DFSG, Licensing & New Packages Team

Hi,

There is some significant variation between the expressed licensing in debian/copyright and the actual licensing so changes will be needed before this is accepted. It is also possible that some files in this version are not freely licensed and may need to be removed or replaced.

1. [important] [licensing] debian/copyright licenses the source as GPL-3+ but file headers say GPL-3.0-only

• Files: debian/copyright:5-8, src/common.rs:7, src/main.rs:7
• Evidence: SPDX-License-Identifier: GPL-3.0-only in every Rust source under src/ (79 occurrences) vs License: GPL-3+ for Files: *. The project is internally inconsistent: config.rs.in is GPL-3.0-or-later, meson.build has license: 'GPL-3.0-or-later', and the appdata has <project_license>GPL-3.0+</project_license>.
• Problem: In DEP-5/SPDX terms GPL-3+ means "version 3 or any later version", but the per-file header grants are version-3-only (GPL-3.0-only). The copyright file overstates the licence grant for nearly all of the source tree, so it does not accurately describe the licensing (Policy 12.5 / copyright-format 7.1).
• Fix: Either set the Files: * License: short name to GPL-3 to match the headers, or get upstream to make the SPDX headers/meson/appdata consistently or-later. Do not leave GPL-3+ while headers say only.

2. [important] [licensing] Third-party files in the tree are described as GPL-3+ by Stéphane Cerveau but are neither

• Files: installer/macos/mac_app_path.sh:1-3, installer/macos/mac_app_pack.sh:29-37, data/css/style.css:1-6, subprojects/packagefiles/gtk/
• Evidence: mac_app_path.sh: SPDX-License-Identifier: GPL-2.0-or-later plus # https://gitlab.com/inkscape/inkscape/-/blob/master/packaging/macos/bash_d/lib_.sh; mac_app_pack.sh copyright block names Thomas Aylott, Mathias Bynens, Andrew Dvorak, Duncan McGreggor, Zuhong Tao (no licence stated); style.css: shamelessly stolen CSS from Pipewire (PipeWire is MIT); subprojects/packagefiles/gtk/*.patch are GTK project patches (LGPL-2.1+).
• Problem: Files: * claims all files are Copyright 2021-2026 Stéphane Cerveau under GPL-3+, but these files carry other copyright holders and other/unknown licences and are never described individually, so the copyright file is incomplete/inaccurate for the shipped source.
• Fix: Add per-file Files: stanzas (e.g. GPL-2+. for mac_app_path.sh with Inkscape attribution, MIT/Expat with PipeWire attribution for style.css, LGPL for the GTK patches), or replace the assets.

3. [important] [licensing] Icon design credited to Freepik/Flaticon but licensed GPL-3+ without evidence

• Files: data/icons/AUTHORS:1-3, data/icons/dev.mooday.GstPipelineStudio.svg:4
• Evidence: Designed by Freepik from Flaticon. + https://www.flaticon.com/premium-icon/pipeline_1191012 / pipeline_1190961; the app icon SVG embeds the raster as a base64 PNG and debian/copyright lists the icons as GPL-3+ by Cerveau.
• Problem: Flaticon "premium" icons are stock assets whose terms restrict redistribution; if the shipped icons (and derived png/ico/icns/bmp banners) are substantially derived from them, claiming GPL-3+ and shipping them in source+binary may be a DFSG problem. Provenance is unconfirmed.
• Fix: Confirm the artwork is original/owned and remove the Flaticon attribution, or replace the icons; otherwise document the actual licence and holder.

4. [important] [packaging] Build-Depends missing gstreamer plugins required by the build-time test suite

• Files: debian/control:10-24, debian/rules:23-24, src/gps/tests/player.rs
• Evidence: rules: execute_after_dh_auto_test: xvfb-run -a ... ./run-tests.sh runs cargo test gps::test -- --test-threads=1; tests call player.create_pipeline("videotestsrc num-buffers=5 ! fakesink") with assert!(result.is_ok()) and .expect("videotestsrc not found") and use audiotestsrc/filesink. videotestsrc/audiotestsrc/filesink ship in gstreamer1.0-plugins-base, which appears only in the binary Depends, not Build-Depends. No Build-Depends pulls the plugin packages in a clean chroot.
• Problem: In a clean build environment the elements are absent, so the tests fail and dh_auto_test fails, i.e. the package does not build from source (Policy 4.5: every third-party package needed to build/test must be in Build-Depends).
• Fix: Add gstreamer1.0-plugins-base to Build-Depends and confirm whether gstreamer1.0-plugins-good is also needed by the tests. (Inferred from the test code; I could not run a build here.)

5. [minor] [packaging] Patch headers lack DEP-3 Description (and Origin)

• Files: debian/patches/meson-Fix-build-for-Debian.patch:1-4, debian/patches/Relax-deps.patch:1-4, debian/patches/Patch-for-tungstenite-0.28.patch:1-4
• Evidence: Headers have From/Date/Subject/Forwarded: not-needed, Debian-specific but no Description:/Origin:.
• Problem: DEP-3 recommends Description and Origin for maintainability; lintian reports patch-missing-description.
• Fix: Add a one-line Description: (and Origin: where a source exists) to each patch header.

Thanks!