DFSG NEW review for libdozeu version 0.0~git20260825.d0e9ba6-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The entire source is MIT-licensed and DFSG-compliant. dozeu.h carries 'SPDX-License-Identifier: MIT' with 'Copyright (c) 2026, NVIDIA CORPORATION', and README.md states 'MIT' with 'Copyright 2018, Hajime Suzuki'; both holders are named in the Files: * stanza and the full MIT text is reproduced in the standalone License paragraph. log.h and unittest.h have no standalone notice but declare @license MIT / @author Hajime Suzuki and are correctly covered by Files: *. The one gap is that unittest.h embeds a small, modified slice of kvec.h from klib (github.com/attractivechaos/klib) whose own MIT copyright notice is not reproduced and whose holder is not credited.

Packaging

Clean, conventional packaging of a header-only library: a single libdozeu-dev binary package with correct Architecture: all and Multi-Arch: foreign, Build-Depends of debhelper-compat (= 14) and libsimde-dev (which provides the vendored simde/ submodule the header includes), a correct Depends on libsimde-dev, an autopkgtest that compiles and runs example.c, a sane initial changelog closing the ITP, Standards-Version 4.7.4 (current), and Vcs-* fields. debian/rules uses the documented 'dh $@ --without=single-binary' to silence the compat-14 single-binary addon warning, and the Makefile has no install target so dh_auto_install correctly no-ops.

Issues

1. [minor] [licensing] Files: * does not credit the klib (Attractive Chaos / kvec.h) copyright holder for code embedded in unittest.h

• Files: unittest.h:51, debian/copyright:5-9
• Basis: checked, in the package or with a reference tool
• Evidence: unittest.h line 51: * from kvec.h in klib (https://github.com/attractivechaos/klib) followed by the utkv_* macros (utkv_roundup32, utkv_init, utkv_push, etc., lines ~51-105), a 'little bit modified from the original' per the comment. debian/copyright Files: * names only '2018 Hajime Suzuki' and '2026 NVIDIA CORPORATION'.
• Problem: unittest.h redistributes a recognizable, modified subset of klib's kvec.h (MIT-licensed, © Attractive Chaos / Heng Li). The MIT license requires the copyright notice to be reproduced in 'substantial portions', but the original notice is not kept (only a pointer comment), and debian/copyright's Files: * stanza does not name that third-party holder, so the copyright file does not fully describe the copyright of this file.
• Fix: Add the klib/Attractive Chaos holder (with its own MIT notice) for the derived code, either as a separate Files stanza covering unittest.h or as an additional Copyright line in Files: *, and note the kvec.h origin.

Verified

• Read debian/copyright, control, rules, changelog, source/format, the .install/.docs/.examples files, tests/control, tests/run-unit-test, README.test, upstream/metadata and salsa-ci.yml in full.
• Read dozeu.h (header only, MIT SPDX, © NVIDIA), log.h, unittest.h, the three example sources, README.md (MIT, © 2018 Hajime Suzuki) and the Makefile; the whole upstream tree is these 8 text files plus the simde/ submodule and fig/xdrop.png.
• dozeu.h:2-4 and README.md:173 confirm the two MIT copyright notices whose holders match the Files: * stanza; the full MIT text in debian/copyright matches the standard license.
• simde/ is an empty git submodule (see .gitmodules) provided at build time by Build-Depends libsimde-dev, which apt-cache confirms exists (Arch: all, Multi-Arch: foreign); dozeu.h's #include "simde/x86/sse4.1.h" resolves against /usr/include/simde/.
• fig/xdrop.png is a binary documentation illustration referenced only in README.md and is not installed by the package, so it is not a licensing or source-availability concern.
• libdozeu-dev.install installs only dozeu.h, log.h and unittest.h under /usr/include/dozeu/; .examples and .docs install the example sources and README, as expected.
• The debhelper tool confirms that at compat 14 '--without single-binary' is the documented way to silence the implicit single-binary addon warning for a one-Package source, and that dh_gencontrol auto-adds relationship substvars so the package's Depends field needs no ${misc:Depends}.
• The makefile buildsystem (makefile.pm) skips 'install' via exists_make_target when the Makefile has no install target, so dh_auto_install no-ops rather than failing.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20260825.d0e9ba6, packaged 0.0~git20260825.d0e9ba6).

Not confirmed

• fig/xdrop.png was not opened (binary image); its provenance is assumed to be upstream's own illustration, consistent with its use as a README diagram.
• Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: glob: "/home/review" is not a file of the package or of the reviewing system.

Proposed changes

None.