inema 1.0.4-1

Package Information

Description	Implementation of Deutsche Post Internetmarke Online Franking Implementation of "Internetmarke" web API for interacting with HTTP endpoints of the German postal company Deutsche Post, in order to buy printable letter postage, online.
Maintainer	Debian Python Team <team+python@tracker.debian.org>
Changed By	Jakob Haufe <sur5r@debian.org>
Sponsor	sur5r@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/python-team/packages/inema-python.git (browse)
Closes	#1144796
Tracker	https://tracker.debian.org/pkg/inema
Uploaded	8 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Wed, 11 Nov 2026 21:50:18 +0100
Source	inema
Version	1.0.4-1
Changed-By	Jakob Haufe <sur5r@debian.org>
Architecture	source all

Changelog◂

inema (1.0.4-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1144796)

.dsc◂

Component	main
Package-List	python3-inema deb python optional arch=all
Section	python
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: inema
Source: https://gitea.sysmocom.de/odoo/python-inema

Files: *
Copyright: 2016-2026, Georg Sauthoff <mail@gms.tf>
           2016-2021, Harald Welte <laforge@gnumonks.org>
License: LGPL-3+

Files: debian/*
Copyright: 2026, Jakob Haufe <sur5r@debian.org>
License: LGPL-3+

License: LGPL-3+
 On Debian systems, the complete text of the GNU Lesser General Public License
 version 3 can be found in `/usr/share/common-licenses/LGPL-3'.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 hours ago.

Report◂

DFSG NEW review for inema version 1.0.4-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and matches the tree. LICENSE is the complete LGPL-3 text, every module either carries an SPDX LGPL-3.0-or-later tag or has no notice at all, and pyproject.toml and README.rst state the same licence, so License: LGPL-3+ with a pointer to /usr/share/common-licenses/LGPL-3 is right. Both holders named by the scan (Georg Sauthoff, Harald Welte) are in the Files: * stanza, and the file the debian/* stanza covers is the packaging. The only third-party material, inema/data/*.json, is factual Deutsche Post product/price data with no copyright notice. No non-free terms, missing licences or incompatible licences were found.

Packaging

Conventional, correct dh/pybuild packaging: compat 14 via debhelper-compat, 3.0 (quilt) with one DEP-3 patch, Standards-Version current against Policy 4.7.4.1, salsa Vcs fields, and runtime dependencies on requests/lxml/pytz/zeep produced by dh_python3's Requires-Dist handling. Three minor defects: inema/inema.py imports pkg_resources without python3-pkg-resources in Depends; nothing is tested (debian/tests is empty and all tests are switched off at build time although one test needs neither credentials nor network); and two of the four installed example scripts import names that inema/__init__.py no longer provides.

Issues

minor packaging 1. Depends lacks python3-pkg-resources, imported at module level by inema/inema.py ◂

Files: inema/inema.py:9-11, inema/inema.py:19, debian/control:20-21, pyproject.toml:22-27
Basis: checked, in the package or with a reference tool
Evidence: from pkg_resources import resource_stream, resource_listdir / import pkg_resources / __version__ = pkg_resources.get_distribution(__package__).version; pyproject's dependencies are only requests, lxml, pytz, zeep, and the binary Depends is only ${misc:Depends}, ${python3:Depends}.
Problem: ${python3:Depends} is generated by dh_python3 from the wheel's Requires-Dist plus the interpreter taken from shebang scripts (dh-python's dhpython/depends.py, guess_deps default on); none of the four distributions maps to python3-pkg-resources, so import inema.inema raises ModuleNotFoundError on any system where python3-pkg-resources is not present for another reason. That is an undeclared dependency (Policy 7.1) and breaks the SOAP client modules of the package.
Fix: Add python3-pkg-resources to the package's Depends, or have upstream use importlib.metadata.version() and importlib.resources as inema/data.py already does, and drop the pkg_resources import.

minor packaging 2. debian/tests is empty: no autopkgtest, and every test is also disabled at build time ◂

Files: debian/tests/, debian/rules:8-9, test_local.py:11-21
Basis: checked, in the package or with a reference tool
Evidence: override_dh_auto_test: with only # All tests require credentials and internet connectivity, and debian/tests contains no file at all.
Problem: Nothing exercises the package anywhere: the build runs no tests and there is no autopkgtest, so a broken install (missing data files, broken module imports) would reach testing unnoticed. The stated reason does not cover test_local.py, which only calls inema.data.load_products() and load_formats() and needs neither credentials nor network (the schema/openapi tests do need local specification files, schema/rest/*.json and pp-post-internetmarke-latest.yaml, which the tarball does not contain, and teardown of test_rest.py needs a real Portokasse).
Fix: Add debian/tests/control with a test that runs test_local.py (Depends: python3-pytest) or at least imports inema.rest and inema.data, and consider running test_local.py at build time with python3-pytest in Build-Depends-Indep.

minor packaging 3. Installed examples example.py and products.py import Internetmarke/ProductInformation from inema, which exports nothing ◂

Files: examples/example.py:5, examples/products.py:7, inema/__init__.py:1, debian/python3-inema.examples:1
Basis: checked, in the package or with a reference tool
Evidence: from inema import Internetmarke and from inema import ProductInformation, while inema/__init__.py is a single line, # -*- coding: utf-8 -*-; the classes now live in inema/inema.py (and Internetmarke also in inema/soapfree.py).
Problem: debian/python3-inema.examples installs examples/* into /usr/share/doc/python3-inema/examples, and two of those four scripts abort immediately with ImportError, so the package ships examples that cannot run. Only check_price.py imports modules that still exist (import inema, import inema.inema).
Fix: Patch the two scripts to from inema.inema import Internetmarke / ProductInformation (or drop them from debian/python3-inema.examples), forward the change upstream, and drop the now unnecessary shebang-only hunks for those files.

Verified ◂

Prescan: its author check found every copyright holder in the tree named in debian/copyright; the scan listed no further files (no built files, minified code, PDFs or suspect licence wording), so there is nothing else to account for.
Read debian/copyright in full: DEP-5 with the correct Format URL, Files: * (Sauthoff, Welte, LGPL-3+), Files: debian/* (Jakob Haufe, LGPL-3+), and one stand-alone License paragraph pointing at /usr/share/common-licenses/LGPL-3, which exists.
Licence evidence across the whole tree (excluding .pc/): LICENSE is the complete LGPL-3 text; conftest.py, test_.py, inema/frank.py, rest.py, soapfree.py carry SPDX-License-Identifier: LGPL-3.0-or-later; inema.py, utils.py, wpint.py carry SPDX-Identifier: LGPL-3.0-or-later; data.py, init.py, doc/, examples/*, Makefile, MANIFEST.in, .gitignore, .readthedocs.yaml carry no notice. pyproject.toml license = "LGPL-3.0-or-later" and README.rst agree. No MIT/BSD/Apache/MPL/CC/All rights reserved/non-commercial wording anywhere.
inema/data/formats.json, products.json and products-2026-01-01.json are Deutsche Post page-format and product/price data (ids, names, weights, cost_price), produced by examples/update_products.py from a Deutsche Post product price list per its own comment; they contain no copyright notice or terms, and Files: * covers them.
inema/frank.py:158 has a stale help epilog line 2016, Georg Sauthoff <mail@georg.so>, GPLv3+ while the same file's SPDX header at line 3-4 says LGPL-3.0-or-later; it is a help string, not a licence grant, and debian/copyright follows the header.
Automatic dependency generation checked in dh-python itself: dhpython/depends.py adds ${python3:Depends} from the wheel's Requires-Dist (guess_deps defaults to True) and dh-python's pypi-to-Debian table maps requests/lxml/pytz/zeep to python3-requests/python3-lxml/python3-pytz/python3-zeep, so no explicit Depends are missing for those.
Trailing commas at the end of Uploaders, Build-Depends, Build-Depends-Indep and Depends were checked and are harmless: deps_parse in /usr/share/perl5/Dpkg/Deps.pm splits on commas and Perl's split drops the trailing empty field; dpkg only special-cases a trailing comma in Maintainer.
debian/patches/0001 has a DEP-3 header (From, Date, Subject, Forwarded: no) and fixes #!/usr/bin/python/env python3 shebangs in examples; it is applied and not obsolete.
source/format is 3.0 (quilt); debhelper compat 14 declared via debhelper-compat; the single-binary dh add-on used in debian/rules exists in this debhelper (/usr/share/perl5/Debian/Debhelper/Sequence/single_binary.pm) and only adds a dh_auto_install destdir; no maintainer scripts, no Multi-Arch needed for an arch: all pure-Python package.
Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components equal) is current; Section python, Architecture all, DPT Maintainer with Uploaders, Homepage and salsa Vcs fields are consistent; changelog is a well-formed inema (1.0.4-1) unstable entry closing the ITP.
documentation: doc/ is Sphinx source that is not installed (no debian/*.docs), which is fine; no binary, image, font, archive, PDF or minified file exists in the tree.
uscan found the packaged version as the newest upstream release (upstream 1.0.4, packaged 1.0.4).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (LGPL-3).

Not confirmed ◂

Whether the salsa repository named in Vcs-Git/Vcs-Browser already exists (initial upload, nothing to compare against).
End-to-end behaviour of the SOAP and REST clients and of the frank script: they need Deutsche Post API credentials and network access, which this review cannot use.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 7 hours ago.

Back to Dashboard | View all reviews for this package