DFSG NEW review for dune-geometry version 2.11.0-4

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is licensed GPL-2.0-only with the DUNE runtime exception, a DFSG-free licence, and the Files: * Copyright list reproduces the holder list in LICENSE.md exactly. Every file, including the images and the Python bindings added in -4, carries a matching SPDX tag, and no other licence or non-free term appears. However, the stand-alone License stanza does not quote the exception as it is actually written upstream: it reproduces an older DUNE wording, adds a sentence that is not in LICENSE.md, and is therefore an inaccurate description of the licence.

Packaging

Established DUNE packaging of good quality: debhelper 13 with dh and cmake, correct arch/indep split, Multi-Arch dev package, separate -doc and the new python3 package, an autopkgtest, 3.0 (quilt) with three DEP-3 patches with documented purpose, no maintainer scripts, and Standards-Version 4.7.0 (current Policy 4.7.4.1). I found no packaging defect worth reporting. The only open checks are the dune-common 2.11.0-4 build dependency, which is not yet in the archive lists, and how the Python modules reach the new binary package (see unconfirmed).

Issues

1. [important] [licensing] debian/copyright quotes an outdated DUNE exception instead of the upstream licence text

• Files: debian/copyright:49-68, LICENSE.md:36-45, LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt:10-19
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: As a special exception, you may use the DUNE library without restriction. ... This license clones the one of the libstc++ library.; LICENSE.md: As a special exception, you may use the DUNE source files as part of a software library or application without restriction.
• Problem: The stand-alone License paragraph is not the licence the files are under. It reproduces the pre-2.9 DUNE exception wording (broader: use the DUNE library without restriction), and adds This license clones the one of the libstc++ library., which is not in LICENSE.md or LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt. DEP-5 section 6.7 and Policy 12.5 require the copyright file to give the actual licence text, so a reader gets terms that upstream did not grant in this release.
• Fix: Replace the quoted exception in debian/copyright with the exact text from LICENSE.md lines 38-45 (identical to LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt lines 12-19) and drop the This license clones ... sentence. Keeping the short name GPL-2 with DUNE exception and the pointer to /usr/share/common-licenses/GPL-2 is fine.

2. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read debian/copyright in full and debian/ in full (control, rules, changelog head and tail, clean, gbp.conf, salsa-ci.yml, tests/control, tests/python-jit, patches/series, all three patches, install files, lintian overrides, upstream/metadata, source/format).
• Licence inventory: every text file under dune/, doc/, python/, the root files and the debian/ patches' targets carries SPDX-License-Identifier: LicenseRef-GPL-2.0-only-with-DUNE-exception; no file has a different or absent licence, and no non-free wording (only the standard GPL-2 clause in LICENSE.md about noncommercial distribution) or third-party bundled code was found.
• The prescan's two 'missing holders' are one and the same collective SPDX notice, SPDX-FileCopyrightText: Copyright © DUNE Project contributors, see file LICENSE.md in module root (also spelt SPDX-FileCopyrightInfo: in the C++ files and doc/doxygen/modules.txt, which the scan split at Info:). It points to LICENSE.md and is not itself a holder: LICENSE.md's 31-name 'Copyright holders' list is reproduced verbatim in the Files: * stanza. This applies to every path the prescan listed: CHANGELOG.md, CMakeLists.txt, INSTALL, README.md, config.h.cmake, dune-geometry.pc.in, dune.module, .gitignore, .gitlab-ci.yml, all doc/CMakeLists.txt, doc/appl/, doc/doxygen/ (CMakeLists.txt, Doxylocal, mainpage.txt, modules.txt), doc/refinement/{CMakeLists.txt,refinement.tex,*.svg.license}, and every CMakeLists.txt, header and source under dune/geometry/, dune/python/ and python/**.
• Individual notices: dune/geometry/refinement/simplex.cc:9 says copyright (C) 2005 Jorrit Fahlke and doc/refinement/referencetokuhn0.svg:97 and simplexvertexindex.svg:169 name the same holder in Inkscape RDF metadata; Jorrit Fahlke is listed in debian/copyright (2011--2020). The year difference is minor drift, not a missing holder.
• Images: doc/appl/refelements/ has 9 .png and 9 .svg files, doc/refinement/ has 3 .svg files; each has an adjacent .license file with the same SPDX tag, and the .svg sources of the .png files are shipped. The GPL-2.0/LGPL-2.1 RDF links inside two SVGs are stale Inkscape editor metadata, not a separate licence grant. No binary blobs, jars, .class, .so, .pyc, minified JS/CSS, firmware or built PDFs exist in the tree.
• Generated quadrature headers have their preferred form in the tree: gaussjacobi.mac writes gaussquadrature.hh, jacobi1quadrature.hh and jacobi2quadrature.hh (the jacobian.mac in their warning is a stale string passed as scriptname), gausslobatto.mac and gaussradau.mac write their headers via writequad.mac.
• COPYING is a 0-byte file; the licence text is LICENSE.md (and LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt). Headers in .gitignore, .gitlab-ci.yml and dune/geometry/refinement/simplex.cc still point at COPYING, an upstream inconsistency that does not affect Debian's licensing because the full text is in LICENSE.md.
• Packaging: debhelper-compat (= 13) with dh $@ --builddirectory=build --buildsystem=cmake; the -arch/-indep overrides of dh_auto_test used in debian/rules are supported by dh(1) (checked in /usr/bin/dh), and at compat 13 dh skips them under nocheck, so no check is needed in rules.
• Standards-Version 4.7.0 against current Policy 4.7.4.1: same first two components, so not an issue (policy tool).
• debian/tests/python-jit's relative path dune/python/test/refelement.py is valid: the autopkgtest specification guarantees the test's cwd is the source root; the file exists.
• All three patches carry DEP-3 headers (From, Date, Subject, description) and debian/patches/series matches .pc/applied-patches. No maintainer scripts or *.maintscript files exist. debian/source/format is 3.0 (quilt).
• Compared LICENSE.md and the exception in the original tarball (/review/dune-geometry_2.11.0.orig.tar.gz) with the unpacked tree; patches do not touch them. .pc/ and debian/cargo-checksum.json do not exist / were ignored as instructed.
• uscan found the packaged version as the newest upstream release (upstream 2.11.0, packaged 2.11.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• libdune-common-dev (>= 2.11.0-4~) and python3-dune-common (>= 2.11.0-4~) are required, but the reviewing system's unstable/experimental lists have dune-common only up to 2.11.0-2; 2.11.0-4 is presumably in NEW. This matters because /usr/share/dune/dune-debian-python.mk, included by debian/rules, is not installed on this system and appears to come with that newer dune-common.
• python3-dune-geometry has no .install file, and libdune-geometry-dev.install claims all of usr/lib; I could not read /usr/share/dune/dune-debian-python.mk, so I could not verify that the Python modules and the compiled extension land in python3-dune-geometry and not in libdune-geometry-dev. A build (or dh_install --list-missing) would show it.
• No build, test or autopkgtest was run (read-only review).
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: grep: "xd://man" is not a file of the package or of the reviewing system.