Review: giza 2.0.0-1
Package Information
| Description | Lightweight scientific plotting library (development files) Giza is a lightweight scientific plotting library built on top of cairo that provides uniform output to multiple devices. Giza also provides a mostly compatible, modern replacement for the PGPLOT graphics library. This package contains the development files. |
|---|---|
| Maintainer | Debian Astro Team <debian-astro-maintainers@lists.alioth.debian.org> |
| Changed By | Ole Streicher <olebole@debian.org> |
| Sponsor | olebole@debian.org |
| Distribution | experimental |
| Architecture | any |
| VCS | git: https://salsa.debian.org/debian-astro-team/giza.git (browse) |
| Popcon Installs | 604 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/giza |
| Uploaded | 30 days ago |
New Package Report
.changes
| Date | Thu, 08 Oct 2026 18:05:12 +0200 |
|---|---|
| Source | giza |
| Version | 2.0.0-1 |
| Changed-By | Ole Streicher <olebole@debian.org> |
| Architecture | source amd64 |
| Distribution | experimental |
Changelog
giza (2.0.0-1) experimental; urgency=medium
.
* New upstream version 2.0.0
* Rediff patches. Drop patches that are no longer required
* Push Standards-Version to 4.7.4, debhelper compat to 14;
no changes required
* Link Fortran tests against libgiza explicitly
* New packages because new SOVERSION 2. Switch to experimental
to prepare transition
* Don't use rpath
* Create temporary homedir
* Fix FTBFS on i386
* Update/complete d/copyright.dsc
| Section | libdevel |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | giza-dev deb libdevel optional arch=any libcpgplot2 deb libs optional arch=any libgiza2 deb libs optional arch=any libpgplot2 deb libs optional arch=any |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: giza Source: https://github.com/danieljprice/giza Files: * Copyright: 2010-2015 The Authors Daniel Price <daniel.price@monash.edu> James Wetter <wetter.j@gmail.com> Joachim Frieben <jfrieben@hotmail.com> 1989-2015 Free Software Foundation, Inc 2026 Shugo Suwazono License: LGPL This library is free software; and you are welcome to redistribute it under the terms of the GNU Lesser General Public License (LGPL, see COPYING.LESSER file for details) and the provision that this notice remains intact. If you modify this file, please note section 2 of the LGPLv3 states that: . a) The work must carry prominent notices stating that you modified it, and giving a relevant date. . This software is distributed "AS IS", with ABSOLUTELY NO WARRANTY. See the LGPL for specific language governing rights and limitations. . On Debian systems, the full text of the GNU Lesser General Public License can be found in the file `/usr/share/common-licenses/LGPL'. Files: m4/* Copyright: 2004-2005, 2007-2008, 2011-2019, 2021-2024 Free Software Foundation, Inc. Written by Gary V. Vaughan and Scott James Remnant, 2004 License: FSFULLR Note: These files are not used to build the package. Files: m4/libtool.m4 Copyright: 1996-2001, 2003-2019, 2021-2024 Free SoftwareFoundation, Inc. Written by Gordon Matzigkeit, 1996 License: FSFULLR AND GPL-2+ with GNU Libtool exception Note: This file is not used to build the package. Files: build/ltmain.sh Copyright: 1996-2019, 2021-2024 Free Software Foundation, Inc. Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996 License: GPL-2+ with GNU Libtool exception License: FSFULLR This file is free software; the Free Software Foundation gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved. License: GPL-2+ with GNU Libtool exception This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. . GNU Libtool is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. . As a special exception to the GNU General Public License, if you distribute this file as part of a program or library that is built using GNU Libtool, you may include this file under the same distribution terms that you use for the rest of that program. . GNU Libtool is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. . On Debian systems, the full text of the GNU General Public License version 2 can be found in the file `/usr/share/common-licenses/GPL-2'. Files: INSTALL Copyright: 1994–1996, 1999–2002, 2004–2017, 2020–2025 Free Software Foundation, Inc. License: FSFAP Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without warranty of any kind. Note: This file is not used to build the package. Files: configure Copyright: Copyright (C) 1992-1996, 1998-2017, 2020-2023 Free Software Foundation, Inc. License: FSFUL This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. Note: This file is not used to build the package. Files: debian/* build/install-sh Copyright: 2016 Ole Streicher <olebole@debian.org> Copyright (C) 1994 X Consortium License: Expat Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: . The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC- TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. . Except as contained in this notice, the name of the X Consortium shall not be used in advertising or otherwise to promote the sale, use or other deal- ings in this Software without prior written authorization from the X Consor- tium. Note: build/install-sh is not used to build the package.
DFSG Assistant LLM REVIEW 1 blocker, 2 important, 3 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 21 days ago.
Report
DFSG NEW review for giza version 2.0.0-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: No
- Issues: 1 blocker, 2 important, 3 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The source is DFSG-free: the library is LGPL-3+ (COPYING.LESSER v3, README.md) and no non-free, no-modification or field-of-use terms were found. debian/copyright is DEP-5 and well structured, but it is not fully accurate: the whole-package short name LGPL means LGPL-2.1 per copyright-format 7.1, the build/ltmain.sh stanza omits the Bootstrap Authors copyright and its MIT licence option, and several generated build files and pkg-config templates carry different notices (GPL with Autoconf exception, or an unlimited-permission grant) that the catch-all LGPL stanza does not describe.
Packaging
The packaging is modern and mostly sound (compat 14, correct dh use, DEP-5 copyright, quilt patches with DEP-3 headers, Multi-Arch: same, salsa CI), but the Fortran module giza.mod that upstream installs is shipped by no package, and the --list-missing override of dh_missing hides this instead of failing the build. One Debian patch contains a real loop bug (for (i == 1; ...)), and libx11-dev, whose headers the X11 driver includes directly, is only a transitive build dependency. No autopkgtests are present.
Issues
blocker
licensing
1. Whole-package licence short name LGPL states the wrong version
◂
- Files:
debian/copyright:5-25,COPYING.LESSER:1-3,README.md:111-117 - Basis: checked, in the package or with a reference tool
- Evidence:
License: LGPL...On Debian systems, the full text of the GNU Lesser General Public License can be found in the file /usr/share/common-licenses/LGPL. COPYING.LESSER is version 3; README.md sayslicensed under the GNU Lesser General Public License version 3 or later (LGPL-3.0+). - Problem: copyright-format 1.0 section 7.1 defines
LGPLas covering LGPL-2.1, LGPL-3.0 or LGPL-2.0 and says that omitting the version implies the lowest one, i.e. LGPL-2.1. debian/copyright therefore states a licence version that does not match the files, and it does not record theor latergrant in README.md. The stanza's own prose mentionsLGPLv3, contradicting its synopsis. - Fix: Use
License: LGPL-3+(the README's grant) and point at/usr/share/common-licenses/LGPL-3; if upstream is read as granting only v3, useLGPL-3and correct README.md instead.
important licensing 2. build/ltmain.sh stanza omits the Bootstrap Authors copyright and the MIT option ◂
- Files:
debian/copyright:Files: build/ltmain.sh,build/ltmain.sh:75-82,build/ltmain.sh:1539-1544 - Basis: checked, in the package or with a reference tool
- Evidence:
# Copyright (C) 2004-2019, 2021, 2023-2024 Bootstrap AuthorsandThis file is dual licensed under the terms of the MIT license ..., and GPL version 2 or later. The copyright stanza names onlyFree Software Foundation, Inc.andLicense: GPL-2+ with GNU Libtool exception. - Problem: The generated ltmain.sh embeds funclib.sh/optlib, whose copyright holder (Bootstrap Authors) and dual MIT option are missing, so the stanza does not describe the file's actual copyright and licensing.
- Fix: Add the Bootstrap Authors copyright and describe the dual
MIT or GPL-2+ with GNU Libtool exceptionchoice, with a stand-alone MIT/Expat text (the file is not built into any binary, so the combination is compatible).
important packaging 3. giza.mod is installed by upstream but shipped in no binary package; dh_missing only lists it ◂
- Files:
src/Makefile.am:21-22,debian/giza-dev.install,debian/rules:12-13 - Basis: checked, in the package or with a reference tool
- Evidence: src/Makefile.am:
fmoddir = $(libdir)/$(FC)/modulesandfmod_DATA = giza.mod. debian/giza-dev.install listsusr/include/*,usr/lib/*/libgiza*.a,usr/lib/*/libgiza.so,usr/lib/*/libpgplot*.a,usr/lib/*/libpgplot.so,usr/lib/*/libcpgplot*.a,usr/lib/*/libcpgplot.so,usr/lib/*/pkgconfig/*— no.mod. debian/rules:dh_missing --list-missing; dh_missing(1):In compat 13 and later, --fail-missing is the default. - Problem: giza-dev is the development package and ships the Fortran interface source (giza-fortran.F90) and libpgplot; the compiler-generated module that upstream installs under /usr/lib//gfortran/modules is dropped, so
use gizadoes not work out of the box. Because dh_missing is overridden to --list-missing instead of the compat-14 --fail-missing, the omission is only a warning in the build log and the upload is not stopped. - Fix: Add
usr/lib/*/gfortran/modules/*.modto debian/giza-dev.install (or, if the module is deliberately not shipped because .mod files are compiler specific, say so with debian/not-installed and keep --fail-missing so future omissions fail the build).
minor licensing 4. Generated build helpers and pkg-config templates have notices not reflected in debian/copyright ◂
- Files:
aclocal.m4:26-42,build/config.guess:3-26,build/config.sub:1-26,build/compile:6-23,build/depcomp:6-23,build/missing:8-24,build/test-driver:6-21,src/giza.pc.in:3-6,src/cpgplot.pc.in:3-6,src/pgplot.pc.in:3-6 - Basis: checked, in the package or with a reference tool
- Evidence: aclocal.m4:
Copyright © 2004 Scott James Remnant,Copyright © 2012-2015 Dan Nicholson,GNU General Public License ... either version 2 ... As a special exception ... configuration script generated by Autoconf. build/config.guess:either version 3 ... or any later version ... As a special exception. src/giza.pc.in:as a special exception the author gives unlimited permission to copy and/or distribute it. All of these fall underFiles: *withLicense: LGPL. - Problem: The catch-all stanza applies LGPL to files that actually carry GPL-2+/GPL-3+ with the Autoconf exception or an FSFULLR-style unlimited permission, and it does not name Dan Nicholson (aclocal.m4 embeds pkg.m4). The prescan flagged this holder. These files are removed by debian/clean and regenerated by dh_autoreconf, but the source package still contains them and debian/copyright must describe them.
- Fix: Add stanzas for
aclocal.m4(GPL-2+ with Autoconf exception, Scott James Remnant and Dan Nicholson),build/config.guess build/config.sub(GPL-3+ with Autoconf exception) andbuild/compile build/depcomp build/missing build/test-driver(GPL-2+ with Autoconf exception), and change thesrc/*.pc.incoverage to the unlimited-permission grant (the same FSFULLR-style text already defined).
minor
packaging
5. X11 retry patch contains for (i == 1; ...) and targets a test that is no longer run
◂
- Files:
debian/patches/Wait-to-initialize-X11-before-first-X11-test.patch,test/C/Makefile.am:17 - Basis: checked, in the package or with a reference tool
- Evidence: Added code:
int i; for (i == 1; (XW.display == NULL) && (i < 20) ; i++) { sleep(1); ... }. test/C/Makefile.am:TESTS = $(auto_ctests), while test-cairo-xw is only ininteractive_ctests/check_PROGRAMS. - Problem:
i == 1is a comparison, not an assignment, soiis read uninitialised and the retry loop is undefined; when X is not yet available the intended up-to-19-second retry does not happen. The test it patches is not in TESTS, so it is compiled but never executed bymake check, making the patch ineffective for its stated purpose (Closes: #1094102). - Fix: Drop the patch as obsolete, or fix it to
for (i = 1; ...)and put test-cairo-xw back in TESTS if the retry is still wanted.
minor packaging 6. libx11-dev is used directly but is only a transitive build dependency ◂
- Files:
debian/control:7-14,src/giza-driver-xw.c:33-40,configure.ac:95-108 - Basis: checked, in the package or with a reference tool
- Evidence: Build-Depends lists
libcairo2-devbut notlibx11-dev; giza-driver-xw.c includes<X11/cursorfont.h>,<X11/keysym.h>and<X11/Xutil.h>, and configure.ac builds the /xw driver conditionally on an X11 and cairo-xlib check. apt-cache shows libx11-dev is currently pulled in only as a dependency of libcairo2-dev. - Problem: If cairo's dependencies change, or for a build with a different cairo, the X11 driver (the default
?device) would be silently disabled; Policy 4.2 expects the packages directly needed for the build to be listed. - Fix: Add
libx11-devto Build-Depends.
Verified ◂
- Read the whole prescan; covered all 243 files it scanned: every file under debian/ was read, plus COPYING, COPYING.LESSER, README.md, AUTHORS, INSTALL, configure.ac, all Makefile.am files and the licence headers of all src/, test/, scripts/, docs/ and build/ files by grep.
Bootstrap Authors(build/ltmain.sh:75,1539) is a real holder of the embedded funclib/optlib code, under a dual MIT/GPL-2+ grant; it is missing from debian/copyright (reported).Dan Nicholson(aclocal.m4:27) holds copyright in the pkg.m4 macro embedded in the generated aclocal.m4; he is missing from debian/copyright (reported).- debian/copyright is DEP-5 with the standard Format URL; stanzas for Files: , m4/, m4/libtool.m4, build/ltmain.sh, INSTALL, configure, and debian/*+build/install-sh; no Files-Excluded.
- No non-free wording found: greps for non-commercial, no-modification, field-of-use, "Good, not Evil", "All rights reserved" and proprietary found only GPL/COPYING prose.
- src/lex.yy.c is flex 2.6.4 output from src/giza-scanner.l, which is present, so the preferred form for modification is shipped.
- docs/*.html are generated by scripts/api.pl, scripts/pgplot_status.pl and scripts/cpgplot_status.pl from sources in the tree; docs/documentation/cairo-device.c and gettingstarted.c are the sources for the example pages.
- docs/title.png, docs/favicon.ico, docs/samples/images/.{jpg,png}, docs/samples/thumbs/, docs/documentation/images/Getting_Started.png and docs/documentation/thumbs/Getting_Started.png are website graphics/sample plots; no third-party attribution exists in the tree and they fall under the package-wide LGPL statement.
- src/*.pc.in carry an unlimited-permission notice by Daniel Price (reported under the generated-file issue); test/C/test-cpgconb.c-style test files carry only the LGPL notice, which is consistent with Files: *.
- No .jar, .class, .so, .dll, .exe, .pyc or firmware blobs are present; the only binaries are the documentation images.
- All five patches were read; they carry From/Date/Subject DEP-3 headers, and the quilt series applies them in order.
- debian/control uses debhelper-compat (= 14) and Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match); at compat 14 dh_gencontrol supplies the relationship substvars itself, so their presence is not an issue.
- Build-Depends are otherwise satisfiable: debhelper depends on dh-autoreconf, which pulls autoconf, automake, autopoint and libtool, so the autoreconf sequence (enabled by default from compat 10) can regenerate the files debian/clean removes (configure, Makefile.in, aclocal.m4, build/, m4/).
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream2.0.2, packaged2.0.0), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (GPL-2,LGPL).
Not confirmed ◂
- src/giza-hershey-to-utf.h owes its Hershey-to-Unicode table to github.com/reinholtz/hershey-fonts-with-unicode (credited in the file) without a stated licence; the table's licensing could not be checked without network access. The file's own header is LGPL by the giza authors.
- src/giza-contour.c:26 says
The guts of this routine were taken from conrec.c as written by Paul Bourke; no copyright or licence notice for that code appears in the file or in debian/copyright, and its terms could not be checked from the package. - src/giza-rectangle.c:113 says
Adapted from: http://www.mono-project.com/Mono.Cairo_Cookbook; the snippet's licensing could not be checked. - Whether giza.mod is intentionally not shipped could not be established from the package; the consequence of the .install/dh_missing configuration was deduced from the files and dh_missing(1), not observed in a build.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.
Review Information
accepted — allocated to awm 13 days ago, started 13 days ago, completed 13 days ago.
Final Comment
Hi,
Please update license from LGPL to specify the version as 'LGPL-3.0+' and other points which the LLM review notes.
Thanks!
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 2.0.0-1 | a966028a… | 2026-10-08 02:45 | 2026-10-08 10:46 | eamanu | rejected | VIEW |
Public Notes
Missed Author Check
Command: dfsg-author-check -markdown
Exit code: 1
Author check: giza-2.0.0
Scanned 243 files. Authors declared in debian/copyright: 12.
Not named in debian/copyright (1):
- Dan Nicholson <dbn.lists@gmail.com>
aclocal.m4:27
Possibly named in debian/copyright under a similar name (2):
- Bootstrap Authors (might be The Authors)
build/ltmain.sh:1539build/ltmain.sh:75
- Daniel Price and James Wetter") (might be Daniel Price <daniel.price@monash.edu>)
src/giza-driver-ps.c:89
Result: 1 holder not named in debian/copyright, and 2 possibly named under a similar name
To name them, add to the end of debian/copyright:
Files: aclocal.m4
Copyright: 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
1996-2025 Free Software
2004 Scott James Remnant <scott@netsplit.com>
License: LGPL
Each paragraph names every holder found in its files, with the years their copyright lines give, and has the License of the paragraph that covers them now, which it takes the place of for them. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.