DFSG NEW review for fonts-arsenal version 2.001+git20170626+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 2 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Everything upstream is SIL OFL 1.1 with the notice Copyright 2012 (The) Arsenal (Project) Authors (andrij.design@gmail.com), and debian/copyright is DEP-5 with a Files: * catch-all plus a debian/* override that match the tree. OFL.txt declares no Reserved Font Name, so OFL-1.1-no-RFN is the right short name, and the licence text is correctly pointed at /usr/share/common-licenses/OFL-1.1, which exists. No file lacks a licence and no built file is shipped: the OTFs are generated from sources/Arsenal.glyphs at build time and upstream's built fonts/ directory is both absent and named in Files-Excluded. Copyright and licence are DFSG-free and compatible.

Packaging

Small, clean packaging (compat 14, quilt, Vcs-*, salsa-ci, a correct debian/install/debian/clean pair matching fontmake's master_otf output). Two things a sponsor would require first: debian/rules runs fontmake but Build-Depends does not list it, so a clean-chroot build fails; and the binary is declared Architecture: any although it is nothing but architecture-independent OTF data, where the Fonts Team uses Architecture: all.

Issues

1. [important] [packaging] debian/rules runs fontmake, but fontmake is not in Build-Depends

• Files: debian/rules:4-5, debian/control:5-6
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules: override_dh_auto_build: / fontmake -g sources/Arsenal.glyphs -o otf; debian/control: Build-Depends: / debhelper-compat (= 14), only
• Problem: The fonts are not shipped in the tarball but generated at build time from sources/Arsenal.glyphs, so the build needs the fontmake program. A clean build environment installs only build-essential and Build-Depends; neither contains fontmake (apt-cache show fontmake: 3.12.1-3, Section devel, not essential), so the override fails with fontmake: command not found and the following dh_install then finds no master_otf/*.otf. The build can only have succeeded where fontmake happened to be installed already.
• Fix: Add fontmake to Build-Depends (Build-Depends-Indep would also satisfy the font generation if Architecture becomes all, but Build-Depends is always satisfied for build-indep targets per Policy 7.7).

2. [important] [packaging] Architecture: any for a package holding only architecture-independent OTF data; should be all

• Files: debian/control:13, debian/control:14
• Basis: checked, in the package or with a reference tool
• Evidence: Package: fonts-arsenal / Architecture: any / Multi-Arch: foreign
• Problem: The binary package contains only OTF files produced from sources/Arsenal.glyphs; nothing in it varies with the architecture, which is what Policy 5.6.8 means by all ("'all', which indicates an architecture-independent package"). With any the identical content is built and published once per release architecture for no benefit, and the Fonts Team's packages use all here (checked with apt-cache: fonts-inter 4.1+ds1-4 and fonts-open-sans 3.003~git20231116+ds-1, both Architecture: all with Multi-Arch: foreign).
• Fix: Set Architecture: all (keeping Multi-Arch: foreign).

Verified

• Read every file under debian/ (changelog, clean, control, copyright, install, rules, salsa-ci.yml, source/format) and every upstream file: .gitignore, AUTHORS.txt, CONTRIBUTORS.txt, DESCRIPTION.en_us.html, FONTLOG.txt, OFL.txt, README.md, sources/Arsenal.glyphs, sources/Arsenal-Italic.glyphs, sources/fleuron.png, sources/poster.png - 12 files, i.e. the whole tree apart from .pc/.
• The prescan listed no file to account for: its author check scanned 8 files and found every holder named in debian/copyright.
• No built file is shipped: the OTFs come from fontmake -g sources/Arsenal.glyphs -o otf at build time, and upstream's built fonts/ directory is absent from the tree while Files-Excluded: fonts names it, so exclusion and tree agree.
• The only non-text files are the two PNGs and the two .glyphs sources. The .glyphs files are the font sources (text plists; sources/Arsenal.glyphs:13 and sources/Arsenal-Italic.glyphs:10 carry copyright = "Copyright 2012 The Arsenal Project Authors (andrij.design@gmail.com)" and the OFL 1.1 notice), and the PNGs are upstream specimen images embedded by README.md, covered by the Files: * stanza.
• OFL.txt:1 is Copyright 2012 The Arsenal Project Authors (andrij.design@gmail.com) and names no Reserved Font Name, so OFL-1.1-no-RFN is accurate; /usr/share/common-licenses/OFL-1.1 exists on the reviewing system and is the file debian/copyright points to.
• debian/copyright: holder list matches the notices (README.md:34 adds Stairsfor, which the copyright file also names); Files: * is the catch-all and debian/* the later override; the file is valid DEP-5 with a stand-alone License: paragraph.
• fontmake's _output_dir() (/usr/lib/python3/dist-packages/fontmake/font_project.py:1541) makes -o otf write master_otf/*.otf, and for output otf alone no UFOs and no designspace are written (save_ufos false, font_project.py:995 and 362-370), so debian/install (master_otf/*.otf usr/share/fonts/opentype/arsenal) and debian/clean (master_otf/) both match what the build produces.
• debian/clean's directory entry is correct: dh_clean removes directories listed with a trailing slash, together with their content (dh_clean(1)).
• compat 14 is debhelper's recommended level (debhelper 14.5 on the reviewing system) and dh_gencontrol adds relationship substvars itself there, so the binary stanza needs no ${misc:Depends}/${shlibs:Depends}.
• debian/changelog: 2.001+git20170626+ds-1, unstable, urgency medium, closes #944140, and the date is the Saturday it names.
• No debian/tests/ and no autopkgtest: nothing to run for a data-only font package, which is normal for the Fonts Team and not counted as a fault.
• uscan found the packaged version as the newest upstream release (upstream 2.001+git20170626, packaged 2.001+git20170626+ds).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (OFL-1.1).

Not confirmed

• Whether the italic styles are meant to be shipped: sources/Arsenal-Italic.glyphs is a full 1.4 MB source with the same copyright and licence in the tarball, but debian/rules builds only sources/Arsenal.glyphs, so the package installs Roman masters only. A build (fontmake -g sources/Arsenal-Italic.glyphs -o otf) or upstream's release would show whether an italic belongs in the binary package.
• Whether this 2017 .glyphs source still loads with glyphsLib/fontmake 3.12.1 (fontmake's docs say .glyphs is supported, but only running the build would show it for this file); the package's build could not be run here.
• The content of the two PNGs (sources/fleuron.png, sources/poster.png) was not inspected (binary), only their paths and their use as specimen images in README.md; they are covered by the Files: * stanza.

Proposed changes

None.