Review: field-api-ecmwf 0.3.10-1

Package Information

Description	Library to manage the transfer of data from CPUs to GPUs Field API aims to ease the management and the transfer of data between CPUs and GPUs for the Météo-France/ECMWF software. It provides abstractions and wrappers around Fortran fields(arrays) to hide data movement complexity. This package provides the shared library.
Maintainer	Alastair McKinstry <mckinstry@debian.org>
Changed By	Alastair McKinstry <mckinstry@debian.org>
Sponsor	mckinstry@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/mckinstry/field-api-ecmwf.git (browse)
Closes	#1151276
Tracker	https://tracker.debian.org/pkg/field-api-ecmwf
Uploaded	19 days ago

New Package Report

.changes◂

Source	field-api-ecmwf
Version	0.3.10-1
Changed-By	Alastair McKinstry <mckinstry@debian.org>
Architecture	source arm64
Distribution	unstable
Date	Mon, 19 Oct 2026 15:47:16 +0100

Changelog◂

field-api-ecmwf (0.3.10-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151276)

.dsc◂

Package-List	libfield-api-ecmwf-0d deb science optional arch=any libfield-api-ecmwf-dev deb science optional arch=any
Section	science
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://www.github.com/ecmwf-ifs/field_api
Upstream-Name: field_api

Files: *
Copyright: (C) 2020-2026 ECMWF
 (C) 2022-2026 Meteo-France
 (C) 2023- NVIDIA
License: Apache-2.0

Files:
 debian/*
Copyright: Copyright (C) 2024-2026, Alastair McKinstry <mckinstry@debian.org>
License: Apache-2.0

License: Apache-2.0
 This software is licensed under the terms of the Apache Licence Version 2.0
 which can be obtained at http://www.apache.org/licenses/LICENSE-2.0.
 .
 In applying this licence, ECMWF does not waive the privileges and immunities granted to it by
 virtue of its status as an intergovernmental organisation nor does it submit to any jurisdiction.
 .
 The texts of this license can be found in /usr/share/common-licenses/Apache-2.0

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 19 days ago.

Report◂

DFSG NEW review for field-api-ecmwf version 0.3.10-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is DFSG-compliant: it is Apache-2.0 throughout (top-level LICENSE is the full Apache-2.0 text; every source file sampled carries the Apache Licence 2.0 notice with holders ECMWF, Meteo-France and NVIDIA, all of which are named in the machine-readable debian/copyright Files: * stanza, which correctly references /usr/share/common-licenses/Apache-2.0). The prescan found no built/minified/binary files. However, debian/copyright does not accurately name every copyright holder: src/core/buddy_alloc.h is an embedded third-party allocator carrying only Copyright 2021 Stanislav Paskalev with no in-file licence text, and that holder is not represented in debian/copyright (it falls under Files: * Apache-2.0). One minor attribution gap; everything else is accurate.

Packaging

Well-structured, current packaging by an experienced DD: debhelper compat 14 with correct dh usage and hardening, source format 3.0 (quilt), Standards-Version 4.7.4 (current), correct binary split (runtime -0d + dev), Vcs-* fields, salsa-ci and gbp. All Build-Depends exist in the archive and satisfy version requirements (ecbuild 3.16>=3.12 so the FetchContent network fallback in field_api_fetchcontent_ecbuild.cmake is not triggered; libfiat-dev 2.0.1; libfckit-utils; fypp; pkgconf; dh-fortran); the ecbuild buildsystem used by dh --buildsystem=ecbuild is provided by the ecbuild package (dh-sequence-ecbuild). Minor notes only: the three quilt patches carry no DEP-3 headers, two of them (fix-broken.patch, shared-libs.patch) are commented out of series but retained, and the autotests are disabled (override_dh_auto_test) with no autopkgtests.

Issues

minor licensing 1. Copyright holder Stanislav Paskalev (src/core/buddy_alloc.h) not named in debian/copyright ◂

Files: src/core/buddy_alloc.h:2; debian/copyright Files: * stanza
Basis: checked, in the package or with a reference tool
Evidence:

buddy_alloc.h line 2: `/*
- Copyright 2021 Stanislav Paskalev spaskalev@protonmail.com; the file contains no in-file licence text of its own (no MIT/Apache/notice), and debian/copyright's Files: *` names only ECMWF, Meteo-France and NVIDIA.
Problem: This is embedded third-party code (a binary buddy allocator, github.com/spaskalev/buddy_alloc) whose copyright holder is not represented in debian/copyright, so the file is not accurately described. It is currently attributed under Files: * to Apache-2.0, but its own provenance (and whether it is genuinely Apache-2.0, as the upstream project is commonly MIT) cannot be confirmed from the tree, since the file carries no licence text.
Fix: Add a Files: src/core/buddy_alloc.h stanza naming Copyright: 2021 Stanislav Paskalev <spaskalev@protonmail.com> and the correct licence short name (confirming with upstream whether it is Apache-2.0 or MIT, adding the licence text if not Apache-2.0), before the Files: * catch-all.

minor packaging 2. Quilt patches lack DEP-3 headers; two patches commented out of series but retained ◂

Files: debian/patches/fix-broken.patch, shared-libs.patch, shared.patch; debian/patches/series
Basis: checked, in the package or with a reference tool
Evidence: series lists # fix-broken.patch and # shared-libs.patch (disabled) with only shared.patch applied; none of the three patches has a DEP-3 Description/Origin/Forwarded/Author block.
Problem: The applied patch (shared.patch, which adds VERSION 0d so the SHARED library gets the .so.0d soname the install files and package name depend on) lacks a DEP-3 header, so its purpose and upstream-forwarding status are undocumented; the two disabled patches are dead weight in the tree.
Fix: Add DEP-3 headers (Description, Origin, Forwarded, Author) to shared.patch; either enable the two disabled patches or remove them from the tree if obsolete.

minor packaging 3. Autotests skipped and no autopkgtests ◂

Files: debian/rules (override_dh_auto_test); no debian/tests/control
Basis: checked, in the package or with a reference tool
Evidence:

rules has override_dh_auto_test: @echo Skip tests this build and there is no debian/tests/.
Problem: The test suite (tests/*.F90 with abor1catcher.sh etc.) is disabled at build time and there is no autopkgtest stanza, so the package ships without its numerical tests being exercised in the archive.
Fix: Run the ctest suite during builds (optionally honouring DEB_BUILD_OPTIONS=nocheck) and/or add a debian/tests/control autopkgtest exercising the library.

Verified ◂

debian/copyright is machine-readable (correct Format: URL) with a Files: * catch-all, a debian/* stanza, and a valid Apache-2.0 License paragraph referencing /usr/share/common-licenses/Apache-2.0.
Every source file sampled (CMakeLists, cmake/*.cmake, src/, python_utils/, tests/, arch/) carries the Apache Licence Version 2.0 notice naming ECMWF and Meteo-France (and NVIDIA where applicable); all are covered by the Files: * stanza, whose holders match.
NVIDIA is the sole holder on src/core/field_RANKSUFF_data_module.fypp, src/core/field_RANKSUFF_module.fypp and tests/*_NVIDIA-credited .F90 files; the Files: * stanza names NVIDIA.
Top-level LICENSE is the full Apache-2.0 text; no other licence or minified/binary artifact was found in the tree.
Files under .github/ (workflows, install-hdf5.sh, install-nvhpc.sh) carry no copyright notice but are upstream CI/config source and covered under Files: * Apache-2.0.
All Build-Depends resolve in the archive and meet the versioned requirements (ecbuild 3.16.0 >= 3.12, so the network FetchContent fallback in cmake/field_api_fetchcontent_ecbuild.cmake is not triggered; libfiat-dev 2.0.1-2; libfckit-utils; fypp; pkgconf; dh-fortran).
The ecbuild dh buildsystem invoked by dh $@ --buildsystem=ecbuild is provided by the ecbuild binary package (Provides: dh-sequence-ecbuild), so it is not a missing build dependency.
debian/control uses valid substvars (${shlib:Depends}, ${misc:Depends}, ${fortran:Depends}) and binary packages; ${shlib:Depends}/${misc:Depends} are auto-added at compat 14 (not missing).
Changelog is sane (initial release 0.3.10-1 unstable, closes #1151276); source format 3.0 (quilt); gbp.conf and salsa-ci.yml are standard.
uscan found the packaged version as the newest upstream release (upstream 0.3.10, packaged 0.3.10).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Whether src/core/buddy_alloc.h is genuinely Apache-2.0 or only MIT from its upstream origin cannot be confirmed from the tree, since the file carries no in-file licence text; the package relies on the project's Apache-2.0 LICENSE for it.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 19 days ago.

Review Information

accepted — allocated to awm 19 days ago, started 19 days ago, completed 19 days ago.

Final Comment

Hi,

Three minor issues found by the LLM. I suspect that the third is a false positive, and if it is then it would be helpful to understand why so I can teach the LLM a lesson about this!

Thanks!

Back to Dashboard | View all reviews for this package