DFSG NEW review for dune-localfunctions version 2.11.0-2

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 4 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole tree is GPL-2.0-only with the DUNE runtime exception: every one of the 287 files that carries an SPDX header uses LicenseRef-GPL-2.0-only-with-DUNE-exception, and LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt holds the text (GPL-2 plus the exception); no other licence or non-free term appears anywhere. debian/copyright is DEP-5, names all 46 holders of LICENSE.md in Files: * (the collective Copyright © DUNE Project contributors in the headers resolves to exactly that list), gives debian/* its own stanza and points to /usr/share/common-licenses/GPL-2. The only defect is that the stand-alone licence paragraph still quotes an older wording of the DUNE exception (and a libstdc++ sentence) that no longer matches LICENSE.md; the licence, the holders and the applicability to every file are otherwise accurate, so this does not affect DFSG-freedom.

Packaging

Sound packaging in the DUNE house style: debhelper compat 13 through the dune-common Makefile fragments, three binaries (-dev, -doc, python3-), Build-Depends on libdune-common-dev/python3-dune-common 2.11.0-4 which exist in the archive, an autopkgtest, Vcs-*, upstream metadata, salsa CI and Rules-Requires-Root, with Standards-Version 4.7.0 against Policy 4.7.4.1. Three minor things to fix: one of the two patches has no DEP-3 header, debian/gbp.conf configures an empty upstream branch that gbp rejects, and the -dev package's Multi-Arch: foreign is questionable (not confirmed).

Issues

1. [minor] [licensing] debian/copyright quotes an out-of-date DUNE exception text, not the one in LICENSE.md

• Files: debian/copyright:63-84, LICENSE.md:56-59, LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt:8-11
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: The exact wording of the exception reads as follows: / As a special exception, you may use the DUNE library without restriction. and later This license clones the one of the libstdc++ library.; LICENSE.md and LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt: As a special exception, you may use the DUNE source files as part of a software library or application without restriction. (the libstdc++ sentence is gone).
• Problem: The file states it gives the exact wording of the exception the package is under, but quotes the formulation DUNE used before the LICENSE.md rewrite; every source file refers to file LICENSE.md in module root as the operative text. The licence is correctly identified and both wordings grant unrestricted use, so there is no DFSG question, but debian/copyright is inaccurate as a quotation and the rights it presents are not literally those granted.
• Fix: Replace the quoted exception with the current text from LICENSE.md / LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt and drop (or mark as historical) the This license clones the one of the libstdc++ library sentence.

2. [minor] [packaging] increase-test-orthonormal-tolerance.patch has no DEP-3 header

• Files: debian/patches/increase-test-orthonormal-tolerance.patch:1
• Basis: checked, in the package or with a reference tool
• Evidence: The file starts directly with --- a/dune/localfunctions/test/test-orthonormal.cc; unlike debian/patches/python-static-class-objects-after-finalization.patch it has no Description:, Origin:, Forwarded: or Last-Update: fields.
• Problem: The purpose (raising the orthonormality tolerance in test-orthonormal.cc from 1200 to 5000 epsilon) and its upstream status are unrecorded, so a reader cannot tell whether it is still needed or was ever sent upstream; this is the DEP-3 convention the other patch in the package follows.
• Fix: Add a DEP-3 header with a one-line Description, an Origin/Author, a Last-Update date and Forwarded (submit it upstream, or Forwarded: not-needed if it is only a test tolerance for Debian's slow architectures).

3. [minor] [packaging] debian/gbp.conf sets an empty upstream-branch, which gbp cannot use

• Files: debian/gbp.conf:3
• Basis: checked, in the package or with a reference tool
• Evidence: upstream-branch = with no value; gbp's default is upstream (gbp/config.py:199) and a configured value is passed straight through, while gbp/scripts/import_orig.py:454 raises no_upstream_branch_msg when repo.has_branch(options.upstream_branch) is false, and has_branch('') runs git show-ref --verify refs/heads/ and always returns false (gbp/git/repository.py:400-408).
• Problem: gbp import-orig in this repository aborts with Repository does not have branch '' for upstream sources ... unless -u is passed each time, and DEP-14's upstream branch name is upstream, which the file was added for.
• Fix: Set upstream-branch = upstream, or delete the line so the gbp default applies.

4. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Read all of debian/ (control, rules, changelog, copyright, clean, gbp.conf, salsa-ci.yml, both .install files, source/format, upstream/metadata, patches/series and both patches, tests/control and both test files), the .dsc, and both Makefile fragments included by rules are not needed to see the packaging's own content.
• Licence inventory: every one of the 287 files with an SPDX header (dune/, python/, doc/**, top-level files) uses SPDX-License-Identifier: LicenseRef-GPL-2.0-only-with-DUNE-exception; a search for any other SPDX id, Lesser General Public, Apache License, Mozilla Public, BSD, MIT License, public domain, All rights reserved, no modification found nothing in the tree except the licence texts.
• The prescan's two unnamed holders are the same collective notice, Copyright © DUNE Project contributors, see file LICENSE.md in module root (e.g. dune/localfunctions/brezzidouglasfortinmarini/bdfmcube.hh:3, CMakeLists.txt:1, CHANGELOG.md:2, INSTALL:2); LICENSE.md:1-48 lists exactly the 46 holders that Files: * names, so nothing is missing for those 78 + 223 files.
• LICENSE.md and LICENSES/LicenseRef-GPL-2.0-only-with-DUNE-exception.txt contain the full GPL-2 text plus the exception; debian/copyright refers to /usr/share/common-licenses/GPL-2 for the GPL part.
• noncommercial appears only in GPL-2 section 3c (LICENSE.md:220, LICENSES/LicenseRef-...:171), i.e. licence text, not a restriction on the package.
• COPYING is an empty (0-byte) upstream file; the licence actually referenced by the headers is LICENSE.md.
• The documentation is built from sources that are in the package: doc/dune-localfunctions-manual.tex and doc/doxygen/ (mainpage.txt, modules.txt, Doxylocal) are all present and carry the same licence header; there is no PDF, image, font, object file, archive or other binary in the tree (glob over png/jpg/pdf/eps/svg/gif/ttf/otf/woff/so/a/h5/dat/zip/gz/tar found nothing).
• debian/* is licensed by its own later Files: debian/* stanza, so the catch-all Files: * does not cover it; all Files patterns used are plain and anchored, as copyright-format 6.9 allows.
• Dependencies resolve: libdune-common-dev 2.11.0-4, libdune-geometry-dev 2.11.0-4 and python3-dune-common 2.11.0-4 are in the archive and satisfy the >= 2.11.0-4~ / >= 2.11.0~ bounds; the << 2.12~ upper bounds in python3-dune-localfunctions are consistent with that package.
• The JIT autopkgtest's build tools are present transitively: python3-dune-common Depends on cmake, g++, make and python3-dev, so debian/tests/python-jit needs only its listed python3-dune-localfunctions and python3-venv.
• Standards-Version 4.7.0 against Policy 4.7.4.1 differs only in the third component, which is not an issue; debhelper compat 13 is supported by the installed debhelper 14.5, and the rules rely on its override_dh_auto_test-arch/-indep targets correctly.
• Both patches are applied in the unpacked tree (quilt series and .pc agree), and the patched dune/python/localfunctions/localfiniteelement.hh and dune/localfunctions/test/test-orthonormal.cc contain the changes.
• uscan found the packaged version as the newest upstream release (upstream 2.11.0, packaged 2.11.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• libdune-localfunctions-dev is Architecture: any with Multi-Arch: foreign and installs usr/lib; if that is DUNE's CMake package config under /usr/lib/<triplet>/cmake (as Debian's cmake does), the installed paths differ per architecture and Policy 5.6.34.2 forbids Multi-Arch: foreign. I could not list the installed files to settle it; note that libdune-functions-dev, the same team's header-only -dev package, carries no Multi-Arch field at all.
• The Python build and install step lives in /usr/share/dune/dune-debian.mk and dune-debian-python.mk, shipped by dune-common 2.11.0-4, which is not installed on the reviewing system, so I could not check how the bindings are built and put into python3-dune-localfunctions — in particular how setup.py's unconditional from skbuild import setup, pyproject.toml's dune-geometry@git+https://... build requirement and the absence of python3-skbuild from Build-Depends are avoided; likewise I could not read /usr/share/dune/dune-python-autopkgtest.
• debian/tests/python-jit must itself be executable for autopkgtest to run it; the file mode is not visible to the tools I have and I could not check it.