Review: duckdb 2.0.0+dfsg2-1
Package Information
| Description | in-process SQL OLAP database management system - CLI DuckDB is an in-process SQL OLAP database management system. It provides a rich SQL dialect with support for arbitrary and nested correlated subqueries, window functions, collations, and complex types (arrays, structs). This package contains the DuckDB command-line interface. See /usr/share/doc/duckdb/README.Debian for usage examples. |
|---|---|
| Maintainer | Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org> |
| Changed By | Dominique Belhachemi <domibel@debian.org> |
| Sponsor | domibel@debian.org |
| Distribution | unstable |
| Architecture | any |
| VCS | git: https://salsa.debian.org/science-team/duckdb.git (browse) |
| Popcon Installs | 38 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/duckdb |
| Uploaded | 3 days ago |
| Supersedes | 2.0.0+dfsg-1 |
Potential Library Transition
The maintainer says no transition is needed and asked us to review anyway.
I tested the reverse dependency. It builds fine. No transition coordination necessary.
— domibel, 3 days ago
New Package Report
.changes
| Distribution | unstable |
|---|---|
| Date | Tue, 27 Oct 2026 19:38:32 -0400 |
| Source | duckdb |
| Version | 2.0.0+dfsg2-1 |
| Changed-By | Dominique Belhachemi <domibel@debian.org> |
| Architecture | source amd64 |
Changelog
duckdb (2.0.0+dfsg2-1) unstable; urgency=medium
.
* New upstream release 2.0.0
* Repack upstream tarball as +dfsg2: combine duckdb core with 5
out-of-tree extensions (httpfs, quack, sqlite_scanner,
postgres_scanner, mysql_scanner), so they can be built for other
architectures using Debian's own baseline.
* debian/rules: add -DDUCKDB_OPTIMIZATION_PROFILE=NONE to disable the
new unconditional -march=x86-64-v3 default on amd64
* Rename libduckdb1.5 to libduckdb2.0 to match the new SOVERSION
* Build the 5 out-of-tree extensions as standalone loadable
files in /usr/lib/duckdb/extensions/, and make them
preferred over local ~/.duckdb/extensions/
* debian/control: add libcurl4-openssl-dev, libmariadb-dev,
libpq-dev, libssl-dev, python3, zlib1g-dev build-deps
* debian/control: drop the now-unused libicu-dev build-dep
* Disable autoinstall of known extensions by default, so extension
use never triggers a silent internet connection
* debian/README.Debian: document the 5 bundled extensions
* debian/tests: add autopkgtest coverage for the 5 bundled extensions
* debian/watch: add Dversion-Mangle to strip +dfsg for uscan.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | duckdb deb database optional arch=any libduckdb-dev deb libdevel optional arch=any libduckdb2.0 deb libs optional arch=any |
| Section | database |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source:
https://github.com/duckdb/duckdb,
https://github.com/duckdb/duckdb-httpfs,
https://github.com/duckdb/duckdb-quack,
https://github.com/duckdb/duckdb-sqlite,
https://github.com/duckdb/duckdb-postgres,
https://github.com/duckdb/duckdb-mysql,
https://github.com/duckdb/database-connector
Upstream-Name: duckdb
Upstream-Contact:
https://github.com/duckdb/duckdb,
Files: *
Copyright: 2018-2025 Stichting DuckDB Foundation
License: Expat
Files: src/common/crypto/md5.cpp
Copyright: 1993 Colin Plumb
License: public-domain
Files: extension_external/mysql/src/include/mysql_version.h
Copyright: 1996-2007 TCX DataKonsult AB, Monty Program KB, Detron HB, MySQL AB
License: public-domain
Files: extension_external/sqlite/src/sqlite/sqlite3.c
extension_external/sqlite/src/sqlite/sqlite3.h
Copyright: none
License: public-domain
Files: debian/*
Copyright: 2026 Dominique Belhachemi <domibel@debian.org>
License: Expat
Files: test/sqlite/termcolor.hpp
Copyright: 2013 Ihor Kalnytskyi
License: BSD-3-Clause
Files: src/common/checksum.cpp
src/common/types/hash.cpp
Copyright: 2018-2021 Martin Ankerl
License: Expat
Files: src/include/duckdb/execution/merge_sort_tree.hpp
Copyright: 2022 salesforce.com, inc.
License: Expat
Files: src/include/duckdb/storage/compression/alp/algorithm/*
src/include/duckdb/storage/compression/alprd/algorithm/*
Copyright: 2023 CWI, Azim Afroozeh, Leonardo Xavier Kuffo Rivero
License: Expat
Files: test/sakila/*
Copyright: 2006 MySQL AB
License: BSD-3-Clause
Files: third_party/jemalloc/*
Copyright: 2002-present Jason Evans <jasone@canonware.com>
2007-2012 Mozilla Foundation
2009-present Facebook, Inc.
License: BSD-2-Clause
Files: third_party/jemalloc/include/jemalloc/internal/hash.h
Copyright: Austin Appleby
License: public-domain
Files: third_party/jemalloc/include/msvc_compat/C99/stdint.h
Copyright: 2006-2008 Alexander Chemeris
License: BSD-3-Clause
Files: src/include/duckdb/common/adbc/*
Copyright: Apache Arrow Authors
License: Apache-2.0
Files: src/include/duckdb/common/arrow/nanoarrow/*
Copyright: Apache Arrow Authors
License: Apache-2.0
Files: src/common/adbc/nanoarrow/*
Copyright: Apache Arrow Authors
License: Apache-2.0
Files: test/api/adbc/*
Copyright: Apache Arrow Authors
License: Apache-2.0
Files: third_party/catch/*
Copyright: 2021 Two Blue Cubes Ltd
License: BSL-1.0
Files: third_party/concurrentqueue/*
Copyright: 2013-2016 Cameron Desrochers
License: BSD-2-Clause or BSL-1.0
Files: third_party/concurrentqueue/lightweightsemaphore.h
Copyright: Jeff Preshing
License: Zlib
Files: third_party/fast_float/*
Copyright: 2021 Daniel Lemire, João Paulo Magalhaes
License: Expat
Files: third_party/fastpforlib/*
Copyright: 2013-2014 Daniel Lemire
License: Apache-2.0
Files: third_party/fmt/*
Copyright: 2012-present Victor Zverovich
License: Expat
Files: third_party/fsst/*
Copyright: 2018-2020 CWI, TU Munich, FSU Jena
License: Expat
Files: third_party/httplib/*
Copyright: 2017 yhirose
License: Expat
Files: third_party/hyperloglog/*
Copyright: 2012 Artsyinc, Inc.
License: Expat
Files: third_party/hyperloglog/sds.cpp
third_party/hyperloglog/sds.hpp
Copyright: 2006-2015 Salvatore Sanfilippo
2015 Oran Agra
2015 Redis Labs, Inc
License: BSD-3-Clause
Files: third_party/hyperloglog/hyperloglog.cpp
Copyright: 2014 Salvatore Sanfilippo
License: BSD-3-Clause
Files: third_party/jaro_winkler/*
Copyright: 2022 Max Bachmann
License: Expat
Files: third_party/mbedtls/*
Copyright: The Mbed TLS Contributors
License: Apache-2.0 or GPL-2+
Files: third_party/miniz/*
Copyright: 2010-2014 RAD Game Tools, Valve Software, Rich Geldreich, Tenacious Software LLC
2016 Martin Raiber
License: Expat
Files: third_party/parquet/*
Copyright: 2012-2014 The Apache Software Foundation
License: Apache-2.0
Files: third_party/pcg/*
Copyright: 2014-2017 Melissa O'Neill, PCG Project contributors
License: Apache-2.0 or Expat
Files: third_party/pdqsort/*
Copyright: 2021 Orson Peters
License: Zlib
Files: third_party/re2/*
Copyright: 2009 The RE2 Authors
License: BSD-3-Clause
Files: third_party/re2/util/rune.cc
third_party/re2/util/utf.h
Copyright: 2002 Lucent Technologies
License: HPND
Files: third_party/ska_sort/*
Copyright: 2016 Malte Skarupke
License: BSL-1.0
Files: third_party/skiplist/*
Copyright: 2017-2023 Paul Ross
License: Expat
Files: third_party/tdigest/*
Copyright: Ted Dunning
License: Apache-2.0
Files: third_party/thrift/*
Copyright: The Apache Software Foundation
License: Apache-2.0
Files: third_party/utf8proc/*
Copyright: 2009-2019 Steven G. Johnson, Jiahao Chen, Tony Kelman, Jonas Fonseca, Public Software Group e.V.
License: Expat
Files: third_party/utf8proc/utf8proc_data.cpp
Copyright: 1991-2007 Unicode, Inc.
License: Expat and Unicode-Data
Files: extension/icu/collation/generated/collation_data.cpp
Copyright: Unicode, Inc.
License: Expat and Unicode-Data
Files: third_party/vergesort/*
Copyright: 2015 Morwenn
License: Expat
Files: third_party/vergesort/detail/insertion_sort.h
third_party/vergesort/detail/log2.h
Copyright: 2015 Orson Peters
2015-2016 Morwenn
License: Zlib
Files: tools/shell/linenoise/*
Copyright: 2014-2016 Salvatore Sanfilippo, Pieter Noordhuis
License: BSD-2-Clause
Files: scripts/run-clang-tidy.py
scripts/clang-tidy-diff.py
Copyright: LLVM Project contributors
License: Apache-2.0 with LLVM exception
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
.
On Debian systems, the full text of the Apache License, Version 2.0
can be found in the file /usr/share/common-licenses/Apache-2.0.
License: Apache-2.0 with LLVM exception
Licensed under the Apache License, Version 2.0 (the "License") with
the LLVM Exceptions, as follows:
.
---- LLVM Exceptions to the Apache 2.0 License ----
.
As an exception, if, as a result of your compiling your source code, portions
of this Software are embedded into an Object form of such source code, you
may redistribute such embedded portions in such Object form without complying
with the conditions of Sections 4(a), 4(b) and 4(d) of the License.
.
In addition, if you combine or link compiled forms of this Software with
software that is licensed under the GPLv2 ("Combined Software") and if a
court of competent jurisdiction determines that the patent provision (Section
3), the indemnity provision (Section 9) or other Section of the License
conflicts with the conditions of the GPLv2, you may retroactively and
prospectively choose to deem waived or otherwise exclude such Section(s) of
the License, but only in their entirety and only with respect to the Combined
Software.
.
On Debian systems, the full text of the Apache License, Version 2.0
can be found in the file /usr/share/common-licenses/Apache-2.0.
License: BSD-2-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software
without specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
License: BSL-1.0
Boost Software License - Version 1.0 - August 17th, 2003
.
Permission is hereby granted, free of charge, to any person or organization
obtaining a copy of the software and accompanying documentation covered by
this license (the "Software") to use, reproduce, display, distribute,
execute, and transmit the Software, and to prepare derivative works of the
Software, and to permit third-parties to whom the Software is furnished to
do so, all subject to the following:
.
The copyright notices in the Software and this entire statement, including
the above license grant, this restriction and the following disclaimer,
must be included in all copies of the Software, in whole or in part, and
all derivative works of the Software, unless such copies or derivative
works are solely in the form of machine-executable object code generated
by a source language processor.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
License: GPL-2+
On Debian systems, the full text of the GNU General Public License
version 2 can be found in the file /usr/share/common-licenses/GPL-2.
License: HPND
Permission to use, copy, modify, and distribute this software for any
purpose without fee is hereby granted, provided that this entire notice
is included in all copies of any software which is or includes a copy
or modification of this software and in all copies of the supporting
documentation for such software.
.
THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED
WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR LUCENT TECHNOLOGIES MAKE ANY
REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY
OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.
License: public-domain
This work has been dedicated to the public domain by its author, who
disclaims copyright to it.
License: Unicode-Data
Permission is hereby granted, free of charge, to any person obtaining a
copy of the Unicode data files and any associated documentation (the "Data
Files") or Unicode software and any associated documentation (the
"Software") to deal in the Data Files or Software without restriction,
including without limitation the rights to use, copy, modify, merge,
publish, distribute, and/or sell copies of the Data Files or Software, and
to permit persons to whom the Data Files or Software are furnished to do
so, provided that (a) the above copyright notice(s) and this permission
notice appear with all copies of the Data Files or Software, (b) both the
above copyright notice(s) and this permission notice appear in associated
documentation, and (c) there is clear notice in each modified Data File or
in the Software as well as in the documentation associated with the Data
File(s) or Software that the data or software has been modified.
.
THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS
INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR
CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THE DATA FILES OR SOFTWARE.
.
Except as contained in this notice, the name of a copyright holder shall
not be used in advertising or otherwise to promote the sale, use or other
dealings in these Data Files or Software without prior written
authorization of the copyright holder.
License: Zlib
This software is provided 'as-is', without any express or implied warranty.
In no event will the authors be held liable for any damages arising from the
use of this software.
.
Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:
.
1. The origin of this software must not be misrepresented; you must not
claim that you wrote the original software. If you use this software in
a product, an acknowledgment in the product documentation would be
appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.
DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 3 days ago.
Report
DFSG NEW review for duckdb version 2.0.0+dfsg2-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: No
- Issues: 0 blocker, 1 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 102 found (36 not listed by the scan, so not checked)
Licensing
Licensing is DFSG-free and debian/copyright (DEP-5) matches the tree. Every files-with-other-terms group that exists in the source has a stanza (jemalloc, adbc/nanoarrow, catch, concurrentqueue, fast_float, fastpforlib, fmt, fsst, httplib, hyperloglog, jaro_winkler, mbedtls, miniz, parquet, pcg, pdqsort, re2, ska_sort, skiplist, tdigest, thrift, utf8proc, vergesort, linenoise, ALP/ALP-RD, termcolor, Sakila, LLVM scripts, md5.cpp, salesforce merge_sort_tree, the mysql_version.h header and the vendored sqlite3.c), and each states the licence the file's own text does. Files-Excluded is not used, but the repack (data/ and benchmark/ removed, five extension repositories added) is documented in debian/README.source. Nothing non-free was found, and the three holders the scan flagged are accounted for below.
Packaging
The packaging is otherwise careful (compat 14, arch-constraint build-deps, system libraries instead of bundled ones, DEP-3 patches, autopkgtests for the CLI, library and all five loadable extensions, correct v2.0.0/linux_ extension layout), but libduckdb-dev ships a CMake config that cannot work with the imported libraries its patches add, and the extension-trust patch verifies a string prefix instead of the resolved path, which defeats the signature check it is meant to scope. Both are fixable without changing the build.
Issues
1. [important] [packaging] libduckdb-dev's DuckDBConfig.cmake does not find the imported libraries that the exported duckdb target links against
- Files:
DuckDBConfig.cmake.in:11,src/CMakeLists.txt:75,src/CMakeLists.txt:84,src/CMakeLists.txt:94,src/CMakeLists.txt:120,debian/patches/use-system-zstd.patch,debian/patches/use-system-yyjson.patch,debian/patches/use-system-mbedtls.patch,debian/patches/use-system-parquet-codecs.patch,debian/control,debian/rules - Basis: inferred from what was read, not seen directly
- Evidence:
DuckDBConfig.cmake.inhas onlyinclude(CMakeFindDependencyMacro)/find_dependency(Threads); the patches put imported targets into the public link interface:list(APPEND DUCKDB_SYSTEM_LIBS PkgConfig::libzstd PkgConfig::libxxhash),list(APPEND DUCKDB_SYSTEM_LIBS MbedTLS::mbedcrypto),list(APPEND DUCKDB_SYSTEM_LIBS yyjson::yyjson), plusSnappy::snappy,LZ4::lz4_shared,PkgConfig::BROTLIon the exportedparquet_extension/icu_extension, andsrc/CMakeLists.txt:120doestarget_link_libraries(duckdb PUBLIC ${DUCKDB_SYSTEM_LIBS}).libduckdb-dev.installshipsusr/lib/*/cmake/DuckDB/, i.e. the DuckDBExports.cmake that names all those targets. - Problem: CMake writes the imported target names verbatim into the installed export file; a consumer's
find_package(DuckDB)thentarget_link_libraries(app duckdb)fails at generate time with 'links to target "PkgConfig::libzstd" but the target was not found', because the config file defines none of them. The -dev package's advertised CMake interface is therefore unusable. Related:libduckdb-devDepends on libmbedtls-dev and libzstd-dev but not libxxhash-dev or pkgconf, which such a config would need; andDuckDBConfig.cmake.in:22still offersDuckDB_LIBRARIES duckdb_staticalthoughdebian/rules:114deletes every*.afrom the package. - Fix: Add the missing find_dependency/pkg_check_modules calls to the config (and the matching -dev packages plus pkgconf to libduckdb-dev's Depends), or link the system libraries PRIVATE and whole-archive them into libduckdb.so so they never appear in the interface; drop the duckdb_static branch from the config since no static library is shipped, or ship the .a files.
2. [minor] [packaging] trust-system-extensions.patch skips signature verification for any path that merely starts with /usr/lib/duckdb/extensions/, so ../.. bypasses the check
- Files:
debian/patches/trust-system-extensions.patch,src/main/extension/extension_load.cpp:665-672,src/common/file_system.cpp:405-418 - Basis: checked, in the package or with a reference tool
- Evidence:
const bool is_system_extension = filename.size() >= system_extension_path.size() && filename.compare(0, system_extension_path.size(), system_extension_path) == 0;withDEBIAN_DUCKDB_SYSTEM_EXTENSION_PATHfixed at compile time to/usr/lib/duckdb/extensions/; for a direct loadfilename = fs.ExpandPath(filename), andFileSystem::ExpandPathonly rewrites a leading~or afile://URL, leaving.and..untouched. - Problem: The test is a byte prefix test on the path string the user supplied, not on the file reached, so
LOAD '/usr/lib/duckdb/extensions/../../../tmp/evil.duckdb_extension'(or the same with afile://URL) is treated as a Debian-packaged extension and loaded without the signature check that the patch exists to scope to /usr/lib/duckdb/extensions. DuckDB's extension signatures are the defence against loading unsigned native code from untrusted SQL or databases; the patch reintroduces a way around them, which is a security regression that the deliberate trust of the packaged directory does not require. - Fix: Resolve the path first (
fs.CanonicalizePath/RealPath) and compare the resolved path, or comparefs.ExtractDirectory(canonical)with the canonical trusted directory, before setting is_system_extension.
Verified
- Read the whole of debian/: control, rules, changelog (full), copyright (full, 401 lines), all four install/manpages files, source/format, gbp.conf, salsa-ci.yml, cmake-instrumentation.json, duckdb.1, README.Debian, README.source, tests/control and all nine tests/* scripts, all ten patches and patches/series, and the five extension-configs/*.cmake.
- debian/copyright is DEP-5 with the correct Format URL; every short name it uses is defined by a stand-alone License paragraph (Expat, BSD-2-Clause, BSD-3-Clause, BSL-1.0, Zlib, HPND, Unicode-Data, public-domain, Apache-2.0, Apache-2.0 with LLVM exception, GPL-2+), the Apache-2.0 and GPL-2+ paragraphs point at /usr/share/common-licenses, and the licences that are not there carry their full text.
- Copyright holder check:
Public Software Group e. V.is named in theFiles: third_party/utf8proc/*stanza (as 'Public Software Group e.V.'). Thomas Porschberg (third_party/thrift/thrift/LICENSE:222, aclocal m4 files) and Twitter/ElephantBird (third_party/parquet/LICENSE:215, parquet-hadoop Java) appear only in vendor LICENSE boilerplate for components that are not in the tree: the thrift subset has only protocol/transport headers, and the parquet subset has parquet_types.{h,cpp}, parquet.thrift, generate.sh and windows_compatibility.h.yhirosein the httplib stanza andMelissa O'Neill, PCG Project contributorsin the pcg stanza match the files' own headers. - Licence-wording hits are not licence terms: third_party/miniz/miniz.cpp:579 is the Unlicense public-domain dedication that follows the MIT block in the same file (
commercial or non-commercialis its permission grant, not a restriction); api_spec/v2/function/aggregate.yaml:850, src/include/duckdb_v2.h:5608 and tools/cpp/duckdb_cpp.hpp:4152 are API documentation about aggregate state objects ('the source must not be modified'). - Archives: test/sql/table_function/files/four.blob is a 178-byte zip fixture for the table-function tests; test/sql/window/walmart.csv.gz feeds test_window_walmart and test_partition_flushing; the 17 test/sqlserver/data/.csv.gz plus test/sqlserver/scrape.py are the SQL Server compatibility fixtures; extension_external/httpfs/data/secrets/httpfs/.duckdb_secret are the httpfs secret-chain test fixtures; extension_external/sqlite/data/db/ (with the .db-wal and .db-journal files) and data/sql/ hold the sqlite_scanner test databases. All are upstream test data under
Files: *. - extension_external/quack/rpc.pdf is generated by extension_external/quack/plot.R (
pdf("rpc.pdf", height=5, width=15)), so its preferred form for modification is in the package. - Generated code has its generator or input in the package: third_party/parquet/parquet_types.{h,cpp} from parquet.thrift via third_party/parquet/generate.sh; extension/icu/collation/generated/collation_data.cpp and extension/icu/datetime/generated/tz_data.cpp from extension/icu/scripts/*.py; scripts/null.txt is the single NUL byte scripts/append_metadata.cmake requires.
- Other binary data in the scan were checked by directory: test/api/serialized_plans/cases/.bin (serialized-plan cases), test/storage/bc/.db, test/sql/storage/compression/{chimp,patas}/.db, test/sql/storage_version/, test/sql/copy/parquet/broken/*.parquet, test/geoparquet/seattle.parquet and extension_external/quack/test/certs/ are upstream-generated test data with no third-party notice. third_party/catch/catch.hpp carries its BSL-1.0 header; third_party/yyjson/ contains only DuckDB's own yyjson_memory.hpp wrapper (system libyyjson is linked, so no yyjson licence stanza is needed); third_party/imdb/ is DuckDB's own benchmark harness.
- Packaging checks: Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components current, not an issue); compat 14, so the absent ${misc:Depends}/${shlibs:Depends} fields are correct; build-deps resolvable (architecture-is-64-bit provided by architecture-properties 0.2.6, libyyjson-dev 0.12.0, libmbedtls-dev 3.6.7, libzstd-dev 1.5.7, libxxhash-dev, cmake 4.4.4 satisfies cmake_minimum_required(4.1) in debian/tests); all patches carry DEP-3 Description/Author/Forwarded/Last-Update headers; the extension install path repository/v2.0.0/linux_<DEB_HOST_ARCH> matches DUCKDB_NORMALIZED_VERSION (v2.0.0 from OVERRIDE_GIT_DESCRIBE) and the patched DuckDBPlatform(); the 512-byte
tail -c 512in rules matches ParsedExtensionMetaData::FOOTER_SIZE (src/include/duckdb/main/extension.hpp:45);dh_dwz -- -L noneis a valid dwz option (dwz(1) -L <COUNT|none>). - dh_shlibdeps does see the loadable .duckdb_extension files: at compat 14 it selects files by ELF header type (Debian::Debhelper::Dh_Lib::is_so_or_exec_elf_file), not by name, so the runtime Depends of the extension modules (libmariadb, libpq, OpenSSL, curl, snappy, lz4, brotli, zstd) are computed from the duckdb binary package.
- Repack:
Files-Excludedis not used; the copyright-format document shipped here does not define it, and the removal of data/ and benchmark/ plus the addition of the five extension repositories is documented in debian/README.source and the changelog. - uscan found the packaged version as the newest upstream release (upstream
2.0.0, packaged2.0.0+dfsg2). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,GPL-2).
Not confirmed
- Upstream terms of the bundled sample data: test/sqlserver/data/*.csv.gz (AdventureWorks tables: Sales.SalesPerson, SalesTerritory, HumanResources.Employee ...), extension_external/sqlite/data/db/sakila.db and chinook.db, test/sql/window/walmart.csv.gz and test/geoparquet/seattle.parquet carry no licence notice in the tree and are attributed to the DuckDB Foundation by
Files: *. I could not check the originating projects' licences from here, and did not open the .db files; if any of them is not MIT/BSD-equivalent (the Sakila database itself is BSD-3-Clause, as thetest/sakila/*stanza records), debian/copyright needs a stanza for it. - Whether the DuckDBConfig.cmake defect actually breaks consumers: this rests on CMake requiring
Foo::bar-style names in INTERFACE_LINK_LIBRARIES to be defined targets; no CMake consumer of libduckdb-dev was available to run here. - mips64el: the patched DuckDBPlatform() has no mips64el case and would return linux_unknown_arch, while debian/rules installs from repository/v2.0.0/linux_mips64el, which would make the extension install step fail. I could not confirm whether mips64el is still a release architecture for this suite.
- The +dfsg2 tarball is a combination of six upstream repositories with data/ and benchmark/ stripped, not a plain release; I did not compare it against the upstream tarballs, so I cannot say whether anything beyond that differs from what upstream shipped.
Proposed changes
None.
Uploader's response to the LLM review
Please continue.
— Dominique Belhachemi (domibel), 3 days ago
Review Information
accepted — allocated to awm 3 days ago, started 3 days ago, completed 3 days ago.
Final Comment
Hi,
Not sure if I believe that first LLM issue, but the second one seems like an interesting catch.
Thanks!
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 2.0.0+dfsg-1 | 59d68e17… | 2026-10-28 07:37 | 2026-10-28 07:37 | awm | accepted | VIEW |
| 1.5.1-2 | ba0476a8… | 2026-03-28 05:30 | 2026-03-29 06:29 | awm | accepted | VIEW |
| 1.5.1-1 | d17ced01… | 2026-03-26 07:47 | 2026-03-27 07:05 | awm | rejected | VIEW |
Public Notes
Missed Author Check
Command: dfsg-author-check -markdown
Exit code: 1
Author check: duckdb-2.0.0+dfsg2
Scanned 13231 files. Authors declared in debian/copyright: 44.
Not named in debian/copyright (3):
- Public Software Group e. V., Berlin, Germany
third_party/utf8proc/LICENSE:32third_party/utf8proc/include/utf8proc.hpp:3third_party/utf8proc/utf8proc.cpp:4
- Thomas Porschberg <thomas@randspringer.de>
third_party/thrift/thrift/LICENSE:222
- Twitter
third_party/parquet/LICENSE:215
Possibly named in debian/copyright under a similar name (2):
- Melissa O'Neill <oneill@pcg-random.org>, and the PCG Project contributors (might be Melissa O'Neill, PCG Project contributors)
third_party/pcg/pcg_extras.hpp:4third_party/pcg/pcg_random.hpp:4third_party/pcg/pcg_uint128.hpp:4
- Yuji Hirose (might be yhirose)
third_party/httplib/httplib.hpp:4
Result: 3 holders not named in debian/copyright, and 2 possibly named under a similar name
To name them, add to the end of debian/copyright:
Files: third_party/parquet/LICENSE
Copyright: 2013 Daniel Lemire
2014 The Apache Software Foundation
2012-2014 Twitter
License: Apache-2.0
Files: third_party/thrift/thrift/LICENSE
Copyright: 2007 Thomas Porschberg <thomas@randspringer.de>
License: Apache-2.0
Files: third_party/utf8proc/LICENSE
third_party/utf8proc/include/utf8proc.hpp
third_party/utf8proc/utf8proc.cpp
Copyright: 2009, 2013 Public Software Group e. V., Berlin, Germany
1991-2007 Unicode, Inc
License: Expat
Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.