DFSG NEW review for libbdsg version 0.3+git20261016.485b32b+dfsg-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 6 found

Licensing

debian/copyright is DEP-5 with a Files: * MIT stanza (2019 Erik Garrison, 2019-2020 vgteam contributors, matching the top-level LICENSE) and a separate Apache-2.0 stanza for the one file with its own notice, bdsg/include/bdsg/internal/varint.hpp (Copyright 2016 Jakob Stoklund Olesen). A whole-tree grep for Copyright/(C)/SPDX/Licensed under/permission notices and for GPL/LGPL/BSD/MPL/CC/non-commercial wording found no other holder, licence or restriction, so both licences are free, MIT-compatible, and the Apache-2.0 text is reachable through /usr/share/common-licenses. The upstream git submodules under bdsg/deps/ are empty directory stubs in the tarball and the use-system-deps patch removes every add_subdirectory() for them, so no third-party code is embedded. All six files the prescan listed are upstream documentation assets, not built or installed artefacts.

Packaging

Clean library packaging: two binary packages with a correct split (libbdsg0 / libbdsg-dev), Multi-Arch: same on both, debhelper compat 14 with dh_auto_* on a CMake out-of-tree build, hardening on, a Debian-invented SONAME (libbdsg.so.0) with matching package name, and install files that match exactly what upstream installs (usr/lib//libbdsg.so. and usr/include/bdsg + usr/lib/*/libbdsg.so). All Build-Depends and -dev Depends exist in the archive at satisfiable versions; the public headers' external includes (boost, sdsl, handlegraph, sparsepp, DYNAMIC/hopscotch, mio, BBHash) are all covered by libbdsg-dev's Depends. -DOPTIMIZE=OFF merely removes upstream's own -O3 so dpkg-buildflags' -O2 applies. Standards-Version 4.7.4 is current against Policy 4.7.4.1. Two minor points: the upstream test suite is built but never executed, and the patches carry no DEP-3 Forwarded field.

Issues

1. [minor] [packaging] Upstream test binary test_libbdsg is built but never run, and autopkgtest only compiles a toy program

• Files: debian/rules:17-18, debian/tests/compile, bdsg/src/test_libbdsg.cpp:5444, CLAUDE.md

• Basis: checked, in the package or with a reference tool

• Evidence:

  debian/rules:

  override_dh_auto_test:
  	# The upstream test harness is a standalone binary, not integrated with CTest.
  

  CMakeLists.txt builds test_libbdsg unconditionally (add_executable(test_libbdsg ${bdsg_DIR}/src/test_libbdsg.cpp), output build/bin/test_libbdsg), and the shipped CLAUDE.md/README_BOTS.md say To run the tests after building: ./bin/test_libbdsg. test_libbdsg.cpp:5444 is int main(void) calling ~60 self-contained test functions (no arguments, no external data).

• Problem: 5,497 lines of assertions never execute: dh_auto_test is replaced by an empty target, and debian/tests/compile only builds a twelve-line HashGraph/PackedGraph program. The comment's rationale (no CTest integration) does not prevent running the binary directly, so a regression the upstream suite catches reaches the archive untested.

• Fix:

  Run the binary, e.g.

  override_dh_auto_test:
  	cd build && ./bin/test_libbdsg
  

  (the tests create and remove files in the current directory) or add a debian/tests stanza that builds and runs it; keep the small compile test as well if wanted.

2. [minor] [packaging] debian/patches/*.patch have no DEP-3 Forwarded field, though two are upstreamable build fixes

• Files: debian/patches/use-system-deps.patch, debian/patches/soname.patch, debian/patches/no-rpath-and-build-dir.patch
• Basis: checked, in the package or with a reference tool
• Evidence: Each header has only Description:, Author:, Last-Update: and Assisted-By:; there is no Forwarded:/Origin: line. use-system-deps.patch (use find_package/find_path instead of the git submodules) and soname.patch (add project VERSION/SOVERSION) are changes upstream would plausibly take; only the RPATH removal is Debian-specific.
• Problem: Without Forwarded: a reviewer or future maintainer cannot tell whether the patches were sent upstream or must be carried forever, and a reopened upstream CMake build silently invalidates them.
• Fix: Add Forwarded: https://github.com/vgteam/libbdsg/issues/N (or Forwarded: not-needed with a one-line reason, e.g. for the RPATH patch) to each patch's DEP-3 header.

Verified

• dbsg/docs/exampleGraph.pptx is an OOXML (zip) slide deck from upstream's documentation directory; it is covered by the Files: * MIT stanza and installed by neither binary package. Its embedded parts were not inspected (binary).
• bdsg/docs/exdata/cactus-brca2.vg is a gzip-compressed vg graph used as a tutorial download; the unpacked text form bdsg/docs/exdata/cactus-brca2.gfa is in the package, so its preferred form is present. MIT via Files: *; not installed.
• bdsg/docs/exdata/cactus-brca2.pg and bdsg/docs/exdata/graph.pg are PackedGraph serialisations used as tutorial downloads (tutorial.rst shows the vg convert --packed-out recipe); bdsg/docs/assets/simple_nested_chain.dist and simple_nested_chain.hg are libbdsg serialisations produced by the tutorial's own code (tutorial.rst:242-245). All are upstream documentation example data, MIT via Files: *, installed by neither binary package.
• Licence inventory: whole-tree grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/public domain/All rights reserved and for GPL/LGPL/Apache/BSD/Mozilla/MPL/CC-BY/non-commercial found only LICENSE, bdsg/docs/conf.py (copyright = u'2020, vgteam') and bdsg/include/bdsg/internal/varint.hpp; the latter is the only file whose own notice differs from MIT and it has its own Apache-2.0 stanza. Headers such as wang_hash.hpp, hash_map.hpp, packed_structs.hpp and dynamic_types.hpp carry no separate holder or licence.
• Upstream git submodules under bdsg/deps/ (BBHash, DYNAMIC, hopscotch-map, libhandlegraph, mio, pybind11, sdsl-lite, sparsepp) are present only as empty directories in the unpacked tarball, and debian/patches/use-system-deps.patch replaces every add_subdirectory() for them with find_package/find_path against lib*-dev packages, so no vendored copies are shipped (no Built-Using needed).
• Files-Excluded: */odgi-presentation-stringology-2019 in debian/copyright is consistent: the orig tarball's bdsg/docs/ listing has no such entry and no other file in the unpacked tree matches it.
• Binary documentation images (bdsg/docs/img/.png, bdsg/docs/assets/.png) and their Inkscape SVG sources (bdsg/docs/img/exampleGraph.svg, bdsg/docs/assets/simple_nested_chain.svg) plus bdsg/docs/assets/lil.gfa are upstream figures under the Files: * MIT stanza; no font, audio or other data files are in the tree.
• Binder-generated pybind11 sources (bdsg/cmake_bindings/*, bdsg/std/bdsg/internal/binder_hook_bind.cpp) have their generator inputs in the package (config.cfg, make_and_run_binder.py, the *.classfragment inputs to graph_proxy.hpp, which is why those fragments must be installed); they are only compiled when BUILD_PYTHON_BINDINGS=ON, which debian/rules turns off, and no network fetch (ExternalProject_Add binder, git clone pybind11) runs in that configuration.
• Dependencies checked with apt-cache and /usr share: libbbhash-dev 1.0.0-8, libhandlegraph-dev 20261019.3d8c3c9-1, libsdsl-dev 2.4+dfsg-1, libmio-dev, libxxsds-dynamic-dev, libsparsepp-dev, libtsl-hopscotch-map-dev all exist and satisfy the version constraints; libsdsl-dev pulls libdivsufsort-dev and libsdsl4, so find_library(SDSL_LIBRARY NAMES sdsl) and the autopkgtest -lsdsl resolve.
• Public headers' external includes are exactly boost, sdsl, handlegraph, sparsepp, dynamic (with tsl hopscotch) and mio; jansson.h appears only in bdsg/src/snarl_distance_index.cpp, so libbdsg-dev correctly does not depend on libjansson-dev, while ${shlibs:Depends} covers libjansson4 for libbdsg0.
• Install files match the patched CMake install destinations: CMakeLists installs the library to CMAKE_INSTALL_LIBDIR (forced to lib/ by debian/rules and by debhelper's cmake buildsystem) and the header tree to include/bdsg, giving usr/lib//libbdsg.so. for libbdsg0 and usr/include/bdsg plus usr/lib/*/libbdsg.so for libbdsg-dev; nothing else is installed (test_libbdsg is not in any install() rule, so dh_missing has nothing to complain about).
• debhelper compat 14 with dh $@ --buildsystem=cmake --builddirectory=build, hardening=+all and the three patches applied in series; the applied CMakeLists.txt shows project(bdsg VERSION 0.1.0), SOVERSION 0, no INSTALL_RPATH for libbdsg and no $ORIGIN build RPATH.
• Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1, so it is current.
• debian/tests/compile is set -e with a temporary directory and trap, Depends: @, build-essential, and links -lbdsg -lhandlegraph -lsdsl, all provided through libbdsg-dev; Testsuite field is not needed for one test in debian/tests.
• Changelog: single 0.3+git20261016.485b32b+dfsg-1 entry to unstable dated 2026-10-28 closing #1152344, consistent with the +dfsg repack and the git-snapshot upstream version; Vcs-Git/Vcs-Browser and Homepage point at salsa med-team/libbdsg and the upstream repo.
• uscan found the packaged version as the newest upstream release (upstream 0.3+git20261016.485b32b, packaged 0.3+git20261016.485b32b+dfsg).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed

• The pptx and the serialised graph files could only be judged by type and location, not by their contents (binary files).
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: read: "../libbdsg_0.3+git20261016.485b32b+dfsg-1.dsc" is not a file of the package or of the reviewing system.

Proposed changes

None.