DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: dwarfs 0.13.0+ds-1

New Package Report

.changes
Changed-ByAhmad Khalifa
Architecturesource amd64
Distributionunstable
DateWed, 10 Sep 2025 19:24:41 +0100
Sourcedwarfs
Version0.13.0+ds-1
.dsc
Package-Listdwarfs deb utils optional arch=linux-amd64,linux-arm64
libdwarfs-dev deb libdevel optional arch=linux-amd64,linux-arm64
libdwarfs0 deb libs optional arch=linux-amd64,linux-arm64
Sectionutils
Priorityoptional
Componentmain
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/mhx/dwarfs
Upstream-Name: dwarfs
Files-Excluded:
 fast_float
 sfx
Comment:
 Exclude bundled system libraries

Files: *
Copyright: Marcus Holland-Moritz <github@mhxnet.de>
License: Expat
Comment:
 Parts used for reading are Expat, parts for writing/testing are GPL-3+.
 Since it's mostly reading, default to Expat and mention exceptions below.

Files:
 cmake/compile.cmake
 cmake/dwarfs_install.cmake.in
 cmake/folly.cmake
 cmake/libdwarfs.cmake
 cmake/libdwarfs_tool.cmake
 CMakeLists.txt
 cmake/manpage.cmake
 cmake/need_fmt.cmake
 cmake/need_fuse.cmake
 cmake/need_gtest.cmake
 cmake/need_phmap.cmake
 cmake/need_range_v3.cmake
 cmake/render_manpage.cmake
 cmake/thrift.cmake
 cmake/thrift_library.cmake
 cmake/version.cmake
 include/dwarfs/internal/metadata_utils.h
 include/dwarfs/writer/*
 include/dwarfs/utility/rewrite_filesystem.h
 include/dwarfs/utility/rewrite_options.h
 src/internal/metadata_utils.cpp
 src/writer/*
 src/utility/rewrite_filesystem.cpp
 test/*
 tools/src/mkdwarfs.cpp
 tools/src/mkdwarfs_main.cpp
Copyright: Marcus Holland-Moritz <github@mhxnet.de>
License: GPL-3+
Comment:
 SPDX tags are incorrectly set to GPL-3.0-only instead of GPL-3.0-or-later,
 but the license headers are GPL-3.0-or-later. Ignoring SPDX as discussed
 and fixed by upstream in issue #275 (github.com/mhx/dwarfs/issues/275).

Files: fbthrift/*
Copyright: Meta Platforms
License: Apache-2.0

Files: fbthrift/build/fbcode_builder/*
Copyright:
 Facebook, Inc. and its affiliates.
 Meta Platforms, Inc. and affiliates.
License: Expat

Files:
 fbthrift/build/fbcode_builder/CMake/FindLMDB.cmake
 fbthrift/build/fbcode_builder/CMake/FindRe2.cmake
Copyright: Meta Platforms, Inc. and affiliates.
License: GPL-2

Files:
 fbthrift/build/fbcode_builder/CMake/FindLibUnwind.cmake
 fbthrift/build/fbcode_builder/CMake/FindXxhash.cmake
 fbthrift/build/fbcode_builder/CMake/FindZstd.cmake
Copyright: Meta Platforms, Inc. and affiliates.
License: Apache-2.0

Files: folly/*
Copyright: Meta Platforms, Inc. and affiliates.
License: Apache-2.0

Files: folly/build/fbcode_builder/*
Copyright: Meta Platforms, Inc. and affiliates.
License: Expat

Files:
 folly/build/fbcode_builder/CMake/FindLMDB.cmake
 folly/build/fbcode_builder/CMake/FindRe2.cmake
Copyright: Meta Platforms, Inc. and affiliates.
License: GPL-2

Files:
 folly/build/fbcode_builder/CMake/FindLibUnwind.cmake
 folly/build/fbcode_builder/CMake/FindXxhash.cmake
 folly/build/fbcode_builder/CMake/FindZstd.cmake
Copyright: Meta Platforms, Inc. and affiliates.
License: Apache-2.0

Files: folly/folly/external/aor/*
Copyright: 2023, Arm Limited.
License: Expat
Comment: original under "MIT OR Apache-2.0 WITH LLVM-exception"
 Using Expat for debian

Files: folly/folly/external/farmhash/*
Copyright: 2014 Google, Inc.
License: Expat

Files: folly/folly/external/fast-crc32/*
Copyright: Unknown
License: Expat

Files: folly/folly/external/nvidia/*
Copyright: 2024 NVIDIA CORPORATION & AFFILIATES
License: Apache-2.0

Files: folly/folly/external/rapidhash/*
Copyright:
 2025 Nicolas De Carli
 Wang Yi <godspeed_china@yeah.net>
License: Expat

Files: folly/folly/hash/detail/Crc32cDetail.cpp
Copyright:
 2016 Ferry Toth, Exalon Delft BV
 Facebook
License: Zlib

Files: folly/folly/hash/detail/ChecksumDetail.cpp
Copyright: 2016 Eric Biggers
License: Expat

Files: fsst/*
Copyright:
 2018-2020, CWI, TU Munich, FSU Jena
 Marcus Holland-Moritz <github@mhxnet.de>
License: Expat
Comment:
 3rd-party project, patched by author, so cannot be split out
 Upstream is https://github.com/cwida/fsst

Files: ricepp/*
Copyright: Marcus Holland-Moritz <github@mhxnet.de>
License: Expat
Comment:
 Looks like a 3rd-party project, but same author, no other repo.

Files: ricepp/CMakeLists.txt
Copyright: Marcus Holland-Moritz <github@mhxnet.de>
License: GPL-3+

Files: debian/*
Copyright: 2025 Ahmad Khalifa <ahmad@khalifa.ws>
License: Expat

# ------------------------------

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: GPL-2
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 2.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
Comment:
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: GPL-3+
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this package. If not, see <https://www.gnu.org/licenses/>.
Comment:
 On Debian systems, the complete text of the GNU General
 Public License version 3 can be found in `/usr/share/common-licenses/GPL-3'.

License: Zlib
 This software is provided 'as-is', without any express or implied
 warranty. In no event will the authors be held liable for any damages
 arising from the use of this software.
 .
 Permission is granted to anyone to use this software for any purpose,
 including commercial applications, and to alter it and redistribute
 it freely, subject to the following restrictions:
 1. The origin of this software must not be misrepresented;
    you must not claim that you wrote the original software.
    If you use this software in a product, an acknowledgment
    in the product documentation would be appreciated but
    is not required.
 2. Altered source versions must be plainly marked as such,
    and must not be misrepresented as being the original software.
 3. This notice may not be removed or altered from any
    source distribution.

Review Information

rejected — allocated to siretart 1 month, 7 days ago, started 1 month, 7 days ago, completed 1 month, 5 days ago.

Final Comment

debian/copyright lists Copyright: Unknown for folly/folly/external/fast-crc32/*.
The files themselves just say /* Generated by https://github.com/corsix/fast-crc32/ */
and /* MIT licensed */, but don't name a copyright holder. Since the Expat license
requires reproducing "the above copyright notice", we need to know who that is.
Please look up the actual copyright holder from the upstream
https://github.com/corsix/fast-crc32/ project and update debian/copyright.

Separately, a few files under fbthrift/thrift/lib/java/ are copyrighted by
VMware rather than Meta — specifically ForkJoinPoolScheduler.java,
ForkJoinPoolSchedulerTest.java, and AbstractSchedulerTest.java, all in
fbthrift/thrift/lib/java/runtime/.../resources/. They say
Copyright (c) 2017-2021 VMware Inc. or its affiliates and are Apache-2.0
licensed. The fbthrift/* stanza in debian/copyright currently only lists
Meta Platforms as copyright holder, so VMware needs to be added there too.

Public Notes

1 month, 7 days ago ● public

debian/copyright lists "Copyright: Unknown" for folly/folly/external/fast-crc32/*

Files: folly/folly/external/fast-crc32/*
Copyright: Unknown
License: Expat

The actual source files indicate these files were "Generated by https://github.com/corsix/fast-crc32/" and are "MIT licensed".

According to Debian Policy Manual section 2.3, "under international copyright law, no distribution or modification of a work is allowed without an explicit notice saying so. Therefore a program without a copyright notice is copyrighted." The copyright holder must be identified and documented.

Back to Dashboard | View all reviews for this package