Review: hackermail 1.6.8-3

Package Information

Description	mails management tool for hackers collaborating via mailing lists HacKerMaiL (hkml) is a mails management tool for hackers who collaborate using mailing lists. It requires no complicated setup but just git. Using it, you can fetch mailing list archives, read mails in those, and post replies or new mails. It supports public-inbox managed mailing list archives, such as the Linux kernel mailing lists hosted on lore.kernel.org, as well as manually exported mbox files. It also provides helpers for applying patches from mails, tagging, monitoring and formatting patch series.
Maintainer	Han Gao <rabenda.cn@gmail.com>
Changed By	Han Gao <rabenda.cn@gmail.com>
Sponsor	vimer@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/Revy/hackermail.git (browse)
Closes	#1152330
Tracker	https://tracker.debian.org/pkg/hackermail
Uploaded	9 days ago
Supersedes	1.6.8-1

New Package Report

.changes◂

Distribution	unstable
Date	Thu, 29 Oct 2026 18:04:59 +0800
Source	hackermail
Version	1.6.8-3
Changed-By	Han Gao <rabenda.cn@gmail.com>
Architecture	source all

Changelog◂

hackermail (1.6.8-3) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152330)

.dsc◂

Section	mail
Priority	optional
Component	main
Package-List	hackermail deb mail optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: hackermail
Upstream-Contact: SeongJae Park <sj@kernel.org>
Source: https://github.com/sjp38/hackermail

Files: *
Copyright: 2019-2026 SeongJae Park <sj@kernel.org>
           2019-2026 hackermail contributors
License: GPL-2

Files: debian/*
Copyright: 2026 Han Gao <rabenda.cn@gmail.com>
License: GPL-2

License: GPL-2
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License version 2 as
 published by the Free Software Foundation.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General Public License
 version 2 can be found in "/usr/share/common-licenses/GPL-2".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 9 days ago.

Report◂

DFSG NEW review for hackermail version 1.6.8-3

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 1 found

Licensing

debian/copyright is DEP-5 with the correct Format line, a Files: * stanza (2019-2026 SeongJae Park / hackermail contributors, GPL-2), a Files: debian/* stanza (2026 Han Gao, GPL-2) and a standalone GPL-2 text that points at /usr/share/common-licenses/GPL-2. Every Python file under src/ and tests/ and every test/completion shell script carries SPDX-License-Identifier: GPL-2.0, LICENSE is the verbatim GPL-2 text, pyproject.toml declares GPL-2.0-only, so License: GPL-2 (not GPL-2+) is the right short name. No file carries a different licence, no non-free wording exists anywhere in the tree, the only binary blobs are upstream's demo GIF and the generated lore manifest data, both covered by Files: * and neither installed.

Packaging

Packaging is modern and clean: debhelper-compat 13 with dh sequences for python3 and bash-completion, no patches, a hand-written man page, bash completion, autopkgtest with a unit-test script and a superficial version check, DEP-5 copyright, upstream metadata, Rules-Requires-Root: no, and a source-only pip manifest installed as a data file only because hkml version reads it. One small runtime bug: hkml thread always pushes its output through a pager that is neither guarded by a tty check nor by an availability check, while less is only a Recommends.

Issues

minor packaging 1. hkml thread spawns less on a pipe, and dies with a traceback when less (only a Recommends) is not installed ◂

Files: src/hkml_open.py:42-56, src/hkml_list.py:1214-1218, src/hkml_thread.py:69,78, debian/control
Basis: checked, in the package or with a reference tool
Evidence: hkml_open.pr_with_pager_if_needed(): except OSError: / # maybe the user is using pipe to the output / pass … then unconditionally subprocess.call(['less', '-R', '-M', '--no-init', tmp_path]); debian/control: Recommends: git-email, less.
Problem: hkml thread always renders its output through hkml_list.show_list() -> hkml_open.pr_with_pager_if_needed(), which runs less whenever the text is longer than 90% of the terminal. When stdout is not a terminal os.get_terminal_size() raises OSError, the exception is swallowed, and less is started anyway, so hkml thread <id> | grep ... launches an interactive pager on the pipe instead of writing the thread to it. On an installation without Recommends (--no-install-recommends, or a resolver that drops them) subprocess.call(['less', ...]) raises FileNotFoundError and the user sees a Python traceback instead of the thread. Policy 7.2 says Depends should be used when the package is required for a significant amount of functionality, otherwise the program must cope without it.
Fix: Call the pager only when sys.stdout.isatty() (and only if _hkml_subproc.cmd_available('less')), otherwise print(text); or move less to Depends.

Verified ◂

Read every file in debian/ except debian/watch (control, rules, changelog, copyright, gbp.conf, clean, .install/.docs/.links/.manpages/*.bash-completion, hkml.1, source/format, source/lintian-overrides, tests/control, tests/unittests, upstream/metadata) and the .dsc.
Script files: all 34 src/.py, all 10 tests/.py, scripts/hkml-completion.sh and scripts/__summary_mm_commits.py have # SPDX-License-Identifier: GPL-2.0. scripts/mm_commits_changes.sh and scripts/update_lore_manifest.sh have no notice and are covered by Files: *.
LICENSE is the complete, unmodified GPL-2 text (339 lines, GNU GENERAL PUBLIC LICENSE Version 2, June 1991); the or any later version sentence near its end belongs to GPL-2's own 'How to Apply These Terms' appendix and is not an upstream grant. pyproject.toml: license = "GPL-2.0-only", matching License: GPL-2.
manifests/lore.js (the scan's 'minified code'): JSON data, not JavaScript — one line of {"/linux-coco/git/0.git": {"description": ..., "fingerprint": ..., "modified": ...}, ...}. It is produced by scripts/update_lore_manifest.sh from https://lore.kernel.org/manifest.js.gz via hkml manifest convert_public_inbox_manifest, needs no preferred-from source beyond that script (it is data, not code), and is not installed: debian/hackermail.install ships only pyproject.toml and src/*.py. The package's own lintian override documents it.
images/hkml_interactive_list_demo.gif: 3.2 MB screen recording of the tool, referenced from README.md's Demo section; upstream's own work, covered by Files: *, not installed in the binary. No other images, fonts, sounds or prebuilt files exist in the tree.
Read the remaining upstream files (README.md, USAGE.md, CONTRIBUTING, TODO, release_note, .coveragerc, .gitignore, .github/workflows/ci.yml, root hkml launcher); none carries a copyright, licence or 'all rights reserved' notice that contradicts Files: *, and a tree-wide grep for non-commercial/no-modification/field-of-use wording found nothing.
Copyright holder check agrees with the prescan: SeongJae Park and Han Gao are named, 'hackermail contributors' covers the rest; no third-party holder appears in any file.
Man page's reference to /usr/share/doc/hackermail/USAGE.md.gz is correct: dh_compress's find expression compresses files over 4 KB under usr/share/doc and does not exclude .md (checked /usr/bin/dh_compress and dh_compress(1)); README.md is under 4 KB and stays uncompressed, and nothing references it.
The binary does get a python3 dependency: dh_python3 treats /usr/share/ as a private directory and adds python3:any for .py files found there (read /usr/share/dh-python/dhpython/fs.py and depends.py).
Build-Depends resolve on the reviewing system: dh-sequence-bash-completion is provided by bash-completion 1:2.16.0-8, dh-sequence-python3 by dh-python 7.20261025 (apt-cache).
Tests need nothing beyond the stdlib: the only subprocess use is mocked (test_hkml_sync.py patches hkml_sync.subprocess.call), so no git/curl/network is needed at build time or in autopkgtest.
Packaging layout checked: /usr/bin/hkml -> usr/share/hackermail/src/hkml.py via .links, modules in /usr/share/hackermail/src, pyproject.toml in /usr/share/hackermail for hkml version to read, USAGE.md.gz + README.md in /usr/share/doc, release_note as upstream changelog via override_dh_installchangelogs, completion in /usr/share/bash-completion/completions/hkml.
uscan found the packaged version as the newest upstream release (upstream 1.6.8, packaged 1.6.8).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed ◂

No build or run was possible: whether the installed /usr/bin/hkml symlink yields a sys.path[0] that lets hkml import the sibling modules in /usr/share/hackermail/src was not exercised (upstream ships the same symlink arrangement, and debian/tests/control's hkml version check would fail loudly if it did not).
The 3.2 MB images/hkml_interactive_list_demo.gif was not opened (binary); judged from README.md, which shows it as the demo recording.

Proposed changes ◂

None.

Uploader's response to the LLM review

Thank you for reviewing this package again.

— vimerbf (vimer), 9 days ago

Review Information

accepted — allocated to mechtilde 5 days ago, started 5 days ago, completed 5 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.6.8-1	65e27dc2…	2026-11-02 16:16	2026-11-02 16:16	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package