DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: duckdb 2.0.0+dfsg2-1

Package Information

Descriptionin-process SQL OLAP database management system - CLI

DuckDB is an in-process SQL OLAP database management system. It provides a rich SQL dialect with support for arbitrary and nested correlated subqueries, window functions, collations, and complex types (arrays, structs).

This package contains the DuckDB command-line interface.

See /usr/share/doc/duckdb/README.Debian for usage examples.

MaintainerDebian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed ByDominique Belhachemi <domibel@debian.org>
Sponsordomibel@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/science-team/duckdb.git (browse)
Popcon Installs38
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/duckdb
Uploaded3 days ago
Supersedes2.0.0+dfsg-1

Potential Library Transition

The maintainer says no transition is needed and asked us to review anyway.

I tested the reverse dependency. It builds fine. No transition coordination necessary.

— domibel, 3 days ago

New Package Report

.changes◂
Distributionunstable
DateTue, 27 Oct 2026 19:38:32 -0400
Sourceduckdb
Version2.0.0+dfsg2-1
Changed-ByDominique Belhachemi <domibel@debian.org>
Architecturesource amd64
Changelog◂
duckdb (2.0.0+dfsg2-1) unstable; urgency=medium
 .
   * New upstream release 2.0.0
   * Repack upstream tarball as +dfsg2: combine duckdb core with 5
     out-of-tree extensions (httpfs, quack, sqlite_scanner,
     postgres_scanner, mysql_scanner), so they can be built for other
     architectures using Debian's own baseline.
   * debian/rules: add -DDUCKDB_OPTIMIZATION_PROFILE=NONE to disable the
     new unconditional -march=x86-64-v3 default on amd64
   * Rename libduckdb1.5 to libduckdb2.0 to match the new SOVERSION
   * Build the 5 out-of-tree extensions as standalone loadable
     files in /usr/lib/duckdb/extensions/, and make them
     preferred over local ~/.duckdb/extensions/
   * debian/control: add libcurl4-openssl-dev, libmariadb-dev,
     libpq-dev, libssl-dev, python3, zlib1g-dev build-deps
   * debian/control: drop the now-unused libicu-dev build-dep
   * Disable autoinstall of known extensions by default, so extension
     use never triggers a silent internet connection
   * debian/README.Debian: document the 5 bundled extensions
   * debian/tests: add autopkgtest coverage for the 5 bundled extensions
   * debian/watch: add Dversion-Mangle to strip +dfsg for uscan
.dsc◂
Priorityoptional
Componentmain
Package-Listduckdb deb database optional arch=any
libduckdb-dev deb libdevel optional arch=any
libduckdb2.0 deb libs optional arch=any
Sectiondatabase
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source:
 https://github.com/duckdb/duckdb,
 https://github.com/duckdb/duckdb-httpfs,
 https://github.com/duckdb/duckdb-quack,
 https://github.com/duckdb/duckdb-sqlite,
 https://github.com/duckdb/duckdb-postgres,
 https://github.com/duckdb/duckdb-mysql,
 https://github.com/duckdb/database-connector
Upstream-Name: duckdb
Upstream-Contact:
 https://github.com/duckdb/duckdb,

Files: *
Copyright: 2018-2025 Stichting DuckDB Foundation
License: Expat

Files: src/common/crypto/md5.cpp
Copyright: 1993 Colin Plumb
License: public-domain

Files: extension_external/mysql/src/include/mysql_version.h
Copyright: 1996-2007 TCX DataKonsult AB, Monty Program KB, Detron HB, MySQL AB
License: public-domain

Files: extension_external/sqlite/src/sqlite/sqlite3.c
 extension_external/sqlite/src/sqlite/sqlite3.h
Copyright: none
License: public-domain

Files: debian/*
Copyright: 2026 Dominique Belhachemi <domibel@debian.org>
License: Expat

Files: test/sqlite/termcolor.hpp
Copyright: 2013 Ihor Kalnytskyi
License: BSD-3-Clause

Files: src/common/checksum.cpp
 src/common/types/hash.cpp
Copyright: 2018-2021 Martin Ankerl
License: Expat

Files: src/include/duckdb/execution/merge_sort_tree.hpp
Copyright: 2022 salesforce.com, inc.
License: Expat

Files: src/include/duckdb/storage/compression/alp/algorithm/*
 src/include/duckdb/storage/compression/alprd/algorithm/*
Copyright: 2023 CWI, Azim Afroozeh, Leonardo Xavier Kuffo Rivero
License: Expat

Files: test/sakila/*
Copyright: 2006 MySQL AB
License: BSD-3-Clause

Files: third_party/jemalloc/*
Copyright: 2002-present Jason Evans <jasone@canonware.com>
 2007-2012 Mozilla Foundation
 2009-present Facebook, Inc.
License: BSD-2-Clause

Files: third_party/jemalloc/include/jemalloc/internal/hash.h
Copyright: Austin Appleby
License: public-domain

Files: third_party/jemalloc/include/msvc_compat/C99/stdint.h
Copyright: 2006-2008 Alexander Chemeris
License: BSD-3-Clause

Files: src/include/duckdb/common/adbc/*
Copyright: Apache Arrow Authors
License: Apache-2.0

Files: src/include/duckdb/common/arrow/nanoarrow/*
Copyright: Apache Arrow Authors
License: Apache-2.0

Files: src/common/adbc/nanoarrow/*
Copyright: Apache Arrow Authors
License: Apache-2.0

Files: test/api/adbc/*
Copyright: Apache Arrow Authors
License: Apache-2.0

Files: third_party/catch/*
Copyright: 2021 Two Blue Cubes Ltd
License: BSL-1.0

Files: third_party/concurrentqueue/*
Copyright: 2013-2016 Cameron Desrochers
License: BSD-2-Clause or BSL-1.0

Files: third_party/concurrentqueue/lightweightsemaphore.h
Copyright: Jeff Preshing
License: Zlib

Files: third_party/fast_float/*
Copyright: 2021 Daniel Lemire, João Paulo Magalhaes
License: Expat

Files: third_party/fastpforlib/*
Copyright: 2013-2014 Daniel Lemire
License: Apache-2.0

Files: third_party/fmt/*
Copyright: 2012-present Victor Zverovich
License: Expat

Files: third_party/fsst/*
Copyright: 2018-2020 CWI, TU Munich, FSU Jena
License: Expat

Files: third_party/httplib/*
Copyright: 2017 yhirose
License: Expat

Files: third_party/hyperloglog/*
Copyright: 2012 Artsyinc, Inc.
License: Expat

Files: third_party/hyperloglog/sds.cpp
 third_party/hyperloglog/sds.hpp
Copyright: 2006-2015 Salvatore Sanfilippo
 2015 Oran Agra
 2015 Redis Labs, Inc
License: BSD-3-Clause

Files: third_party/hyperloglog/hyperloglog.cpp
Copyright: 2014 Salvatore Sanfilippo
License: BSD-3-Clause

Files: third_party/jaro_winkler/*
Copyright: 2022 Max Bachmann
License: Expat

Files: third_party/mbedtls/*
Copyright: The Mbed TLS Contributors
License: Apache-2.0 or GPL-2+

Files: third_party/miniz/*
Copyright: 2010-2014 RAD Game Tools, Valve Software, Rich Geldreich, Tenacious Software LLC
 2016 Martin Raiber
License: Expat

Files: third_party/parquet/*
Copyright: 2012-2014 The Apache Software Foundation
License: Apache-2.0

Files: third_party/pcg/*
Copyright: 2014-2017 Melissa O'Neill, PCG Project contributors
License: Apache-2.0 or Expat

Files: third_party/pdqsort/*
Copyright: 2021 Orson Peters
License: Zlib

Files: third_party/re2/*
Copyright: 2009 The RE2 Authors
License: BSD-3-Clause

Files: third_party/re2/util/rune.cc
 third_party/re2/util/utf.h
Copyright: 2002 Lucent Technologies
License: HPND

Files: third_party/ska_sort/*
Copyright: 2016 Malte Skarupke
License: BSL-1.0

Files: third_party/skiplist/*
Copyright: 2017-2023 Paul Ross
License: Expat

Files: third_party/tdigest/*
Copyright: Ted Dunning
License: Apache-2.0

Files: third_party/thrift/*
Copyright: The Apache Software Foundation
License: Apache-2.0

Files: third_party/utf8proc/*
Copyright: 2009-2019 Steven G. Johnson, Jiahao Chen, Tony Kelman, Jonas Fonseca, Public Software Group e.V.
License: Expat

Files: third_party/utf8proc/utf8proc_data.cpp
Copyright: 1991-2007 Unicode, Inc.
License: Expat and Unicode-Data

Files: extension/icu/collation/generated/collation_data.cpp
Copyright: Unicode, Inc.
License: Expat and Unicode-Data

Files: third_party/vergesort/*
Copyright: 2015 Morwenn
License: Expat

Files: third_party/vergesort/detail/insertion_sort.h
 third_party/vergesort/detail/log2.h
Copyright: 2015 Orson Peters
 2015-2016 Morwenn
License: Zlib

Files: tools/shell/linenoise/*
Copyright: 2014-2016 Salvatore Sanfilippo, Pieter Noordhuis
License: BSD-2-Clause

Files: scripts/run-clang-tidy.py
 scripts/clang-tidy-diff.py
Copyright: LLVM Project contributors
License: Apache-2.0 with LLVM exception

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 .
 On Debian systems, the full text of the Apache License, Version 2.0
 can be found in the file /usr/share/common-licenses/Apache-2.0.

License: Apache-2.0 with LLVM exception
 Licensed under the Apache License, Version 2.0 (the "License") with
 the LLVM Exceptions, as follows:
 .
 ---- LLVM Exceptions to the Apache 2.0 License ----
 .
 As an exception, if, as a result of your compiling your source code, portions
 of this Software are embedded into an Object form of such source code, you
 may redistribute such embedded portions in such Object form without complying
 with the conditions of Sections 4(a), 4(b) and 4(d) of the License.
 .
 In addition, if you combine or link compiled forms of this Software with
 software that is licensed under the GPLv2 ("Combined Software") and if a
 court of competent jurisdiction determines that the patent provision (Section
 3), the indemnity provision (Section 9) or other Section of the License
 conflicts with the conditions of the GPLv2, you may retroactively and
 prospectively choose to deem waived or otherwise exclude such Section(s) of
 the License, but only in their entirety and only with respect to the Combined
 Software.
 .
 On Debian systems, the full text of the Apache License, Version 2.0
 can be found in the file /usr/share/common-licenses/Apache-2.0.

License: BSD-2-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 3. Neither the name of the copyright holder nor the names of its contributors
    may be used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: BSL-1.0
 Boost Software License - Version 1.0 - August 17th, 2003
 .
 Permission is hereby granted, free of charge, to any person or organization
 obtaining a copy of the software and accompanying documentation covered by
 this license (the "Software") to use, reproduce, display, distribute,
 execute, and transmit the Software, and to prepare derivative works of the
 Software, and to permit third-parties to whom the Software is furnished to
 do so, all subject to the following:
 .
 The copyright notices in the Software and this entire statement, including
 the above license grant, this restriction and the following disclaimer,
 must be included in all copies of the Software, in whole or in part, and
 all derivative works of the Software, unless such copies or derivative
 works are solely in the form of machine-executable object code generated
 by a source language processor.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
 SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
 FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
 ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License: GPL-2+
 On Debian systems, the full text of the GNU General Public License
 version 2 can be found in the file /usr/share/common-licenses/GPL-2.

License: HPND
 Permission to use, copy, modify, and distribute this software for any
 purpose without fee is hereby granted, provided that this entire notice
 is included in all copies of any software which is or includes a copy
 or modification of this software and in all copies of the supporting
 documentation for such software.
 .
 THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED
 WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR LUCENT TECHNOLOGIES MAKE ANY
 REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY
 OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.

License: public-domain
 This work has been dedicated to the public domain by its author, who
 disclaims copyright to it.

License: Unicode-Data
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of the Unicode data files and any associated documentation (the "Data
 Files") or Unicode software and any associated documentation (the
 "Software") to deal in the Data Files or Software without restriction,
 including without limitation the rights to use, copy, modify, merge,
 publish, distribute, and/or sell copies of the Data Files or Software, and
 to permit persons to whom the Data Files or Software are furnished to do
 so, provided that (a) the above copyright notice(s) and this permission
 notice appear with all copies of the Data Files or Software, (b) both the
 above copyright notice(s) and this permission notice appear in associated
 documentation, and (c) there is clear notice in each modified Data File or
 in the Software as well as in the documentation associated with the Data
 File(s) or Software that the data or software has been modified.
 .
 THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
 KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
 THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS
 INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR
 CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
 USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
 TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THE DATA FILES OR SOFTWARE.
 .
 Except as contained in this notice, the name of a copyright holder shall
 not be used in advertising or otherwise to promote the sale, use or other
 dealings in these Data Files or Software without prior written
 authorization of the copyright holder.

License: Zlib
 This software is provided 'as-is', without any express or implied warranty.
 In no event will the authors be held liable for any damages arising from the
 use of this software.
 .
 Permission is granted to anyone to use this software for any purpose,
 including commercial applications, and to alter it and redistribute it
 freely, subject to the following restrictions:
 .
 1. The origin of this software must not be misrepresented; you must not
    claim that you wrote the original software. If you use this software in
    a product, an acknowledgment in the product documentation would be
    appreciated but is not required.
 2. Altered source versions must be plainly marked as such, and must not be
    misrepresented as being the original software.
 3. This notice may not be removed or altered from any source distribution.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 3 days ago.

Report◂

DFSG NEW review for duckdb version 2.0.0+dfsg2-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: No
  • Issues: 0 blocker, 1 important, 1 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 102 found (36 not listed by the scan, so not checked)

Licensing

Licensing is DFSG-free and debian/copyright (DEP-5) matches the tree. Every files-with-other-terms group that exists in the source has a stanza (jemalloc, adbc/nanoarrow, catch, concurrentqueue, fast_float, fastpforlib, fmt, fsst, httplib, hyperloglog, jaro_winkler, mbedtls, miniz, parquet, pcg, pdqsort, re2, ska_sort, skiplist, tdigest, thrift, utf8proc, vergesort, linenoise, ALP/ALP-RD, termcolor, Sakila, LLVM scripts, md5.cpp, salesforce merge_sort_tree, the mysql_version.h header and the vendored sqlite3.c), and each states the licence the file's own text does. Files-Excluded is not used, but the repack (data/ and benchmark/ removed, five extension repositories added) is documented in debian/README.source. Nothing non-free was found, and the three holders the scan flagged are accounted for below.

Packaging

The packaging is otherwise careful (compat 14, arch-constraint build-deps, system libraries instead of bundled ones, DEP-3 patches, autopkgtests for the CLI, library and all five loadable extensions, correct v2.0.0/linux_ extension layout), but libduckdb-dev ships a CMake config that cannot work with the imported libraries its patches add, and the extension-trust patch verifies a string prefix instead of the resolved path, which defeats the signature check it is meant to scope. Both are fixable without changing the build.

Issues

1. [important] [packaging] libduckdb-dev's DuckDBConfig.cmake does not find the imported libraries that the exported duckdb target links against

  • Files: DuckDBConfig.cmake.in:11, src/CMakeLists.txt:75, src/CMakeLists.txt:84, src/CMakeLists.txt:94, src/CMakeLists.txt:120, debian/patches/use-system-zstd.patch, debian/patches/use-system-yyjson.patch, debian/patches/use-system-mbedtls.patch, debian/patches/use-system-parquet-codecs.patch, debian/control, debian/rules
  • Basis: inferred from what was read, not seen directly
  • Evidence: DuckDBConfig.cmake.in has only include(CMakeFindDependencyMacro) / find_dependency(Threads); the patches put imported targets into the public link interface: list(APPEND DUCKDB_SYSTEM_LIBS PkgConfig::libzstd PkgConfig::libxxhash), list(APPEND DUCKDB_SYSTEM_LIBS MbedTLS::mbedcrypto), list(APPEND DUCKDB_SYSTEM_LIBS yyjson::yyjson), plus Snappy::snappy, LZ4::lz4_shared, PkgConfig::BROTLI on the exported parquet_extension/icu_extension, and src/CMakeLists.txt:120 does target_link_libraries(duckdb PUBLIC ${DUCKDB_SYSTEM_LIBS}). libduckdb-dev.install ships usr/lib/*/cmake/DuckDB/, i.e. the DuckDBExports.cmake that names all those targets.
  • Problem: CMake writes the imported target names verbatim into the installed export file; a consumer's find_package(DuckDB) then target_link_libraries(app duckdb) fails at generate time with 'links to target "PkgConfig::libzstd" but the target was not found', because the config file defines none of them. The -dev package's advertised CMake interface is therefore unusable. Related: libduckdb-dev Depends on libmbedtls-dev and libzstd-dev but not libxxhash-dev or pkgconf, which such a config would need; and DuckDBConfig.cmake.in:22 still offers DuckDB_LIBRARIES duckdb_static although debian/rules:114 deletes every *.a from the package.
  • Fix: Add the missing find_dependency/pkg_check_modules calls to the config (and the matching -dev packages plus pkgconf to libduckdb-dev's Depends), or link the system libraries PRIVATE and whole-archive them into libduckdb.so so they never appear in the interface; drop the duckdb_static branch from the config since no static library is shipped, or ship the .a files.

2. [minor] [packaging] trust-system-extensions.patch skips signature verification for any path that merely starts with /usr/lib/duckdb/extensions/, so ../.. bypasses the check

  • Files: debian/patches/trust-system-extensions.patch, src/main/extension/extension_load.cpp:665-672, src/common/file_system.cpp:405-418
  • Basis: checked, in the package or with a reference tool
  • Evidence: const bool is_system_extension = filename.size() >= system_extension_path.size() && filename.compare(0, system_extension_path.size(), system_extension_path) == 0; with DEBIAN_DUCKDB_SYSTEM_EXTENSION_PATH fixed at compile time to /usr/lib/duckdb/extensions/; for a direct load filename = fs.ExpandPath(filename), and FileSystem::ExpandPath only rewrites a leading ~ or a file:// URL, leaving . and .. untouched.
  • Problem: The test is a byte prefix test on the path string the user supplied, not on the file reached, so LOAD '/usr/lib/duckdb/extensions/../../../tmp/evil.duckdb_extension' (or the same with a file:// URL) is treated as a Debian-packaged extension and loaded without the signature check that the patch exists to scope to /usr/lib/duckdb/extensions. DuckDB's extension signatures are the defence against loading unsigned native code from untrusted SQL or databases; the patch reintroduces a way around them, which is a security regression that the deliberate trust of the packaged directory does not require.
  • Fix: Resolve the path first (fs.CanonicalizePath/RealPath) and compare the resolved path, or compare fs.ExtractDirectory(canonical) with the canonical trusted directory, before setting is_system_extension.

Verified

  • Read the whole of debian/: control, rules, changelog (full), copyright (full, 401 lines), all four install/manpages files, source/format, gbp.conf, salsa-ci.yml, cmake-instrumentation.json, duckdb.1, README.Debian, README.source, tests/control and all nine tests/* scripts, all ten patches and patches/series, and the five extension-configs/*.cmake.
  • debian/copyright is DEP-5 with the correct Format URL; every short name it uses is defined by a stand-alone License paragraph (Expat, BSD-2-Clause, BSD-3-Clause, BSL-1.0, Zlib, HPND, Unicode-Data, public-domain, Apache-2.0, Apache-2.0 with LLVM exception, GPL-2+), the Apache-2.0 and GPL-2+ paragraphs point at /usr/share/common-licenses, and the licences that are not there carry their full text.
  • Copyright holder check: Public Software Group e. V. is named in the Files: third_party/utf8proc/* stanza (as 'Public Software Group e.V.'). Thomas Porschberg (third_party/thrift/thrift/LICENSE:222, aclocal m4 files) and Twitter/ElephantBird (third_party/parquet/LICENSE:215, parquet-hadoop Java) appear only in vendor LICENSE boilerplate for components that are not in the tree: the thrift subset has only protocol/transport headers, and the parquet subset has parquet_types.{h,cpp}, parquet.thrift, generate.sh and windows_compatibility.h. yhirose in the httplib stanza and Melissa O'Neill, PCG Project contributors in the pcg stanza match the files' own headers.
  • Licence-wording hits are not licence terms: third_party/miniz/miniz.cpp:579 is the Unlicense public-domain dedication that follows the MIT block in the same file (commercial or non-commercial is its permission grant, not a restriction); api_spec/v2/function/aggregate.yaml:850, src/include/duckdb_v2.h:5608 and tools/cpp/duckdb_cpp.hpp:4152 are API documentation about aggregate state objects ('the source must not be modified').
  • Archives: test/sql/table_function/files/four.blob is a 178-byte zip fixture for the table-function tests; test/sql/window/walmart.csv.gz feeds test_window_walmart and test_partition_flushing; the 17 test/sqlserver/data/.csv.gz plus test/sqlserver/scrape.py are the SQL Server compatibility fixtures; extension_external/httpfs/data/secrets/httpfs/.duckdb_secret are the httpfs secret-chain test fixtures; extension_external/sqlite/data/db/ (with the .db-wal and .db-journal files) and data/sql/ hold the sqlite_scanner test databases. All are upstream test data under Files: *.
  • extension_external/quack/rpc.pdf is generated by extension_external/quack/plot.R (pdf("rpc.pdf", height=5, width=15)), so its preferred form for modification is in the package.
  • Generated code has its generator or input in the package: third_party/parquet/parquet_types.{h,cpp} from parquet.thrift via third_party/parquet/generate.sh; extension/icu/collation/generated/collation_data.cpp and extension/icu/datetime/generated/tz_data.cpp from extension/icu/scripts/*.py; scripts/null.txt is the single NUL byte scripts/append_metadata.cmake requires.
  • Other binary data in the scan were checked by directory: test/api/serialized_plans/cases/.bin (serialized-plan cases), test/storage/bc/.db, test/sql/storage/compression/{chimp,patas}/.db, test/sql/storage_version/, test/sql/copy/parquet/broken/*.parquet, test/geoparquet/seattle.parquet and extension_external/quack/test/certs/ are upstream-generated test data with no third-party notice. third_party/catch/catch.hpp carries its BSL-1.0 header; third_party/yyjson/ contains only DuckDB's own yyjson_memory.hpp wrapper (system libyyjson is linked, so no yyjson licence stanza is needed); third_party/imdb/ is DuckDB's own benchmark harness.
  • Packaging checks: Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components current, not an issue); compat 14, so the absent ${misc:Depends}/${shlibs:Depends} fields are correct; build-deps resolvable (architecture-is-64-bit provided by architecture-properties 0.2.6, libyyjson-dev 0.12.0, libmbedtls-dev 3.6.7, libzstd-dev 1.5.7, libxxhash-dev, cmake 4.4.4 satisfies cmake_minimum_required(4.1) in debian/tests); all patches carry DEP-3 Description/Author/Forwarded/Last-Update headers; the extension install path repository/v2.0.0/linux_<DEB_HOST_ARCH> matches DUCKDB_NORMALIZED_VERSION (v2.0.0 from OVERRIDE_GIT_DESCRIBE) and the patched DuckDBPlatform(); the 512-byte tail -c 512 in rules matches ParsedExtensionMetaData::FOOTER_SIZE (src/include/duckdb/main/extension.hpp:45); dh_dwz -- -L none is a valid dwz option (dwz(1) -L <COUNT|none>).
  • dh_shlibdeps does see the loadable .duckdb_extension files: at compat 14 it selects files by ELF header type (Debian::Debhelper::Dh_Lib::is_so_or_exec_elf_file), not by name, so the runtime Depends of the extension modules (libmariadb, libpq, OpenSSL, curl, snappy, lz4, brotli, zstd) are computed from the duckdb binary package.
  • Repack: Files-Excluded is not used; the copyright-format document shipped here does not define it, and the removal of data/ and benchmark/ plus the addition of the five extension repositories is documented in debian/README.source and the changelog.
  • uscan found the packaged version as the newest upstream release (upstream 2.0.0, packaged 2.0.0+dfsg2).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2).

Not confirmed

  • Upstream terms of the bundled sample data: test/sqlserver/data/*.csv.gz (AdventureWorks tables: Sales.SalesPerson, SalesTerritory, HumanResources.Employee ...), extension_external/sqlite/data/db/sakila.db and chinook.db, test/sql/window/walmart.csv.gz and test/geoparquet/seattle.parquet carry no licence notice in the tree and are attributed to the DuckDB Foundation by Files: *. I could not check the originating projects' licences from here, and did not open the .db files; if any of them is not MIT/BSD-equivalent (the Sakila database itself is BSD-3-Clause, as the test/sakila/* stanza records), debian/copyright needs a stanza for it.
  • Whether the DuckDBConfig.cmake defect actually breaks consumers: this rests on CMake requiring Foo::bar-style names in INTERFACE_LINK_LIBRARIES to be defined targets; no CMake consumer of libduckdb-dev was available to run here.
  • mips64el: the patched DuckDBPlatform() has no mips64el case and would return linux_unknown_arch, while debian/rules installs from repository/v2.0.0/linux_mips64el, which would make the extension install step fail. I could not confirm whether mips64el is still a release architecture for this suite.
  • The +dfsg2 tarball is a combination of six upstream repositories with data/ and benchmark/ stripped, not a plain release; I did not compare it against the upstream tarballs, so I cannot say whether anything beyond that differs from what upstream shipped.

Proposed changes

None.

Uploader's response to the LLM review

Please continue.

— Dominique Belhachemi (domibel), 3 days ago

Review Information

accepted — allocated to awm 3 days ago, started 3 days ago, completed 3 days ago.

Final Comment

Hi,

Not sure if I believe that first LLM issue, but the second one seems like an interesting catch.

Thanks!

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.0.0+dfsg-1 59d68e17… 2026-10-28 07:37 2026-10-28 07:37 awm accepted VIEW
1.5.1-2 ba0476a8… 2026-03-28 05:30 2026-03-29 06:29 awm accepted VIEW
1.5.1-1 d17ced01… 2026-03-26 07:47 2026-03-27 07:05 awm rejected VIEW

Public Notes

3 days ago ● public

Missed Author Check

Command: dfsg-author-check -markdown
Exit code: 1

Author check: duckdb-2.0.0+dfsg2

Scanned 13231 files. Authors declared in debian/copyright: 44.

Not named in debian/copyright (3):

  • Public Software Group e. V., Berlin, Germany
    • third_party/utf8proc/LICENSE:32
    • third_party/utf8proc/include/utf8proc.hpp:3
    • third_party/utf8proc/utf8proc.cpp:4
  • Thomas Porschberg <thomas@randspringer.de>
    • third_party/thrift/thrift/LICENSE:222
  • Twitter
    • third_party/parquet/LICENSE:215

Possibly named in debian/copyright under a similar name (2):

  • Melissa O'Neill <oneill@pcg-random.org>, and the PCG Project contributors (might be Melissa O'Neill, PCG Project contributors)
    • third_party/pcg/pcg_extras.hpp:4
    • third_party/pcg/pcg_random.hpp:4
    • third_party/pcg/pcg_uint128.hpp:4
  • Yuji Hirose (might be yhirose)
    • third_party/httplib/httplib.hpp:4

Result: 3 holders not named in debian/copyright, and 2 possibly named under a similar name

To name them, add to the end of debian/copyright:

Files: third_party/parquet/LICENSE
Copyright: 2013 Daniel Lemire
           2014 The Apache Software Foundation
           2012-2014 Twitter
License: Apache-2.0

Files: third_party/thrift/thrift/LICENSE
Copyright: 2007 Thomas Porschberg <thomas@randspringer.de>
License: Apache-2.0

Files: third_party/utf8proc/LICENSE
 third_party/utf8proc/include/utf8proc.hpp
 third_party/utf8proc/utf8proc.cpp
Copyright: 2009, 2013 Public Software Group e. V., Berlin, Germany
           1991-2007 Unicode, Inc
License: Expat

Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.

Back to Dashboard | View all reviews for this package