DFSG NEW review for fenicsx-compat version 0.4.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The whole source is MIT/Expat: LICENSE carries the MIT text with Copyright (c) 2026 Simula Research Laboratory, Henrik N.T. Finsberg, Jørgen S. Dokken, pyproject.toml declares license = "MIT" and no file in the tree carries another notice. debian/copyright is DEP-5 with the canonical Format line, a Files: * stanza naming exactly that holder and License: Expat with the full MIT text, and a debian/* stanza for the packaging. Nothing non-free, nothing generated without source, nothing vendored.

Packaging

A single Architecture: all Python module built with pybuild at debhelper compat 14, dh-sequence-python3, correct Build-Depends, a 3.0 (quilt) source format with one documented patch, four autopkgtests covering serial, MPI, complex and complex-MPI legs, and a sane changelog closing the ITP. Standards-Version 4.7.4 is current (Policy 4.7.4.1). The only defects are the missing DEP-3 headers on the one patch and an open question about whether python3-dolfinx reaches the binary package's Depends (see Not confirmed).

Issues

1. [minor] [packaging] debian/patches/force-adios2-mpi.patch has no DEP-3 headers (no Description, Origin or Forwarded)

• Files: debian/patches/force-adios2-mpi.patch:1-8
• Basis: checked, in the package or with a reference tool
• Evidence: The file begins directly with Index: fenicsx-compat/src/fenicsx_compat/__init__.py and the ---/+++ lines; there is no Description:, Origin:/Author:, Forwarded: or Last-Update: field. debian/patches/series lists it as force-adios2-mpi.patch.
• Problem: The patch is Debian-specific and changes upstream behaviour for every importer of the module (it sets ADIOS2_ALWAYS_USE_MPI=1 at import time), yet nothing in the patch records why it exists or whether it was offered upstream; that information lives only in debian/changelog. A reviewer or a later maintainer of the source has no way to tell whether it can be dropped with a new upstream release, which is what DEP-3 headers exist for.
• Fix: Add a DEP-3 header to the patch: a Description: of the adios2-serial/adios2-mpi problem and the forced MPI build, Author:/Origin:, and Forwarded: no (or the upstream issue/MR if it was sent), plus Last-Update:.

Verified

• debian/copyright is machine-readable (DEP-5) with the canonical Format: URL, Upstream-Name, Source, Upstream-Contact, a Files: * stanza (Copyright: 2026 Simula Research Laboratory, Henrik N.T. Finsberg, Jørgen S. Dokken, License: Expat) and a later Files: debian/* stanza for Drew Parsons; the stand-alone License: Expat paragraph reproduces the full MIT text, so no reference to /usr/share/common-licenses is needed.
• LICENSE matches that stanza exactly (MIT License, Copyright (c) 2026 Simula Research Laboratory, Henrik N.T. Finsberg, Jørgen S. Dokken), and pyproject.toml (license = "MIT") and PKG-INFO (License-Expression: MIT, License-File: LICENSE) agree.
• A grep over the whole tree for copyright, (C), ©, SPDX-License-Identifier, GNU, Apache, all rights reserved, public domain and licen[cs]e found notices only in LICENSE, PKG-INFO, pyproject.toml, _config.yml (copyright: "2026"), and debian/copyright; no file carries a second or conflicting licence.
• The pre-scan's holder check found every holder it detected named in debian/copyright; the holders it could have flagged are the three in LICENSE and Henrik Finsberg and Jørgen Dokken in _config.yml, all named.
• .github/scripts/docs_site.py states Adapted from dolfinx_mpc (Jørgen S. Dokken, MIT); the same MIT terms apply and the author is named, so Files: * covers it.
• No compiled, minified or generated binaries in the tree: the only non-Python code is plain, commented JavaScript (.github/docs-version-flyout.js), shell scripts under .devcontainer and .github, and YAML workflows; docs are Markdown/reStructuredText sources, with no built docs, images or fonts shipped.
• PKG-INFO is hatchling metadata generated from pyproject.toml (version 0.4.0, same dependencies and licence); it agrees with the tree and is covered by Files: *.
• debian/copyright's Files: * also covers .github/, .devcontainer/ and docs/, which carry no separate terms; .pc/ was excluded from the review as instructed.
• debian/source/format is 3.0 (quilt); the one patch is listed in debian/patches/series and is applied (src/fenicsx_compat/init.py starts with the added comment block and os.environ["ADIOS2_ALWAYS_USE_MPI"] = "1").
• debian/control builds one binary package, python3-fenicsx-compat, Architecture: all (pure Python, py.typed only), debhelper-compat 14 with dh-sequence-python3, and dh $@ --buildsystem=pybuild --with=single-binary; the single-binary add-on exists in debhelper (apt-cache: dh-sequence-single-binary is provided by debhelper 14.5).
• Build-Depends are plausible: python3-hatchling and pybuild-plugin-pyproject match build-backend = "hatchling.build", pybuild selects its pytest test runner because python3-pytest is in Build-Depends (checked /usr/share/perl5/Debian/Debhelper/Buildsystem/pybuild.pm:212), and the test-only deps are marked <!nocheck>.
• Standards-Version 4.7.4 against Policy 4.7.4.1: first two components match, nothing to report.
• Changelog: single initial-release entry, unstable, urgency=medium, closing #1152268, dated Tue, 27 Oct 2026, with the adios2 patch and the Recommends explained.
• Autopkgtests: debian/tests/control runs four tests (serial, MPI, complex, complex-MPI); the scripts run pytest from the unpacked source tree, which is present, and the one test skipped at build (test_every_public_function_has_a_guide_entry) is also skipped there; optional gmsh/pyvista use is guarded by importorskip.
• Reference packages named in the packaging exist in the archive (apt-cache): python3-dolfinx 1:0.11.0.post0-7, python3-dolfinx-complex, python3-adios2, python3-adios2-mpi, python3-petsc4py-complex.
• uscan found the packaged version as the newest upstream release (upstream 0.4.0, packaged 0.4.0).

Not confirmed

• Whether ${python3:Depends} actually pulls in python3-dolfinx (and through it python3-mpi4py). debian/control lists only ${python3:Depends} and ${misc:Depends}; the dependency must come from dh_python3 translating the dist-info Requires-Dist: fenics-dolfinx>=0.10.0 (pyproject.toml:18). dh_python3's pydist database on this system (/usr/share/dh-python/dist/cpython3_fallback) has entries for fenics-basix, fenics-ffcx, fenics-ufl, adios4dolfinx, io4dolfinx and dolfinx-mpc but none for fenics-dolfinx, so unless python3-dolfinx itself ships /usr/share/python3/dist/python3-dolfinx, the requirement is silently dropped and the package has no dependency on python3-dolfinx although it imports dolfinx unconditionally on import fenicsx_compat. python3-mpi4py is imported at top level too (src/fenicsx_compat/la.py:1, mesh.py:4) and is only Recommends, which is sufficient only if python3-dolfinx is a real Depends. A build log (dh_python3's warning about an untranslatable requirement) or dpkg -I python3-fenicsx-compat_0.4.0-1_all.deb would settle it; if the dependency is absent, add python3-dolfinx (>= 1:0.10.0~), python3-mpi4py, python3-packaging to Depends.

Proposed changes

None.