DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: libcanard 0.2+git20250713.601ed35-1

Package Information

Descriptionlightweight DroneCAN protocol stack in C

Libcanard implements the DroneCAN transport protocol for communication between embedded devices over Controller Area Network (CAN) buses. It provides transfer fragmentation and reassembly, node addressing, memory-pool allocation and scalar serialization.

This package contains the shared library with the default classic-CAN, single-interface configuration. This is the DroneCAN implementation, distinct from the Cyphal library of the same name.

MaintainerDebian Robotics Team <team+robotics@tracker.debian.org>
Changed BySteffen Moeller <moeller@debian.org>
Sponsormoeller@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/robotics-team/libcanard.git (browse)
Closes#1153246
Trackerhttps://tracker.debian.org/pkg/libcanard
Uploaded2 hours ago

New Package Report

.changes◂
Sourcelibcanard
Version0.2+git20250713.601ed35-1
Changed-BySteffen Moeller <moeller@debian.org>
Architecturesource amd64
Distributionunstable
DateFri, 06 Nov 2026 19:15:27 +0100
Changelog◂ 
libcanard (0.2+git20250713.601ed35-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1153246).
   * Build a versioned shared library and provide development sources for
     applications using a different compile-time ABI configuration.
   * Use system GoogleTest without downloads and add installed-consumer tests.
   * Derive snapshot versions from the upstream commit date and hash.
.dsc◂
Sectionlibdevel
Priorityoptional
Componentmain
Package-Listlibcanard-dev deb libdevel optional arch=any
libcanard0 deb libs optional arch=any
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/DroneCAN/libcanard
Upstream-Name: DroneCAN libcanard
Upstream-Contact: https://github.com/DroneCAN/libcanard/issues

Files: *
Copyright: 2015 UAVCAN
           2016-2019 UAVCAN Team
License: Expat

Files: canard/*.h
Copyright: 2022 Siddharth B Purohit, CubePilot Pty Ltd
License: Expat

Files: drivers/linux/* drivers/mcast/*
Copyright: 2023 DroneCAN Team
License: Expat

Files: debian/*
Copyright: 2026 Steffen Moeller <moeller@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included
 in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for libcanard version 0.2+git20250713.601ed35-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 0 important, 0 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

Every licence in the tree is free: Expat/MIT for the library, headers, tests and helper script, and CC0 for six example programs, so there is no DFSG problem. The Expat text is included, the Format line is correct, and the canard/, drivers/linux, drivers/mcast and debian/ stanzas match the file notices. But six example sources state CC0 and debian/copyright has no stanza for them, so its catch-all describes them as Expat; the copyright file is therefore inaccurate for files that libcanard-dev actually ships.

Packaging

Competent packaging: debhelper compat 14 with dh and a cmake buildsystem, hardening=+all, BUILD_TESTING switched off under nocheck, and the patch removes all FetchContent downloads in favour of system GoogleTest. The shared library is versioned with SONAME 0, named libcanard0 and tracked by a symbols file, and the -dev package carries headers, pkg-config and CMake metadata plus sources for custom configurations, with the configuration guard documented in README.Debian. An autopkgtest links the installed library through pkg-config and CMake, STANDARDS-VERSION, Vcs-*, upstream metadata, README.source and DEP-3 headers are all in order. No packaging fault worth reporting was found.

Issues

blocker licensing 1. Six examples//.c[pp] sources are CC0 but debian/copyright's Files: * stanza makes them Expat ◂
  • Files: debian/copyright:6-9, examples/BatteryNode/battery_node.c:19, examples/ESCNode/esc_node.c:21, examples/ESCNode_C++/esc_node.cpp:18, examples/RangeFinder/rangefinder.c:19, examples/ServoNode/servo_node.c:18, examples/SimpleNode/simple_node.c:12
  • Basis: checked, in the package or with a reference tool
  • Evidence: Each file says This example application is distributed under the terms of CC0 (public domain dedication). / More info: https://creativecommons.org/publicdomain/zero/1.0/, while debian/copyright has only Files: * ... License: Expat (line 6-9) plus stanzas for canard/.h, drivers/linux/ drivers/mcast/* and debian/*, none of which matches examples/.
  • Problem: debian/copyright must record the copyright and licence of every file, and where several stanzas match, the catch-all Files: * applies to examples/. It therefore declares the six example programs to be Expat when their own notices dedicate them to the public domain under CC0. Both licences are free, so this is not a DFSG violation, but the file misdescribes files that libcanard-dev ships in /usr/share/doc/libcanard-dev/examples (debian/libcanard-dev.examples: examples/*).
  • Fix: Add a stanza for the example sources, e.g. Files: examples/*/*.c examples/*/*.cpp with the holder (the files name none themselves) and License: CC0-1.0, plus a stand-alone License: CC0-1.0 paragraph — the full text is in /usr/share/common-licenses/CC0-1.0, so a pointer to it suffices.
Verified ◂
  • Read all of debian/ (copyright, control, rules, changelog, gbp.conf, salsa-ci.yml, source/format, the four .install/.docs/.examples files, libcanard.pc.in, libcanardConfig.cmake.in, canard_build_config.h, libcanard0.symbols, README.Debian, README.source, patches/series, patches/debian-build.patch, tests/control, tests/consumer, tests/consumer.c, upstream/metadata) and inventoried the whole upstream tree.
  • Grepped every non-.pc file for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/MPL/public domain. The only licence notices are Expat (LICENSE, canard.c, canard.h, canard_internals.h, the nine canard/.h headers, the tests/.cpp files, show_data_type_info.py) and the CC0 statements in the six examples; a search for non-commercial, no-modification, field-of-use and similar wording found nothing.
  • All holders found (UAVCAN, UAVCAN Team, Siddharth B Purohit / CubePilot Pty Ltd, DroneCAN Team) are named in debian/copyright; the prescan's author check likewise reported no unlisted holder.
  • debian/copyright is DEP-5 with the correct Format URL, an Expat stand-alone paragraph, valid Files/Copyright/License fields, and stanzas that reproduce the headers of canard/*.h (2022 CubePilot) and drivers/linux + drivers/mcast (2023 DroneCAN Team).
  • No built artefacts in the tree: no .o/.a/.so/.pyc/.class/.jar/minified/PDF/archive files. The canard/tests C++ wrapper suite needs external DSDL and dronecan_dsdlc and is switched off with -DCANARD_BUILD_CXX_TESTS=OFF (debian/rules, README.source); the examples need generated dronecan_msgs.h, documented in README.Debian. No generated code is shipped without its input.
  • Examples' .jpg screenshots and drivers/libuavcan_vs_libcanard_arch.png are upstream documentation assets with no separate notices, covered by Files: *. Nothing in debian/ or the tree asks the reader to fetch anything outside the package.
  • The orig tarball contains no debian/ directory, and drivers/avr/avr-can-lib is an empty directory as README.source states; the CMake install excludes drivers/avr, and .gitmodules records the submodule.
  • Packaging details checked: compat 14, dh $@ --buildsystem=cmake, override_dh_auto_configure sets BUILD_TESTING, override_dh_missing is harmless because dh_missing already defaults to --fail-missing at compat 13+ (debhelper tool), and debhelper's own cmake configure also passes -DBUILD_TESTING:BOOL=OFF under nocheck.
  • libgtest-dev supplies GTestConfig.cmake/GTestTargets.cmake on the reviewing system (checked /usr/lib/x86_64-linux-gnu/cmake/GTest), so find_package(GTest CONFIG REQUIRED) resolves; the patch removes all FetchContent/googletest/DSDL downloads.
  • libcanard0.symbols lists only functions declared in canard.h and defined in canard.c; canardPeekTxQueueDeadline is correctly absent because the Debian build has CANARD_ENABLE_DEADLINE=OFF. SONAME 0 matches the libcanard0 package name.
  • apt-cache has no libcanard0, libcanard-dev or libcanard3, so the names do not collide with an existing archive package; the .dsc binary packages match debian/control.
  • The autopkgtest specification confirms each test's cwd is the source root, so debian/tests/consumer's debian/tests/consumer.c and $PWD/... paths are valid; Depends (@, build-essential, cmake, pkgconf) cover the compiler, CMake and pkg-config it uses, and it builds only in $AUTOPKGTEST-like temporary directories.
  • Standards-Version 4.7.4 is current against Policy 4.7.4.1; Homepage, Vcs-Browser, Vcs-Git, upstream/metadata, README.source and DEP-3 patch headers are present; the changelog is an initial release closing an ITP in unstable.
  • uscan found the packaged version as the newest upstream release (upstream 0.2+git20250713.601ed35, packaged 0.2+git20250713.601ed35).
Not confirmed ◂
  • canard/tests/.cpp and canard/tests/.h carry no copyright header at all; whether their attribution in debian/copyright (the .h files via the canard/*.h stanza to CubePilot, the .cpp files via Files: * to UAVCAN/UAVCAN Team) matches their authorship cannot be determined from the source.
  • File modes (executability of debian/rules and debian/tests/consumer) are not shown by the read tools; autopkgtest applies chmod a+x to test scripts, and any mode problem would surface in a build or test run.
  • The example screenshots and the architecture diagram have no provenance record beyond being upstream repository assets.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 0 hours ago, started 0 hours ago, completed 0 hours ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Back to Dashboard | View all reviews for this package