DFSG NEW review for gardendevd version 0.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

Every source file carries an SPDX header of GPL-3.0-or-later (the C sources, headers, dracut scripts, tests, tools) or LGPL-2.1-or-later (the systemd-derived udev rules and the two keyboard-key generator scripts), matching the debian/copyright stanzas. The tree has no embedded third-party libraries, no non-free terms, and no built/bytecode files. The only fault is that the copyright header paragraph names the wrong project (seedfiles rather than gardendevd); the Files/Copyright/License stanzas themselves are accurate.

Packaging

Packaging is clean and modern: debhelper compat 14, meson build, hardening=+all, correct Build-Depends (pkgconf, libacl1-dev, libsystemd-dev, meson), a single binary package with Provides/Conflicts udev, and correct source format 3.0 (quilt). Two minor nits: debian/gbp.conf has a malformed section header, and the empty override_dh_auto_test silently disables the test suite at build time.

Issues

1. [important] [licensing] debian/copyright header names the wrong upstream project (seedfiles instead of gardendevd)

• Files: debian/copyright:2-3
• Basis: checked, in the package or with a reference tool
• Evidence: Source: https://codeberg.org/Gardenhouse/seedfiles and Upstream-Name: seedfiles, while debian/control and debian/upstream/metadata both give Homepage: https://codeberg.org/Gardenhouse/gardendevd.
• Problem: The Source URL and Upstream-Name point at a different Gardenhouse project (seedfiles), not the package being built. The copyright header's provenance metadata is factually wrong, and a sponsor would require it corrected before upload.
• Fix: Change Source: to https://codeberg.org/Gardenhouse/gardendevd and Upstream-Name: to gardendevd.

2. [minor] [packaging] debian/gbp.conf DEFAULT section header is malformed (missing opening bracket)

• Files: debian/gbp.conf:1
• Basis: checked, in the package or with a reference tool
• Evidence: The first line reads DEFAULT] rather than [DEFAULT]; the other sections ([dch], [import-orig], [pq]) are all correctly bracketed.
• Problem: Without the opening [, the pristine-tar, debian-branch, upstream-branch and upstream-vcs-tag settings are orphaned outside any section, so git-buildpackage fails to read them (git config errors on a key outside a section header).
• Fix: Change the first line to [DEFAULT].

3. [minor] [packaging] override_dh_auto_test is empty, disabling the whole test suite at build time

• Files: debian/rules:18
• Basis: checked, in the package or with a reference tool
• Evidence: override_dh_auto_test: with no recipe, after the comment # Tests expect /run to be available.
• Problem: An empty override target makes dh skip meson test entirely, so the seven test programs declared in meson.build (test-rules-parse, test-rules-eval, test-rules-format, test-builtin, test-parent, test-spawn, test-udev-to-mdev) never run during the build. This is not a build failure, but it silently drops test coverage.
• Fix: Either create /run before testing (e.g. run the tests with a wrapper that ensures /run exists, or use DEB_BUILD_OPTIONS=nocheck to opt out per-build), so the tests actually run.

Verified

• Read every file under debian/ in full (control, rules, changelog, copyright, source/format, gpb.conf, lintian-overrides, salsa-ci.yml, upstream/metadata, watch) and the .dsc.
• Scanned the whole tree (105 files) for copyright/licence evidence; every file carries an SPDX header (GPL-3.0-or-later for C sources, headers, dracut scripts, tests and tools; LGPL-2.1-or-later for rules/udev/.rules and scripts/generate-keyboard-keys-.sh), except trivial build/config files (.gitignore, Containerfile, meson_options.txt, udev.pc.in, rules/mdev.conf, dracut mdev.conf, openrc scripts, test/vm overlay data) which fall under the Files: * GPL-3+ stanza and need no header.
• No LICENSE/COPYING/NOTICE/AUTHORS file exists in the tree; licensing is conveyed per-file by SPDX headers, and debian/copyright reproduces the GPL-3+ and LGPL-2.1+ texts with correct /usr/share/common-licenses pointers.
• The prescan author-check found every copyright holder named in debian/copyright (Rose Hellsing, the systemd contributors, Matthias Geiger); no missing holder.
• 73-uaccess.rules is GPL-3.0-or-later and correctly falls under the Files: * stanza rather than the systemd LGPL-2.1+ stanza (which lists only the LGPL rules files).
• The generate-keyboard-keys-*.sh scripts are LGPL-2.1-or-later systemd-derived generators; their output (a key-name list and table) compiled into the GPL-3+ binary is licence-compatible.
• mdevd is not a hard runtime dependency: gardendevd auto-detects it and falls back to kernel-netlink mode (src/gardendevd.c:737-753), so the absence of a Depends on mdevd is not a fault.
• The empty Files: field in the second debian/copyright stanza is valid DEP-5 field continuation (patterns on the following indented lines).
• uscan found the packaged version as the newest upstream release (upstream 0.2, packaged 0.2).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3, LGPL-2.1).

Not confirmed

• debian/watch looks at codeberg.org/gardenhouse/gardendevd, but the Source field of debian/copyright names codeberg.org/gardenhouse/seedfiles. Whether these are the same upstream was not checked.

Proposed changes

None.