DFSG NEW review for gcsa2 version 1.4-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The software itself is entirely MIT/Expat: the top-level LICENSE and every C++ header/source carry the standard MIT grant, held by Jouni Siren and Genome Research Ltd., both named in debian/copyright. No minified, built, binary or vendored files are present. However, one bundled file, paper/ltexpprt.sty, is a third-party SIAM macro 'may be freely distributed but may not be altered in any way' — a no-modification (non-free) term that fails DFSG-3 and contradict the Files: * stanza, which wrongly describes it as Expat and omits its holder. Everything else in debian/copyright is accurate and DEP-5-compliant (correct Format value, full MIT text included, correct short name).

Packaging

Packaging is of good quality: clean three-way binary split (gcsa2 / libgcsa2-1 / libgcsa2-dev) with correct Multi-Arch: same, compat 14, hardening=+all, dh_install picks the compiled binaries up from the source root and d-shlibmove installs the shared/static libraries and headers, an autopkgtest that links and runs against both the shared and static library, and Standards-Version 4.7.4 against current Policy 4.7.4.1. The build flow is coherent and not a build failure. The only nit is that the four patches, all Debian-specific, lack DEP-3 Forwarded/Origin fields.

Issues

1. [important] [licensing] paper/ltexpprt.sty has a no-modification licence and is misdescribed as Expat in debian/copyright

• Files: gcsa2-1.4/paper/ltexpprt.sty:4-6; gcsa2-1.4/debian/copyright:8-9
• Basis: checked, in the package or with a reference tool
• Evidence: % This file may be freely distributed but may not be altered in any way. (header), a SIAM/ACM-SIAM macro (Donna Witzleben, SIAM). debian/copyright Files: * covers it as License: Expat with holders 'Jouni Siren' / 'Genome Research Ltd.'.
• Problem: The file is shipped in the source yet is under a no-modification term (fails DFSG-3), and debian/copyright does not accurately describe every file: it mislabels this file as Expat and names a holder that never claimed it. It is an ancillary LaTeX typesetting style for the paper rather than functional code, so the core software licensing is unaffected, but it must be accounted for.
• Fix: Repack the upstream tarball excluding the paper/ directory via Files-Excluded (or drop the file), or add a dedicated stanza documenting the SIAM copyright and obtain/confirm a DFSG-free grant; do not claim it is Expat.

2. [minor] [packaging] Patches lack DEP-3 Forwarded/Origin headers

• Files: gcsa2-1.4/debian/patches/{use_debian_sdsl,drop_unneeded_divsufsort,add_ldflags_cppflags,build_shared_library}
• Basis: checked, in the package or with a reference tool
• Evidence: Each has only Description, Author, Last-Update; none has Forwarded:, Origin: or Bug:.
• Problem: DEP-3 recommends Forwarded/Origin so reviewers can see whether a patch should go upstream. These four are inherently Debian-only (use Debian SDSL, drop divsufsort, honour buildflags, build a shared library) and will never be forwarded.
• Fix: Add Forwarded: not-needed (and Origin, e.g. the source of each patch) to each patch header.

Verified

• debian/copyright read in full; DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/) with Files: * (Jouni Siren, Genome Research Ltd., Expat), Files: debian/* (M. R. Crusoe, Expat) and a full stand-alone Expat License text; all holders named. Software files carry the identical MIT text.
• Every C++ source/header and benchmark file carries an MIT per-file notice; holders are only Jouni Siren and Genome Research Ltd. (name spellings match). LICENSE years (e.g. 2018,2019,2021,2025,2026) vs the condensed Copyright: 2018, Jouni Siren line are minor year drift, not a missing holder.
• No minified/built/binary/vendored files in the tree: all files are C++ (.cpp/.h), Makefiles, the design/paper sources (.ipe/.isy/.tex/.bib are text), LICENSE, install.sh, .gitignore. No embedded copy of sdsl-lite or divsufsort (patch use_debian_sdsl removes the bundled-tree references; drop_unneeded_divsufsort drops the extra link libs).
• Packaging build flow verified: dh_auto_build builds into ./bin and ./lib; the Makefile has no install target so dh_auto_install does nothing; dh_install(1) falls back to the current directory for files, so bin/* in gcsa2.install is found in the source root and copied to usr/bin; execute_after_dh_install then creates the .so symlinks and d-shlibmove moves the shared lib to the Multi-Arch path, the static lib and headers (include/gcsa -> usr/include) into the -dev package. Coherent; not a build failure.
• Binary split and Multi-Arch are correct: gcsa2 links libgcsa2 statically (only libsdsl/libstdc++ at runtime, via ${shlibs:Depends}); libgcsa2-1 (Multi-Arch: same) ships the SONAME libgcsa2.so.1; libgcsa2-dev (Multi-Arch: same) Depends libgcsa2-1 (= ${binary:Version}) and libsdsl-dev.
• debian/rules: dh $@, compat 14, hardening=+all exported and also set in the patched Makefile (consistent, via buildflags.mk); dh's make build system passes CPPFLAGS/CXXFLAGS/LDFLAGS so hardening applies. Substvars are named explicitly (harmless at compat 14).
• Standards-Version 4.7.4 is current (Policy 4.7.4.1); Vcs-Git/Vcs-Browser point at salsa. debian/changelog is a sane initial release closing #1151599.
• autopkgtest compile-link exists in debian/tests/control; it compiles smoke.cpp against both the shared (-lgcsa2) and static (/usr/lib/<multiarch>/libgcsa2.a) library and runs both; Depends (libgcsa2-1, libgcsa2-dev, build-essential, libsdsl-dev) is adequate.
• debhelper compat 14 confirmed; no Files-Excluded present in debian/copyright (relevant because none is needed except for the ltexpprt.sty paper file).
• debian/watch, debian/cargo-checksum.json and .pc/ are out of scope and not reviewed.
• uscan found the packaged version as the newest upstream release (upstream 1.4, packaged 1.4).

Not confirmed

None.

Proposed changes

None.