hmmer 3.4+dfsg2-1

Package Information

Description	profile hidden Markov models for protein sequence analysis HMMER is an implementation of profile hidden Markov model methods for sensitive searches of biological sequence databases using multiple sequence alignments as queries. Given a multiple sequence alignment as input, HMMER builds a statistical model called a "hidden Markov model" which can then be used as a query into a sequence database to find (and/or align) additional homologues of the sequence family.
Maintainer	Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed By	Andreas Tille <tille@debian.org>
Sponsor	tille@debian.org
Distribution	experimental
Architecture	any all
VCS	git: https://salsa.debian.org/med-team/hmmer.git (browse)
Popcon Installs	364
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/hmmer
Uploaded	2 hours ago

New Package Report

.changes◂

Distribution	experimental
Date	Thu, 12 Nov 2026 09:04:15 +0100
Source	hmmer
Version	3.4+dfsg2-1
Changed-By	Andreas Tille <tille@debian.org>
Architecture	source amd64 all

Changelog◂

hmmer (3.4+dfsg2-1) experimental; urgency=medium
 .
   * d/copyright: Point Source to Github
   * d/watch:
      - Version=5
      - Fix by pointing to Github
   * Standards-Version: 4.7.4 (routine-update)
   * Reflow Uploaders field (cme)
   * Remove Priority field (cme)
   * Reformat the Last-Update date as ISO YYYY-MM-DD.
   * Replace FSF postal address with a reference to
     https://www.gnu.org/licenses/.
   * Use secure URI in Homepage field.
   * debputy lint --auto-fix (routine-update)
   * Remove easel from upstream source and build against libeasel-dev
     instead
   * Export internal HMMER functions used by pyhmmer
   * Build against the separately packaged Easel library
   * Build shared and static libhmmer libraries with d-shlibs
   * Update the autopkgtest to the packaged libraries
   * Update d/copyright, add d/lrc.control
   * Drop outdated debian/README.Debian

.dsc◂

Package-List	hmmer deb science optional arch=any-amd64,any-i386,arm64,powerpc,ppc64,x32 hmmer-doc deb doc optional arch=all hmmer-examples deb doc optional arch=any libhmmer-dev deb libdevel optional arch=any libhmmer3 deb libs optional arch=any
Section	science
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: HMMER
Upstream-Contact: Sean R. Eddy <eddys@janelia.hhmi.org>
Source: https://github.com/EddyRivasLab/hmmer
Files-Excluded: */libdivsufsort
                */.gitignore

Files: *
Copyright: 1992-2023 Sean R. Eddy <eddy@genetics.wustl.edu>
           2015-2023 President and Fellows of Harvard College
           2000-2023 Howard Hughes Medical Institute
           1995-2006 Washington University School of Medicine
           1992-1995 MRC Laboratory of Molecular Biology
License: BSD-3-Clause

Files: documentation/userguide/unsrtnat-brief.bst
Copyright: 1993-2007 Patrick W Daly
License: LPPL
 This program can be redistributed and/or modified under the terms
 of the LaTeX Project Public License Distributed from CTAN
 archives in directory macros/latex/base/lppl.txt; either
 version 1 of the License, or any later version.

Files: debian/*
Copyright: 1998 John Lapeyre <lapeyre@physics.arizona.edu>
           1999-2001 Matthew Vernon <matthew@debian.org>
           2006-2007 Nelson A. de Oliveira <naoliv@gmail.com>
           2008-2012 Charles Plessy <plessy@debian.org>
           2010 Eric Talevich <etal@uga.edu>,
           2010 Steffen Möller <moeller@debian.org>
           2012-2026 Andreas Tille <tille@debian.org>
License: BSD-3-Clause

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 .
  1. Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
 .
  2. Redistributions in binary form must reproduce the above
     copyright notice, this list of conditions and the following
     disclaimer in the documentation and/or other materials provided
     with the distribution.
 .
  3. Neither the name of any copyright holder nor the names of
     contributors may be used to endorse or promote products derived
     from this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 3 blocker, 2 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for hmmer version 3.4+dfsg2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 3 blocker, 2 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 24 found

Licensing

The bulk of the tree is BSD-3-Clause and matches LICENSE and the holders that debian/copyright names, but the tree is not DFSG-free as a whole: tutorial/7LESS_DROME is distributed under CC-BY-ND, which fails DFSG 3. debian/copyright (DEP-5, correct Format URL) is also inaccurate for several files: the vendored Tufte-LaTeX class files have no licence statement anywhere and are wrongly covered by Files: *, install-sh is MIT/X11 rather than the BSD-3-Clause that Files: * claims, the LPPL stanza has no licence text and no version, and the FSF and X Consortium copyrights are not named. The bibliography style under LPPL is DFSG-free because 'version 1 or any later version' permits 1.3c, and the PDF/Illustrator documents and testsuite index files have their sources in the package.

Packaging

Otherwise solid: debhelper compat 14 with the usual dh targets and hardening, a d-shlibs-built shared library beside the static one, DEP-3 patches, an autopkgtest and salsa-ci with a nocheck build-profile job. It is not ready, though, because libhmmer3, libhmmer-dev and hmmer-examples are Architecture: any while upstream's configure aborts without SSE, NEON or VMX, so the source will FTBFS on riscv64, s390x, ppc64el and others; the hmmer binary's architecture list does not constrain the build. Minor: hmmer-doc's doc-base entry points into the wrong package's doc directory and advertises version 2.3.2, and Files-Excluded does not mention the easel tree the +dfsg2 changelog says was removed.

Issues

blocker licensing 1. tutorial/7LESS_DROME is distributed under CC-BY-ND, a non-free licence ◂

Files: tutorial/7LESS_DROME:127-128, debian/hmmer-doc.docs:2, debian/rules (execute_after_dh_installexamples)
Basis: checked, in the package or with a reference tool
Evidence: CC Copyrighted by the UniProt Consortium, see https://www.uniprot.org/terms / CC Distributed under the Creative Commons Attribution-NoDerivs License
Problem: CC-BY-ND forbids distributing modified versions, so the file fails DFSG 3 and cannot be in main. It is shipped: debian/hmmer-doc.docs installs tutorial/, and debian/rules copies tutorial/ into hmmer-examples as well. debian/copyright has no stanza for it and names neither the UniProt Consortium nor CC-BY-ND; its content also feeds documentation/userguide inclusion outputs and the built Userguide.pdf.
Fix: Remove the entry from the source (new repack, tutorial/7LESS_DROME in Files-Excluded) and replace it with a freely licensed sequence, adjusting tutorial.tex and the inclusion outputs, or obtain permission from UniProt; document the resulting file in debian/copyright.

blocker licensing 2. Vendored Tufte-LaTeX class files have no licence and are wrongly covered by Files: * ◂

Files: documentation/userguide/tufte-book.cls:3, documentation/userguide/tufte-common.def:5, documentation/userguide/install.tex:369-371, debian/copyright:8-14
Basis: checked, in the package or with a reference tool
Evidence: \ProvidesClass{tufte-book}[2015/06/30 v3.5.3 Tufte-book class] and \ProvidesFile{tufte-common.def}[2015/06/21 v3.5.2 ...]; install.tex: 'a customized version of the Tufte-LaTeX book class (which we include in our source code, so you don't have to install it)'. Neither file contains a copyright or licence line, and no stanza in debian/copyright mentions Tufte-LaTeX.
Problem: These are third-party Tufte-LaTeX files (used with local customisations to typeset the shipped Userguide.pdf), not HMMER work. The only stanza that matches them is Files: *, which attributes them to HMMER's institutions under BSD-3-Clause; their actual copyright holders and licence are stated nowhere. The source package therefore redistributes them without their notice, which is an inaccurate and incomplete debian/copyright irrespective of whether the upstream licence is free.
Fix: Add a Files: documentation/userguide/tufte-* stanza naming the Tufte-LaTeX copyright holders (and noting the local modifications) and reproduce that project's licence as a stand-alone License stanza or a pointer to /usr/share/common-licenses, whichever applies.

blocker licensing 3. install-sh is MIT/X11-licensed X Consortium code, not BSD-3-Clause, and its copyright is missing ◂

Files: install-sh:10-36, debian/copyright:8-14, debian/lrc.config:1
Basis: checked, in the package or with a reference tool
Evidence: # Copyright (C) 1994 X Consortium with Permission is hereby granted, free of charge, to any person obtaining a copy ...; # FSF changes to this file are in the public domain. Files: * says License: BSD-3-Clause.
Problem: The file's licence is the X11/MIT text, not the BSD-3-Clause text reproduced in debian/copyright, and the X Consortium holder is not named. The source package distributes the file and the MIT notice has to be retained; debian/lrc.config lists install-sh, so license-reconcile's report of the mismatch is suppressed rather than documented.
Fix: Add a Files: install-sh stanza with Copyright: 1994 X Consortium and a stand-alone MIT/X11 License paragraph reproducing the file's notice, noting the public-domain FSF changes.

important licensing 4. The LPPL stanza gives no licence text and an unversioned short name ◂

Files: debian/copyright:16-21, documentation/userguide/unsrtnat-brief.bst:1-13
Basis: checked, in the package or with a reference tool
Evidence: License: LPPL followed only by the file's four-line notice (either version 1 of the License, or any later version.); the LPPL is not in /usr/share/common-licenses.
Problem: copyright-format 6.7 requires a Files stanza's License field to contain the full text or point into /usr/share/common-licenses, and Policy 2.3 requires a verbatim copy of each distribution licence; neither is met. The unversioned LPPL is also ambiguous, since LPPL 1.0-1.2 are non-free and 1.3c is DFSG-free. The file itself is free ('or any later version' allows 1.3c), but debian/copyright must say so and carry the text.
Fix: Use a versioned short name (e.g. LPPL-1.3c, the version chosen under the 'or later' clause) and add the full LPPL 1.3c text as a stand-alone License: LPPL-1.3c stanza.

important packaging 5. libhmmer3, libhmmer-dev and hmmer-examples are Architecture: any although the source builds only where SSE, NEON or VMX exists ◂

Files: debian/control:63 (Package: libhmmer3), debian/control:77 (Package: libhmmer-dev), debian/control:91 (Package: hmmer-examples), debian/rules:59-70, configure.ac:415-426
Basis: checked, in the package or with a reference tool
Evidence: hmmer has Architecture: any-amd64 any-i386 arm64 powerpc ppc64 x32; the other three have Architecture: any. configure.ac: AC_MSG_NOTICE([HMMER3 requires SSE, NEON or VMX vector instructions.]) and AC_MSG_ERROR([No supported vectorization found for your machine.]). debian/rules enables SSE/NEON/VMX only for amd64/arm64/powerpc/ppc64 and otherwise passes only --enable-threads.
Problem: With an Architecture: any binary in the package the source is built on every release architecture (the .dsc says 'any all'), and hmmer's own restriction does not limit that. On riscv64, s390x, mips64el, armel and ppc64el (VMX is big-endian only) configure finds no supported vector unit and exits nonzero, so those buildds FTBFS. Policy 5.6.8: a list of architectures is for sources that only work correctly on the listed architectures; the same restriction must be on every arch-dependent binary.
Fix: Give libhmmer3, libhmmer-dev and hmmer-examples the same architecture list as hmmer (or extend the list only where configure succeeds).

minor licensing 6. Files: * omits the FSF copyright on config.guess/config.sub and their GPL-3+ with Autoconf exception ◂

Files: config.guess:3-25, config.sub:3-25, debian/copyright:8-14
Basis: checked, in the package or with a reference tool
Evidence: # Copyright 1992-2018 Free Software Foundation, Inc. and under the terms of the GNU General Public License ... either version 3 ... As a special exception ... you may include it under the same distribution terms that you use for the rest of that program.
Problem: Files: * names only HMMER's five holders and BSD-3-Clause. Policy 2.3 does not require these notices in debian/copyright: these are autotools files that are part of the build process and are installed in no binary package, and the Autoconf exception permits the BSD-3-Clause terms used here. The copyright file nevertheless does not describe the files at all, omitting the FSF holder and the GPL-3+/exception, which a complete DEP-5 file should record.
Fix: Add a Files: config.guess config.sub stanza: Copyright: 1992-2018 Free Software Foundation, Inc., License: GPL-3+ with Autoconf exception, and a note that the exception allows distribution under the package's BSD-3-Clause terms.

minor packaging 7. hmmer-doc's doc-base entry points to /usr/share/doc/hmmer/ instead of /usr/share/doc/hmmer-doc/ and names version 2.3.2 ◂

Files: debian/hmmer-doc.doc-base (Title and Files fields), debian/hmmer-doc.docs:1
Basis: checked, in the package or with a reference tool
Evidence: Title: Hmmer 2.3.2 Userguide and Files: /usr/share/doc/hmmer/Userguide.pdf.gz; debian/hmmer-doc.docs installs documentation/userguide/Userguide.pdf.
Problem: dh_installdocs puts Userguide.pdf (then Userguide.pdf.gz after dh_compress) in /usr/share/doc/hmmer-doc/, and nothing installs /usr/share/doc/hmmer/Userguide.pdf.gz, so the registered document does not exist and doc-base/dwww show nothing. The title also advertises the HMMER 2.3.2 guide for a 3.4 package.
Fix: Point Files at /usr/share/doc/hmmer-doc/Userguide.pdf.gz and update Title to the current version.

minor packaging 8. Files-Excluded does not list the easel tree that the +dfsg2 repack removed ◂

Files: debian/copyright:5-6, debian/changelog (3.4+dfsg2-1 entry)
Basis: inferred from what was read, not seen directly
Evidence: Files-Excluded: */libdivsufsort / */.gitignore; changelog: Remove easel from upstream source and build against libeasel-dev instead; the tree contains no easel/ directory.
Problem: If easel was stripped when the +dfsg2 orig tarball was built, uscan cannot reproduce that tarball and the copyright header understates what was removed (which is also why the former easel stanza is gone). If instead the tarball came from a source that never carried easel, the changelog wording and version bump are misleading. The two disagree in any case.
Fix: Add */easel (or easel/*) to Files-Excluded, or record in debian/README.source where the +dfsg2 tarball came from.

Verified ◂

Read debian/copyright in full: DEP-5 with the standard Format URL; stanzas Files: * (BSD-3-Clause, holders match LICENSE), documentation/userguide/unsrtnat-brief.bst (LPPL) and debian/*; the BSD-3-Clause text is present and matches LICENSE.
Files patterns behave as copyright-format 6.9: * matches at every depth, the .bst stanza overrides Files: *, and the tree holds no .gitignore or libdivsufsort path any more.
documentation/userguide/inclusions/alidisplay-serialize.ai and documentation/userguide/inclusions/alidisplay-serialize.pdf: Illustrator drawing and its PDF export, included by daemon.tex; the editable .ai source is present so the PDF is not an orphan build product.
documentation/userguide/inclusions/daemon-results.ai and documentation/userguide/inclusions/daemon-results.pdf: Illustrator drawing and PDF export, included by daemon.tex; source .ai present.
documentation/userguide/inclusions/daemon.ai and documentation/userguide/inclusions/daemon.pdf: Illustrator drawing and PDF export, included by daemon.tex; source .ai present.
documentation/userguide/inclusions/domain-serialize.ai and documentation/userguide/inclusions/domain-serialize.pdf: Illustrator drawing and PDF export, included by daemon.tex; source .ai present.
documentation/userguide/inclusions/hit-serialize.ai and documentation/userguide/inclusions/hit-serialize.pdf: Illustrator drawing and PDF export, included by daemon.tex; source .ai present.
documentation/userguide/inclusions/hmmpgmd-search-stats-serialize.ai and documentation/userguide/inclusions/hmmpgmd-search-stats-serialize.pdf: Illustrator drawing and PDF export, included by daemon.tex; source .ai present.
src/impl_sse/p7_omx.ai: the editable Illustrator figure of the P7_OMX layout named in src/impl_sse/p7_omx.c:8; it is the source, not a built artefact.
Userguide.pdf is not shipped in the source: debian/rules (execute_after_dh_auto_build) builds it from documentation/userguide/*.tex and debian/clean removes it.
testsuite/20aa-alitest.phr, testsuite/20aa-alitest.pin, testsuite/20aa-alitest.pog, testsuite/20aa-alitest.psi, testsuite/20aa-alitest.psq: BLAST-format test indexes generated from testsuite/20aa-alitest.fa, which is in the same directory; test data with its source.
testsuite/3box-alitest.nhr, testsuite/3box-alitest.nin, testsuite/3box-alitest.nog, testsuite/3box-alitest.nsi, testsuite/3box-alitest.nsq: BLAST-format test indexes generated from testsuite/3box-alitest.fa, which is in the same directory; test data with its source.
src/hmmer.c:38 and :58 ('HHMI Janelia Farm Research Campus') are inside a comment showing an example banner, not a copyright notice; the real holders (HHMI, Harvard, Washington University, MRC LMB, Sean Eddy) are named in Files: *.
src/impl_sse/p7_omx.ai's 'Adobe Systems, Inc.' is Adobe/Illustrator and embedded-font metadata inside the drawing, not a copyright claim on the work; no other file in the tree names Adobe.
release-notes/ANNOUNCE-1.8's 'GNU General Public License' sentence describes HMMER 1.8 historically and is not a licence notice for the file or the current tree; debian/lrc.config lists it (and install-sh) for license-reconcile.
LICENSE's general credits to Apple Computer, IBM TJ Watson Research Center, the FSF, X Consortium and Yuta Mori have per-file notices only for FSF (config.guess/config.sub) and X Consortium (install-sh); libdivsufsort-lite is excluded from the tree and no source file names Apple or IBM. LICENSE's Farrar paragraph is a patent sublicence, not a copyright licence term.
No other non-free wording: a tree-wide grep for NoDeriv, NonCommercial, non-commercial, academic-use-only, uniprot.org/terms and Creative Commons matched only tutorial/7LESS_DROME.
Patches create no files (no /dev/null targets), so no patched-in file needs a stanza of its own.
Build dependencies resolvable: libdivsufsort-dev, d-shlibs, rman and autoconf-archive are in the archive; libeasel-dev/libeasel0 are built by easel 0.49+dfsg-1, waiting in NEW; autoconf/automake come with debhelper through dh-autoreconf; Standards-Version 4.7.4 matches Policy 4.7.4.1.
autopkgtest @ expands to all binaries of the source, so libhmmer-dev (headers, .so, pkg-config file) is installed for the test; build-essential and pkgconf are listed.
Coverage: all of debian/ except watch (out of scope) and the .pc/ tree was read in full; the whole upstream tree was grepped for copyright/licence wording; heads of the data and notice files were read; the 13 PDF/Illustrator files and the 10 index binaries were not opened.
uscan found the packaged version as the newest upstream release (upstream 3.4, packaged 3.4+dfsg2).

Not confirmed ◂

libeasel-dev's file list could not be checked (package only in NEW): configure.ac m4_includes /usr/share/easel/m4/esl_{neon,sse,vmx,pic_flags}.m4 and the userguide Makefile uses /usr/share/easel/devkit/rmanprocess.py, while the patch's own comment says libeasel-dev does not install the m4 macros; if either path is absent, autoreconf or the Userguide.pdf build fails.
Provenance and licence of the remaining third-party data are unstated: tutorial/fn3.sto (Pfam PF00041) and tutorial/Pkinase.sto (Pfam PF00069), tutorial/MADE1.sto (Dfam DF0000629, #=GF SE Repbase) and testsuite/PAX8_HUMAN (a UniProt entry) carry no terms, and debian/copyright says nothing about them.
Whether ${devlibs:Depends} on libhmmer-dev resolves to libeasel-dev and libdivsufsort-dev could not be confirmed: d-shlibs is not installed on the review system and the package cannot be built here.
Whether any Apple or IBM code credited in LICENSE is still present in the sources; no file names them.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-16 12:03 UTC, because the review found serious issues.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
3.4+dfsg2-1	82fde167…	2026-11-15 09:04	2026-11-15 09:04	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package