow-stderr isolation-container (or split the socket-using tests into their own stanza) and pick a free port (bind 0 or an ephemeral port) rather than hard-coding 28391.

15. [minor] [licensing] scripts/ LLVM files and the PostgreSQL libpq diff are Apache-2.0 WITH LLVM-exception and PostgreSQL-licensed, unnamed

• Files: scripts/clang-tidy-diff.py:1-7; scripts/run-clang-tidy.py:1-7; extension_external/postgres/vcpkg_ports/libpq/libpq-and-client-tools.diff:41,79; debian/copyright:7-9
• Basis: checked, in the package or with a reference tool
• Evidence: Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. / SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception; the diff carries # Copyright (c) 2022-2025, PostgreSQL Global Development Group in its context lines.
• Problem: The LLVM exception is a distinct licence text (not plain Apache-2.0) that is not in the tree or common-licenses, and the diff is PostgreSQL-licensed material with a holder not named; both are covered only by the Files: * Expat claim.
• Fix: Add stanzas naming the LLVM authors (Apache-2.0 WITH LLVM-exception, including the exception text) and PostgreSQL Global Development Group (PostgreSQL licence, text included) for those files.

16. [minor] [licensing] third_party/pcg is Apache-2.0 OR MIT, not Expat alone, and its Apache text is absent from the tree

• Files: third_party/pcg/pcg_random.hpp:1-17 (same in pcg_extras.hpp, pcg_uint128.hpp); debian/copyright:93-95
• Basis: checked, in the package or with a reference tool
• Evidence: SPDX-License-Identifier: (Apache-2.0 OR MIT); Licensed under the Apache License, Version 2.0 (provided in LICENSE-APACHE.txt ...) or under the MIT license (provided in LICENSE-MIT.txt ...) - neither LICENSE-APACHE.txt nor LICENSE-MIT.txt is in third_party/pcg/.
• Problem: The stanza records only Expat, so a consumer cannot tell that Apache-2.0 is also offered, and the Apache text the headers refer to is not present; the Expat text in debian/copyright is adequate for the MIT branch but the dual offer should be stated.
• Fix: Change the stanza to License: Apache-2.0 or Expat for third_party/pcg/*.

17. [minor] [licensing] Source: names only duckdb/duckdb although the tarball also contains six extension repositories

• Files: debian/copyright:2; extension_external/{httpfs,quack,ui,sqlite,postgres,mysql}/; debian/changelog (2.0.0+dfsg-1), debian/README.source
• Basis: checked, in the package or with a reference tool
• Evidence: Source: https://github.com/duckdb/duckdb; README.source: Added 6 out-of-tree extensions to the .orig source file.
• Problem: The .orig tarball is a merge of duckdb plus duckdb/httpfs, duckdb/quack, duckdb/duckdb-ui, duckdb/sqlite_scanner, duckdb/postgres_scanner and duckdb/mysql_scanner (plus the SQLite amalgamation), so the Source field describes only part of it. Provenance matters for anyone checking a file's origin later.
• Fix: List the extension repositories under Source (or in a Comment), with the versions/commits they were taken at.

18. [minor] [packaging] sqlite_scanner builds its own SQLite 3.38.1 amalgamation although Debian ships libsqlite3

• Files: extension_external/sqlite/src/sqlite/sqlite3.c:1-20, extension_external/sqlite/src/sqlite/CMakeLists.txt; debian/control
• Basis: checked, in the package or with a reference tool
• Evidence: This file is an amalgamation of many separate C source files from SQLite version 3.38.1; the CMakeLists compiles it as sqlite_lib into the sqlite_scanner extension, while Debian has sqlite3 (libsqlite3-dev) and no Build-Depends on it.
• Problem: An 8 MB embedded copy of SQLite (2022 vintage) is shipped inside the duckdb package, so SQLite security fixes have to wait for a duckdb upload rather than arriving with the sqlite3 package. It is also third-party code Debian already maintains.
• Fix: Build the extension against libsqlite3-dev (the extension has a include/sqlite3 shim path), or at least document in README.source why the amalgamation is kept and how it is updated; either way, split the licence stanza as noted for the amalgamation.

Verified

• debian/ read in full: control, rules, changelog, copyright, source/format (3.0 quilt), install/manpages/lintian-overrides files, extension-configs/*.cmake, all twelve patches (each has Description, Author, Forwarded and Last-Update headers), tests/{control,CMakeLists.txt,run-all-tests,cli,library,bigint,json,icu,tpch,parquet,sqlite_scanner,quack,ui,extension_trust}, README.source, README.Debian, gbp.conf, salsa-ci.yml, cmake-instrumentation.json.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): current enough; compat is debhelper-compat (= 14), and the missing ${misc:Depends}/${shlibs:Depends} fields are what dh_gencontrol adds at that level.
• Build-Depends checked against what rules and patches use; architecture-is-64-bit is provided by architecture-properties 0.2.6 and libyyjson-dev exists (0.12.0+ds-2) (apt-cache tool). System zstd/xxhash/snappy/lz4/brotli/yyjson/mbedtls/mariadb/libpq replacements are implemented by the patches and the include shims.
• autopkgtest mechanics: the spec guarantees the cwd is the unpacked source root, so cmake -S debian/tests and PACKAGE_ROOT (= source root) are right; every test named in debian/tests/CMakeLists.txt exists.
• Prescan archive/compressed files: test/sql/table_function/files/four.blob is a zip test fixture; test/sql/window/walmart.csv.gz and test/sqlserver/data/.csv.gz are gzipped CSV test data (provenance noted in an issue); extension_external/sqlite/data/db/.db and the -journal/-wal files are SQLite test databases; extension_external/httpfs/data/secrets/httpfs/.duckdb_secret are small fixtures for the secret parser; scripts/null.txt is a one-byte NUL fixture; test/api/serialized_plans/cases/.bin are plan fixtures each paired with the .sql that generates it.
• Prescan documents: extension_external/quack/rpc.pdf is a rendered plot, and its sources are shipped (plot.R, macbook.tsv, benchmarks/), so it is not a source-less binary document.
• Prescan licence wording: api_spec/v2/function/aggregate.yaml:850, src/include/duckdb_v2.h:5608 and tools/cpp/duckdb_cpp.hpp:4152 (the source must not be modified) describe aggregate-state buffers, not licence terms; third_party/miniz/miniz.cpp:579 commercial or non-commercial is the Unlicense public-domain dedication (free, but attribution is missing - see issue).
• Prescan holders that are accounted for: Public Software Group e.V. is named in the utf8proc stanza (spelling variant); Melissa O'Neill is named as 'PCG Project contributors'; Yuji Hirose for third_party/httplib is named (the extension_external copy is not - see issue); Thomas Porschberg and Douglas Crockford appear only in third_party/thrift/thrift/LICENSE for files (aclocal m4, json_parse.js) that are not vendored; Twitter, Avro, Spark and Daniel Lemire appear only in third_party/parquet/LICENSE for Java/Spark sources that are not vendored; extension_external/mysql/src/include/mysql_version.h is public domain (Copyright Abandoned ... This file is public domain); src/common/crypto/md5.cpp is no copyright is claimed (public domain).
• Generated files have their preferred form in-tree: src/include/duckdb.h and duckdb_v2.h from api_spec/ via scripts/capi_v1_regen.sh and capi_v2_regen.sh (spec and templates shipped); extension/icu/datetime/generated/tz_data.cpp and collation/generated/collation_data.cpp from the shipped generate_/update_ scripts; third_party/parquet/parquet_types.* from the shipped parquet.thrift + generate.sh; extension/tpch/dbgen/include/tpch_constants.hpp from the shipped queries/*.sql.
• Not built by this package but present in the source: tools/swift (a Swift client), extension_external/{mysql,postgres,sqlite}/database-connector, extension_external/*/duckdb and extension-ci-tools (empty submodule directories), examples/ and .github/.
• Licence texts present in debian/copyright for Expat, BSD-2-Clause, BSD-3-Clause, BSL-1.0, Zlib and public-domain; Apache-2.0 and GPL-2+ point at files that exist under /usr/share/common-licenses.
• uscan found the packaged version as the newest upstream release (upstream 2.0.0, packaged 2.0.0+dfsg).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2).

Not confirmed

• The terms of the AdventureWorks, Chinook and Sakila sample data sets could not be checked offline; a licensee check of those files would settle whether the data is DFSG-free as well as unattributed.
• Whether dwz accepts -L none as passed by override_dh_dwz could not be checked (no dwz manual page installed); a build would show it.
• Whether dh_shlibdeps records libpq5/libmariadb3 against the duckdb binary package for the hand-installed *.duckdb_extension files (they are ELF but not named *.so) could not be tested without a build.

Proposed changes

None.