DFSG NEW review for kazv version 0.7.0-3

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 1 blocker, 1 important, 3 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 823 found (783 not listed by the scan, so not checked)

Licensing

Every licence in the tree is free (AGPL-3+, Apache-2.0, Expat/MIT, FSFAP) and the transpiled JavaScript has its sources properly supplied under debian/missing-sources, so there is no DFSG problem with the software itself. debian/copyright is nevertheless inaccurate: the Intl.js/CLDR data is under the Unicode Terms of Use, not plain Expat, and its permission notice is not reproduced; and the AGPL-3+ paragraph points at a file under /usr/share/common-licenses that does not exist on the reviewing system, so the binary package carries no AGPL text. A further stanza carries an impossible copyright year.

Packaging

Control, rules, changelog, gbp.conf, qmldeps.overrides and upstream/metadata are conventional and correct for a Qt6/KF6 package built with debhelper 14 and the pkg-kde-tools dh sequences; all Build-Depends names exist in the archive, there are no patches to review, and the single binary package needs no explicit substvars at compat 14. Remaining gaps are minor: nothing runs the upstream test suite (and there is no autopkgtest), and the Qt image-format plugins that upstream calls a recommended runtime dependency are not in Recommends.

Issues

1. [blocker] [licensing] Unicode licence of the Intl.js/CLDR data is misdescribed as Expat and its notice is missing

• Files: debian/copyright:16-22, debian/copyright:113-131, debian/missing-sources/src/js/Intl.js/LICENSE.txt:29-64, debian/missing-sources/src/js/Intl.js/locale-data/, src/js/transformed-libs/bundled-deps.js
• Basis: checked, in the package or with a reference tool
• Evidence: LICENSE.txt: Copyright (c) 1991-2013 Unicode, Inc. All rights reserved. Distributed under the Terms of Use in http://www.unicode.org/copyright.html. and provided that ... (c) there is clear notice in each modified Data File or in the Software ... that the data or software has been modified.; the same file's debian/copyright stanza says License: Expat and the Expat paragraph (lines 113-131) contains only the MIT text.
• Problem: The locale data under debian/missing-sources/src/js/Intl.js/locale-data/ and the copy compiled into src/js/transformed-libs/bundled-deps.js are under the Unicode Terms of Use, which is the Expat permission with added conditions (modification marking, trademark clause). DEP-5 section 7.1 says a licence that differs from a common one by added restrictions needs a distinct short name (Expat must not be used for it), and section 6.7 requires the full text and notices. The Unicode permission notice is not reproduced anywhere in debian/copyright, so the installed copyright file does not carry the notice the licence requires to appear in associated documentation.
• Fix: Add a stand-alone License stanza containing the full Unicode notice under a distinct short name (for example Unicode-DFS-2016), and apply it to the Unicode data - alone, or as Expat and Unicode-DFS-2016 for files such as bundled-deps.js that mix Intl.js code with CLDR data.

2. [important] [licensing] AGPL-3+ paragraph points at a non-existent file under /usr/share/common-licenses

• Files: debian/copyright:109-111
• Basis: checked, in the package or with a reference tool
• Evidence: version 3 can be found in /usr/share/common-licenses/AGPL-3'.; the reviewing system's /usr/share/common-licenses contains AGPL-3.0and noAGPL-3`.
• Problem: Policy 12.5 requires a verbatim copy of the distribution licence in /usr/share/doc/kazv/copyright. The package relies on a common-licenses pointer, but the pointer is dangling, so the binary package ships no AGPL text at all - the licence covers nearly every file.
• Fix: Reference /usr/share/common-licenses/AGPL-3.0 instead, or include the full AGPL-3 text in the License stanza.

3. [minor] [licensing] Impossible copyright year 2024-2036 in a Files stanza

• Files: debian/copyright:78
• Basis: checked, in the package or with a reference tool
• Evidence: 2024-2036 The Kazv Project
• Problem: The end year is in the future and matches no file notice; the files listed in that stanza carry years such as 2020-2023 (nannanko) and 2024 (tusooa), so the copyright information is wrong.
• Fix: Replace with the years actually present in the files (apparently 2024-2026 or 2020-2026).

4. [minor] [packaging] No autopkgtest, and the upstream test suite is disabled at build time

• Files: debian/rules:10, debian/rules:13-15
• Basis: inferred from what was read, not seen directly
• Evidence: -Dkazv_BUILD_TESTS=OFF (line 10) and override_dh_auto_test: followed by # Slow and flaky, disable for now. / #xvfb-run dh_auto_test (lines 13-15); there is no debian/tests/control.
• Problem: Neither the build nor autopkgtest exercises anything, although the source contains a sizeable test suite in src/tests/ and a working upstream dh_auto_test invocation is commented out. For a new package this leaves the archive with no automated check of the binary at all.
• Fix: Add a debian/tests/control with at least a smoke test of the installed binary (e.g. under xvfb-run), and re-enable the unit tests at build time where they are not prohibitively slow or flaky.

5. [minor] [packaging] Missing Recommends for the Qt image-format plugins upstream calls a recommended runtime dependency

• Files: debian/control:40, README.md:76
• Basis: inferred from what was read, not seen directly
• Evidence: README.md: (ImageFormats is a recommended runtime dependency, without which formats like webp cannot be displayed); the binary stanza has only Depends: libqt6sql6-sqlite.
• Problem: Without the image-format plugins the client cannot render webp (and similar) images received in Matrix messages, although upstream documents the plugin package as recommended for normal operation.
• Fix: Add Recommends: qt6-image-formats-plugins to the kazv binary package.

Verified

• The scan's minified-code list, file by file: each of debian/missing-sources/src/js/Intl.js/dist/Intl.complete.js, debian/missing-sources/src/js/Intl.js/dist/Intl.min.js, debian/missing-sources/src/js/Intl.js/locale-data/complete.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/af-NA.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/af-ZA.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/af.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/agq-CM.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/agq.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ak-GH.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ak.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/am-ET.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/am.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-001.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-AE.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-BH.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-DJ.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-DZ.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-EG.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-EH.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-ER.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-IL.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-IQ.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-JO.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-KM.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-KW.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-LB.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-LY.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-MA.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-MR.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-OM.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-PS.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-QA.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-SA.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-SD.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-SO.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-SS.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-SY.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-TD.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-TN.js, debian/missing-sources/src/js/Intl.js/locale-data/jsonp/ar-YE.js is a build product of the Intl.js fork (dist bundles from src/ + Gruntfile.js, complete.js/jsonp from locale-data/json/*.json), and all of those inputs are present in the same missing-sources tree; the third kind of file on the list is src/js/transformed-libs/bundled-deps.js, Babel output of Intl.js/dist/Intl.complete.js per src/js/transform.bash. None is an unsourced or non-free file; all are accounted for by Policy 4.16 option 2.
• debian/missing-sources is actually part of the source package: it is present in kazv_0.7.0-3.debian.tar.xz and no debian/*.install file installs it into the binary.
• src/js/transformed-libs/fluent-bundle.js, fluent-sequence.js and fluent-langneg.js are Babel output of the @fluent/bundle, @fluent/sequence and @fluent/langneg sources retained under debian/missing-sources/src/js/fluent/ (per src/js/transform.bash), so they are not unsourced build products either.
• Other generated files have their generators in the tree: src/js/sas-emoji-defs.js from src/js/scripts/update-sas-emojis.mjs, and src/contents/ui/emoji/*.qml from tools/emoji.lisp; those generators fetch data over the network at run time but are not used by the build, and they are upstream tools, not instructions to the reviewer.
• Binary assets icons/kazv.ico, icons/kazvlogo-256.png and src/android/res/drawable/kazv.png are images under the Files: * AGPL-3+ stanza; no separate licence notice for them was found in the tree.
• Copyright holders: nannanko, xploreinfinity, April Simone, juangburgos, Unicode, Inc., Andy Earnshaw, Zibi Braniecki, Stas Malolepszy and the Mozilla Foundation all have a matching Files stanza; the prescan's author check reported no holder missing from debian/copyright, and I re-checked nannanko's files against the two stanzas that name that holder.
• debian/copyright is DEP-5 with the current Format: URI; the Files: lists are applied last-match-wins, the debian/* stanza is correctly overridden by the later missing-sources/fluent stanzas, and the empty first line after Files: is the form the copyright-format specification itself uses in its examples.
• No non-free terms: the only matches for non-commercial/NoDerivatives/field-of-use wording are inside the AGPL text in COPYING; no JSON Good, not Evil, CC-*-NC or -ND, or no-modification clause exists in the tree.
• No compiled artifacts in the tree: no .so, .a, .jar, .class, .pyc, .dll, .exe, firmware or PDF; the only binary files are the three images named above.
• Packaging files read in full: debian/control, rules, changelog, source/format, gbp.conf, qmldeps.overrides, upstream/metadata; there is no debian/patches directory, which is consistent with 3.0 (quilt).
• Build-Depends names checked against the archive: dh-sequence-single-binary is provided by debhelper, dh-sequence-kf6 and dh-sequence-qmldeps by pkg-kde-tools, and libkazv-dev, qcoro-qt6-dev, kirigami-addons-dev, libkirigami-dev, libkf6kio-dev, liblager-dev, cmark and libqt6sql6-sqlite all exist.
• At debhelper compat 14, dh_gencontrol adds relationship substvars itself, so the binary stanza's bare Depends: libqt6sql6-sqlite without ${shlibs:Depends}/${misc:Depends} is not a defect and is not reported.
• Standards-Version: 4.7.4 matches the reviewing system's Policy 4.7.4.1 under the first-two-components rule; the changelog's version, distribution and bug closure are sane and Vcs-*/Homepage are filled in.
• Coverage: I read all of debian/ except debian/watch (out of scope) and inventoried src/, tools/, packaging/ and icons/; the 300+ file missing-sources tree was covered through its LICENSE, package.json files and complete file listing rather than every file's contents. .pc/ was ignored throughout.
• uscan found the packaged version as the newest upstream release (upstream 0.7.0, packaged 0.7.0).

Not confirmed

• src/js/sas-emoji-defs.js is generated from matrix-org/matrix-spec's data-definitions/sas-emoji.json; I could not check that data's licence offline, so I cannot confirm that the Files: * AGPL-3+ claim is right for it.
• I could not run a build or the JavaScript toolchain, so I did not verify that src/js/transformed-libs/*.js are reproducible from the sources kept in debian/missing-sources - only that the sources are present.
• The CLDR data in debian/missing-sources/src/js/Intl.js/locale-data/ is described as a modified form of CLDR; whether the fork marks the modifications as the Unicode Terms of Use, clause (c), requires is not determinable from the tree alone.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: grep: "/var/lib/dpkg/info/base-files.list" is not a file of the package or of the reviewing system.

Proposed changes

None.