DFSG NEW Queue

DFSG, Licensing & New Packages Team

fcitx5-ngosen 1.9.2+ds-1

Package Information

DescriptionVietnamese input method for fcitx5

Ngó Sen is a Vietnamese input method for fcitx5. It supports Telex, VNI and other typing methods, macros and spelling checks.

Its main mode writes letters directly into the application without a preedit underline and replaces the text before the cursor to apply tone marks, so address-bar and search suggestions update with each key. A preedit mode is also available for applications that need it.

The package includes a settings window that runs on Qt or libadwaita.

MaintainerDebian Input Method Team <debian-input-method@lists.debian.org>
Changed ByPhi Nguyễn <nguyenphidt@gmail.com>
Sponsorbyang@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/input-method-team/fcitx5-ngosen.git (browse)
Closes#1151867
Trackerhttps://tracker.debian.org/pkg/fcitx5-ngosen
Uploaded4 hours ago

New Package Report

.changes◂
Architecturesource amd64
Distributionunstable
DateWed, 11 Nov 2026 08:02:35 +0700
Sourcefcitx5-ngosen
Version1.9.2+ds-1
Changed-ByPhi Nguyễn <nguyenphidt@gmail.com>
Changelog◂
fcitx5-ngosen (1.9.2+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151867)
.dsc◂
Sectionutils
Priorityoptional
Componentmain
Package-Listfcitx5-ngosen deb utils optional arch=any
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: fcitx5-ngosen
Upstream-Contact: Nguyen Phi <nguyenphidt@gmail.com>
Source: https://github.com/ngosen/ngosen
Comment: Ngó Sen is based on code from https://github.com/LotusInputMethod/fcitx5-lotus and https://github.com/thanhpy2009/VMK
 The release tarball bundles the Rust crates it needs; Debian builds with its
 own packaged crates instead.
Files-Excluded: bamboo-rs/vendor
                bamboo-rs/.cargo
                bamboo-rs/Cargo.lock

Files: *
Copyright: 2022 CSSlayer <wengxt@gmail.com>
           2025 Vo Ngo Hoang Thanh <thanhpy2009@gmail.com>
           2026 Nguyen Hoang Ky <nhktmdzhg@gmail.com>
           2026 Ngó Sen contributors
License: GPL-3.0-or-later

Files: debian/*
Copyright: 2026 Phi Nguyễn <nguyenphidt@gmail.com>
License: GPL-3.0-or-later

Files: bamboo-rs/*
Copyright: 2018 Luong Thanh Lam <ltlam93@gmail.com>
           2022 CSSlayer <wengxt@gmail.com>
           2026 Nguyen Hoang Ky <nhktmdzhg@gmail.com>
           2026 Ngó Sen contributors
License: LGPL-2.1-or-later

Files: bamboo-rs/src/engine/english-words*
       bamboo-rs/src/engine/english-retone-lookalikes.txt
       data/english-common.txt
Copyright: 2000-2026 Kevin Atkinson
License: SCOWL
 Permission to use, copy, modify, distribute, and sell any part of SCOWLv2, or
 word lists created from it, is hereby granted without fee, provided that the
 above copyright notice appears in all copies and that both the above
 copyright notice and this notice appear in supporting documentation.  Kevin
 Atkinson makes no representations about the suitability of this database for
 any purpose.  It is provided "as is" without express or implied warranty.

Files: cmake/*
Copyright: 2016 Xuetian Weng <wengxt@gmail.com>
           2007 Alexander Neundorf <neundorf@kde.org>
           2006 Chusslove Illich <caslav.ilic@gmx.net>
License: BSD-3-Clause

Files: data/dictionaries/*
Copyright: 1997-2003 The Free Vietnamese Dictionary Project
           Ho Ngoc Duc
           Ngo Quoc Hung
           Vietnamese Wiktionary contributors
           ibus-bamboo contributors
License: GPL-3
Comment: data/dictionaries/LICENSE.vietnamese.cm.dict lists the sources. The word
 list is part of ibus-bamboo under GPLv3. It draws on Ho Ngoc Duc's GPL dictionary,
 the Vietnamese Wiktionary (CC-BY-SA) and an abbreviation list used with the
 permission of its author, Ngo Quoc Hung. The original source pages are offline;
 the license file links archived copies on web.archive.org.

Files: io.github.ngosen.NgoSen.metainfo.xml.in.in
Copyright: 2026 Nguyen Hoang Ky <nhktmdzhg@gmail.com>
License: CC0-1.0

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 .
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 3. Neither the name of the University nor the names of its contributors
    may be used to endorse or promote products derived from this software
    without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: CC0-1.0
 The person who associated a work with this deed has dedicated the work to
 the public domain by waiving all of his or her rights to the work worldwide
 under copyright law, including all related and neighboring rights, to the
 extent allowed by law.
 .
 You can copy, modify, distribute and perform the work, even for commercial
 purposes, all without asking permission.


License: GPL-3
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; version 3 of the License.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 On Debian systems, the complete text of the GNU General Public
 License version 3 can be found in "/usr/share/common-licenses/GPL-3".

License: GPL-3.0-or-later
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 3 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 On Debian systems, the complete text of the GNU General Public
 License version 3 can be found in "/usr/share/common-licenses/GPL-3".

License: LGPL-2.1-or-later
 This library is free software; you can redistribute it and/or modify
 it under the terms of the GNU Lesser General Public License as published
 by the Free Software Foundation; either version 2.1 of the License, or
 (at your option) any later version.
 .
 This library is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU Lesser General Public License for more details.
 .
 On Debian systems, the complete text of the GNU Lesser General Public
 License version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 5 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for fcitx5-ngosen version 1.9.2+ds-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 5 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 2 found

Licensing

The tree is DFSG-free: GPL-3.0-or-later for the application, the settings GUI, tests and docs; LGPL-2.1-or-later for bamboo-rs; BSD-3-Clause for cmake/; SCOWL's permissive notice for the English word lists; GPL-3 for the Vietnamese dictionaries (FVDP's versionless GPL plus ibus-bamboo's GPLv3); CC0-1.0 for the metainfo template. No non-free wording, no built or unlicensed artefacts, and every third-party holder in a file header is named in the stanza that covers it. debian/copyright is DEP-5 and matches the tree except for two misc/ helper scripts whose own headers say LGPL-2.1-or-later while the Files: * catch-all calls them GPL-3.0-or-later, and the SCOWL .license stub which the SCOWL stanza's exact path does not reach.

Packaging

Ordinary, well executed packaging: compat 14 with a plain dh sequencer, cmake build system, hardening=+all, upstream tests built and run at build time, the vendored Rust crates cut over cleanly to the archive's crates with Built-Using/Static-Built-Using, man pages for both installed programs, README.Debian, Vcs-* and upstream/metadata, and a current Standards-Version. What is left is minor: one Build-Depends target no package in the archive provides, two runtime library dependencies that the code needs but Depends does not list, and no autopkgtest.

Issues

minor licensing 1. misc/gen-english-words.py and misc/check-word-endings.py declare LGPL-2.1-or-later but debian/copyright's Files: * describes them as GPL-3.0-or-later ◂
  • Files: misc/gen-english-words.py:4, misc/check-word-endings.py:4, debian/copyright:12-17, data/english-common.txt.license
  • Basis: checked, in the package or with a reference tool
  • Evidence: Both files start with # SPDX-FileCopyrightText: 2026 Ngó Sen contributors / # SPDX-License-Identifier: LGPL-2.1-or-later; the only LGPL stanza is Files: bamboo-rs/* (debian/copyright:23-28), so both fall to Files: * / License: GPL-3.0-or-later (debian/copyright:12-17). The SCOWL stanza names the exact path data/english-common.txt (debian/copyright:32), so the companion data/english-common.txt.license, which holds Kevin Atkinson's notice, is also described as GPL-3.0-or-later and its holder is not named for it.
  • Problem: Under copyright-format's last-matching-stanza rule the two scripts are recorded under terms their licensors did not grant them: LGPL-2.1-or-later may be relabelled GPLv3 (LGPL-2.1 section 3), so nothing is undistributable, but debian/copyright does not describe the files as they are licensed, and it credits data/english-common.txt.license to the wrong holders (copyright-format 6.7 and 6.9).
  • Fix: Add a stanza for the two scripts (Files: misc/*.py, Copyright 2026 Ngó Sen contributors, License: LGPL-2.1-or-later, whose text is already in the file), and widen the SCOWL pattern to data/english-common.txt* so the .license stub is covered by it.
minor packaging 2. Build-Depends names librust-bamboo-core-dev, which no package in unstable, experimental or NEW provides ◂
  • Files: debian/control:10, bamboo-rs/Cargo.toml:15, bamboo-rs/CMakeLists.txt:26
  • Basis: checked, in the package or with a reference tool
  • Evidence: librust-bamboo-core-dev (>= 0.5.2), in Build-Depends; apt-cache show librust-bamboo-core-dev answers "No packages found ... Nor is it a binary of this package or of any upload waiting in the NEW queues (the list on ftp-master.debian.org as of 2026-11-11T04:10:12Z)". The crate is needed at build time: bamboo-core = "0.5.2" and cargo build ... --offline, so it must come from /usr/share/cargo/registry.
  • Problem: Nothing in the archive or in NEW can satisfy this build dependency, so the build stops before it starts with "no matching package named bamboo-core". (A build failure is a minor issue by this review's rules, but this one is certain from the package and the archive lists.)
  • Fix: Get bamboo-core into the archive (a librust-bamboo-core-dev package) and keep the versioned dependency, or point the build at the crate under whatever name it is packaged.
minor packaging 3. Depends omits the Qt SVG image-format plugin, so the Qt settings window's icons and logo are blank ◂
  • Files: debian/control:38-39, settings-gui/ui/brand.py:113-125, settings-gui/core/toolkit_install.py:36-40
  • Basis: checked, in the package or with a reference tool
  • Evidence: QIcon.fromTheme(name) and the icons/hicolor/scalable/apps/{name}.svg path in settings-gui/ui/brand.py; the Qt branch of Depends is python3-qtpy | python3-pyqt6 | gir1.2-adw-1 (>= 1.5) and python3-pyqt6 | ... (debian/control:38-39). apt-cache show python3-pyqt6 shows no libqt6svg6 or qt6-svg-plugins in its Depends. Upstream's own table: "qt": {"apt-get": ("python3-qtpy", "python3-pyqt6", ("qt6-svg-plugins", "libqt6svg6"))} with the comment "Without the SVG plugins the logo and icons are blank. Debian 13 moved them out of libqt6svg6".
  • Problem: Qt needs an image-format plugin to load SVG at all; it lives in qt6-svg-plugins since Qt 6.7.2-5. A system whose Qt branch comes from python3-pyqt6 alone installs neither that plugin nor libqt6svg6, and the settings window then shows no logo and no theme icons.
  • Fix: Add qt6-svg-plugins | libqt6svg6 to the Qt alternatives in Depends (or to Recommends if a blank-icon window is acceptable).
minor packaging 4. libxcb-xfixes0 is dlopen'ed for primary-selection following but is not in Depends ◂
  • Files: src/core/ngosen-pointer.cpp:177-192, debian/control:31-37
  • Basis: checked, in the package or with a reference tool
  • Evidence: void* xfixes = dlopen("libxcb-xfixes.so.0", RTLD_NOW | RTLD_LOCAL); and, when it or its symbols are missing, NGOSEN_WARN("Primary selection unavailable: missing XFixes"); return false;. The comment in debian/control above Depends says the dlopen'ed libxcb, libxcb-xtest and libxcb-xinput are listed for that reason; libxcb-xfixes0 is not among them.
  • Problem: libxcb-xfixes0 is a separate binary package, not a dependency of libxcb1 or of the GTK packages, so the GTK-only branch of Depends (gir1.2-adw-1, no Qt) does not install it: primary-selection following, and with it the surrounding-text handling for clients that do not report it, silently switches off.
  • Fix: Add libxcb-xfixes0 to Depends next to libxcb1, libxcb-xinput0 and libxcb-xtest0.
minor packaging 5. No autopkgtest: the installed addon, its D-Bus object and the Python settings GUI are never exercised in the archive ◂
  • Files: debian/, test/CMakeLists.txt, settings-gui/tests/
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/ has no tests/ directory, so debian/tests/control does not exist. Upstream ships the C++ suite in test/ (built and run once by dh_auto_test) and a Python suite in settings-gui/tests/ that nothing in the package runs.
  • Problem: Nothing checks the built package after installation: that the addon loads, that io.github.ngosen.NgoSen1 answers on D-Bus, or that the settings GUI starts with either toolkit. For a new package with substantial upstream tests this is the usual sponsor request rather than a policy violation.
  • Fix: Add debian/tests/control with a trivial test that imports the settings GUI and asks fcitx5 to load the addon (and, with the Python suite, runs settings-gui/tests), marked Restrictions: needs-session or skipping cleanly where there is no bus.
Verified ◂
  • Prescan data/english-common.txt:51861 and :69948: these are entries of the 88,201-line English word list (noncommercial, shareware, ...), not licence terms; neighbouring lines are ordinary words. The file is data/english-common.txt, generated by misc/gen-english-words.py, and is the SCOWL-derived word list that debian/copyright:30-40 covers, with Kevin Atkinson's permission notice reproduced both in the copyright file and in data/english-common.txt.license.
  • Prescan holder Nguyễn Hoàng Kỳ <nhktmdzhg@gmail.com> (src/core/emoji-entry.h:2, src/core/ngosen-go-object.h:4, src/core/ngosen-state-emoji.cpp:4 and 21 more) is the same person as Nguyen Hoang Ky at debian/copyright:14 (diacritics only). Every SPDX-FileCopyrightText name in the tree (CSSlayer, Võ Ngô Hoàng Thành, Lương Thanh Lâm, Nguyễn Hoàng Kỳ, Ngó Sen contributors) is named in the stanza covering its files, as are cmake/ (Xuetian Weng, Alexander Neundorf, Chusslove Illich), the SCOWL data (Kevin Atkinson), data/dictionaries (FVDP, Ho Ngoc Duc, Ngo Quoc Hung, Wiktionary and ibus-bamboo contributors) and the CC0 metainfo.
  • Licence inventory by grep over the whole tree: every SPDX-License-Identifier is GPL-3.0-or-later except bamboo-rs/** (LGPL-2.1-or-later, matching its stanza) and the two misc/ scripts; no MIT/Expat/Apache/MPL/AGPL/CC-BY tag exists. The Expat stanza that upstream's own packaging/debian/copyright:37-41 needs is correctly absent here, because Files-Excluded removes bamboo-rs/vendor.
  • Combined licences are compatible: LGPL-2.1-or-later Rust static library linked into a GPL-3.0-or-later fcitx5 addon; BSD-3-Clause cmake modules (build only); SCOWL word lists; GPL-3 dictionaries built from FVDP material (GPL, any version) and ibus-bamboo (GPLv3); CC0-1.0 metainfo template.
  • No non-free wording anywhere: grep for non-commercial, no-modification, personal-use, evaluation-only, all-rights-reserved found nothing outside the word list.
  • No built, minified or opaque files: no .so/.a/.o/.pyc/archives/PDF/fonts in the tree; the only binaries are docs/screenshots/*.png (four screenshots of the settings window, not installed). The generated word lists ship with their generator (misc/gen-english-words.py), and misc/editor-test/pages/*.html load their editors from CDN URLs, so no third-party JavaScript is embedded.
  • Icons: the 78 SVGs under data/icons/ (breeze, breeze-dark, hicolor) are the project's own drawings, identical between the breeze and hicolor copies, with no foreign copyright; they are rendered to 22/24 px PNG at build time by rsvg-convert (librsvg2-bin).
  • data/dictionaries/vietnamese.cm.dict: LICENSE.vietnamese.cm.dict records the FVDP dictionary (GPL), vi.wiktionary (CC-BY-SA) and Ngo Quoc Hung's abbreviation list (used with permission), and debian/copyright:48-59 names those holders and says the same in a Comment; CHANGELOG.md:172 records the same licensing decision.
  • Packaging mechanics: compat 14 with the dh sequencer, --buildsystem=cmake in obj-, hardening=+all; dh_auto_test runs the C++ suite because rules passes -DBUILD_TESTING=ON unless DEB_BUILD_OPTIONS has nocheck (and dh, not the override, decides that at compat 13+); the vendored-crate path is cut over cleanly (-DNGOSEN_VENDORED_CRATES=OFF, Files-Excluded, and the configure/clean hooks create and remove debian/cargo_home, debian/cargo_registry and bamboo-rs/Cargo.lock); CARGO_HOME ends in debian/cargo_home and cargo prepare-debian --link-from-system is used as /usr/share/cargo/bin/cargo documents; /usr/share/cargo/bin/dh-cargo-built-using exists, so Built-Using/Static-Built-Using are filled before dh_gencontrol.
  • Dependency names checked with apt-cache and all present: fcitx5, fcitx5-data, fcitx5-modules-dev, libfcitx5core-dev, libfcitx5config-dev, libfcitx5utils-dev, dh-cargo, librust-libc-dev, libxcb1, libxcb-xinput0, libxcb-xtest0, libxcb-xfixes0, python3-qtpy, python3-pyqt6, python3-pyside6.qtwidgets, gir1.2-adw-1 (1.10.0 in unstable, so the >= 1.5 requirement is met).
  • debian/copyright is machine-readable with the exact Format URL and no draft field names; the /usr/share/common-licenses pointers (GPL-3 for both GPL short names, LGPL-2.1) name files that exist, and the non-common licences used (BSD-3-Clause, SCOWL, CC0-1.0) have their text in the file.
  • debian/: single unstable changelog entry for 1.9.2+ds-1 matching the +ds tarball (vendor directory removed), Closes: #1151867; Standards-Version 4.7.4, whose first two components match the system's Policy 4.7.4.1; man pages for both installed programs and a manpages file; README.Debian; no patches, so no DEP-3 question; no maintainer scripts.
  • Coverage: all of debian/ was read in full, plus CMakeLists.txt, src/, src/core/, bamboo-rs/, settings-gui/, test/, data/, misc/, cmake/, gnome-shell/, docs/, po/ and the root files; .pc/ and debian/cargo-checksum.json were left alone as instructed (no cargo-checksum.json exists).
  • uscan found the packaged version as the newest upstream release (upstream 1.9.2, packaged 1.9.2+ds).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3, LGPL-2.1).
Not confirmed ◂
  • The CC-BY-SA version applying to the Wiktionary-derived part of data/dictionaries/vietnamese.cm.dict is stated nowhere in the package (the license file only links archived copies). CC-BY-SA 4.0 is one-way compatible with GPLv3, so the documented combination works there; if the text is 3.0 the combination with the GPLv3 dataset would need a licensing decision. The material is a word list, and Debian already ships its source (ibus-bamboo) the same way.
  • librust-bamboo-core-dev is reported from the reviewing system's package lists (unstable, experimental and NEW as of 2026-11-11T04:10:12Z); an upload accepted after those lists were taken would make that finding moot.
Proposed changes ◂

None.

Uploader's response to the LLM review

Thanks. Going through them:

  1. Correct. I will add a Files: misc/.py stanza (LGPL-2.1-or-later) and widen the SCOWL pattern to data/english-common.txt.
  2. Not correct: librust-bamboo-core-dev 0.5.4-1 is in unstable (amd64, arm64, armhf, i386, loong64, ppc64el, s390x; rmadison checked today).
  3. Correct. qt6-svg-plugins goes into Depends with the Qt alternatives.
  4. Correct. libxcb-xfixes0 goes into Depends next to the other dlopen'ed libxcb libraries.
  5. Agreed. A smoke autopkgtest will follow.

1, 3 and 4 will be fixed in the packaging repo and shipped in the next upload. I would rather not reject this one over minor issues.

— Phi Nguyễn (nguyenphi), 2 hours ago

Back to Dashboard | View all reviews for this package