DFSG, Licensing & New Packages Team

Hi,

Some issues were found in review which will mean you need to create a new version before it can be accepted.

1. [important] [licensing] Vendored transpiled JS (Project Fluent + Intl.js polyfill) misdescribed as AGPL-3+/Kazv Project in debian/copyright

• Files: debian/copyright:14-22, src/js/transformed-libs/fluent-bundle.js, src/js/transformed-libs/fluent-langneg.js, src/js/transformed-libs/fluent-sequence.js, src/js/transformed-libs/bundled-deps.js, src/js/package-lock.json, src/js/transform.bash
• Evidence: fluent-bundle.js starts with /* @fluent/bundle@0.16.1 */; src/js/package-lock.json records "license": "Apache-2.0" for the @fluent deps; transform.bash runs npx babel node_modules/@fluent/*/index.js and npx babel Intl.js/dist/Intl.complete.js to produce these files, which are then compiled into the app (l10n.js imports them). debian/copyright's Files: * stanza gives them Copyright: 2020-2026 Tusooa Zhu / The Kazv Project, License: AGPL-3+, and no other stanza mentions them.
• Problem: These committed, headerless, babel-minified bundles embed third-party code under permissive licences (Apache-2.0 Project Fluent; the canonical Intl.js polyfill is MIT). The catch-all misattributes files and licences, no copyright holders are named, and the Apache-2.0/MIT terms are not reproduced, so debian/copyright does not accurately describe these files (copyright-format spec sections 6.7 and 7.1; Policy 12.5), and the minified committed form lacks the generator input (the src/js/Intl.js submodule is empty in the tarball) - a preferred-form-for-modification concern.
• Fix: Add a Files: src/js/transformed-libs/* stanza (and, if kept vendored, treat src/js/package-lock.json consistently) with the real holders and License: Apache-2.0 referenced to /usr/share/common-licenses/Apache-2.0, plus an MIT/Expat stanza for bundled-deps.js (confirm the fork's actual licence upstream first), reproducing the permissive licence texts.

2. [important] [packaging] kazv binary lacks runtime Depends on QML modules and the Qt SQLite driver

• Files: debian/control:22-24
• Evidence: QML files import org.kde.kirigami, org.kde.kirigamiaddons.formcard/components/delegates and org.kde.coreaddons (About.qml:9-11, AvatarAdapter.qml:8); Video.qml imports QtMultimedia; db-store.cpp:65 calls QSqlDatabase::addDatabase(u"QSQLITE"_s, ...); the package has Depends: ${misc:Depends}, ${shlibs:Depends} only.
• Problem: shlibdeps only follows DT_NEEDED, so these runtime-only QML plugins/loadable modules are not pulled in; the desktop build does not even link Kirigami (src/CMakeLists.txt:142-145 links it only if(ANDROID)). A clean apt install kazv yields an app that cannot start (missing org.kde.*/QtMultimedia QML modules) and cannot open its cache store (missing SQLite driver). Upstream's own AppImage build installs exactly these modules (packaging/GNU-Linux/appimage/build.sh:27-52, incl. qml6-module-qtmultimedia, libqt6sql6-sqlite, and the kf6-kirigami/coreaddons/kirigami-addons dev packages). Policy 7.2 requires Depends to name packages needed for significant functionality.
• Fix: Add to kazv's Depends at least qml6-module-org-kde-kirigami, qml6-module-org-kde-kirigamiaddons-formcard (which pulls components/delegates), qml6-module-org-kde-coreaddons, qml6-module-qtmultimedia and libqt6sql6-sqlite; verify the remaining QtQuick.Controls/Layouts/Shapes modules are covered transitively via kirigami's module deps, and test on a minimal chroot.

3. [minor] [licensing] Impossible copyright year range '2024-3036' in a Files stanza

• Files: debian/copyright:77
• Evidence: Copyright: 2024-3036 The Kazv Project / 2020-2026 nannanko <nannanko@kazv.moe> / 2020-2026 Tusooa Zhu <tusooa@kazv.moe>
• Problem: '3036' appears to be a typo for '2026'; the stanza covers CacheSettings.qml, kazv-file.cpp, sso-login-process-test.cpp and the 100-ui.ftl files, so the copyright statement is factually wrong.
• Fix: Correct to 2024-2026 The Kazv Project.

4. [minor] [packaging] Standards-Version one release behind current

• Files: debian/control:12
• Evidence: Standards-Version: 4.7.4; current Debian Policy is 4.7.4.1.
• Problem: The policy-conformance statement is out of date (4.7.4.1 is a point-release update of 4.7.4; nothing substantive is likely affected, but the field should state what was checked).
• Fix: Bump to 4.7.4.1 after reviewing the 4.7.4.1 changes (Policy appendix A10).

5. [minor] [packaging] Leftover licensecheck draft debian/copyright.in shipped with FIXME placeholders

• Files: debian/copyright.in
• Evidence: Header Upstream-Name: FIXME, Upstream-Contact: FIXME, Disclaimer: Autogenerated by licensecheck, and a stanza with Copyright: NONE / License: UNKNOWN FIXME for the top-level docs and CHANGELOG.
• Problem: The generated draft is superseded by the hand-written debian/copyright; shipping it in the source tree is confusing and it contains misleading UNKNOWN/FIXME licensing claims that duplicate debian/copyright.
• Fix: Remove debian/copyright.in from the source package, or keep it only as a maintainer artifact (gitignore it / generate it on demand).

Thanks!