DFSG NEW review for formiko version 2.0.0-2

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 0 important, 3 minor
• debian/watch: old format (version 4)
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every file in the tree carries a free licence, so the licensing itself is DFSG-compliant: the application is BSD-3-Clause (COPYING, matching pyproject.toml's License-Expression and the About dialog's Gtk.License.BSD_3), and the only file under another licence, the AppStream metainfo XML, is MIT. debian/copyright is not, however, fully accurate: its MIT stanza names formiko.metainfo.xml, a path that no longer exists because debian/patches/appstream-id-consistency.patch renamed the file to cz.zeropage.Formiko.metainfo.xml, so that MIT file now falls under the Files: * BSD-3-Clause catch-all; and the BSD-3-Clause text reproduced in the file differs from upstream's clause 3 wording. All holders the scan found are named; the remaining files (icons, JSON-preview assets, generated metainfo artefacts) are covered by Files: *.

Packaging

Clean, modern debhelper compat 14 packaging: dh sequencer with the pybuild buildsystem, Rules-Requires-Root: no, Vcs-* and upstream metadata, a sensible binary split (formiko / formiko-vim) with the moved files guarded by Breaks/Replaces and a symlinked doc directory, and a two-command autopkgtest. Every dependency named in control exists in the archive. Two patches with proper DEP-3 headers, one of them a backport and one forwarded upstream. The only faults are minor: the shipped man pages are upstream text written for the pre-GTK4 formiko.

Issues

1. [blocker] [licensing] debian/copyright's MIT stanza names formiko.metainfo.xml, a path that no longer exists, so cz.zeropage.Formiko.metainfo.xml is described as BSD-3-Clause

• Files: debian/copyright:15-18 (Files: formiko.metainfo.xml), debian/patches/appstream-id-consistency.patch, cz.zeropage.Formiko.metainfo.xml:40
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright has Files: formiko.metainfo.xml / Copyright: 2019-2026 Ondřej Tůma <mcbig@zeropage.cz> / License: MIT. appstream-id-consistency.patch renames it: --- a/formiko.metainfo.xml / +++ b/cz.zeropage.Formiko.metainfo.xml, and no top-level formiko.metainfo.xml exists in the unpacked tree. Per the copyright-format 1.0 spec section 6.9 (read with the policy tool), a pattern without a wildcard is anchored at the root and names one path, so the pattern matches nothing and the last stanza matching the file is Files: * (License: BSD-3-Clause). The file itself declares <metadata_license>MIT</metadata_license> at line 40.
• Problem: The metainfo file's licence is misstated: Debian's own copyright file tells users it is BSD-3-Clause (the catch-all) when it is MIT. The MIT stanza is dead text, matching no file at all.
• Fix: Change the stanza's pattern to Files: cz.zeropage.Formiko.metainfo.xml (the path the file actually has after the packaging patch) and keep License: MIT.

2. [minor] [licensing] debian/copyright's BSD-3-Clause clause 3 reads "Neither the name of the University nor the names of its contributors", upstream's COPYING says "the author"

• Files: debian/copyright:29-30, COPYING:14-15
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: 3. Neither the name of the University nor the names of its contributors; COPYING: * Neither the name of the author nor the names of its / contributors may be used to endorse or promote products derived.
• Problem: The licence text Debian distributes names a party (a university) that appears in no upstream notice, so the reproduced BSD-3-Clause variant does not match the licence actually granted; the restriction differs in who may not be used for endorsement.
• Fix: Reproduce upstream's wording in the stand-alone License: BSD-3-Clause paragraph: Neither the name of the author nor the names of its contributors.

3. [minor] [packaging] The shipped man pages still describe formiko as a Gtk3/WebKit2/GtkSpell3/recommonmark program

• Files: formiko.rst (DESCRIPTION), formiko-vim.rst (DESCRIPTION)
• Basis: checked, in the package or with a reference tool
• Evidence: formiko.rst: It is written in Python with Gtk3 and Webkit2. It use Docutils and recommonmark Common Mark parser. / This version use SourceView as editor and GtkSpell3 as spell checker. formiko-vim.rst: At this moment, **this works only on X11 graphics backend**, because GtkSockets not work on Wayland yet. while 2.0.0 requires Gtk 4.0, Adw 1, GtkSource 5, WebKit 6.0 and Spelling 1 (formiko/main.py) and its changelog entry says recommonmark was dropped.
• Problem: Both man pages are built into formiko.1/formiko-vim.1 and installed, and give users factually wrong information about the toolkit, the parser and the spell checker of the version they have installed.
• Fix: Update the DESCRIPTION sections of formiko.rst and formiko-vim.rst for the GTK4/libadwaita/WebKit 6.0 port (and drop the Wayland caveat if it no longer applies), ideally upstream.

4. [minor] [packaging] debian/watch is in the old version 4 format

• Files: debian/watch
• Basis: found by the review tooling's own checks
• Evidence: version=4
• Problem: Version 5 is the current format of debian/watch.
• Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.

Verified

• Prescan's author check: the scan found every copyright holder it looked for already named in debian/copyright; the holders in Files: * (Formiko Team, Ondřej Tůma, Petr Šimčík) match COPYING and AUTHORS, and the other names in AUTHORS (Ben Burrill, Fr_Dae, Jason Dong, Jeremy Bicha, Sabri Ünal, Vincent Bermel) are past contributors, not separate holders.
• icons/formiko.svg is the source for the PNGs under icons/16x16 .. 512x512, generated by the shipped icons/svg2png.py; the preferred form is present, so the PNGs are not unbuildable binaries.
• formiko/data/jsonfold.js and formiko/data/jsonfold.css are 12-line and 25-line hand-written assets for the JSON preview (imported by formiko/json_preview.py and packaged via [tool.setuptools.package-data]); no vendored library and no third-party notice, covered by Files: *.
• formiko/data/AUTHORS and top-level AUTHORS are contributor lists, not licence statements.
• PKG-INFO, formiko.egg-info/ and ChangeLog are setuptools/sdist artefacts shipped in the upstream tarball (debian/source/options ignores egg-info in the diff); they carry License-Expression: BSD-3-Clause, consistent with Files: *.
• debian/upstream/signing-key.asc is a PGP public key (no copyrightable content that needs a stanza); it is matched by Files: debian/*.
• No non-free terms anywhere: the only licence texts in the tree are COPYING (BSD-3-Clause) and the MIT metadata_license of the metainfo file.
• All names in Depends/Build-Depends/Recommends were checked with apt-cache and exist in the archive: gir1.2-adw-1, gir1.2-gtksource-5, gir1.2-webkit-6.0, gir1.2-spelling-1, gir1.2-vte-3.91, gir1.2-gtk-4.0, python3-jsonpath-ng, python3-m2r2, python3-pynvim.
• The higher-level licensing and packaging points were read in the reference tools: copyright-format section 6.9 (Files patterns) for the dead Files: formiko.metainfo.xml pattern, and the debhelper tool for dh_installdocs/dh_missing at compat 14.
• debian/rules was checked against the debhelper tool at compat 14: the execute_after_dh_install hook and the missing substvars concern do not apply, and the dh_installdocs --link-doc from formiko-vim (Architecture: all) to formiko (Architecture: all) is an allowed combination with a declared dependency (formiko (= ${binary:Version})).
• .pc/ and debian/cargo-checksum.json were excluded throughout; there is no cargo-checksum file.
• uscan found the packaged version as the newest upstream release (upstream 2.0.0, packaged 2.0.0).

Not confirmed

• Whether the first autopkgtest (formiko --help, no display in autopkgtest) exits before GTK needs an X/Wayland connection; only running it in the archive's autopkgtest shows this, and a failure there would not be a packaging fault of the kind this review reports.
• Nothing was built or run in the package (read-only review), so build-time behaviour of the pybuild/pytest steps in debian/rules was not exercised.