DFSG, Licensing & New Packages Team

Hi,

Several of these issues might be incorrect: please advise if they are wrong so I can ignore them on a future upload. In particular I did not attempt to build the package, so the assertions about FTBFS on current buildds may be incorrect however the licensing issues #3 and #4 below need fixing before I can accept.

1. [packaging] Build fails: pom pins javac source/target 1.7, but default-jdk is OpenJDK 25

• Files: pom.xml:64-66, debian/control:11
• Evidence: pom.xml maven-compiler-plugin configuration <source>1.7</source><target>1.7</target>; Build-Depends: default-jdk; apt-cache shows default-jdk -> openjdk-25-jdk.
• Problem: javac since JDK 20 errors with "Source option 7 is no longer supported. Use 8 or later." The parent pom's compiler configuration propagates to the core, cdk and opsin modules, so mvn package cannot compile any main source on the current unstable toolchain (Build-Depends default-jdk). maven-debian-helper (2.6.9) does not rewrite pom compiler settings, and debian/maven.properties only sets maven.test.skip=true. This is a build failure on current archive buildds.
• Fix: Add a quilt patch raising the compiler source/target (or use maven.compiler.release) to 8 or higher, and bump the compiler plugin as needed.

2. [packaging] cdk module's shade plugin builds an uberjar that embeds the whole CDK

• Files: cdk/pom.xml:94-107, debian/libcentres-java.poms, debian/clean:1
• Evidence: maven-shade-plugin execution bound to package with <finalName>centres</finalName> (no shadedArtifactAttached), so it replaces the module's main artifact; debian/clean contains cdk/dependency-reduced-pom.xml (a shade by-product), proving the plugin runs during the Debian build; libcentres-java.poms installs cdk/pom.xml's jar with no option to install the unshaded artifact.
• Problem: The installed centres-cdk jar would bundle a full copy of CDK (LGPL-2.1 code) even though CDK is already packaged as libcdk-java and is a Build-Depends/Runtime-Depends of this package. That contradicts Policy 4.13 (embedded code copies) and makes the BSD-2 attribution in debian/copyright for that jar incomplete, since the embedded CDK classes are not covered by it.
• Fix: Disable the shade plugin for the Debian build (or build and install the unshaded jar) so the package relies on the CDK classes from libcdk-java; verify the installed jar's contents.

3. [licensing] BSD-2-clause License stanza in debian/copyright is truncated

• Files: debian/copyright:36
• Evidence: Stanza ends ...ARISING IN ANY WAY OUT OF THE USE OF THIS; the LICENSE file (lines 22-23) continues ...OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
• Problem: BSD-2-clause is not in /usr/share/common-licenses, so the complete text must be reproduced in
  debian/copyright (copyright-format 6.7) and thus in the binary package's copyright file. The last sentence of the warranty disclaimer is missing.
• Fix: Append the missing final sentence to the License: BSD-2-clause stanza.

4. [licensing] Root pom.xml declares LGPL-3.0 while actual license is BSD-2

• Files: pom.xml:26-31
• Evidence: <licenses><license><name>GNU Lesser General Public License, Version 3.0</name> while the top-level LICENSE (BSD-2) and README.md say "BSD 2-Clause", and debian/copyright attributes pom.xml to BSD-2-clause.
• Problem: Leftover upstream metadata: this pom is installed by maven-debian-helper (libcentres-java.poms), so the shipped /usr/share/maven-repo/.../centres-1.4.pom advertises LGPL-3.0, contradicting the package's copyright and the actual license grant.
• Fix: Fix the <licenses> block upstream to BSD-2 (or document the mismatch with a Comment in debian/copyright and contact upstream).

5. [packaging] Outdated Standards-Version (4.7.0, current is 4.7.4.1)

• Files: debian/control:15
• Evidence: Standards-Version: 4.7.0; Policy tool reports Debian Policy version 4.7.4.1.
• Problem: The Standards-Version does not reflect the current Policy; section 4.1 requires a maintainer to aim for conformance with the latest Policy, and newer 4.7.x releases contain relevant clarifications.
• Fix: Bump Standards-Version to 4.7.4.1 after checking the A10 upgrading checklist.

Thanks!