Review: kronosnet 1.35-1
Package Information
| Description | kronosnet protocol dissector for Wireshark ${S:X-Common-Description} This package contains the Wireshark dissector. |
|---|---|
| Maintainer | Debian HA Maintainers <debian-ha-maintainers@alioth-lists.debian.net> |
| Changed By | Ferenc Wágner <wferi@debian.org> |
| Sponsor | wferi@debian.org |
| Distribution | unstable |
| Architecture | any all |
| VCS | git: https://salsa.debian.org/ha-team/kronosnet.git (browse) |
| Closes | #1142847 |
| Popcon Installs | 2540 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/kronosnet |
| Uploaded | 1 month, 11 days ago |
New Package Report
.changes
| Changed-By | Ferenc Wágner <wferi@debian.org> |
|---|---|
| Architecture | source amd64 all |
| Distribution | unstable |
| Date | Sun, 27 Sep 2026 20:22:30 +0200 |
| Source | kronosnet |
| Version | 1.35-1 |
Changelog
kronosnet (1.35-1) unstable; urgency=medium
.
* [c61640a] New upstream release (1.35) (Closes: #1142847)
Contains fixes for CVE-2026-15811, CVE-2026-15812 and CVE-2026-15813.
* [bd53aef] Update Standards-Version to 4.7.4 (no changes required)
* [db73b61] New patch: libknet/wireshark/Makefile.am: handle.c uses ceil,
which generally requires using the math library
* [cc02831] Upstream commit 39327848 converted README to Markdown
* [bf2291b] New binary package for the dissector: kronosnet-wireshark
* [6c1f5aa] Update symbols files
* [0210371] Update watch file to version 5
* [0ace58d] New patch: libknet/wireshark/Makefile.am: use our generic compiler
and linker flags
* [d3c6583] debian/tests: do not rely on testbed reuse.
Autopkgtest 6 stopped reusing testbeds for better isolation, thus we
need to configure separately for the two test suites.
* [01d1056] debian/tests/control: add the new libwireshark-dev build
dependency.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | kronosnet-wireshark deb net optional arch=any libknet-dev deb libdevel optional arch=linux-any libknet-doc deb doc optional arch=all libknet1t64 deb libs optional arch=linux-any libnozzle-dev deb libdevel optional arch=linux-any libnozzle1t64 deb libs optional arch=linux-any |
| Section | net |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: kronosnet
Source: https://kronosnet.org/releases
Files: *
Copyright: 2010-2025 Red Hat, Inc.
License: GPL-2+
Files: libknet/*
libnozzle/*
Copyright: 2010-2025 Red Hat, Inc.
License: LGPL-2.1+
Files: debian/*
Copyright: 2017-2025 Ferenc Wágner <wferi@debian.org>
License: LGPL-2.1+
Files: build-aux/git-version-gen
Copyright: 2012-2019 Red Hat, Inc.
2007-2016 Free Software Foundation, Inc.
License: GPL-3+
License: LGPL-2.1+
You can redistribute these libraries and/or modify them under the
terms of the GNU Lesser General Public License as published by the
Free Software Foundation; either version 2.1 of the License, or (at
your option) any later version.
.
The libraries are distributed in the hope that they will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
.
You should have received a copy of the GNU Lesser General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
.
On Debian systems, the complete text of the GNU Lesser General
Public License can be found in "/usr/share/common-licenses/LGPL-2.1".
License: GPL-2+
You can redistribute these applications and/or modify them under the
terms of the GNU General Public License as published by the Free
Software Foundation; either version 2 of the License, or (at your
option) any later version.
.
The applications are distributed in the hope that they will be
useful, but WITHOUT ANY WARRANTY; without even the implied warranty
of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
.
On Debian systems, the complete text of the GNU General Public
License can be found in "/usr/share/common-licenses/GPL-2".
License: GPL-3+
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
.
On Debian systems, the complete text of the GNU General Public
License can be found in "/usr/share/common-licenses/GPL-3".
Review Information
accepted — allocated to awm 1 month, 10 days ago, started 1 month, 10 days ago, completed 1 month, 10 days ago.
Final Comment
Hi,
The package is accepted, and DFSG compliance is OK, however the review finds some minor issues...
Licensing accuracy issues
- Wrong LGPL version in debian/copyright — the main issue.
debian/copyright:12 declares libknet/* and libnozzle/* as LGPL-2.1+ and references /usr/share/common-licenses/LGPL-2.1 (line 38). But every source file header says LGPL-2.0+ (the older GNU Library GPL v2.0, a different license from LGPL-2.1). E.g.:
- libknet/common.c:6, libknet/handle.c:7, libknet/libknet.h:7, libnozzle/libnozzle.c:6 → all "LGPL-2.0+".
The copyright file therefore states the wrong license version and points to the wrong common-license file. (Upstream's own README.licence also says 2.1, so the mismatch likely came from copying that rather than the per-file headers — but debian/copyright must reflect the source headers.)
- Wireshark dissector mis-declared as GPL.
libknet/wireshark/packet-kronosnet.{c,h} are LGPL-2.0+ (packet-kronosnet.c:8). But the glob libknet/* in DEP-5 does not match subdirectories, so these files fall through to the catch-all Files: * → GPL-2+ (debian/copyright:5-7). Wrong license declared for the shipped kronosnet-wireshark plugin.
- Build files under the libraries declared LGPL but actually GPL.
libknet/Makefile.am:7, libnozzle/Makefile.am:7 (and generated Makefile.in) are GPL-2.0+, yet they sit directly in libknet//libnozzle/ so they match the libknet//libnozzle/ globs and are declared LGPL-2.1+. Wrong.
- Minor: config.guess/config.sub mis-versioned.
These are GPL-3+ (with the FSF exception), but the copyright file only lists them under the catch-all Files: * → GPL-2+. Note the maintainer did single out build-aux/git-version-gen as GPL-3+ (debian/copyright:18-21) but missed these two.
Non-license packaging note
debian/rules:15 sets --docdir=/usr/share/doc/libknet1, pointing at the pre-time64 name (the package is now libknet1t64). The files it installs there are then discarded via debian/not-installed, so only man pages actually ship (in libknet-doc). This works but is stale/inconsistent with the current package naming.
I hope this is useful.
Thanks!