DFSG NEW review for intel-ipsec-mb version 3.0.1+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 4 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code itself is DFSG-free: everything is BSD-3-Clause or Apache-2.0 (both free and mutually compatible), debian/* is GPL-2+, and no non-free wording (non-commercial, no-modification, field-of-use, CC-*-NC/ND) appears anywhere in the tree. debian/copyright is in DEP-5 format but is inaccurate: it names only Intel Corporation as copyright holder, while four other holders appear in the file headers — The OpenSSL Project Authors (the large vendored OpenSSL tree under lib/openssl/ and lib/include/openssl/), Kitware, Inc. and Contributors (two CMake files), Nokia (one test file) and SUSE LLC (the SUSE spec file). The licences of those files are stated correctly; only the holders are missing.

Packaging

Packaging is sound: debhelper compat 14 with a minimal dh ${@} rules file, two build directories giving the shared and static libraries that debian/.install expect, correct library/dev split, a 550-entry symbols file whose soname mathches the package name, man pages and the single public header installed, no patches, no maintainer scripts, current Standards-Version 4.7.4 (Policy 4.7.4.1) and sane Vcs-/changelog fields. The only remarks are that the vendored OpenSSL code is built into the runtime library without being documented for Debian, and that the Linux build leaks the vendored OpenSSL internal symbols into libIPSec_MB.so.3.

Issues

1. [blocker] [licensing] debian/copyright does not name The OpenSSL Project Authors, holder of the vendored OpenSSL files under lib/openssl/ and lib/include/openssl/

• Files: debian/copyright:11-21, lib/openssl/crypto/sha/sha3_ossl.c:2, lib/openssl/crypto/perlasm/x86_64-xlate.pl:2, lib/openssl/crypto/ml_dsa/ml_dsa_ntt.c:2, lib/openssl/crypto/ml_kem/ml_kem.c:2, lib/openssl/crypto/sha/asm/keccak1600-x86_64.pl:2, lib/include/openssl/crypto/ml_dsa.h:2, lib/include/openssl/internal/constant_time.h:2, lib/include/openssl/compat/internal/sha3.h:8, lib/include/openssl/compat/openssl_compat.h:8
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: Files:\n lib/include/openssl/*\n lib/openssl/*\nCopyright: 2012-2025 Intel Corporation; the files themselves say e.g. * Copyright 2017-2026 The OpenSSL Project Authors. All Rights Reserved. (sha3_ossl.c:2) and * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. (compat/internal/sha3.h:8), the latter under the overriding stanza lib/include/openssl/compat/internal/* / lib/include/openssl/compat/openssl* which also names only Intel.
• Problem: DEP-5 requires the Copyright field to record the actual holders (copyright-format 6.5/6.6); naming only Intel Corporation is inaccurate and incomplete for ~35 files that carry The OpenSSL Project Authors' notice. The licence short names (Apache-2.0 for lib/openssl/* and lib/include/openssl/*, Apache-2.0 or BSD-3-clause for the compat/ tree) are correct, so only the holder line is wrong.
• Fix: Add The OpenSSL Project Authors with its years to the Copyright of the stanzas covering lib/openssl/* and lib/include/openssl/* (including the compat/ override stanza), merging it with the existing Intel line.

2. [blocker] [licensing] debian/copyright Files: * does not name Kitware, Inc. and Contributors, holder of CMakeLists.txt and lib/cmake/uninstall.cmake.in

• Files: debian/copyright:7-9, CMakeLists.txt:3, lib/cmake/uninstall.cmake.in:3
• Basis: checked, in the package or with a reference tool
• Evidence: # Copyright 2000-2023 Kitware, Inc. and Contributors (CMakeLists.txt:3 and lib/cmake/uninstall.cmake.in:3); debian/copyright Files: * gives only Copyright: 2012-2025 Intel Corporation.
• Problem: Both files carry a second copyright holder that debian/copyright does not record. Their licence (BSD-3-Clause, per the SPDX line in both files) is already covered by the Files: * stanza, so only the holder is missing.
• Fix: Add Kitware, Inc. and Contributors (2000-2023) to the Copyright of a stanza covering these two files, or list them explicitly.

3. [blocker] [licensing] debian/copyright Files: * does not name Nokia, holder of test/kat-app/snow3g_test.c

• Files: debian/copyright:7-9, test/kat-app/snow3g_test.c:3
• Basis: checked, in the package or with a reference tool
• Evidence: Copyright (c) 2022, Nokia with SPDX-License-Identifier: BSD-3-Clause (test/kat-app/snow3g_test.c:3-4); the Files: * stanza names only Intel Corporation.
• Problem: A holder present in the file is absent from debian/copyright, making the file's stanza inaccurate as to copyright.
• Fix: Add 2022 Nokia to the Copyright of the stanza covering test/kat-app/snow3g_test.c.

4. [blocker] [licensing] debian/copyright Files: * does not name SUSE LLC, holder of rpm/SUSE/intel-ipsec-mb.spec

• Files: debian/copyright:7-9, rpm/SUSE/intel-ipsec-mb.spec:4
• Basis: checked, in the package or with a reference tool
• Evidence: # Copyright (c) 2022-2024 SUSE LLC (rpm/SUSE/intel-ipsec-mb.spec:4), whose text also states the file is under the same licence as the pristine package (BSD-3-Clause here); debian/copyright names only Intel Corporation.
• Problem: The RPM spec ships in the source package and carries a holder debian/copyright omits.
• Fix: Add 2022-2024 SUSE LLC to the Copyright of the stanza covering rpm/SUSE/intel-ipsec-mb.spec (BSD-3-clause).

5. [minor] [packaging] Vendored OpenSSL implementation built into libIPSec_MB.so.3 without being documented for Debian

• Files: lib/openssl/README.md, lib/CMakeLists.txt:155-158, lib/include/openssl/README.md, lib/openssl/crypto/ml_dsa/asm/ml_dsa_ntt-x86_64.pl, lib/openssl/crypto/sha/asm/keccak1600-x86_64.pl, lib/openssl/crypto/perlasm/x86_64-xlate.pl
• Basis: inferred from what was read, not seen directly
• Evidence: lib/openssl/README.md: "Files under this tree ... are copied verbatim (or with only cosmetic/Intel modifications) from" OpenSSL, commit: 626ff8fd9344eb46e50464960ce84dcbacf5a4dd; lib/CMakeLists.txt:155-158 globs ${DIR_CURRENT}/openssl/crypto/ml_dsa/*.c, ${DIR_CURRENT}/openssl/crypto/ml_kem/*.c and ${DIR_CURRENT}/openssl/crypto/sha/*.c into the library.
• Problem: About 30 files copied from OpenSSL (ML-DSA, ML-KEM, SHA-3 and the perlasm back end) are compiled into the shipped library. This is legitimate here (they are OpenSSL internal code that libcrypto does not install), and debian/copyright does declare the Apache-2.0 licence, but the vendoring is nowhere stated in the Debian packaging, so a later maintainer cannot tell that an OpenSSL CVE may need checking against a copy inside this package.
• Fix: Note the vendored copy and its OpenSSL commit in debian/README.source (or a Comment field in debian/copyright), and keep the holders correct as per the licensing issues above.

6. [minor] [packaging] libIPSec_MB.so.3 exports the vendored OpenSSL internal symbols (SHA3_absorb, SHA3_squeeze, ...)

• Files: debian/libipsec-mb3.symbols:1-13, lib/libIPSec_MB.def:1-28, lib/CMakeLists.txt, CMakeLists.txt:59-61
• Basis: inferred from what was read, not seen directly
• Evidence: debian/libipsec-mb3.symbols: SHA3_absorb@Base 3.0.1+dfsg-1, SHA3_shake128_x4_avx512vl@Base 3.0.1+dfsg-1, SHA3_squeeze@Base 3.0.1+dfsg-1; the corresponding sources are the vendored lib/openssl/crypto/sha/sha3_ossl.c etc. The intended export list, lib/libIPSec_MB.def (Windows), contains no SHA3_* or perlasm symbol, and CONTRIBUTING:263 says symbols are exported when "defined in intel-ipsec-mb.h and symbols added to libIPSec_MB.def".
• Problem: On Linux no visibility control (-fvisibility=hidden or a version script) is used, so the vendored OpenSSL internals are exported from libIPSec_MB.so.3 although they are not part of the API. A process loading both libcrypto and libIPSec_MB can resolve the unversioned names to this library's copy, which is a real interposition hazard for the packet-processing stacks this library targets.
• Fix: Build the library with hidden visibility and an explicit export list (the existing libIPSec_MB.def, or a version script), then regenerate debian/libipsec-mb3.symbols so only the documented API is exported.

Verified

• debian/copyright is in DEP-5 format (correct Format: URL) and was read in full; its Files: patterns were checked against the tree using copyright-format 6.9 semantics (* and ? match /, last matching stanza wins).
• Licences found in the tree: BSD-3-Clause (SPDX, Intel Corporation; LICENSE 2012-2026) and Apache-2.0 (the vendored OpenSSL tree; LICENSE.OpenSSL is the verbatim Apache-2.0 text) — both DFSG-free and mutually compatible; debian/* is GPL-2+.
• No non-free terms anywhere: no non-commercial, no modification/no derivative, field-of-use, JSON Good, not Evil or CC-*-NC/ND wording (searched the whole tree).
• No built artefacts shipped: no .so/.a/.o/.dll/.exe/.jar/.pyc/.pdf/.min.js or similar anywhere in the tree (globbed by extension).
• Files-Excluded: docs in debian/copyright matches the tree: there is no docs/ directory (only a ../docs/doc_api OUTPUT_DIRECTORY string in lib/api_doxygen.conf).
• README.md's "Legal Disclaimer" ("THIS SOFTWARE IS PROVIDED BY INTEL"AS IS"...") is Intel's generic product disclaimer, not a licence restriction; the files it accompanies carry an explicit BSD-3-Clause grant, so it is not a DFSG problem.
• The three BSD-3-Clause exceptions in the vendored tree (lib/openssl/crypto/ml_dsa/ml_dsa_sample_hw_x86_64_avx2.c and avx512.c, lib/openssl/crypto/ml_kem/asm/ml_kem_ntt-x86_64.pl, lib/openssl/crypto/sha/sha3_x4_avx2.c) were opened and carry only the Intel BSD-3-Clause header — the separate stanza for them is correct.
• The 35 vendored OpenSSL files' licences match their stanzas (Apache-2.0, or Apache-2.0 or BSD-3-clause under compat/); only their holders are missing from debian/copyright.
• Packaging read in full: debian/{control,rules,changelog,copyright,lrc.config,source/format,upstream/metadata,.install,.docs,*.symbols}; single dh ${@} at compat 14, no debian/patches, no maintainer scripts, no autopkgtest.
• Build wiring checked against the tree: the two build directories produce the shared library and the static library matched by debian/*.install; unix.cmake installs only lib/intel-ipsec-mb.h as a header and lib/libipsec-mb.7 + lib/libipsec-mb-dev.7 under share/man/man7 (both files exist); test/imb-provider (which would install a .so) is not added by test/CMakeLists.txt, so dh_missing --fail-missing has nothing unreported.
• Build-Depends cmake and nasm are used; CMakeLists.txt:60 has find_package(Perl REQUIRED), but the perlasm scripts use only core modules (use strict, use integer), which the Essential perl-base provides, so no non-Essential perl build dependency is missing.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (debian-policy changelog) — current; soname package name libipsec-mb3 matches libIPSec_MB.so.3 in the symbols file; changelog distributions sid/experimental are consistent.
• uscan found the packaged version as the newest upstream release (upstream 3.0.1, packaged 3.0.1+dfsg).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, GPL-2).

Not confirmed

• No build or test was run: whether the two build directories build and whether ctest passes in both is not verified.
• Whether Debian's libcrypto also exports the same unversioned SHA3_* names could not be checked without inspecting a binary file, so the interposition risk in the symbols finding is reasoned, not observed.

Proposed changes

None.