DFSG NEW review for libgfakluge version 0.0~git20211004.2e0aa73-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: 2 found

Licensing

Upstream is MIT/Expat (LICENSE.md, 'Copyright (C) 2015 Eric T Dawson', also stated in src/main.cpp and README.md). debian/copyright is DEP-5 and its Files: * stanza names every holder visible in the tree (Eric T. Dawson, Richard Durbin) under the correct short name Expat, with the full Expat text in a stand-alone License paragraph; debian/* has its own stanza. No non-free terms, no files without a licence and no third-party licence files were found. The two prebuilt Mach-O executables are compiled from sources shipped in the package and are not installed, so they raise no DFSG question.

Packaging

Competent Debian Med packaging: dh sequencer at debhelper compat 14, hardening enabled, correctly split header-only libgfakluge-dev (Multi-Arch: same, and zlib1g-dev because gfa_builder.hpp includes <zlib.h>) plus the gfak tool, autopkgtest smoke test that exercises both the CLI and the installed headers, Vcs-* fields, and Standards-Version 4.7.4, which matches the current Policy 4.7.4.1. Build flags from dpkg-buildflags reach the upstream Makefile through debhelper's exported environment, so the hardening export is effective. The only shortcoming is that the gfak tool is shipped without any manual page or other documentation besides --help.

Issues

1. [minor] [packaging] gfak is installed without a man page or any other documentation

• Files: debian/gfak.install (installs usr/bin/gfak), no debian/manpages, debian/gfak.manpages or usr/share/man page anywhere in the tree, debian/rules
• Basis: checked, in the package or with a reference tool
• Evidence: debian/gfak.install contains only usr/bin/gfak; debian/rules installs only the binary and the four headers; there is no debian/*.manpages, no debian/*.docs, and upstream ships no manual page (only README.md/examples.md, which are not installed). Policy 12.1: Each program, utility, and function should have an associated manual page ... If no manual page is available, this is considered as a bug.
• Problem: The binary package installs a nine-subcommand tool whose only documentation is gfak --help; Policy 12.1 treats a missing manual page as a bug, and /usr/share/doc/gfak will contain just the copyright file.
• Fix: Add a section-1 manual page derived from gfak --help / examples.md and list it in debian/gfak.manpages; optionally also install README.md and examples.md via debian/gfak.docs.

Verified

• Pre-scan file src/tinyFA/getseq is a Mach-O (macOS) executable 33.7 KB, and src/tinyFA/indexseq is a 29.2 KB Mach-O executable. Both are stale build products: their sources are shipped at src/tinyFA/examples/getseq.cpp and src/tinyFA/examples/index.cpp and src/tinyFA/Makefile builds exactly those two targets from them. Nothing in debian/rules installs them and .gitignore does not exclude them, so they are upstream litter, not a DFSG or licensing problem.
• Whole-tree grep for Copyright, (C), ©, SPDX-License-Identifier, Permission is hereby granted, GNU General/Lesser, Apache License, Mozilla Public, public domain, All rights reserved found only LICENSE.md (MIT, Eric T Dawson) and the version string in src/main.cpp (Copyright (C) 2015 Eric T. Dawson ... Licensed under the MIT License); codemeta.json and paper/paper.md both also declare MIT. No holder or licence text is unaccounted for by Files: *.
• data/reads.gfa is the 4.8 MB file the pre-scan could only read 4 MiB of; it is GFA test data (a unitig S line), and the other nine files in data/ are small GFA/FASTA test fixtures. No licence text in them.
• Build flags: debhelper 14.5's dh_auto_build calls setup_buildenv() -> set_buildflags(), which exports dpkg-buildflags' CXXFLAGS/CPPFLAGS/LDFLAGS (/usr/share/perl5/Debian/Debhelper/Dh_Lib.pm). The upstream Makefile's CXXFLAGS += -O3 ... appends to that value and its link line uses $(LDFLAGS), so hardening=+all in debian/rules does take effect despite the Makefile owning CXXFLAGS.
• override_dh_auto_test with only a comment is correct at compat 14: dh skips override targets of dh_auto_test under DEB_BUILD_OPTIONS=nocheck from compat 13 on (debhelper tool), and upstream make check would need the bash-tap submodule, which is an empty directory in this snapshot.
• override_dh_auto_install writes into debian/tmp; dh_install(1) falls back to debian/tmp from compat 7 on, so debian/gfak.install (usr/bin/gfak) and debian/libgfakluge-dev.install (the four headers) pick the files up, leaving nothing for dh_missing --fail-missing (compat 14 default).
• Standards-Version 4.7.4 is current: the reviewing system's Policy is 4.7.4.1, so the first two components match. debhelper-compat (= 14) is satisfiable (debhelper 14.5 provides it).
• At compat 14, ${shlibs:Depends}/${misc:Depends} are added by dh_gencontrol whether or not they are written; the explicit use in debian/control is harmless, and zlib1g-dev in libgfakluge-dev is required because the installed gfa_builder.hpp includes <zlib.h>.
• Sampled sources and headers (gfakluge.hpp, gfa_builder.hpp, tinyfa.hpp, pliib.hpp, main.cpp, gtest.cpp, gfak_test.cpp, scripts/.py, paper/, Makefile, makefile.detuned, test/gfa_test.t) found no additional copyright notices, no generated-without-source code, and no embedded third-party library beyond the tinyFA/pliib helpers upstream ships in-tree.
• Autopkgtest: debian/tests/control runs debian/tests/smoke with @ and g++; the script uses gfak stats -n (main.cpp prints Number of nodes: N for -n), gfak convert -S 2.0/-S 1.0, and compiles a program against gfakluge.hpp using the parse_gfa_file(std::istream&) overload, which exists (gfakluge.hpp:2343).
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20211004.2e0aa73, packaged 0.0~git20211004.2e0aa73).

Not confirmed

• src/tinyFA/ (and pliib.hpp inside it) come from the separate submodules github.com/edawson/tinyFA and github.com/edawson/pliib and carry no licence file of their own in the tree; debian/copyright asserts Expat for them under Files: *. I could not verify that claim from the package alone (the submodule contents are not covered by the repository's LICENSE.md in git terms, although they are part of this source tarball).

Proposed changes

None.