Review: ejabberd-contrib 0.2026.09.14~dfsg0-1

Package Information

Description	user-contributed modules for ejabberd (metapackage) This package depends on all available modules from ejabberd-contrib, but doesn't do or add anything itself. This is a pure metapackage.
Maintainer	Ejabberd Packaging Team <ejabberd@packages.debian.org>
Changed By	Philipp Huebner <debalance@debian.org>
Sponsor	debalance@debian.org
Distribution	unstable
Architecture	any all
VCS	git: https://salsa.debian.org/ejabberd-packaging-team/ejabberd-contrib.git (browse)
Closes	#1101689
Popcon Installs	60
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/ejabberd-contrib
Uploaded	20 days ago

New Package Report

.changes◂

Architecture	source all amd64
Distribution	unstable
Date	Sun, 18 Oct 2026 15:34:32 +0200
Source	ejabberd-contrib
Version	0.2026.09.14~dfsg0-1
Changed-By	Philipp Huebner <debalance@debian.org>

Changelog◂

ejabberd-contrib (0.2026.09.14~dfsg0-1) unstable; urgency=medium
 .
   * New upstream version 0.2026.09.14~dfsg0
   * Build for ejabberd 26.07
   * Add binary packages for:
      - mod_autoreload
      - mod_http_redirect
      - mod_muc_webchat_url
      - mod_s3_upload,
      - mod_tombstones (Closes: #1101689)
      - mod_unified_push
      - mod_webadmin_config
   * Add erlang-jose build and runtime dependencies
   * Add module-local include directories to the Erlang compiler search path
   * Clarify the selected-module policy in debian/README.source
   * Stop building the upstream-known-broken mod_irc binary package
   * Remove the obsolete LAGER compiler define
   * Remove empty lintian override files
   * Update debian/copyright

.dsc◂

Section	net
Priority	optional
Component	main
Package-List	ejabberd-contrib deb net optional arch=all ejabberd-mod-autoreload deb net optional arch=any ejabberd-mod-cron deb net optional arch=any ejabberd-mod-default-contacts deb net optional arch=any ejabberd-mod-default-rooms deb net optional arch=any ejabberd-mod-deny-omemo deb net optional arch=any ejabberd-mod-filter deb net optional arch=any ejabberd-mod-grafite deb net optional arch=any ejabberd-mod-http-redirect deb net optional arch=any ejabberd-mod-isolation deb net optional arch=any ejabberd-mod-log-chat deb net optional arch=any ejabberd-mod-logsession deb net optional arch=any ejabberd-mod-logxml deb net optional arch=any ejabberd-mod-message-log deb net optional arch=any ejabberd-mod-muc-log-http deb net optional arch=any ejabberd-mod-muc-webchat-url deb net optional arch=any ejabberd-mod-post-log deb net optional arch=any ejabberd-mod-pottymouth deb net optional arch=any ejabberd-mod-rest deb net optional arch=any ejabberd-mod-s2s-log deb net optional arch=any ejabberd-mod-s3-upload deb net optional arch=any ejabberd-mod-shcommands deb net optional arch=any ejabberd-mod-spam-filter deb net optional arch=any ejabberd-mod-statsdx deb net optional arch=any ejabberd-mod-tombstones deb net optional arch=any ejabberd-mod-unified-push deb net optional arch=any ejabberd-mod-webadmin-config deb net optional arch=any ejabberd-mod-webpresence deb net optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: ejabberd-contrib
Source: https://github.com/processone/ejabberd-contrib
Comment: source tarball has been repacked, see debian/README.source for details

Files: *
Copyright: 2002-2026 ProcessOne
License: GPL-2.0+

Files: debian/*
Copyright: 2014-2026 Philipp Huebner <debalance@debian.org>
           2016-2018 Mathias Ertl <mati@jabber.at>
License: GPL-2.0+

Files: ejabberd_observer_cli/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_autoreload/*
Copyright: Blieb <blieb84@icloud.com>
License: GPL-2.0+

Files: ejabberd_auth_http/*
Copyright: Piotr Nosek <piotr.nosek@erlang-solutions.com>
License: GPL-2.0+

Files: mod_captcha_rust/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_cron/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_default_contacts/*
Copyright: Holger Weiss <holger@zedat.fu-berlin.de>
License: GPL-2.0+

Files: mod_default_rooms/*
Copyright: Holger Weiss <holger@zedat.fu-berlin.de>
License: GPL-2.0+

Files: mod_deny_omemo/*
Copyright: Holger Weiss <holger@zedat.fu-berlin.de>
License: GPL-2.0+

Files: mod_ecaptcha/*
Copyright: Badlop <badlop@process-one.net>
           2002-2022 ProcessOne
License: GPL-2.0+

Files: mod_example/*
Copyright: 2002-2024 ProcessOne
License: GPL-2.0+

Files: mod_filter/*
Copyright: Magnus Henoch <henoch@dtek.chalmers.se>
License: GPL-2.0+

Files: mod_grafite/*
Copyright: Thiago Rocha Camargo <rochacamargothiago@gmail.com>
License: GPL-2.0+

Files: mod_http_redirect/*
Copyright: Badlop <badlop@process-one.net>
           2002-2023 ProcessOne
License: GPL-2.0+

Files: mod_isolation/*
Copyright: Evgeny Khramtsov <ekhramtsov@process-one.net>
License: GPL-2.0+

Files: mod_libcluster/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_log_chat/*
Copyright: Jérôme Sautret <jerome.sautret@process-one.net>
License: LGPL-2.1+

Files: mod_logsession/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_logxml/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_message_log/*
Copyright: Holger Weiss <holger@zedat.fu-berlin.de>
License: GPL-2.0+

Files: mod_muc_log_http/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_muc_webchat_url/*
Copyright: Badlop <badlop@process-one.net>
           2002-2025 ProcessOne
License: GPL-2.0+

Files: mod_post_log/*
Copyright: 2014 Mojo Lingo LLC
License: Expat

Files: mod_pottymouth/*
Copyright: Tom Quackenbush <tom@madglory.com>
License: Apache-2.0

Files: mod_prometheus/*
Copyright: Pouriya Jahanbakhsh <pouriya.jahanbakhsh@gmail.com>
           Stefan Strigler <stefan@strigler.de>
           zzzZLRzzz
License: GPL-2.0+

Files: mod_pubsub_serverinfo/*
Copyright: Guus der Kinderen <guus.der.kinderen@gmail.com>
           Stefan Strigler <stefan@strigler.de>
           2023-2025 ProcessOne
License: GPL-2.0+

Files: mod_push_offline/*
Copyright: 2022 Mujtaba Roohani
License: GPL-3+

Files: mod_rest/*
Copyright: Nolan Eakins <sneakin@semanticgap.com>
License: GPL-2.0+

Files: mod_s2s_log/*
Copyright: Mickael Remond <mremond@process-one.net>
License: GPL-2.0+

Files: mod_s3_upload/*
Copyright: Roman Hargrave <roman@hargrave.info>
License: GPL-2.0+

Files: mod_shcommands/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_spam_filter/*
Copyright: Holger Weiss <holger@zedat.fu-berlin.de>
License: GPL-2.0+

Files: mod_statsdx/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

Files: mod_tombstones/*
Copyright: Badlop <badlop@process-one.net>
           2002-2024 ProcessOne
License: GPL-2.0+

Files: mod_unified_push/*
Copyright: 2025 itd <itd@net.in.tum.de>
License: GPL-2.0+

Files: mod_webpresence/*
Copyright: Igor Goryachev <igor@goryachev.org>
License: GPL-2.0+

Files: mod_webadmin_config/*
Copyright: Badlop <badlop@process-one.net>
License: GPL-2.0+

License: GPL-2.0+
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 This package is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <http://www.gnu.org/licenses/>
 .
 On Debian systems, the complete text of the GNU General
 Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: GPL-3+
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 3 of the License, or
 (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU General Public License
 version 3 can be found in "/usr/share/common-licenses/GPL-3".

License: LGPL-2.1+
 This package is free software; you can redistribute it and/or modify
 it under the terms of the GNU Lesser General Public License as published
 by the Free Software Foundation; either version 2.1 of the License, or
 (at your option) any later version.
 .
 On Debian systems, the complete text of the GNU Lesser General Public
 License version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the full text of the Apache License version 2.0
 can be found in the file
 `/usr/share/common-licenses/Apache-2.0'.

DFSG Assistant LLM REVIEW 0 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 20 days ago.

Report◂

DFSG NEW review for ejabberd-contrib version 0.2026.09.14~dfsg0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 2 important, 2 minor
debian/watch: only comments
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The code licences are free and mutually compatible, and debian/copyright is well-formed DEP-5 with text or common-licences pointers for every short name used. However, the ~190 icon files shipped by ejabberd-mod-webpresence are third-party artwork whose authors and licences are not documented (the module's own AUTHORS file lists about 25 icon themes under 'Unknown author'), while debian/copyright attributes the whole mod_webpresence directory including the pixmaps to one author under GPL-2+. Several per-module stanzas also drop the ProcessOne copyright notice that the source headers state. So the file does not accurately describe every file.

Packaging

The packaging is generally sound: debhelper compat 13, correct use of dh and erlang-depends, a single DEP-3 patch, complete binary package set and metapackage, changelog and Vcs fields in order, and Standards-Version 4.7.4 with Policy at 4.7.4.1. One helper is broken: the find pattern in debian/dh_moduleupdate cannot match the ejabberd directory that debian/rules relies on, so the generated postinst silently omits its module-update block. An unused rebar build-dependency is the only other real nit.

Issues

important licensing 1. mod_webpresence icon artwork is third-party with unknown authors, but debian/copyright assigns it all to one author under GPL-2+ ◂

Files: mod_webpresence/priv/pixmaps/, mod_webpresence/AUTHORS:12-50, debian/copyright, debian/ejabberd-mod-webpresence.install
Basis: checked, in the package or with a reference tool
Evidence: AUTHORS: This module includes pixmap artwork from many different authors. The list of known authors ... Unknown author: followed by alphamod, amibulb, amiglobe, crystal, nuvola, gnome, ...; debian/copyright: Files: mod_webpresence/* / Copyright: Igor Goryachev <igor@goryachev.org> / License: GPL-2.0+; debian/ejabberd-mod-webpresence.install installs mod_webpresence/priv/pixmaps into /usr/share/ejabberd-mod-webpresence.
Problem: The package ships roughly 190 PNG/GIF files taken from many icon themes. The module's AUTHORS file says most of them have unknown authors, and it records no licences at all; several themes (crystal, nuvola, gnome) are separate works under their own licences. debian/copyright nevertheless attributes every file in the directory to Igor Goryachev under GPL-2+ and includes no per-theme notice, so it does not accurately describe the copyright and licensing of the shipped images. Whether redistributing them is permitted cannot be established from the package.
Fix: Document the provenance and licence of each icon theme in debian/copyright (separate Files/ Copyright/ License stanzas as needed) and include any required notices, or remove the themes whose provenance cannot be established (with a corresponding tarball repack and README.source note). If the whole set really is offered under GPL-2+ by its authors, cite the evidence for that.

important packaging 2. dh_moduleupdate cannot find the ejabberd directory that debian/rules uses, so generated postinsts silently skip the module update ◂

Files: debian/dh_moduleupdate:5, debian/rules:8
Basis: inferred from what was read, not seen directly
Evidence: debian/rules: EJABBERDDIR=$(shell basename find /usr/lib -regextype posix-egrep -maxdepth 2 -type d -regex ".*/ejabberd-[0-9.]{5,10}"); debian/dh_moduleupdate: EJABBERDDIR=$(basename "$(find /usr/lib -regextype posix-egrep -maxdepth 2 -type d -regex ".*/ejabberd-[0-9.]{5,10}-.*")")
Problem: The two expressions require different directory names: debian/rules needs a directory ending in the version (the build only succeeds when this yields e.g. ejabberd-26.07, since the compiler include path is built from it), while dh_moduleupdate requires a hyphen and further text after the version, which that directory does not have. find then returns nothing, EJABBERDDIR is empty, mod_dir is /usr/lib/<triplet>/ejabberd-/ebin/, the [ ! -d ] test succeeds and the script exits 0 after printing Package does not install any modules. The postinst consequently never contains the ejabberdctl update block it is meant to add, for any of the 27 module packages.
Fix: Use the same pattern as debian/rules (drop the trailing -.*), or compute the directory once in debian/rules and pass it to dh_moduleupdate, so the generated postinst block is actually emitted.

minor licensing 3. ProcessOne copyright notices in several module sources are not in the stanzas that cover those files ◂

Files: mod_default_contacts/src/mod_default_contacts.erl:8, mod_default_rooms/src/mod_default_rooms.erl:8, mod_deny_omemo/src/mod_deny_omemo.erl:8, mod_logsession/src/mod_logsession.erl:8, mod_message_log/src/mod_message_log.erl:8, mod_s2s_log/src/mod_s2s_log.erl:8, mod_spam_filter/src/mod_spam_filter.erl:8, ejabberd_auth_http/src/scram2.erl:8, debian/copyright
Basis: checked, in the package or with a reference tool
Evidence: e.g. mod_default_contacts.erl: %%% ejabberd, Copyright (C) 2019-2020 ProcessOne; mod_s2s_log.erl: %%% ejabberd, Copyright (C) 2002-2020 ProcessOne; the applicable stanzas name only Holger Weiss, Badlop, Mickael Remond, etc.
Problem: Each of these directories has its own Files stanza, which overrides the catch-all Files: * stanza (Copyright: 2002-2026 ProcessOne). Within the applicable stanza the ProcessOne notice present in the file is therefore not represented, so the holder list for those files is incomplete.
Fix: Add ProcessOne with the years stated in each header to the Copyright field of the affected stanzas (mod_default_contacts, mod_default_rooms, mod_deny_omemo, mod_logsession, mod_message_log, mod_s2s_log, mod_spam_filter, ejabberd_auth_http).

minor packaging 4. Build-Depends on rebar is unused ◂

Files: debian/control:11
Basis: checked, in the package or with a reference tool
Evidence: Build-Depends: ... erlang-tools, rebar; neither debian/rules nor debian/patches invokes rebar (modules are compiled with erlc in debian/rules).
Problem: An unnecessary build-dependency slows builds and can hold up testing transitions for no benefit.
Fix: Drop rebar from Build-Depends, or use it for the modules that need it.

Verified ◂

The pre-scan listed no candidate files: it scanned 229 files and reported that every copyright holder it found is named in debian/copyright; I checked the holder names against the per-module stanzas independently.
Read debian/copyright in full: it is DEP-5 with the correct Format URL, a Files: * stanza plus one stanza for every module directory present in the tree and for debian/*, and stand-alone License paragraphs for GPL-2.0+, GPL-3+, LGPL-2.1+, Expat and Apache-2.0 (common-licences pointers where applicable).
Read every file under debian/ in full (control, rules, changelog, copyright, README.Debian, README.source, dh_moduleupdate, NEWS, install, postinst, source/format, source/lintian-overrides, upstream/metadata, patches/series and patches/src.includes.patch).
Scanned all Erlang/Elixir sources, every per-module COPYING, the AUTHORS file and the .po/.msg translations for copyright and licence wording; found no non-free terms (no non-commercial, no-modification, field-of-use or 'Good, not Evil' wording), and no licence other than GPL-2+, GPL-3+, LGPL-2.1+, Expat and Apache-2.0, all mutually compatible here.
No vendored third-party libraries, no generated code without its generator input, and no minified JS/CSS, archives, bytecode or PDFs; the only binary files are the mod_webpresence PNG/GIF icons (recorded above). pubsub_serverinfo_codec.erl is generated from the shipped spec/pubsub_serverinfo_codec.spec.
Checked dependency names against the archive: ejabberd 26.07-1, erlang-jose 1.11.12-3 and rebar exist, so the versioned Build-Depends and the mod-unified-push runtime dependency are satisfiable.
Every binary package's BUILD_PATH in debian/rules corresponds to an existing source directory, and the ejabberd-contrib metapackage depends on all 27 module packages built from debian/control.
debian/changelog's top entry is for 0.2026.09.14~dfsg0-1, unstable, urgency medium, and closes #1101689; the version scheme and date are consistent.
Standards-Version 4.7.4 is current against Policy 4.7.4.1 (first two components match); debhelper compat 13 with debhelper-compat and no debian/compat is correct.
Source format is 3.0 (quilt) and the single patch has DEP-3 headers (Description, Author, Forwarded: not-needed); .pc/ was excluded from all searches.
No debian/tests directory and no autopkgtest is declared; nothing in the package suggests a test would fail.
debian/watch holds only comments, so there is nothing for uscan to test. Whether the comments explain the lack of an upstream release channel was not judged.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2, GPL-3, LGPL-2.1).

Not confirmed ◂

Four newly packaged modules (mod_muc_webchat_url, mod_s3_upload, mod_tombstones and mod_unified_push) still contain -include_lib("xmpp/include/xmpp.hrl"), while debian/patches/src.includes.patch converts that include to p1_xmpp for every other built module. Whether the unpatched form resolves depends on the ejabberd build-tree layout (the existing mod_spam_filter uses the same include without a patch), which only a build would show.
mod_unified_push additionally includes jose/include/jose_jwk.hrl; I could not check that the Debian erlang-jose package installs that header without building.
mod_filter and mod_grafite ship neither a COPYING file nor a licence header in their sources; the only GPL-2+ grant visible in the package is debian/copyright (and a remark in mod_webpresence/ChangeLog that all modules are published under the GPL by default). I did not treat this as a defect, but the upstream grant is not directly evidenced in those directories.
The actual name of the installed ejabberd library directory on a user system was inferred from debian/rules rather than observed (ejabberd is not installed on the reviewing system); the dh_moduleupdate finding depends on it being ejabberd-26.07 as debian/rules requires.

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 19 days ago, started 19 days ago, completed 19 days ago.

Final Comment

Hi,

Please read the LLM review and consider whether you agree with it's findings. I'll accept on this occasion since it is already in Debian anyway, but some of the upstream's uncredited use of various themes and images seems fairly cavalier, if those assertions are true.

Thanks!

Back to Dashboard | View all reviews for this package