DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: giza 2.0.0-1

Package Information

DescriptionLightweight scientific plotting library (development files)

Giza is a lightweight scientific plotting library built on top of cairo that provides uniform output to multiple devices. Giza also provides a mostly compatible, modern replacement for the PGPLOT graphics library.

This package contains the development files.

MaintainerDebian Astro Team <debian-astro-maintainers@lists.alioth.debian.org>
Changed ByOle Streicher <olebole@debian.org>
Sponsorolebole@debian.org
Distributionexperimental
Architectureany
VCSgit: https://salsa.debian.org/debian-astro-team/giza.git (browse)
Popcon Installs604
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/giza
Uploaded30 days ago

New Package Report

.changes◂
DateThu, 08 Oct 2026 18:05:12 +0200
Sourcegiza
Version2.0.0-1
Changed-ByOle Streicher <olebole@debian.org>
Architecturesource amd64
Distributionexperimental
Changelog◂
giza (2.0.0-1) experimental; urgency=medium
 .
   * New upstream version 2.0.0
   * Rediff patches. Drop patches that are no longer required
   * Push Standards-Version to 4.7.4, debhelper compat to 14;
     no changes required
   * Link Fortran tests against libgiza explicitly
   * New packages because new SOVERSION 2. Switch to experimental
     to prepare transition
   * Don't use rpath
   * Create temporary homedir
   * Fix FTBFS on i386
   * Update/complete d/copyright
.dsc◂
Sectionlibdevel
Priorityoptional
Componentmain
Package-Listgiza-dev deb libdevel optional arch=any
libcpgplot2 deb libs optional arch=any
libgiza2 deb libs optional arch=any
libpgplot2 deb libs optional arch=any
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: giza
Source: https://github.com/danieljprice/giza

Files: *
Copyright: 2010-2015 The Authors
 Daniel Price <daniel.price@monash.edu>
 James Wetter <wetter.j@gmail.com>
 Joachim Frieben <jfrieben@hotmail.com>
 1989-2015 Free Software Foundation, Inc
 2026 Shugo Suwazono
License: LGPL
 This library is free software; and you are welcome to redistribute
 it under the terms of the GNU Lesser General Public License
 (LGPL, see COPYING.LESSER file for details) and the provision that
 this notice remains intact. If you modify this file, please
 note section 2 of the LGPLv3 states that:
 .
  a) The work must carry prominent notices stating that you modified
  it, and giving a relevant date.
 .
 This software is distributed "AS IS", with ABSOLUTELY NO WARRANTY.
 See the LGPL for specific language governing rights and limitations.
 .
 On Debian systems, the full text of the GNU Lesser General Public
 License can be found in the file `/usr/share/common-licenses/LGPL'.

Files: m4/*
Copyright: 2004-2005, 2007-2008, 2011-2019, 2021-2024 Free Software Foundation, Inc.
 Written by Gary V. Vaughan and Scott James Remnant, 2004
License: FSFULLR
Note: These files are not used to build the package.

Files: m4/libtool.m4
Copyright: 1996-2001, 2003-2019, 2021-2024 Free SoftwareFoundation, Inc.
 Written by Gordon Matzigkeit, 1996
License: FSFULLR AND GPL-2+ with GNU Libtool exception
Note: This file is not used to build the package.

Files: build/ltmain.sh
Copyright: 1996-2019, 2021-2024 Free Software Foundation, Inc.
 Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996
License: GPL-2+ with GNU Libtool exception

License: FSFULLR
 This file is free software; the Free Software Foundation gives
 unlimited permission to copy and/or distribute it, with or without
 modifications, as long as this notice is preserved.

License: GPL-2+ with GNU Libtool exception
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 .
 GNU Libtool is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 .
 As a special exception to the GNU General Public License, if you
 distribute this file as part of a program or library that is built
 using GNU Libtool, you may include this file under the  same
 distribution terms that you use for the rest of that program.
 .
 GNU Libtool is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 . 
 On Debian systems, the full text of the GNU General Public License
 version 2 can be found in the file `/usr/share/common-licenses/GPL-2'.

Files: INSTALL
Copyright: 1994–1996, 1999–2002, 2004–2017, 2020–2025 Free Software Foundation, Inc.
License: FSFAP
 Copying and distribution of this file, with or without modification,
 are permitted in any medium without royalty provided the copyright
 notice and this notice are preserved.  This file is offered as-is,
 without warranty of any kind.
Note: This file is not used to build the package.

Files: configure
Copyright: Copyright (C) 1992-1996, 1998-2017, 2020-2023 Free Software Foundation, Inc.
License: FSFUL
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
Note: This file is not used to build the package.

Files: debian/* build/install-sh
Copyright: 2016 Ole Streicher <olebole@debian.org>
 Copyright (C) 1994 X Consortium
License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to
 deal in the Software without restriction, including without limitation the
 rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 sell copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
 X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
 AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
 TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 .
 Except as contained in this notice, the name of the X Consortium shall not
 be used in advertising or otherwise to promote the sale, use or other deal-
 ings in this Software without prior written authorization from the X Consor-
 tium.
Note: build/install-sh is not used to build the package.

DFSG Assistant LLM REVIEW 1 blocker, 2 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 21 days ago.

Report◂

DFSG NEW review for giza version 2.0.0-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: No
  • Issues: 1 blocker, 2 important, 3 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

The source is DFSG-free: the library is LGPL-3+ (COPYING.LESSER v3, README.md) and no non-free, no-modification or field-of-use terms were found. debian/copyright is DEP-5 and well structured, but it is not fully accurate: the whole-package short name LGPL means LGPL-2.1 per copyright-format 7.1, the build/ltmain.sh stanza omits the Bootstrap Authors copyright and its MIT licence option, and several generated build files and pkg-config templates carry different notices (GPL with Autoconf exception, or an unlimited-permission grant) that the catch-all LGPL stanza does not describe.

Packaging

The packaging is modern and mostly sound (compat 14, correct dh use, DEP-5 copyright, quilt patches with DEP-3 headers, Multi-Arch: same, salsa CI), but the Fortran module giza.mod that upstream installs is shipped by no package, and the --list-missing override of dh_missing hides this instead of failing the build. One Debian patch contains a real loop bug (for (i == 1; ...)), and libx11-dev, whose headers the X11 driver includes directly, is only a transitive build dependency. No autopkgtests are present.

Issues

blocker licensing 1. Whole-package licence short name LGPL states the wrong version ◂
  • Files: debian/copyright:5-25, COPYING.LESSER:1-3, README.md:111-117
  • Basis: checked, in the package or with a reference tool
  • Evidence: License: LGPL ... On Debian systems, the full text of the GNU Lesser General Public License can be found in the file /usr/share/common-licenses/LGPL. COPYING.LESSER is version 3; README.md says licensed under the GNU Lesser General Public License version 3 or later (LGPL-3.0+).
  • Problem: copyright-format 1.0 section 7.1 defines LGPL as covering LGPL-2.1, LGPL-3.0 or LGPL-2.0 and says that omitting the version implies the lowest one, i.e. LGPL-2.1. debian/copyright therefore states a licence version that does not match the files, and it does not record the or later grant in README.md. The stanza's own prose mentions LGPLv3, contradicting its synopsis.
  • Fix: Use License: LGPL-3+ (the README's grant) and point at /usr/share/common-licenses/LGPL-3; if upstream is read as granting only v3, use LGPL-3 and correct README.md instead.
important licensing 2. build/ltmain.sh stanza omits the Bootstrap Authors copyright and the MIT option ◂
  • Files: debian/copyright:Files: build/ltmain.sh, build/ltmain.sh:75-82, build/ltmain.sh:1539-1544
  • Basis: checked, in the package or with a reference tool
  • Evidence: # Copyright (C) 2004-2019, 2021, 2023-2024 Bootstrap Authors and This file is dual licensed under the terms of the MIT license ..., and GPL version 2 or later. The copyright stanza names only Free Software Foundation, Inc. and License: GPL-2+ with GNU Libtool exception.
  • Problem: The generated ltmain.sh embeds funclib.sh/optlib, whose copyright holder (Bootstrap Authors) and dual MIT option are missing, so the stanza does not describe the file's actual copyright and licensing.
  • Fix: Add the Bootstrap Authors copyright and describe the dual MIT or GPL-2+ with GNU Libtool exception choice, with a stand-alone MIT/Expat text (the file is not built into any binary, so the combination is compatible).
important packaging 3. giza.mod is installed by upstream but shipped in no binary package; dh_missing only lists it ◂
  • Files: src/Makefile.am:21-22, debian/giza-dev.install, debian/rules:12-13
  • Basis: checked, in the package or with a reference tool
  • Evidence: src/Makefile.am: fmoddir = $(libdir)/$(FC)/modules and fmod_DATA = giza.mod. debian/giza-dev.install lists usr/include/*, usr/lib/*/libgiza*.a, usr/lib/*/libgiza.so, usr/lib/*/libpgplot*.a, usr/lib/*/libpgplot.so, usr/lib/*/libcpgplot*.a, usr/lib/*/libcpgplot.so, usr/lib/*/pkgconfig/* — no .mod. debian/rules: dh_missing --list-missing; dh_missing(1): In compat 13 and later, --fail-missing is the default.
  • Problem: giza-dev is the development package and ships the Fortran interface source (giza-fortran.F90) and libpgplot; the compiler-generated module that upstream installs under /usr/lib//gfortran/modules is dropped, so use giza does not work out of the box. Because dh_missing is overridden to --list-missing instead of the compat-14 --fail-missing, the omission is only a warning in the build log and the upload is not stopped.
  • Fix: Add usr/lib/*/gfortran/modules/*.mod to debian/giza-dev.install (or, if the module is deliberately not shipped because .mod files are compiler specific, say so with debian/not-installed and keep --fail-missing so future omissions fail the build).
minor licensing 4. Generated build helpers and pkg-config templates have notices not reflected in debian/copyright ◂
  • Files: aclocal.m4:26-42, build/config.guess:3-26, build/config.sub:1-26, build/compile:6-23, build/depcomp:6-23, build/missing:8-24, build/test-driver:6-21, src/giza.pc.in:3-6, src/cpgplot.pc.in:3-6, src/pgplot.pc.in:3-6
  • Basis: checked, in the package or with a reference tool
  • Evidence: aclocal.m4: Copyright © 2004 Scott James Remnant, Copyright © 2012-2015 Dan Nicholson, GNU General Public License ... either version 2 ... As a special exception ... configuration script generated by Autoconf. build/config.guess: either version 3 ... or any later version ... As a special exception. src/giza.pc.in: as a special exception the author gives unlimited permission to copy and/or distribute it. All of these fall under Files: * with License: LGPL.
  • Problem: The catch-all stanza applies LGPL to files that actually carry GPL-2+/GPL-3+ with the Autoconf exception or an FSFULLR-style unlimited permission, and it does not name Dan Nicholson (aclocal.m4 embeds pkg.m4). The prescan flagged this holder. These files are removed by debian/clean and regenerated by dh_autoreconf, but the source package still contains them and debian/copyright must describe them.
  • Fix: Add stanzas for aclocal.m4 (GPL-2+ with Autoconf exception, Scott James Remnant and Dan Nicholson), build/config.guess build/config.sub (GPL-3+ with Autoconf exception) and build/compile build/depcomp build/missing build/test-driver (GPL-2+ with Autoconf exception), and change the src/*.pc.in coverage to the unlimited-permission grant (the same FSFULLR-style text already defined).
minor packaging 5. X11 retry patch contains for (i == 1; ...) and targets a test that is no longer run ◂
  • Files: debian/patches/Wait-to-initialize-X11-before-first-X11-test.patch, test/C/Makefile.am:17
  • Basis: checked, in the package or with a reference tool
  • Evidence: Added code: int i; for (i == 1; (XW.display == NULL) && (i < 20) ; i++) { sleep(1); ... }. test/C/Makefile.am: TESTS = $(auto_ctests), while test-cairo-xw is only in interactive_ctests/check_PROGRAMS.
  • Problem: i == 1 is a comparison, not an assignment, so i is read uninitialised and the retry loop is undefined; when X is not yet available the intended up-to-19-second retry does not happen. The test it patches is not in TESTS, so it is compiled but never executed by make check, making the patch ineffective for its stated purpose (Closes: #1094102).
  • Fix: Drop the patch as obsolete, or fix it to for (i = 1; ...) and put test-cairo-xw back in TESTS if the retry is still wanted.
minor packaging 6. libx11-dev is used directly but is only a transitive build dependency ◂
  • Files: debian/control:7-14, src/giza-driver-xw.c:33-40, configure.ac:95-108
  • Basis: checked, in the package or with a reference tool
  • Evidence: Build-Depends lists libcairo2-dev but not libx11-dev; giza-driver-xw.c includes <X11/cursorfont.h>, <X11/keysym.h> and <X11/Xutil.h>, and configure.ac builds the /xw driver conditionally on an X11 and cairo-xlib check. apt-cache shows libx11-dev is currently pulled in only as a dependency of libcairo2-dev.
  • Problem: If cairo's dependencies change, or for a build with a different cairo, the X11 driver (the default ? device) would be silently disabled; Policy 4.2 expects the packages directly needed for the build to be listed.
  • Fix: Add libx11-dev to Build-Depends.
Verified ◂
  • Read the whole prescan; covered all 243 files it scanned: every file under debian/ was read, plus COPYING, COPYING.LESSER, README.md, AUTHORS, INSTALL, configure.ac, all Makefile.am files and the licence headers of all src/, test/, scripts/, docs/ and build/ files by grep.
  • Bootstrap Authors (build/ltmain.sh:75,1539) is a real holder of the embedded funclib/optlib code, under a dual MIT/GPL-2+ grant; it is missing from debian/copyright (reported).
  • Dan Nicholson (aclocal.m4:27) holds copyright in the pkg.m4 macro embedded in the generated aclocal.m4; he is missing from debian/copyright (reported).
  • debian/copyright is DEP-5 with the standard Format URL; stanzas for Files: , m4/, m4/libtool.m4, build/ltmain.sh, INSTALL, configure, and debian/*+build/install-sh; no Files-Excluded.
  • No non-free wording found: greps for non-commercial, no-modification, field-of-use, "Good, not Evil", "All rights reserved" and proprietary found only GPL/COPYING prose.
  • src/lex.yy.c is flex 2.6.4 output from src/giza-scanner.l, which is present, so the preferred form for modification is shipped.
  • docs/*.html are generated by scripts/api.pl, scripts/pgplot_status.pl and scripts/cpgplot_status.pl from sources in the tree; docs/documentation/cairo-device.c and gettingstarted.c are the sources for the example pages.
  • docs/title.png, docs/favicon.ico, docs/samples/images/.{jpg,png}, docs/samples/thumbs/, docs/documentation/images/Getting_Started.png and docs/documentation/thumbs/Getting_Started.png are website graphics/sample plots; no third-party attribution exists in the tree and they fall under the package-wide LGPL statement.
  • src/*.pc.in carry an unlimited-permission notice by Daniel Price (reported under the generated-file issue); test/C/test-cpgconb.c-style test files carry only the LGPL notice, which is consistent with Files: *.
  • No .jar, .class, .so, .dll, .exe, .pyc or firmware blobs are present; the only binaries are the documentation images.
  • All five patches were read; they carry From/Date/Subject DEP-3 headers, and the quilt series applies them in order.
  • debian/control uses debhelper-compat (= 14) and Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match); at compat 14 dh_gencontrol supplies the relationship substvars itself, so their presence is not an issue.
  • Build-Depends are otherwise satisfiable: debhelper depends on dh-autoreconf, which pulls autoconf, automake, autopoint and libtool, so the autoreconf sequence (enabled by default from compat 10) can regenerate the files debian/clean removes (configure, Makefile.in, aclocal.m4, build/, m4/).
  • uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.0.2, packaged 2.0.0), which is not a fault of the package.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, LGPL).
Not confirmed ◂
  • src/giza-hershey-to-utf.h owes its Hershey-to-Unicode table to github.com/reinholtz/hershey-fonts-with-unicode (credited in the file) without a stated licence; the table's licensing could not be checked without network access. The file's own header is LGPL by the giza authors.
  • src/giza-contour.c:26 says The guts of this routine were taken from conrec.c as written by Paul Bourke; no copyright or licence notice for that code appears in the file or in debian/copyright, and its terms could not be checked from the package.
  • src/giza-rectangle.c:113 says Adapted from: http://www.mono-project.com/Mono.Cairo_Cookbook; the snippet's licensing could not be checked.
  • Whether giza.mod is intentionally not shipped could not be established from the package; the consequence of the .install/dh_missing configuration was deduced from the files and dh_missing(1), not observed in a build.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.

Review Information

accepted — allocated to awm 13 days ago, started 13 days ago, completed 13 days ago.

Final Comment

Hi,

Please update license from LGPL to specify the version as 'LGPL-3.0+' and other points which the LLM review notes.

Thanks!

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.0.0-1 a966028a… 2026-10-08 02:45 2026-10-08 10:46 eamanu rejected VIEW

Public Notes

13 days ago ● public

Missed Author Check

Command: dfsg-author-check -markdown
Exit code: 1

Author check: giza-2.0.0

Scanned 243 files. Authors declared in debian/copyright: 12.

Not named in debian/copyright (1):

  • Dan Nicholson <dbn.lists@gmail.com>
    • aclocal.m4:27

Possibly named in debian/copyright under a similar name (2):

  • Bootstrap Authors (might be The Authors)
    • build/ltmain.sh:1539
    • build/ltmain.sh:75
  • Daniel Price and James Wetter") (might be Daniel Price <daniel.price@monash.edu>)
    • src/giza-driver-ps.c:89

Result: 1 holder not named in debian/copyright, and 2 possibly named under a similar name

To name them, add to the end of debian/copyright:

Files: aclocal.m4
Copyright: 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
           1996-2025 Free Software
           2004 Scott James Remnant <scott@netsplit.com>
License: LGPL

Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.

Back to Dashboard | View all reviews for this package