DFSG NEW review for kazv version 0.7.0-2

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 1 blocker, 2 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 1 found

Licensing

Licensing and attribution are almost entirely in order: the tree is AGPL-3.0-or-later as debian/copyright says, with a handful of correctly identified permissive files (Expat for src/qfunctionutils.hpp and src/js/transformed-libs/bundled-deps.js, Apache-2.0 for the fluent-*.js, FSFAP for the AppStream file), all text present or referenced to /usr/share/common-licenses, and all holders seen in the file headers are named in the copyright file. The file is DEP-5 with the correct Format URL. It is not DFSG-clean as shipped, however: src/js/transformed-libs/ holds generated JavaScript whose preferred form is not in the package. bundled-deps.js is a 741 KB minified single-line bundle, and its input (src/js/Intl.js/, an empty git submodule) is absent, so neither the file nor its sources can be modified here; the fluent-*.js files are Babel output of the @fluent npm packages, whose sources are also absent although Debian ships node-fluent-bundle. No debian/missing-sources exists.

Packaging

The packaging is close to uploadable: 3.0 (quilt), debhelper-compat 14 with dh sequences, hardening=+all, Standards-Version 4.7.4.1 which is current, sane changelog, Vcs-* fields, a tidy single binary package, and every Build-Depends I checked resolves in the archive. Two things a sponsor would send back: the binary's Depends field omits ${shlibs:Depends} and ${misc:Depends} (and the substvar dh-sequence-qmldeps provides), so the package declares no dependency on the libraries it links nor on the QML modules it imports; and there is no autopkgtest while the build disables upstream's test suite entirely. Minor: an unused cmark build dependency.

Issues

1. [blocker] [licensing] src/js/transformed-libs/bundled-deps.js is a minified bundle whose source is not in the package

• Files: src/js/transformed-libs/bundled-deps.js (whole file, one 741.6 KB line); src/js/transform.bash:6; src/js/Intl.js/ (empty directory); .gitmodules
• Evidence: The file starts !function(e,t){"object"==typeof exports&&... and consists of one minified line. src/js/transform.bash line 6: npx babel Intl.js/dist/Intl.complete.js > transformed-libs/bundled-deps.js. debian/copyright: Files: src/js/transformed-libs/bundled-deps.js / Copyright: 2013 Andy Earnshaw / License: Expat / Comment: Source available from https://r.lily-is.land/the-kazv-project/Intl.js-fork ... Transpiled from Intl.js/dist/Intl.complete.js. .gitmodules lists src/js/Intl.js, and that directory is empty in the tarball.
• Problem: The source package ships only the generated, minified form of this code. Its generator input (the Intl.js fork) is not present anywhere in the tree - src/js/Intl.js is an unpopulated git submodule, so transform.bash cannot be run - and there is no debian/missing-sources. DFSG #2 and Policy 4.16 require the preferred form for modification to be distributed; a minified JS file isn't it. The file is also the only copyright holder entry not backed by a notice in the file itself, since the minified bundle carries none.
• Fix: Repack the upstream tarball to include the Intl.js fork sources, or place them under debian/missing-sources/ following the convention in Policy 4.16 (e.g. debian/missing-sources/src/js/Intl.js/...); alternatively drop the pre-built bundle and generate it at build time from packaged sources. Add the fork's own copyright holders to the stanza once the fork's sources are available, and note the repack in debian/README.source.

2. [important] [licensing] fluent-.js are Babel output of @fluent/ whose sources are not in the package, and Debian already ships those libraries

• Files: src/js/transformed-libs/fluent-bundle.js, src/js/transformed-libs/fluent-langneg.js, src/js/transformed-libs/fluent-sequence.js; src/js/transform.bash:3-5
• Evidence: Each file's first line is a version banner: /* @fluent/bundle@0.16.1 */, /* @fluent/langneg@0.5.2 */, /* @fluent/sequence@0.6.0 */. transform.bash lines 3-5: npx babel node_modules/@fluent/bundle/index.js > transformed-libs/fluent-bundle.js (and the same for sequence and langneg). debian/copyright: Comment: Source available from https://registry.npmjs.org/@fluent/ with License: Apache-2.0. Debian ships node-fluent-bundle 0.19.1, which provides node-fluent-bundle, node-fluent-langneg and node-fluent-sequence.
• Problem: Same Policy 4.16 problem as the minified bundle: these are transpiled files shipped without their sources - node_modules/ is not in the tarball and .gitignore excludes it - so the shipped form is not the preferred form for modification and the files cannot be regenerated from the source package. Additionally, Policy 4.13 discourages convenience copies of code Debian already packages, and these are copies of a library (Project Fluent) that Debian has in node-fluent-bundle.
• Fix: Ship the corresponding npm sources (the 0.16.1/0.5.2/0.6.0 tarballs' sources) under debian/missing-sources/, or repack, so the bundles can be regenerated at build time; where Debian's node-fluent-* versions are usable, build against those instead of carrying convenience copies. Keep the version banners and the Apache-2.0 stanza.

3. [important] [packaging] kazv binary package Depends omits ${shlibs:Depends} and ${misc:Depends}

• Files: debian/control:39 (kazv stanza)

• Evidence:

  Package: kazv
  Architecture: any
  Depends: libqt6sql6-sqlite
  Description: ...
  ``` - the only dependency is the SQLite driver plugin; the variable placeholders are absent.
  

• Problem: dh_shlibdeps computes the shared-library dependencies and dh_gencontrol substitutes them only into a ${shlibs:Depends} placeholder; with no such placeholder the whole computed list is dropped, so the package declares no dependency on the Qt 6, KF 6 or system libraries it links against (Policy 8.6.1). ${misc:Depends} is likewise unused. dh-sequence-qmldeps is enabled (debian/control:6), but the QML runtime modules it adds also reach the binary only through a substvar the control file does not carry - the QML files import org.kde.kirigami, org.kde.kirigamiaddons.formcard/.components, org.kde.coreaddons and QtMultimedia, so those runtime modules are currently not pulled in either.

• Fix: Write the field as Depends: libqt6sql6-sqlite, ${shlibs:Depends}, ${misc:Depends} plus the placeholder that the enabled qmldeps sequence provides (as generated packages using that sequence do), and re-check the resulting binary's Depends with dpkg-deb -f ... Depends.

4. [minor] [packaging] No autopkgtest, and the upstream test suite is disabled in the build

• Files: debian/rules:10-12; no debian/tests/ directory

• Evidence:

  override_dh_auto_test:
  	# Slow and flaky, disable for now.
  	#xvfb-run dh_auto_test
  ``` and `-Dkazv_BUILD_TESTS=OFF` in `override_dh_auto_configure`; upstream has ~25 unit tests in `src/tests/CMakeLists.txt` and 40 Qt Quick tests.
  

• Problem: Nothing verifies the package in the archive: no autopkgtest, and the build compiles and runs no tests at all. For a new package the maintainer should give at least one smoke test, even if the full suite stays off.

• Fix: Add a minimal debian/tests/control (for example a kazv --help/--version smoke test) and, if feasible, an autopkgtest that runs a subset of the upstream tests; or explain in debian/rules/README.source why the suite must remain disabled.

5. [minor] [packaging] Unused 'cmark' build dependency

• Files: debian/control:9
• Evidence: Build-Depends: ... cmake, cmark, extra-cmake-modules, ...; the only use of cmark is find_package(cmark) / pkg_search_module(cmark libcmark ...) in CMakeLists.txt:79-87 and #include <cmark.h> in src/kazv-markdown.cpp, i.e. the library; nothing in the tree, including debian/rules, invokes a cmark executable.
• Problem: The cmark binary package is pulled into the build environment for nothing; the C library comes from libcmark-dev, which is already listed.
• Fix: Drop cmark from Build-Depends (keep libcmark-dev).

Verified

• debian/copyright is DEP-5 (Format URL is the current one) and its stanzas match what I found: Files: * AGPL-3+ for the bulk of the tree, debian/* for the packaging, and separate stanzas for the fluent bundles (Apache-2.0), bundled-deps.js (Expat), the AppStream file (FSFAP), src/l10n/hi/100-ui.ftl (xploreinfinity), src/qfunctionutils.hpp (Expat) and the nannanko/April Simone files.
• Every copyright holder named in a file header is represented: tusooa <tusooa@kazv.moe> / Tusooa Zhu, nannanko <nannanko@kazv.moe> (27 named files plus the grouped stanza), April Simone <apr3vau@outlook.com> (src/tests/quick-tests/tst_ReactToEventPopup.qml, tools/emoji.lisp), xploreinfinity (src/l10n/hi/100-ui.ftl) and juangburgos (src/qfunctionutils.hpp); the prescan's author check agrees.
• src/qfunctionutils.hpp carries SPDX-License-Identifier: MIT for juangburgos; debian/copyright gives it License: Expat with the full Expat text - same licence, correctly reproduced (the only MIT-less-than-full-text case, and it is present).
• moe.kazv.mxc.kazv.appdata.xml declares <metadata_license>FSFAP</metadata_license> / <project_license>AGPL-3.0-or-later</project_license>, matching its FSFAP stanza and the tree's AGPL; the FSFAP text is reproduced in full.
• src/js/transformed-libs/bundled-deps.js is the minified/generated file the prescan flagged; it is reported above as an issue, not waved through.
• Generated files whose generators and inputs are present and readable were checked and are fine: src/contents/ui/emoji/*.qml are emitted by tools/emoji.lisp (present, AGPL-3.0-or-later, header says so), and src/js/sas-emoji-defs.js is emitted by src/js/scripts/update-sas-emojis.mjs (present) as plain readable JS holding the emoji list.
• Binary files recorded, not opened: icons/kazv.ico, icons/kazvlogo-256.png, src/android/res/drawable/kazv.png. They fall under Files: * (AGPL-3+) and I found no notice or other terms for them; no provenance problem is visible in the package.
• COPYING is the AGPL-3 text (the tree's declared licence) and README.md states AGPL; no other LICENSE/COPYING/NOTICE file exists anywhere in the tree, per a full glob.
• src/l10n/zh-Hans is a zero-byte, unused file in the tarball; src/l10n/translations.qrc maps zh-Hans/* to cmn-Hans/* by alias, so it is not referenced and has no licensing significance.
• Build dependencies spot-checked against the archive: libkazv-dev 1.0.0-1, kirigami-addons-dev 1.14.2-2, libqt6sql6-sqlite 6.11.2+dfsg-5 and dh-sequence-single-binary (provided by debhelper 14.5) all exist; dh-sequence-kf6 and dh-sequence-qmldeps come from packages already in Build-Depends.
• Standards-Version: 4.7.4.1 equals the reviewing system's Policy version 4.7.4.1, so it is current; hardening=+all is set in debian/rules and the package builds with dh.
• debian/changelog: version 0.7.0-2, unstable, maintainer consistent with debian/control, initial release closes an ITP bug number; gbp.conf, debian/source/format (3.0 quilt), debian/upstream/metadata and debian/qmldeps.overrides are all well-formed; there are no patches, no maintainer scripts and no debian/missing-sources.
• uscan found the packaged version as the newest upstream release (upstream 0.7.0, packaged 0.7.0).

Not confirmed

• The Intl.js fork (https://r.lily-is.land/the-kazv-project/Intl.js-fork) and the @fluent npm sources are outside what I may read, so I could not check whether the 2013 Andy Earnshaw / 2016 Zibi Braniecki, Stas Malolepszy attributions in debian/copyright are complete for those files, nor whether the fork carries additional holders.
• I could not read dh_qmldeps (no manual page and no installed copy on the reviewing system), so the exact substvar the enabled qmldeps sequence expects is stated from the packaging convention rather than from the tool's own documentation; a build would show it.
• No build or test was run and I did not check that the QtMultiMedia/QtQuick libraries are pulled in by the remaining dependencies.

Proposed changes

None.