Review: hmmer 3.4+dfsg2-1

Package Information

Description	profile hidden Markov models for protein sequence analysis HMMER is an implementation of profile hidden Markov model methods for sensitive searches of biological sequence databases using multiple sequence alignments as queries. Given a multiple sequence alignment as input, HMMER builds a statistical model called a "hidden Markov model" which can then be used as a query into a sequence database to find (and/or align) additional homologues of the sequence family.
Maintainer	Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed By	Andreas Tille <tille@debian.org>
Sponsor	tille@debian.org
Distribution	experimental
Architecture	any all
VCS	git: https://salsa.debian.org/med-team/hmmer.git (browse)
Popcon Installs	363
Binary NEW	Yes (new binary packages of a source already in sid)
Tracker	https://tracker.debian.org/pkg/hmmer
Uploaded	6 hours ago

New Package Report

.changes◂

Architecture	source amd64 all
Distribution	experimental
Date	Thu, 12 Nov 2026 09:04:15 +0100
Source	hmmer
Version	3.4+dfsg2-1
Changed-By	Andreas Tille <tille@debian.org>

Changelog◂

hmmer (3.4+dfsg2-1) experimental; urgency=medium
 .
   * d/copyright: Point Source to Github
   * d/watch:
      - Version=5
      - Fix by pointing to Github
   * Standards-Version: 4.7.4 (routine-update)
   * Reflow Uploaders field (cme)
   * Remove Priority field (cme)
   * Reformat the Last-Update date as ISO YYYY-MM-DD.
   * Replace FSF postal address with a reference to
     https://www.gnu.org/licenses/.
   * Use secure URI in Homepage field.
   * debputy lint --auto-fix (routine-update)
   * Remove easel from upstream source and build against libeasel-dev
     instead
   * Export internal HMMER functions used by pyhmmer
   * Build against the separately packaged Easel library
   * Build shared and static libhmmer libraries with d-shlibs
   * Update the autopkgtest to the packaged libraries
   * Update d/copyright, add d/lrc.control
   * Drop outdated debian/README.Debian

.dsc◂

Priority	optional
Component	main
Package-List	hmmer deb science optional arch=any-amd64,any-i386,arm64,powerpc,ppc64,x32 hmmer-doc deb doc optional arch=all hmmer-examples deb doc optional arch=any libhmmer-dev deb libdevel optional arch=any libhmmer3 deb libs optional arch=any
Section	science

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: HMMER
Upstream-Contact: Sean R. Eddy <eddys@janelia.hhmi.org>
Source: https://github.com/EddyRivasLab/hmmer
Files-Excluded: */libdivsufsort
                */.gitignore

Files: *
Copyright: 1992-2010 Sean R. Eddy <eddy@genetics.wustl.edu>
                     Howard Hughes Medical Institute
           1992-2004 Washington University School of Medicine
           1992-1994 MRC Laboratory of Molecular Biology
License: GPL-3

Files: documentation/userguide/unsrtnat-brief.bst
Copyright: 1993-2007 Patrick W Daly
License: LPPL
 This program can be redistributed and/or modified under the terms
 of the LaTeX Project Public License Distributed from CTAN
 archives in directory macros/latex/base/lppl.txt; either
 version 1 of the License, or any later version.

Files: debian/*
Copyright: 1998 John Lapeyre <lapeyre@physics.arizona.edu>
           1999-2001 Matthew Vernon <matthew@debian.org>
           2006-2007 Nelson A. de Oliveira <naoliv@gmail.com>
           2008-2012 Charles Plessy <plessy@debian.org>
           2010 Eric Talevich <etal@uga.edu>,
           2010 Steffen Möller <moeller@debian.org>
           2012-2026 Andreas Tille <tille@debian.org>
License: GPL-3

License: GPL-3
   This package is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 3 as published
   by the Free Software Foundation.
 .
   This package is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU General
 Public License can be found in `/usr/share/common-licenses/GPL-3'.

DFSG Assistant LLM REVIEW 2 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 4 hours ago.

Report◂

DFSG NEW review for hmmer version 3.4+dfsg2-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 2 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 24 found

Licensing

The tree is free: HMMER 3.4 is BSD-3-Clause (LICENSE, configure.ac, README), the single .bst is LPPL-1.0+ used only for the guide, and the figures/test data raise no licensing question. But debian/copyright declares GPL-3 for Files: * and ships no BSD-3-Clause text, and it omits the holder President and Fellows of Harvard College for the source that is compiled into every binary package; both make the file inaccurate for every installed file, not just incomplete.

Packaging

Modern packaging (debhelper compat 14 with dh, hardening=+all, LTO handling, d-shlibs based libhmmer3/libhmmer-dev split, autopkgtest that links against the packaged libraries, DEP-3 patches), and the new build dependencies resolve (libeasel-dev comes from easel 0.49+dfsg-1 in NEW, libdivsufsort-dev is in the archive). The only actual packaging bug found is a stale doc-base entry; the remaining issues are record-keeping gaps.

Issues

blocker licensing 1. Files: * says GPL-3 but HMMER 3.4 is BSD-3-Clause ◂

Files: debian/copyright:8-13, debian/copyright:30-42, LICENSE:58, configure.ac:107, README.md:3
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright has Files: * ... License: GPL-3 and a stand-alone License: GPL-3 pointing to /usr/share/common-licenses/GPL-3; LICENSE:58 says HMMER source code is distributed as open source under the terms of the BSD three-clause license:, configure.ac:107 has HMMER_LICENSE="Freely distributed under the BSD open source license.", release-notes/RELEASE-3.2:8 HMMER is now distributed under the BSD license, instead of the GPL.
Problem: The wrong short name, the wrong licence text and the wrong pointer: every file in the source package (and so the binaries, man pages and the installed Userguide.pdf) is documented under a licence upstream replaced in 3.2. BSD-3-Clause is not in /usr/share/common-licenses, so the full notice and disclaimer must be reproduced in debian/copyright (Policy 12.5); the GPL text reference does not do that. No source file carries a GPL notice.
Fix: Change the Files: * stanza to License: BSD-3-clause and replace the stand-alone GPL-3 paragraph with a stand-alone License: BSD-3-clause paragraph carrying the text from LICENSE:58-83 (copyright notice, the three conditions, the advertising/endorsement clause and the disclaimer).

blocker licensing 2. Files: * does not name President and Fellows of Harvard College ◂

Files: debian/copyright:9-12, LICENSE:2-6
Basis: checked, in the package or with a reference tool
Evidence: LICENSE:3 Copyright (C) 2015-2023 President and Fellows of Harvard College, next to 1992-2023 Sean R. Eddy, 2000-2023 Howard Hughes Medical Institute, 1995-2006 Washington University School of Medicine, 1992-1995 MRC Laboratory of Molecular Biology; debian/copyright lists Sean R. Eddy (1992-2010), HHMI, Washington University (1992-2004) and MRC LMB (1992-1994) only.
Problem: A copyright holder of the compiled sources is missing, and the years of the other holders are those of the 2010 GPL era. Policy 2.3 requires the notices of files compiled into shipped binaries to be in debian/copyright when the licence requires the notice to be kept (the BSD-3-Clause first two conditions do); src/*.c, the library and every program are built from that code.
Fix: Add 2015-2023 President and Fellows of Harvard College and bring the years of Eddy (1992-2023), HHMI (2000-2023), Washington University (1995-2006) and MRC LMB (1992-1995) in line with LICENSE:2-6.

minor licensing 3. config.guess, config.sub and install-sh are covered by Files: * under licences and holders they do not have ◂

Files: config.guess:1-26, config.sub:1-26, install-sh:8-35, debian/copyright:8-13, debian/lrc.config:1-2
Basis: checked, in the package or with a reference tool
Evidence: config.guess:3 / config.sub:3 Copyright 1992-2018 Free Software Foundation, Inc. with either version 3 of the License, or (at your option) any later version and As a special exception ... if you distribute this file as part of a program that contains a configuration script generated by Autoconf; install-sh:10-13 Copyright (C) 1994 X Consortium with the MIT-style permission notice and FSF changes to this file are in the public domain; debian/lrc.config whitelists install-sh rather than documenting it.
Problem: The blanket Files: * / GPL-3 stanza misstates install-sh entirely (X11/MIT, not GPL) and misses the + and the Autoconf exception of config.guess/config.sub, and names neither the Free Software Foundation nor the X Consortium. All three are build-only files that no binary package installs, so Policy 2.3 does not require their notices in debian/copyright, hence minor rather than blocker; but the source package is distributed under those terms and the file should describe them.
Fix: Add a Files: config.guess config.sub stanza (GPL-3+ with the Autoconf exception, FSF holder) and a Files: install-sh stanza (X11/MIT with the X Consortium advertising clause, X Consortium holder, FSF changes public domain), with the full texts, and drop install-sh from debian/lrc.config.

minor licensing 4. Files-Excluded does not record the easel/ tree removed by this repack ◂

Files: debian/copyright:5-6, debian/changelog:20
Basis: checked, in the package or with a reference tool
Evidence: Files-Excluded: */libdivsufsort / */.gitignore, while the changelog entry says Remove easel from upstream source and build against libeasel-dev instead and the tree and orig tarball contain no easel/ directory.
Problem: debian/copyright is the record of how the DFSG tarball was made; as it stands, regenerating the orig tarball from upstream with these exclusions puts easel/ back, which is a second body of upstream code with its own copyright holders and would also break the patched configure.ac. It also means the licence/holder changes caused by dropping easel are undocumented.
Fix: Add easel/* (and any other removed path) to Files-Excluded.

minor packaging 5. doc-base entry points to /usr/share/doc/hmmer/Userguide.pdf.gz but hmmer-doc installs it under hmmer-doc ◂

Files: debian/hmmer-doc.doc-base:14, debian/hmmer-doc.doc-base:2, debian/hmmer-doc.docs:1
Basis: checked, in the package or with a reference tool
Evidence: Files: /usr/share/doc/hmmer/Userguide.pdf.gz and Title: Hmmer 2.3.2 Userguide; debian/hmmer-doc.docs installs documentation/userguide/Userguide.pdf, which dh_installdocs puts in /usr/share/doc/hmmer-doc/ and dh_compress gzips (debian/rules:162 only excludes tutorial/).
Problem: The registered document does not exist, so doc-base (and anything reading its index) reports a missing file and the user guide is not indexed. The title also still names version 2.3.2.
Fix: Change the Files line to /usr/share/doc/hmmer-doc/Userguide.pdf.gz and update the title to the current version.

Verified ◂

Read all of debian/ (control, rules, changelog, copyright, all six patches and series, tests/control and run-unit-test, hmmer-doc.doc-base, hmmer-doc.docs, hmmer.install, hmmer.pc.in, clean, source/format, source/options, lrc.config, gbp.conf, README.source, upstream/metadata, salsa-ci.yml) and the top-level LICENSE, README.md, configure.ac.
Searched the whole tree except debian/ and .pc/ for Copyright/(C)/© and for GPL, LGPL, BSD, LPPL, MIT, Apache, MPL, public-domain, "all rights reserved", SPDX and non-commercial/no-modification wording. The only licence texts are LICENSE (BSD-3-Clause), config.guess/config.sub (GPL-3+ with the Autoconf exception), install-sh (X11/MIT plus FSF public-domain changes), the LPPL header of documentation/userguide/unsrtnat-brief.bst and historical release notes; no non-free terms anywhere.
documentation/userguide/unsrtnat-brief.bst:9-12 says either version 1 of the License, or any later version; taking the later-version option allows LPPL 1.3c, which the DFSG accepts, so the unversioned LPPL short name at debian/copyright:17 is imprecise but not a DFSG problem. The file is a renamed modification of Patrick Daly's unsrtnat.bst and is used only by bibtex when building Userguide.pdf.
documentation/userguide/inclusions/alidisplay-serialize.ai is an Adobe Illustrator source for documentation/userguide/inclusions/alidisplay-serialize.pdf; the PDF is the exported figure the LaTeX guide includes. Both come from upstream and only the built Userguide.pdf is installed.
documentation/userguide/inclusions/daemon-results.ai is an Adobe Illustrator source for documentation/userguide/inclusions/daemon-results.pdf, the exported figure included by the guide; shipped by upstream, not installed.
documentation/userguide/inclusions/daemon.ai is an Adobe Illustrator source for documentation/userguide/inclusions/daemon.pdf, the exported figure included by the guide; shipped by upstream, not installed.
documentation/userguide/inclusions/domain-serialize.ai is an Adobe Illustrator source for documentation/userguide/inclusions/domain-serialize.pdf, the exported figure included by the guide; shipped by upstream, not installed.
documentation/userguide/inclusions/hit-serialize.ai is an Adobe Illustrator source for documentation/userguide/inclusions/hit-serialize.pdf, whose %!PS-Adobe-3.0 %%Creator: Adobe Illustrator(R) 17.0 header and %%For: (Nicholas Carter) identify it as the exported figure; shipped by upstream, not installed.
documentation/userguide/inclusions/hmmpgmd-search-stats-serialize.ai is an Adobe Illustrator source for documentation/userguide/inclusions/hmmpgmd-search-stats-serialize.pdf, the exported figure included by the guide; shipped by upstream, not installed.
src/impl_sse/p7_omx.ai is a hand-drawn Illustrator diagram of the P7_OMX layout, named in the header comments of src/impl_sse/p7_omx.c and src/impl_vmx/p7_omx.c; nothing builds or installs it. The Adobe Systems, Inc. string at line 2629 is the copyright line of the embedded ICC colour profile next to %!PS-Adobe-3.0 / %%Creator: Adobe Illustrator(R) 12.0, not a licence claim on the drawing.
testsuite/20aa-alitest.phr is the NCBI BLAST legacy protein database header file, generated with formatdb from testsuite/20aa-alitest.fa and 20aa-alitest.afa in the same directory; upstream test data, installed only into hmmer-examples.
testsuite/20aa-alitest.pin is the corresponding BLAST protein database index file; upstream test data from the same .fa/.afa files, installed only into hmmer-examples.
testsuite/20aa-alitest.pog is a BLAST protein database auxiliary file; upstream test data, installed only into hmmer-examples.
testsuite/20aa-alitest.psi is the BLAST protein database offset file; upstream test data, installed only into hmmer-examples.
testsuite/20aa-alitest.psq is the BLAST protein database sequence file; upstream test data generated from 20aa-alitest.fa/.afa, installed only into hmmer-examples.
testsuite/3box-alitest.nhr is the NCBI BLAST legacy nucleotide database header file, generated with formatdb from testsuite/3box-alitest.fa in the same directory; upstream test data, installed only into hmmer-examples.
testsuite/3box-alitest.nin is the corresponding BLAST nucleotide database index file; upstream test data, installed only into hmmer-examples.
testsuite/3box-alitest.nog is a BLAST nucleotide database auxiliary file; upstream test data, installed only into hmmer-examples.
testsuite/3box-alitest.nsi is the BLAST nucleotide database offset file; upstream test data, installed only into hmmer-examples.
testsuite/3box-alitest.nsq is the BLAST nucleotide database sequence file; upstream test data generated from 3box-alitest.fa, installed only into hmmer-examples.
The HHMI Janelia Farm Research Campus strings at src/hmmer.c:38 and :58 are example banner output inside a documentation comment and the HMMER_LICENSE macro's documented value, not a notice on the file; the banner actually printed comes from configure.ac's HMMER_COPYRIGHT (Howard Hughes Medical Institute, 2023), which debian/copyright names. Free Software Foundation and X Consortium occurrences are the config.guess/config.sub/install-sh issue above; the Adobe occurrence is the ICC profile.
No built artifact lacks its source: the inclusions/.out files are upstream-shipped outputs of the documented programs and their generator documentation/userguide/inclusions/gen-inclusions.py is shipped; Userguide.pdf is built from the .tex sources, the documentation/man/.man.in sources and the .pdf figures present. No libdivsufsort or easel sources remain in the tree.
All six patches carry DEP-3 headers (Description, Author/From, Last-Update, Forwarded) and none modifies LICENSE or a copyright notice.
Build dependencies resolve: libdivsufsort-dev 2.0.1-7 is in the archive; libeasel-dev is built by easel 0.49+dfsg-1, waiting in NEW, so its absence from the archive is not a fault; rman and d-shlibs exist.
debhelper compat 14: ${misc:Depends}/${shlibs:Depends} need not be written in control, and override_dh_auto_test need not test DEB_BUILD_OPTIONS itself because dh skips that override under nocheck; the make tests in execute_after_dh_auto_build is outside the skipped targets but needs only build-essential and the listed build dependencies.
debian/copyright already begins with the exact copyright-format 1.0 Format URL, so no replacement file is proposed.
uscan found the packaged version as the newest upstream release (upstream 3.4, packaged 3.4+dfsg2).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-3).

Not confirmed ◂

Whether libeasel-dev (easel 0.49+dfsg-1, in NEW) installs the files the patched build hard-codes: /usr/share/easel/m4/esl_{neon,sse,vmx,pic_flags}.m4 (configure.ac:64-67) and /usr/share/easel/devkit/rmanprocess.py (documentation/userguide/Makefile.in:27). If they are missing, autoreconf or the Userguide.pdf build fails; the file list of a binary package in NEW is not available to the reference tools.
No build or test was run; the review is of the source tree only.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 4 hours ago, started 4 hours ago, completed 4 hours ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

The uploader said:

Will be fixed in next upload

Back to Dashboard | View all reviews for this package