DFSG NEW review for libgedit-tepl version 6.15.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: No
• Issues: 0 blocker, 2 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The source is uniformly LGPL-3.0-or-later and DFSG-free: every C source/header and script carries the SPDX tag, the only licence text shipped is LICENSES/LGPL-3.0-or-later.txt, and no non-free or unclear terms were found. debian/copyright is in DEP-5 format with the correct short name and full licence text, but its Files: * Copyright field omits Matthias Clasen, whose explicit copyright notice is on tepl/tepl-pango.c. That makes the file incomplete rather than wrong; adding the missing holder makes it accurate.

Packaging

The packaging is mostly in good shape: compat 14, meson/dh, correct library split and Multi-Arch, a current and populated symbols file, DEP-3-free because there are no patches, and a sane changelog. Two things should be fixed before upload: the library package does not depend on the package that ships the GSettings schema it uses at runtime, and the test wrapper in debian/rules makes a DEB_BUILD_OPTIONS=nocheck build fail because the wrapper programs are excluded by the nocheck build profile.

Issues

1. [important] [packaging] libgedit-tepl-6-5 lacks a runtime dependency on gsettings-desktop-schemas

• Files: debian/control:59-63, tepl/tepl-settings.c:241, docs/more-information.md
• Basis: checked, in the package or with a reference tool
• Evidence: tepl/tepl-settings.c:241: self->priv->settings_desktop_interface = g_settings_new ("org.gnome.desktop.interface"); is executed when TeplSettings is created; libgedit-tepl-6-5's only Depends is libgedit-tepl-common (>= ${source:Version}). docs/more-information.md lists gsettings-desktop-schemas among upstream's dependencies.
• Problem: Policy 3.5 requires a package to depend on what it needs to work. The org.gnome.desktop.interface schema (and the font-name key read here) is provided by gsettings-desktop-schemas (checked: its file /usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.xml exists and contains font-name). Nothing in the binary's dependency closure pulls it in: apt-cache shows libgtk-3-0t64, libgedit-amtk-5-0, libgedit-gtksourceview-300-4 and libhandy-1-0 do not depend on it. An application using TeplBuffer/TeplSettings on a system without that package therefore fails when the schema is looked up.
• Fix: Add gsettings-desktop-schemas to the Depends of libgedit-tepl-6-5 (the -dev package already depends on gsettings-desktop-schemas-dev).

2. [important] [packaging] nocheck builds fail because the test override still runs xvfb-run/dbus-run-session

• Files: debian/rules:10-11, debian/control:12-13,32-33
• Basis: checked, in the package or with a reference tool
• Evidence: debian/rules:10-11 override_dh_auto_test: / dbus-run-session -- xvfb-run dh_auto_test; at-spi2-core, dbus-daemon, xauth and xvfb are declared < !nocheck> in Build-Depends.
• Problem: Overrides are run unconditionally, and the nocheck option only makes dh_auto_test itself perform no tests (dh_auto_test(1): "If the DEB_BUILD_OPTIONS environment variable contains nocheck, no tests will be performed"). The wrapper programs are still invoked, but the packages providing xvfb-run and dbus-run-session are not installed when the nocheck build profile is active, so a supported build (Policy 4.9.1 permits DEB_BUILD_OPTIONS=nocheck, e.g. dpkg-buildpackage -B with nocheck) fails with a missing command.
• Fix: Guard the override, e.g. override_dh_auto_test: then ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS))), the dbus-run-session -- xvfb-run dh_auto_test line, and endif.

3. [minor] [licensing] debian/copyright omits Matthias Clasen as a copyright holder

• Files: tepl/tepl-pango.c:1, debian/copyright:5-17
• Basis: checked, in the package or with a reference tool
• Evidence: tepl/tepl-pango.c:1 has SPDX-FileCopyrightText: 2016 - Matthias Clasen <mclasen@redhat.com>; the Files: * Copyright block (debian/copyright:6-16) names no Matthias Clasen.
• Problem: The file contains code copied from GTK's gtkfontbutton.c and names its copyright holder, but the Copyright field does not record him. Copyright-format 1.0 requires the Copyright field to describe the files' holders, so debian/copyright is incomplete even though every other holder and the licence are correct.
• Fix: Add 2016 - Matthias Clasen <mclasen@redhat.com> to the Files: * Copyright field.

Verified

• Read debian/copyright in full: DEP-5 with the canonical Format URL, Files: * and Files: debian/*, both LGPL-3+, and a stand-alone LGPL-3+ paragraph pointing at /usr/share/common-licenses/LGPL-3 (which exists).
• Inventoried all 220 files outside .pc/ and debian/ (sources, headers, meson files, 30 .po files, gtk-doc XML, tests and test data, tools, LICENSES, NEWS, README, doap). No compiled, minified or generated artefacts were found: no .mo, .gir, .typelib, .o, .so, .a, jar, bytecode, PDF or image files.
• Every C source/header and script carries SPDX-License-Identifier: LGPL-3.0-or-later; the only licence file is LICENSES/LGPL-3.0-or-later.txt, containing the LGPL-3 text. The licence is DFSG-free and is the same one debian/copyright states.
• tepl/tepl-pango.c notes at line 6 that the code is taken from GTK's gtkfontbutton.c; LGPL-2.1-or-later code may be relicensed under LGPL-3.0-or-later, so the file's LGPL-3 header is compatible (the holder omission is the licensing issue).
• build/ contains only a .gitignore; it is an upstream placeholder directory, not a build artefact.
• po/da.po:2 and po/hu.po:2: the Copyright (C) ... Free Software Foundation, Inc. line is the gettext template header; the real translator credits are in the same comment block and the files state they are distributed under the package licence, so the Files: * stanza covers them.
• po/ka.po:2: libgedit-tepl's authors is an unfilled gettext placeholder; the translator (Ekaterine Papava) is named at line 4 and the file is under the package licence.
• Read all of debian/: control, rules, changelog, gbp.conf, source/format (3.0 quilt), install/links/docs/doc-base files, symbols, upstream/metadata; there are no patches, maintainer scripts or debian/tests.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): the first two components are 4.7, so it is current enough.
• At compat 14 dh_gencontrol adds relationship substvars itself (debhelper tool), so the absence of ${shlibs:Depends}, ${misc:Depends} and ${gir:Depends} from debian/control is not a fault.
• The symbols file matches the exported API: it includes the 6.14 additions (TeplStatusbar, TeplCodeCommentView) and all declarations in tepl/tepl-statusbar.h and tepl/code-comment/tepl-code-comment-view.h; NEWS says 6.15.0 adds no API.
• The gtk-doc module name is libgedit-tepl-6 in docs/reference/meson.build, matching debian/libgedit-tepl-dev.links and the doc-base Index path.
• gsettings-desktop-schemas exists in the archive (apt-cache) and provides org.gnome.desktop.interface with a font-name key, so it is the right dependency for the schema looked up in tepl-settings.c.
• uscan found the packaged version as the newest upstream release (upstream 6.15.0, packaged 6.15.0).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (LGPL-3).

Not confirmed

• The package was not built and its tests were not run; the nocheck failure in the packaging issue follows from debian/rules and the <!nocheck> Build-Depends, and was not observed.

Proposed changes

None.