DFSG NEW review for intel-ipsec-mb version 3.0.1+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 1 blocker, 2 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The licences in the tree are DFSG-free and compatible: everything is BSD-3-Clause (Intel, plus Kitware/Nokia/SUSE/SUSE-spec additions) except the vendored OpenSSL code under lib/openssl/ and lib/include/openssl/, which is Apache-2.0 (with an Intel BSD-3-Clause dual notice on the compat shims and on the three Intel-authored paths the copyright file names). debian/copyright is in DEP-5 format and its Files patterns match the right licences, but it is incomplete in two ways: it never gives the Apache-2.0 licence text or a pointer to it, so /usr/share/doc/libipsec-mb3/copyright does not contain a verbatim copy of a licence the compiled library is under (Policy 12.5, copyright-format 1.0 6.7), and it names only Intel Corporation as holder, omitting The OpenSSL Project Authors, Kitware, Inc. and Contributors, Nokia and SUSE LLC.

Packaging

The packaging is otherwise sound: debhelper compat 14 with correct dh use, no patches or maintainer scripts needed, install globs that match the paths debhelper makes CMake install to (/usr/lib/x86_64-linux-gnu, /usr/share/man/man7), dh_missing's compat-13 --fail-missing default satisfied, a symbols file whose file name matches the upstream SOVERSION, and correct Build-Depends. But debian/rules configures with debhelper's plain dh_auto_configure, i.e. -DCMAKE_BUILD_TYPE=None, while lib/cmake/unix.cmake replaces CMAKE_C_FLAGS instead of appending to it and keeps its only optimisation flags in CMAKE_C_FLAGS_RELEASE: the shipped libIPSec_MB.so.3 and libIPSec_MB.a C sources are therefore compiled with no -O flag at all and without the CFLAGS dpkg-buildflags provides.

Issues

1. [blocker] [licensing] debian/copyright gives neither the text of Apache-2.0 nor a pointer to it, though ~30 vendored OpenSSL files compiled into libipsec-mb3 are under it

• Files: debian/copyright:11-21, debian/libipsec-mb3.docs, lib/LICENSE.OpenSSL
• Basis: checked, in the package or with a reference tool
• Evidence: Files: / lib/include/openssl/* / lib/openssl/* / Copyright: 2012-2025 Intel Corporation / License: Apache-2.0 (debian/copyright:11-15, and again at :21 as Apache-2.0 or BSD-3-clause), with no remaining lines; the only stand-alone licence paragraphs are License: BSD-3-clause (:37) and License: GPL-2+ (:63).
• Problem: Policy 12.5 requires a verbatim copy of the package's distribution licence in /usr/share/doc/PACKAGE/copyright and says packages under the Apache 2.0 licence should refer to /usr/share/common-licenses/Apache-2.0 rather than quote it; copyright-format 1.0 6.7 requires that a License field with no remaining lines have its short names described in stand-alone License stanzas, and otherwise the full text or a pointer to /usr/share/common-licenses. Neither is present, and nothing else in the binary delivers the text: the only documentation installed is README.md (debian/libipsec-mb3.docs), while the Apache-2.0 code is compiled into the shipped library and the Apache-2.0 text ships in the source as lib/LICENSE.OpenSSL. The copyright file is thus not a complete statement of the distribution licence of the package (the other Apache-2.0 file, LICENSE.OpenSSL, is not installed either).
• Fix: Add a stand-alone paragraph, e.g. License: Apache-2.0 with the text The full text of the Apache License 2.0 can be found in the file /usr/share/common-licenses/Apache-2.0, or the verbatim text from lib/LICENSE.OpenSSL.

2. [important] [licensing] debian/copyright does not name the holders The OpenSSL Project Authors, Kitware, Nokia and SUSE LLC

• Files: debian/copyright:14, debian/copyright:20, debian/copyright:27, lib/openssl/crypto/ml_dsa/ml_dsa_sign.c:2, lib/include/openssl/crypto/ml_dsa.h:2, CMakeLists.txt:3, lib/cmake/uninstall.cmake.in:3, test/kat-app/snow3g_test.c:3, rpm/SUSE/intel-ipsec-mb.spec:4
• Basis: checked, in the package or with a reference tool
• Evidence: The three non-catch-all stanzas list Copyright: 2012-2025 Intel Corporation only (debian/copyright:14, :20, :27), while the files say Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved. (e.g. lib/openssl/crypto/ml_dsa/ml_dsa_sign.c:2), Copyright 2000-2023 Kitware, Inc. and Contributors (CMakeLists.txt:3, lib/cmake/uninstall.cmake.in:3), Copyright (c) 2022, Nokia (test/kat-app/snow3g_test.c:3) and Copyright (c) 2022-2024 SUSE LLC (rpm/SUSE/intel-ipsec-mb.spec:4). The prescan's 34 OpenSSL-holder files are exactly the ~30 files under lib/openssl/crypto/ and lib/include/openssl/ whose headers carry the OpenSSL notice; the four compat headers it listed (compat/openssl_compat.h, compat/internal/{packet.h,sha3.h}, compat/openssl/evp.h) carry both notices, matching the copyright file's Apache-2.0 or BSD-3-clause stanza.
• Problem: copyright-format 1.0 6.8 wants the copyright notices of the files a stanza matches; a missing holder is a substantive omission even where the licence short name is correct (BSD-3-clause for Kitware, Nokia, SUSE and the .spec file; Apache-2.0 for the vendored OpenSSL sources).
• Fix: Add The OpenSSL Project Authors to the two Apache-2.0 stanzas (and to the dual one), and Kitware, Inc. and Contributors, Nokia and SUSE LLC to the copyright of the stanzas covering CMakeLists.txt, lib/cmake/uninstall.cmake.in, test/kat-app/snow3g_test.c and rpm/SUSE/intel-ipsec-mb.spec.

3. [important] [packaging] shipped library is compiled with no -O flag and without the dpkg-buildflags CFLAGS: dh_auto_configure's CMAKE_BUILD_TYPE=None meets upstream's replacement of CMAKE_C_FLAGS

• Files: debian/rules:10-12, lib/cmake/unix.cmake:23-31, cmake/utils.cmake:105-110, lib/CMakeLists.txt:313-318
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules:11-12 call plain dh_auto_configure, and debhelper's CMake buildsystem passes -DCMAKE_BUILD_TYPE=None (/usr/share/perl5/Debian/Debhelper/Buildsystem/cmake.pm, @STANDARD_CMAKE_FLAGS); lib/cmake/unix.cmake:23-28 does set(CMAKE_C_FLAGS "-fPIC -fvisibility=hidden -W -Wall ... -std=c11") (no optimisation flag) and keeps set(CMAKE_C_FLAGS_RELEASE "-fstack-protector -D_FORTIFY_SOURCE=2 -O3") at :31, whose cache entries cmake/utils.cmake:105-110 then clear; string(APPEND CMAKE_C_FLAGS " ${EXTRA_CFLAGS}") at lib/CMakeLists.txt:318 is the only hook for outside flags, and EXTRA_CFLAGS defaults to empty (cmake/utils.cmake:63).
• Problem: CMAKE_FLAGS is used only for the selected configuration (cmake-variables(7), CMAKE_<LANG>_FLAGS_<CONFIG>), so with build type None upstream's -O3/-D_FORTIFY_SOURCE=2/-fstack-protector never reach the compiler; and a plain set() creates a normal variable that is found before the cache entry of the same name (cmake-language(7), Variables), so the CMAKE_C_FLAGS cache entry that CMake fills from the CFLAGS environment variable (cmake-env-variables(7) CFLAGS; /usr/share/cmake-4.3/Modules/CMakeCInformation.cmake:94) is hidden for lib/ and its subdirectories. debhelper adds no -DCMAKE_C_FLAGS of its own. The result: libIPSec_MB.so.3 in libipsec-mb3 and libIPSec_MB.a in libipsec-mb-dev are built at -O0 with no debug info and without dpkg-buildflags' -g -O2 -Werror=format-security (and without the optimisation that -D_FORTIFY_SOURCE needs) - a serious performance regression for a multi-buffer crypto library, whose C parts (ml_dsa/ml_kem, chacha20_poly1305, sha_ni, kasumi, zuc_top, aes_xcbc, ...) are not assembly. 3.0.0+dfsg-1 was the first upload built with CMake rather than the Makefile, so this is new.
• Fix: Pass a build type and the Debian flags through the hook upstream provides, for example dh_auto_configure --builddirectory=build-shared -- -DBUILD_SHARED_LIBS=ON -DCMAKE_BUILD_TYPE=Release -DEXTRA_CFLAGS="$(shell dpkg-buildflags --get CFLAGS)" (EXTRA_CFLAGS is appended after the set(), so it takes effect), or patch lib/cmake/unix.cmake to append to CMAKE_C_FLAGS instead of replacing it; -DCMAKE_C_FLAGS_RELEASE=... alone would not help, since the set() at :31 hides it as well.

Verified

• Read every file of debian/ in full: changelog, control, copyright, rules, libipsec-mb3.install, libipsec-mb-dev.install, libipsec-mb3.docs, libipsec-mb3.symbols, lrc.config, source/format, upstream/metadata. (debian/watch is checked elsewhere.)
• Sampled the upstream tree by directory (all 900-odd files are source: .c, .h, .asm, .inc, .pl, .py, .cmake, .md, .spec, .yml; there is no .o/.so/.a/.jar/.class/.pyc/PDF/minified file, and the largest files, lib/include/.inc, lib/avx512_t/*.asm, are assembly sources).
• Every file the prescan listed is accounted for: the Kitware, Nokia, SUSE and OpenSSL holders in the holder issue above; the licences the prescan guessed for them are right, and the files under lib/include/openssl/compat/** are genuinely dual (Intel SPDX-License-Identifier: BSD-3-Clause plus Copyright 2026 The OpenSSL Project Authors ... Licensed under the Apache License 2.0), as the copyright file's Apache-2.0 or BSD-3-clause stanza says.
• The vendored OpenSSL tree (lib/openssl/, lib/include/openssl/) is licence-correct apart from the holders: those files state Apache-2.0 (or BSD-3-Clause for lib/openssl/crypto/ml_dsa/ml_dsa_sample_hw_x86_64_avx{2,512}.c, lib/openssl/crypto/ml_kem/asm/ml_kem_ntt-x86_64.pl and lib/openssl/crypto/sha/sha3_x4_avx2.c, the three patterns of debian/copyright:23-28, which exist). It is not installed: lib/cmake/unix.cmake:116-118 installs only the library, lib/intel-ipsec-mb.h and the two man7 pages, so no file conflict with libssl-dev.
• No file is left unlicensed: the Files: * stanza matches the whole tree, so unmarked build files (.github/workflows/.yml, tools/asm-cov-configs/.json, lib/api_doxygen.conf, .gitignore) fall under the project's BSD-3-Clause, and debian/* is overridden by the last stanza.
• All file headers carry SPDX-License-Identifier: BSD-3-Clause except the vendored OpenSSL tree; no GPL/LGPL/MIT/ISC/CC or non-commercial/no-modification wording occurs anywhere (the All rights reserved hits are the standard Intel BSD headers, e.g. examples/burst-app/main.c:2).
• README.md 10 (licensing by the GSMA and/or the ETSI) and 11 (Legal Disclaimer, NO LICENSE ... GRANTED THROUGH USE) are disclaimers about algorithm use and patents, not restrictions on the code's licence, which LICENSE and the file headers grant as BSD-3-Clause.
• Files-Excluded: docs is consistent with the tarball: intel-ipsec-mb_3.0.1+dfsg.orig.tar.xz has no docs/, and the build does not need it (only lib/api_doxygen.conf:77 names an output directory under ../docs).
• debian/lrc.config is the per-package configuration for licenserecon (/usr/bin/lrc, package licenserecon 19.0), which its own /usr/share/lrc/lrc.config documents as an optional per-package file; it is not leftover cruft and is covered by the debian/* stanza.
• Installed paths and dh_missing: debhelper passes -DCMAKE_INSTALL_PREFIX=/usr and -DCMAKE_INSTALL_LIBDIR=lib/x86_64-linux-gnu, lib/cmake/unix.cmake:89-97 uses GNUInstallDirs, so the files land in /usr/lib/x86_64-linux-gnu, /usr/include and /usr/share/man/man7 and are all matched by the .install files - dh_missing's compat-13 --fail-missing default is satisfied; SOVERSION is the major of 3.0.1 (lib/cmake/unix.cmake:85-87), giving libIPSec_MB.so.3, which is what libipsec-mb3.symbols names.
• Build-Depends: cmake and nasm suffice (lib/CMakeLists.txt:38 needs nasm >= 2.14 and :52 >= 2.16.02 for SM3/SM4/SHA512-NI; Debian has nasm 3.01); perl, which lib/CMakeLists.txt's find_package(Perl REQUIRED) and the perlasm scripts need, comes with debhelper (Depends: perl:any).
• Standards-Version 4.7.4 against Policy 4.7.4.1 is current; debhelper-compat (= 14) is debhelper's recommended level; no maintainer scripts, no debian/patches, no systemd/init/tmpfiles content, so nothing of that kind to check.
• debian/upstream/metadata has Bug-Database, Bug-Submit, Repository and Repository-Browse; the changelog's entries, versions and target distributions are consistent with the .dsc, and the one bug closure (#1151145) is on 3.0.0+dfsg.really2.0.2-1.
• uscan found the packaged version as the newest upstream release (upstream 3.0.1, packaged 3.0.1+dfsg).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

Not confirmed

• No build was run (read-only review), so the exact compiler command lines were not observed; the conclusion in the third issue rests on debian/rules, the upstream CMake files, debhelper's cmake.pm and CMake's documented flag and variable-scope behaviour, and a build log would show it at once.
• Whether the upstream ctest suite that dh_auto_test runs (built twice, for build-static and build-shared; kat, xvalid, mp, zerolen, oob, abi-check apps) passes on a buildd - cannot be checked here. It needs no network, no libacvp (test/CMakeLists.txt only adds acvp-app if the library is found) and no Clang.
• Whether debian/libipsec-mb3.symbols matches every symbol the new library exports (the file lists 550 symbols, all at 3.0.1+dfsg-1); a build would tell.
• What the removed upstream docs/ directory contained, and why it was excluded: only the +dfsg tarball is provided, so the pristine upstream tarball could not be inspected.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: grep: "xd://policy" is not a file of the package or of the reviewing system.

Proposed changes

None.