DFSG NEW review for hackermail version 1.6.8-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

All upstream code carries SPDX GPL-2.0 headers, LICENSE is the verbatim GPL-2 text, and pyproject.toml declares GPL-2.0-only, matching the License: GPL-2 in debian/copyright (version 2 only, no "or later"). The DEP-5 copyright file names SeongJae Park, the hackermail contributors and Han Gao for debian/*, and the scan found no holder it does not name. No non-free or extra licence terms exist anywhere in the tree; the generated manifests/lore.js and the demo GIF are covered and their provenance is documented.

Packaging

The package is otherwise clean and conventional: one arch:all binary, compat 13, dh sequences for python3 and bash completion, quilt format with no patches, an installed man page, bash completion, /usr/bin/hkml symlink, upstream changelog installed, and autopkgtests exercising the unit tests and the version output. However it misses a runtime dependency: hkml init (the documented first-run step, also triggered from any command when .hkm is absent) calls wget, which nothing in Depends provides. It also fails to declare upstream's requests dependency, leaving the documented sashiko.dev feature non-functional.

Issues

1. [important] [packaging] Depends lacks wget, which hkml init requires and every first run triggers

• Files: debian/control, src/hkml_manifest.py:49-61, src/hkml_init.py:48, src/hkml_list.py:1122, src/_hkml.py:435-445
• Basis: checked, in the package or with a reference tool
• Evidence: debian/control: Depends: ${misc:Depends}, ${python3:Depends}, curl, git; hkml_manifest.py: if not _hkml_subproc.cmd_available('wget'): return 'wget is unavailable' and subprocess.call(['wget', 'https://lore.kernel.org/manifest.js.gz']); hkml_init.py: err = hkml_manifest.fetch_lore(); hkml_list.py:1122 also calls wget for hkml thread <msgid>.
• Problem: Policy 7.2: Depends should be used for packages required for a significant amount of functionality. hkml init is the documented first step and is also invoked by _hkml.set_hkml_dir() when any command runs without a .hkm directory; without wget it aborts with 'Fetching lore manifest failed (wget is unavailable)'. curl is depended on but does not install wget, and wget is only Priority: standard (not Essential), so a minimal installation can reach this state. The same call powers fetching a thread from the web.
• Fix: Add wget to the binary package's Depends (or change the calls in hkml_manifest.py and hkml_list.py to use curl, which is already a dependency).

2. [minor] [packaging] Upstream's python3-requests dependency is not declared, so the documented sashiko.dev feature is dead

• Files: debian/control, pyproject.toml, src/_hkml_sashiko_dev.py:9-13, USAGE.md:894
• Basis: checked, in the package or with a reference tool
• Evidence: pyproject.toml: dependencies = ["requests"]; _hkml_sashiko_dev.py: try: import requests ... except: pass, then return None, 'requests python module import fail'; USAGE.md documents hkml patch sashiko_dev.
• Problem: The sashiko.dev review and forwarding commands are documented and exposed in the interactive menu, but the package ships no dependency (not even Suggests) on python3-requests, so they always fail at runtime with 'requests python module import fail' on a normal installation. dh_python3 does not translate project.dependencies from pyproject.toml, so nothing pulls it in automatically.
• Fix: Add python3-requests to Suggests (or Recommends, if the feature is considered strongly expected) in debian/control.

Verified

• Read every file under debian/ in full, apart from debian/watch (out of scope) and the binary PGP key. No debian/patches directory; source format 3.0 (quilt).
• All 39 upstream Python files under src/ and scripts/ carry # SPDX-License-Identifier: GPL-2.0; LICENSE is the full GPL-2 text of June 1991 with no 'or later' clause, and pyproject.toml declares license = "GPL-2.0-only", so the copyright file's License: GPL-2 is correct.
• debian/copyright is DEP-5: Files: * (SeongJae Park, hackermail contributors, GPL-2) followed by Files: debian/* (Han Gao, GPL-2), with a stand-alone License: GPL-2 paragraph pointing at /usr/share/common-licenses/GPL-2. The prescan's holder check found every holder named.
• Grep of the whole upstream tree for GPL-3, LGPL, MIT, BSD, Apache, MPL, public domain, CC-BY, non-commercial and all-rights-reserved wording found no hits: no other licence, no non-free terms.
• manifests/lore.js is the scan's 'minified code' hit: a single-line JSON manifest of public-inbox mailing lists, generated from https://lore.kernel.org/manifest.js.gz by scripts/update_lore_manifest.sh (and documented in debian/source/lintian-overrides). It contains no code or licence text, its source is regenerable with the shipped script, and it is not installed in the binary package.
• images/hkml_interactive_list_demo.gif is a 3.2 MB demo animation referenced from README.md, upstream-authored and covered by the Files: * stanza; not opened (binary).
• Test fixtures in tests/test_hkml_view_text.py and tests/test_hkml_view_mails.py quote Linux kernel code and MAINTAINERS data, which are GPL-2 and compatible.
• src/hkml_version.py reads pyproject.toml; pyproject.toml is installed to /usr/share/hackermail/, so hkml version prints 1.6.8 and the debian/tests/control Test-Command comparing it with ${source:Upstream-Version} is consistent with the package contents.
• Read /usr/bin/dh_python3 and /usr/share/dh-python/dhpython/depends.py: dh_python3 scans the private dir /usr/share/hackermail, byte-compiles its files in postinst and adds python3:any to ${python3:Depends} from the #!/usr/bin/env python3 shebang, so the missing explicit python3 dependency is not a fault.
• dh_compress compresses files in usr/share/doc larger than 4 KB, so the man page's reference to /usr/share/doc/hackermail/USAGE.md.gz matches the installed documentation; README.md (2.7 KB) stays uncompressed and is not referenced as .gz.
• dh_bash-completion's list format (source name) matches debian/hackermail.bash-completion, installing scripts/hkml-completion.sh as completions/hkml; both dh-sequence Build-Depends exist (provided by bash-completion and dh-python).
• debian/tests/unittests runs with cwd at the source root per the autopkgtest specification, so its cp -a tests works; it links the installed /usr/share/hackermail/src and the tests import from ../src. The version test uses Test-Command correctly.
• Packaging checks: Standards-Version 4.7.4 against Policy 4.7.4.1 is current; changelog version 1.6.8-1, distribution unstable, closes the ITP; the upstream release_note is installed as the upstream changelog; the installed man page (debian/hkml.1), symlink /usr/bin/hkml -> /usr/share/hackermail/src/hkml.py, and debian/clean (src/pycache/) are consistent with how dh_install and dh_python3 work.
• uscan found the packaged version as the newest upstream release (upstream 1.6.8, packaged 1.6.8).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• File permission bits could not be inspected with the available tools; executing /usr/bin/hkml (a symlink to /usr/share/hackermail/src/hkml.py) requires that source file to be executable. Upstream's own README runs ./hkml as a symlink to the same file, so it is most likely 0755 in the tarball.

Proposed changes

None.