libical4 4.0.7+dfsg-1

Package Information

Description	iCalendar library implementation in C (development) libical is an open source implementation of the IETF's iCalendar calendaring and scheduling protocols (RFC 2445, 2446, and 2447). It parses iCal components and provides a C API for manipulating the component properties, parameters, and subcomponents.
Maintainer	Nicolas Mora <babelouest@debian.org>
Changed By	Nicolas Mora <babelouest@debian.org>
Sponsor	babelouest@debian.org
Distribution	experimental
Architecture	any all
VCS	git: https://salsa.debian.org/debian/libical3.git (browse)
Closes	#1119201, #1149060, #1153354
Blocked Bugs	#1117120 (serious)
Tracker	https://tracker.debian.org/pkg/libical4
Uploaded	1 hour ago

Takes Over Existing Binary Packages

This upload builds binary packages that a different source package currently builds in unstable. Check that the takeover is intended and explained, for example in the changelog.

Binary	Currently built by
`libical-dev`	libical3
`libical-doc`	libical3

New Package Report

.changes◂

Architecture	source amd64 all
Distribution	experimental
Date	Fri, 18 Sep 2026 13:04:48 -0400
Source	libical4
Version	4.0.7+dfsg-1
Changed-By	Nicolas Mora <babelouest@debian.org>

Changelog◂

libical4 (4.0.7+dfsg-1) experimental; urgency=medium
 .
   * New upstream release (Closes: #1153354, #1149060)
   * repack source to remove non dfgs compliant files
   * d/control: Rename source package to libical4
   * d/control: remove db5 build dep (Closes: #1119201)

.dsc◂

Section	introspection
Priority	optional
Component	main
Package-List	gir1.2-ical-4.0 deb introspection optional arch=any libical-dev deb libdevel optional arch=any libical-doc deb doc optional arch=all libical4 deb libs optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: libical
Source: https://github.com/libical/libical
Upstream-Contact: allen.d.winter@gmail.com
Files-Excluded: cmake/Toolchain-QNX-common.cmake
 cmake/Toolchain-QNX650-armv7.cmake
 cmake/Toolchain-QNX650-x86.cmake
 cmake/Toolchain-QNX660-armv7.cmake
 cmake/Toolchain-QNX660-common.cmake
 cmake/Toolchain-QNX660-x86.cmake
 cmake/Toolchain-QNX700-aarch64.cmake
 cmake/Toolchain-QNX700-armv7.cmake
 cmake/Toolchain-QNX700-common.cmake
 cmake/Toolchain-QNX700-x86.cmake
 cmake/Toolchain-QNX700-x86_64.cmake

Files: *
Copyright: 2006-2022 Eric Busboom <eric@softwarestudio.org>
           2014-2022 Allen Winter <allen.winter@kdab.com>
License: LGPL-2.1 or MPL-2.0

Files: src/libicalss/*
Copyright: 2000-2001 Eric Busboom <eric@softwarestudio.org>
           2000-2001 Andrea Campi <a.campi@inet.it>
           2000-2001 Critical Path
License: LGPL-2.1 or MPL-2.0

Files: src/java/*
Copyright: 2000-2002 Eric Busboom <eric@softwarestudio.org>
           2000-2002 Patrick Lewis <plewis@inetarena.com>
           2000-2002 Critical Path
License: LGPL-2.1 or MPL-2.0

Files: src/test/libical-glib/*
Copyright: 2015 William Yu <williamyu@gnome.org>
License: LGPL-2.1 or MPL-2.0

Files: src/libical-glib/*
Copyright: 2015 William Yu <williamyu@gnome.org>
License: LGPL-2.1 or MPL-2.0

Files: src/libicalvcal/*
Copyright: 1996 Apple Computer, Inc., AT&T Corp., International
License: LGPL-2.1 or MPL-2.0

Files: src/libical/*
Copyright: 2014-2022 Allen Winter <allen.winter@kdab.com>
           2000-2018 Eric Busboom <eric@softwarestudio.org>
           2000-2018 Andrea Campi <a.campi@inet.it>
           2000-2018 Critical Path
License: LGPL-2.1 or MPL-2.0

Files: src/libical/icaltimezone.*
Copyright: 2001 Damon Chaplin <damon@ximian.com>
License: LGPL-2.1 or MPL-2.0

Files: src/libical/icalarray.*
Copyright: 2001, Ximian, Inc.
License: LGPL-2.1 or MPL-2.0

Files: vzic/*
Copyright: 2000-2001 Ximian, Inc.
 2003, Damon Chaplin <damon@ximian.com>
License: LGPL-2.1 or MPL-2.0

Files: src/libicalvcal/icalvcal.*
Copyright: Eric Busboom, http://www.softwarestudio.org
License: LGPL-2.1 or MPL-2.0

Files: LibIcalConfig.cmake.in
Copyright: Christophe Giboudeaux <cgiboudeaux@gmx.com>
License: LGPL-2.1 or MPL-2.0

Files: src/libical/libical_deprecated.h
Copyright: Emiel Bruijntjes <emiel.bruijntjes@copernica.com>
License: LGPL-2.1 or MPL-2.0

Files: src/libicalss/icalssyacc.c
 src/libicalss/icalssyacc.h
Copyright: 1984-2006 Free Software Foundation, Inc.
License: LGPL-2.1 or MPL-2.0

Files: src/libical/icaltime.c
Copyright: 2000, Eric Busboom <eric@civicknowledge.com>
License: LGPL-2.1 or MPL-2.0

Files: src/libical/qsort_gen.h
 src/test/test-malloc.c
 src/test/test-malloc.h
Copyright: 2018-2022, Markus Minichmayr <markus@tapkey.com>
License: LGPL-2.1 or MPL-2.0

Files: cmake/modules/GObjectIntrospectionMacros.cmake
 cmake/modules/FindGObjectIntrospection.cmake
Copyright: 2010 Pino Toscano, <pino@kde.org>
License: BSD-3-Clause

Files: docs/doxygen-awesome.css
Copyright: 2021 - 2025 jothepro
License: Expat

Files: src/test/regression-classify.c
Copyright: 2002 Paul Lindner <lindner@users.sf.net>
License: LGPL-2.1 or MPL-2.0

Files: src/libical/icaltimezone_p.*
Copyright: 2007, Novell, Inc
License: LGPL-2.1 or MPL-2.0

Files: src/libical-glib/tools/header-parser.c
 src/libical-glib/tools/header-parser.h
 src/libical-glib/tools/api-templates.xml
 src/libical-glib/api/i-cal-vcard-derived-property.xml
 src/libical-glib/api/i-cal-vcard-derived-parameter.xml
 src/libical-glib/api/i-cal-vcard-tz.xml
 src/libical-glib/api/i-cal-vcard-parser.xml
 src/libical-glib/api/i-cal-vcard-property.xml
 src/libical-glib/api/i-cal-vcard-time.xml
 src/libical-glib/api/i-cal-vcard-geo.xml
 src/libical-glib/api/i-cal-vcard-value.xml
 src/libical-glib/api/i-cal-vcard-restriction.xml
 src/libical-glib/api/i-cal-vcard-component.xml
 src/libical-glib/api/i-cal-vcard-derived-value.xml
 src/libical-glib/api/i-cal-vcard-structured.xml
 src/libical-glib/api/i-cal-vcard-parameter.xml
 src/test/icaltm_test.c
 src/test/libical-glib/misc.py
 src/test/libical-glib/vcard-component.py
Copyright: 2017-2025 Red Hat <www.redhat.com>
License: LGPL-2.1 or MPL-2.0

Files: cmake/modules/openssf-c.cmake
 cmake/modules/openssf-cpp.cmake
Copyright: 2024 Steven Engelhardt <https://www.stevenengelhardt.com>
License: public-domain

Files: cmake/modules/FindBerkeleyDB.cmake
Copyright: sum01 <sum01@protonmail.com>
License: public-domain

Files: src/libical/byref.c
Copyright: 2024, Siam Smeets <siam.smeets@dataaccess.eu>
License: LGPL-2.1 or MPL-2.0

Files: uninstall.cmake.in
Copyright: Kitware, Inc. and Contributors
License: BSD-3-Clause

Files: cmake/modules/FindWcecompat.cmake
Copyright: 2010 Andreas Holzammer, <andy@kdab.com>
License: BSD-3-Clause

Files: src/Net-ICal-Libical/lib/Net/ICal/Libical/*
Copyright: (C) COPYRIGHT 2000, Eric Busboom, eric@softwarestudio.org
License: GPL-1+ or Artistic-1
 See `/usr/share/common-licenses/GPL-1' and `/usr/share/common-licenses/Artistic'.

Files: docs/reference/CMakeLists.txt
 docs/reference/libical-glib/CMakeLists.txt
 src/libical-glib/CMakeLists.txt
 src/test/builtin_timezones.c
 src/test/libical-glib/CMakeLists.txt
Copyright: Milan Crha <mcrha@redhat.com>
License: LGPL-2.1 or MPL-2.0

Files: src/libicalvcard/vcardvalue.c
 src/libicalvcard/vcardtime.h
 src/libicalvcard/vcard_file.cmake
 src/libicalvcard/vcardderivedparameter.h.in
 src/libicalvcard/vcardenumarray.h
 src/libicalvcard/vcardderivedproperty.h.in
 src/libicalvcard/vcardparser.c
 src/libicalvcard/vcardproperty.h
 src/libicalvcard/vcardrestriction.h
 src/libicalvcard/libical_vcard_export.h
 src/libicalvcard/vcardcomponent.c
 src/libicalvcard/vcardproperty.c
 src/libicalvcard/vcardparser.h
 src/libicalvcard/vcardtime.c
 src/libicalvcard/vcardtypes.h
 src/libicalvcard/vcardstructuredimpl.h
 src/libicalvcard/vcardvalue.h
 src/libicalvcard/vcardrestriction.c.in
 src/libicalvcard/vcardcomponent.h
 src/libicalvcard/vcardtextlist.c
 src/libicalvcard/vcardtextlist.h
 src/libicalvcard/vcardderivedparameter.c.in
 src/libicalvcard/vcardproperty_p.h
 src/libicalvcard/vcardderivedproperty.c.in
 src/libicalvcard/CMakeLists.txt
 src/libicalvcard/vcardderivedvalue.h.in
 src/libicalvcard/vcardparameter.c
 src/libicalvcard/vcardderivedvalue.c.in
 src/libicalvcard/vcardstructured.h
 src/libicalvcard/vcardvalueimpl.h
 src/libicalvcard/vcardstrarray.h
 src/libicalvcard/vcardparameter.h
 src/libicalvcard/vcardstructured.c
 src/libicalvcard/vcardparameterimpl.h
 src/libical/icalstrarray.h
 src/libical/icalenumarray.h
 src/libical/icalstrarray.c
 src/libical/icalenumarray.c
 src/test/libicalvcard/CMakeLists.txt
 src/test/libicalvcard/vcard_test.c
 src/test/libicalvcard/vcard_test_encode.c
Copyright: 2022 Fastmail Pty. Ltd. (https://fastmail.com)
License: LGPL-2.1 or MPL-2.0

Files: debian/*
Copyright: 2018-2026 Nicolas Mora <babelouest@debian.org>
           2017 Matthias Klose <doko@debian.org>
           2015-2016 Andreas Henriksson <andreas@fatal.se>
           2015 Ivo De Decker <ivodd@debian.org>
           2014 Dimitri John Ledkov <dimitri.j.ledkov@linux.intel.com>
           2014 Tobias Hansen <thansen@debian.org>
           2006-2014 Fathi Boudra <fboudra@free.fr>
License: LGPL-2.1 or MPL-2.0

Files: cmake/modules/GIDocgen.cmake
 docs/reference/libical-glib/urlmap.js
 src/libical-glib/api/i-cal-param-iter.xml
 src/libical-glib/api/i-cal-prop-iter.xml
Copyright: Corentin Noël <corentin.noel@collabora.com>
License: LGPL-2.1 or MPL-2.0

License: LGPL-2.1
 Permission to use and copy is granted subject to the terms of the "GNU
 Lesser General Public License" (LGPL) as published by the Free Software
 Foundation; version 2.1 of the License
 .
 This library is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.
License-Comment:
 On Debian GNU systems, the complete text of the GNU Lesser General
 Public License (LGPL) version 2.1 is available at
 '/usr/share/common-licenses/LGPL-2.1'.
 .
 You should have received a copy of the GNU Lesser General Public
 License along with this program.  If not, see
 <http://www.gnu.org/licenses/>.

License: MPL-2.0
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at http://mozilla.org/MPL/2.0/. 
 .
 On Debian systems you can find the license in:
 /usr/share/common-licenses/MPL-2.0

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without modification,
 are permitted provided that the following conditions are met:
 .
 Redistributions of source code must retain the above copyright notice, this
 list of conditions and the following disclaimer.
 .
 Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 Neither the name Facebook nor the names of its contributors may be used to
 endorse or promote products derived from this software without specific
 prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
 ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
 the Software without restriction, including without limitation the rights to
 use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
 of the Software, and to permit persons to whom the Software is furnished to do
 so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: public-domain
 Public domain, no copyright. Use at your own risk.

DFSG Assistant LLM REVIEW 7 blocker, 0 important, 6 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for libical4 version 4.0.7+dfsg-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 7 blocker, 0 important, 6 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 14 found

Licensing

Every licence actually found in the tree is DFSG-free (LGPL-2.1-only, MPL-2.0, BSD-3-Clause, MIT/Expat, the Apple vCard 'Apple MIT' notice, Unlicense, CC0-1.0, public-domain IANA tz data, GPL-2.0-or-later for vzic, GPL-1+/Artistic-1), and the one non-free licence in the tree (CISST, for the QNX toolchain files) is excluded by Files-Excluded and those files are gone. debian/copyright nevertheless misdescribes the licensing of several groups of files: the Apple vCard code, icaldate_p.[ch] and the timegm() code in icaltime.c, vzic, the cmake helpers, the Net-ICal perl module, and the zoneinfo/tzdata data are all given the wrong licence name, wrong or truncated holders, or left as an unmentioned embedded copy of third-party data, and the Apple notice that must be reproduced is missing altogether.

Packaging

The packaging is in good shape: debhelper compat 14 with a correct dh(1) rules file and hardening, proper Multi-Arch and symbol file for the bumped soname libical.so.4, a working autopkgtest, DEP-3 headers on the patches, and a sane changelog that records the source rename. What is left is minor: a completely disabled patch series with five dead patch files, a leftover .install file for a binary package that no longer exists, stale gtk-doc references after the move to gi-docgen, Vcs-* still naming the libical3 repository, and a Breaks/Replaces on libical3t64 that the soname bump does not require.

Issues

blocker licensing 1. Files: src/libicalvcal/* gives the Apple-licensed vCard code LGPL-2.1 or MPL-2.0 and omits the licence notice it must reproduce ◂

Files: debian/copyright, src/libicalvcal/README.txt:1, src/libicalvcal/vcc.c:105, src/libicalvcal/vcc.h:2, src/libicalvcal/vcc.y:4, src/libicalvcal/vobject.c:2, src/libicalvcal/vobject.h:2, src/libicalvcal/vcaltmp.c:17, src/libicalvcal/vcaltmp.h:2, LICENSES/LicenseRef-APPLEMIT.txt
Basis: checked, in the package or with a reference tool
Evidence: SPDX-FileCopyrightText: 1996 Apple Computer, Inc., AT&T Corp., International / Business Machines Corporation and Siemens Rolm Communications Inc. / SPDX-License-Identifier: LicenseRef-APPLEMIT in each file; debian/copyright Files: src/libicalvcal/* says Copyright: 1996 Apple Computer, Inc., AT&T Corp., International and License: LGPL-2.1 or MPL-2.0. LICENSES/LicenseRef-APPLEMIT.txt: "The above copyright notice and the following four paragraphs must be reproduced in all copies of this software and any software including this software."
Problem: These files are compiled into libicalvcal.so.4, yet debian/copyright names a licence they are not under and truncates the holder mid-sentence ("International"). The required notice and disclaimers appear nowhere in debian/copyright, so the file does not satisfy Policy 12.5's requirement of a verbatim copy of the distribution licences. The licence itself is DFSG-free, so this is an accuracy/completeness fault, not a non-free file.
Fix: Add a stanza naming all four licensors (Apple Computer, Inc., AT&T Corp., International Business Machines Corporation and Siemens Rolm Communications Inc.) with a stand-alone License: paragraph carrying the text from LICENSES/LicenseRef-APPLEMIT.txt (the notice plus the four paragraphs, as the licence demands), and make icalvcal.c/icalvcal.h's separate LGPL-2.1/MPL-2.0 stanza remain the later, overriding one for those two files.

blocker licensing 2. Files: * gives the BSD-3-Clause icaldate_p.c/icaldate_p.h, compiled into libical, as LGPL-2.1 or MPL-2.0 and never names Hiram Clawson ◂

Files: debian/copyright, src/libical/icaldate_p.c:3-5, src/libical/icaldate_p.h:3-5, src/libical/CMakeLists.txt:265, 3RDPARTY.md:5-8
Basis: checked, in the package or with a reference tool
Evidence: SPDX-FileCopyrightText: 1986-2000, Hiram Clawson / SPDX-License-Identifier: BSD-3-Clause; 3RDPARTY.md: "copyright 1986-2000, Hiram Clawson with the BSD-3-Clause license"; src/libical/CMakeLists.txt lists icaldate_p.c among the library sources; debian/copyright has no stanza and the catch-all Files: * says License: LGPL-2.1 or MPL-2.0.
Problem: The holder and licence of code that is compiled into libical.so.4 are both wrong in debian/copyright, which therefore does not describe the licensing of the shipped library (Policy 12.5).
Fix: Add Files: src/libical/icaldate_p.* with Copyright: 1986-2000, Hiram Clawson and License: BSD-3-Clause, reproducing the three-clause text (LICENSES/BSD-3-Clause.txt) with Clawson's name in the non-endorsement clause.

blocker licensing 3. The NLnet Labs BSD-3-Clause timegm() code in src/libical/icaltime.c is not named in the file's copyright stanza ◂

Files: debian/copyright, src/libical/icaltime.c:6-8, src/libical/icaltime.c:10-15
Basis: checked, in the package or with a reference tool
Evidence: The timegm code is Copyright (c) 2001-2006, NLnet Labs. All rights reserved. followed by the three-clause BSD terms ("Neither the name of the NLNET LABS ..."), while the stanza Files: src/libical/icaltime.c says only Copyright: 2000, Eric Busboom <eric@civicknowledge.com> / License: LGPL-2.1 or MPL-2.0.
Problem: Two different licences and two holders apply to this compiled-in file; debian/copyright records only one of each, so the BSD-3-Clause part and its holder are missing from the copyright file.
Fix: Name NLnet Labs as a holder of src/libical/icaltime.c and state that it is LGPL-2.1 or MPL-2.0 for the rest and BSD-3-Clause for the timegm() code (a combined License: field such as LGPL-2.1 or MPL-2.0 and BSD-3-Clause, with both texts present).

blocker licensing 4. Files: vzic/* says LGPL-2.1 or MPL-2.0 but vzic is GPL-2.0-or-later ◂

Files: debian/copyright, vzic/vzic.h:8, vzic/vzic-output.c:8, vzic/Makefile:4, vzic/vzic-dump.pl:10, LICENSE.txt:9-11
Basis: checked, in the package or with a reference tool
Evidence: SPDX-License-Identifier: GPL-2.0-or-later in vzic.c, vzic.h, vzic-output., vzic-parse., vzic-dump.*, test-vzic.c, Makefile, *.pl; LICENSE.txt: "The vzic developer tool is licensed according to the terms of the GNU General Public License version 2.0 or later."
Problem: The licence name in debian/copyright is wrong for 15 files (and the version/or-later part too). vzic is not built by debian/rules (LIBICAL_BUILD_VZIC stays False), but the copyright file must still describe the source it ships.
Fix: Change the vzic stanza to License: GPL-2+ with a stand-alone paragraph referring to /usr/share/common-licenses/GPL-2, and add the BSD-3-Clause vzic/CMakeLists*.txt files separately.

blocker licensing 5. The Net-ICal perl modules are LGPL-2.1-only/MPL-2.0, not GPL-1+/Artistic-1, and netical_wrap.c's own notice is ignored ◂

Files: debian/copyright, src/Net-ICal-Libical/lib/Net/ICal/Libical/Component.pm:6-7, src/Net-ICal-Libical/lib/Net/ICal/Libical.pm:6-8, src/Net-ICal-Libical/netical_wrap.c:7-11
Basis: checked, in the package or with a reference tool
Evidence: SPDX-License-Identifier: LGPL-2.1-only OR MPL-2.0 in Libical.pm, Libical/{Component,Duration,Period,Property,Time}.pm; debian/copyright: Files: src/Net-ICal-Libical/lib/Net/ICal/Libical/* License: GPL-1+ or Artistic-1. netical_wrap.c: Portions Copyright (c) 1995-1998 The University of Utah and The Regents of the University of California. Permission is granted to distribute this file in any manner provided this notice remains intact.
Problem: The stanza states a licence the files do not carry (and, incidentally, a more restrictive one), the SWIG-generated netical_wrap.c is covered only by Files: * as LGPL-2.1/MPL-2.0 although it has its own permissive notice, and neither the University of Utah/Regents holder nor that notice is in debian/copyright.
Fix: Drop or correct the GPL-1+/Artistic-1 stanza to LGPL-2.1 or MPL-2.0, and add a stanza for src/Net-ICal-Libical/netical_wrap.c naming The University of Utah and The Regents of the University of California with their permission notice (plus SWIG's) reproduced.

blocker licensing 6. The cmake toolchain and helper files are BSD-3-Clause (KDAB and others) but debian/copyright gives them LGPL-2.1/MPL-2.0 or omits them ◂

Files: debian/copyright, cmake/Toolchain-RPI.cmake:4-8, cmake/Toolchain-Linux-GCC-i686.cmake:4-8, cmake/modules/GIDocgen.cmake:3-4, cmake/modules/FindBDB.cmake:3, vzic/CMakeLists.txt:4, vzic/CMakeLists-integrated.txt:2
Basis: checked, in the package or with a reference tool
Evidence: SPDX-FileCopyrightText: 2013-2022 Klarälvdalens Datakonsult AB, a KDAB Group company <info@kdab.com> with SPDX-License-Identifier: BSD-3-Clause in the seven cmake/Toolchain-*.cmake files; GIDocgen.cmake is Corentin Noël with BSD-3-Clause, yet its stanza in debian/copyright says License: LGPL-2.1 or MPL-2.0; FindBDB.cmake, vzic/CMakeLists.txt and vzic/CMakeLists-integrated.txt are BSD-3-Clause and have no stanza at all.
Problem: Several shipped build-system files are given the wrong licence, and KDAB and their files are absent from debian/copyright entirely.
Fix: Add the seven cmake/Toolchain-*.cmake files (KDAB, BSD-3-Clause) and the remaining BSD-3-Clause cmake files to a BSD-3-Clause stanza, and correct the GIDocgen.cmake stanza's licence.

blocker licensing 7. zoneinfo/** (CC0-1.0) and the embedded IANA tzdata copy test-data/tzdata2025c/ (public domain) are described as LGPL-2.1 or MPL-2.0 and not mentioned ◂

Files: debian/copyright, REUSE.toml:44-47, zoneinfo/CET.ics, test-data/tzdata2025c/LICENSE:1-2, test-data/tzdata2025c/africa
Basis: checked, in the package or with a reference tool
Evidence: REUSE.toml: path = "zoneinfo/**" with SPDX-License-Identifier = "CC0-1.0"; test-data/tzdata2025c/LICENSE: "Unless specified below, all files in the tz code and data (including this LICENSE file) are in the public domain." debian/copyright covers both with Files: * / Copyright: 1999 Contributors to the Libical project-style claims / License: LGPL-2.1 or MPL-2.0.
Problem: Two substantial parts of the source tree are described under a licence they are not under, and the IANA tz database, third-party data that Debian already ships as tzdata, is not identified at all. REUSE.toml's collective Copyright: 1999 Contributors to the Libical project, used for most documentation, design data and test data, is likewise not represented in debian/copyright.
Fix: Add stanzas for zoneinfo/* (CC0-1.0, quoting the CC0 waiver or pointing at /usr/share/common-licenses/CC0-1.0) and test-data/tzdata2025c/* (public domain, attribution to the IANA tz database), and add the project's collective copyright line for the files REUSE.toml declares it for.

minor licensing 8. The BSD-3-Clause licence paragraph names Facebook, which holds no copyright in this package ◂

Files: debian/copyright
Basis: checked, in the package or with a reference tool
Evidence: Neither the name Facebook nor the names of its contributors may be used to endorse or promote products derived from this software ... — no file in the tree mentions Facebook (the only other hit is a comment in test-data/tzdata2025c/northamerica).
Problem: The licence text was copied from another project; as written it does not reproduce the notices of the BSD-3-Clause licensors here (Pino Toscano, Kitware, Andreas Holzammer, Hiram Clawson, KDAB, NLnet Labs), whose non-endorsement clauses name themselves.
Fix: Use LICENSES/BSD-3-Clause.txt (or each licensor's own text) for the License: BSD-3-Clause paragraph instead of the Facebook wording.

minor packaging 9. Every patch in debian/patches/series is commented out, leaving five dead patch files in the source package ◂

Files: debian/patches/series, debian/patches/32-bit_time_t_upper_bound.patch, debian/patches/glib-t64.patch, debian/patches/gobject-introspection-version.patch, debian/patches/icalbdbset.patch, debian/patches/test-regression.patch
Basis: checked, in the package or with a reference tool
Evidence: series contains only #32-bit_time_t_upper_bound.patch, #icalbdbset.patch, #gobject-introspection-version.patch, #test-regression.patch, #glib-t64.patch. The changes they carry are in 4.0.7 already: element-type time_t at src/libical-glib/api/i-cal-recur.xml:14, #if (SIZEOF_TIME_T > 4) at src/test/regression.c:6616, 20380119T031407Z at src/test/regression.c:6609, ${LIBICAL_LIB_MAJOR_SOVERSION}.0 at src/libical/CMakeLists.txt:176 and src/libical-glib/CMakeLists.txt:297, and no faild string remains.
Problem: Five patch files are shipped and none is applied; a reader has to re-derive from upstream that they are obsolete, and the 32-bit time_t fix (Debian #1142814) is only in the package because upstream 4.0 carries it. Dead patches are the kind of leftover a source package should not carry.
Fix: Delete the five files and the series entries (or the patches directory) and note in the changelog that they are all upstream; if any of them is still needed, uncomment it and say why.

minor packaging 10. debian/python-libical.install is left over for a binary package that debian/control no longer builds ◂

Files: debian/python-libical.install, debian/control
Basis: checked, in the package or with a reference tool
Evidence: The file contains usr/lib/pymodules/*; debian/control builds only libical-dev, libical-doc, libical4 and gir1.2-ical-4.0.
Problem: A .install file for a nonexistent package is silently ignored by dh_install, but it misleads anyone reading debian/ about what the source builds, and it is the only trace of the removed Python bindings.
Fix: Remove debian/python-libical.install (and mention the removal of the Python binding package in the changelog if it was dropped deliberately).

minor packaging 11. gtk-doc-tools is still a Build-Depends and autopkgtest dependency although 4.0 replaced gtk-doc with gi-docgen, and libical-doc.links still creates a gtk-doc path ◂

Files: debian/control:17, debian/tests/control:2, debian/libical-doc.links:1, CHANGELOG.md:145
Basis: checked, in the package or with a reference tool
Evidence: debian/control Build-Depends lists gtk-doc-tools; debian/tests/control Depends lists gtk-doc-tools; nothing in CMakeLists.txt or the cmake modules uses gtk-doc any more; upstream CHANGELOG.md: "Replace gtk-doc with gi-docgen to produce libical-glib developer documentation"; debian/libical-doc.links is usr/share/doc/libical-glib/ usr/share/gtk-doc/html/libical-glib.
Problem: Unused build and test dependencies and a leftover /usr/share/gtk-doc symlink for a documentation build that no longer exists: needless build time and a stale path in the binary package.
Fix: Drop gtk-doc-tools from debian/control and debian/tests/control and remove debian/libical-doc.links; keep gi-docgen (and doxygen only if the apidocs are actually to be built and installed).

minor packaging 12. Vcs-Browser and Vcs-Git still name the libical3 repository after the source package was renamed to libical4 ◂

Files: debian/control:12-13
Basis: inferred from what was read, not seen directly
Evidence: Vcs-Browser: https://salsa.debian.org/debian/libical3 and Vcs-Git: https://salsa.debian.org/debian/libical3.git in a source package now called libical4 (changelog: "d/control: Rename source package to libical4").
Problem: Either the Salsa repository was renamed and the fields are now dead links, or it was not, and the Vcs URLs point users at a repository named after the previous source package while the packaging claims libical4; in both cases the metadata no longer matches the package.
Fix: Rename the Salsa repository (or keep it and accept the old name) and set the Vcs-* fields to the URL that actually holds this packaging.

minor packaging 13. libical4 Replaces and Breaks libical3t64 although the soname bump leaves no file conflict, and its ${t64:Provides} is empty ◂

Files: debian/control:63-65, CMakeLists.txt:181, debian/libical4.symbols:1841
Basis: checked, in the package or with a reference tool
Evidence: Provides: ${t64:Provides} / Replaces: libical3t64 / Breaks: libical3t64 (<< ${source:Version}); the library soname is now 4 (libical.so.4.0 in debian/libical4.symbols), while libical3t64 ships the .so.3 files, so the two packages do not collide. debian/control has no X-Time64-Compat field, which is what dh's t64_compat_name() (Dh_Lib.pm) turns into that substvar, so the Provides expands to nothing; libical3t64 in unstable is Version: 3.0.20-3, Provides: libical3 (= 3.0.20-3).
Problem: The Breaks makes libical4 uninstallable alongside the package currently in unstable and forces libical3t64 off the system, taking every reverse dependency that depends on libical3t64 with it, for no gain: nothing in libical4 collides with libical3t64's files. A soname bump is handled by keeping the old library package until its reverse dependencies are rebuilt and then removing it, not by Breaks/Replaces.
Fix: Drop Replaces/Breaks on libical3t64 (and the empty Provides: ${t64:Provides} unless a real X-Time64-Compat rename is intended) and handle the 3 -> 4 soname transition with a transition bug, keeping libical3t64 available until the reverse dependencies have been rebuilt.

Verified ◂

debian/copyright is DEP-5: correct Format URL, Upstream-Name/Source/Upstream-Contact, 22 Files stanzas plus a debian/* stanza, stand-alone License paragraphs for LGPL-2.1, MPL-2.0, BSD-3-Clause, Expat and public-domain, with /usr/share/common-licenses pointers for LGPL-2.1, MPL-2.0, GPL-1 and Artistic.
Every licence found in the tree is free: LGPL-2.1-only OR MPL-2.0 (the bulk), MPL-2.0, BSD-3-Clause, MIT/Expat (docs/doxygen-awesome.css), the Apple vCard notice (LICENSES/LicenseRef-APPLEMIT.txt), Unlicense/public domain (cmake/modules/FindBerkeleyDB.cmake, openssf-c.cmake, openssf-cpp.cmake), CC0-1.0 (zoneinfo/** per REUSE.toml), public domain IANA tz data (test-data/tzdata2025c/LICENSE), GPL-2.0-or-later (vzic), GPL-1+/Artistic-1 text referenced for the perl binding.
The only non-free wording in the tree, LICENSES/LicenseRef-CISST.txt:85 ("designed for research purposes only"), belongs to the cmake/Toolchain-QNX-* files that debian/copyright excludes in Files-Excluded; a glob for cmake/QNX finds none, and the file itself says "This license applies to the cmake/Toolchain-QNX-* files only".
All 12 files the prescan called unrecognised binary data are test inputs under test-data/: nine OSS-Fuzz crash/PoC files (crash.ics, fuzz463617307, fuzz472865252, fuzz476187660, fuzzubsan3, malloc.ics, timezonefuzz895, vcardfuzz480258833, vcardfuzz505903588) and three .ics regression files that are simply not UTF-8 (issue252.ics, issue253.ics, zday.ics). They are not built artifacts, belong to no binary package, and REUSE.toml declares test-data/** as LGPL-2.1-only OR MPL-2.0 (though see the copyright issue about that claim).
LICENSES/Unlicense.txt:3 ("for any purpose, commercial or non-commercial") is the Unlicense's grant, not a commercial-use restriction.
No built or binary files in the tree: a glob for *.pdf, *.png, *.jpg, *.gif, *.svg, *.o, *.a, *.so, *.pyc, *.jar, *.zip, *.gz, *.tar, *.gir, *.typelib and *.vapi finds nothing.
Generated sources all have their generators present: src/libicalvcal/vcc.c from vcc.y, src/libicalss/icalssyacc.c from icalssyacc.y, src/libicalss/icalsslexer.c from icalsslexer.l, src/Net-ICal-Libical/netical_wrap.c from netical.i, src/libical/icalderived*.c and src/libicalvcard/vcardderived*.c from design-data/ via scripts/mkderived*.pl, and the libical-glib binding from src/libical-glib/api/*.xml.
zoneinfo/*.ics and test-data/zoneinfo2025c[-pure]/ are tz data generated by vzic (vzic/ is in the tree) from the IANA tz database whose source files are shipped in test-data/tzdata2025c/; the generator and the input are both present.
test-data/tzdata2025c/ is an embedded copy of IANA tzdata 2025c (32 files including LICENSE, africa, asia, europe, northamerica, the .awk helpers and theory.html). It is test data only, is not installed, and is public domain per its own LICENSE; Debian's tzdata package is separate. Reported only because debian/copyright does not describe it.
Copyright holders from the prescan that are accounted for: "The Software Studio eric@civicknowledge.com" (src/test/icaltestparser.c:5) is Eric Busboom's company, the holder already in Files: *; "Hiram Clawson with" (3RDPARTY.md:8) is the icaldate_p holder reported above; "Contributors to the libical project" (REUSE.toml) is the collective claim reported above; Gisle Hannemyr (CONTRIBUTORS.md:38) is credited there for mimelite's decode(), and src/libicalss/sspm.c, the file it was for, no longer exists, so no notice is missing for him.
debian/patches/*.patch do carry DEP-3 headers (Origin/From/Date/Subject or Description/Author/Forwarded), so the problem is their being disabled, not their documentation.
Whole of debian/ read: changelog (first entry and history), control, rules, copyright, patches/series and all five patches, source/format, source/lintian-overrides, tests/control and tests/unit-test, upstream/metadata, salsa-ci.yml, libical4.symbols (header and the seven soname boundaries), all .install/.links/.docs/.examples files, doc-base and lintian-overrides.
The licensing grep covered the whole tree for SPDX-License-Identifier (396 files), plus Unlicense/LicenseRef, Apple/AT&T and Facebook references, and every LICENSE/COPYING/NOTICE file (LICENSE.txt, COPYING.LESSER.txt, LICENSES/*, test-data/tzdata2025c/LICENSE).
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 20221025-f9ed452c1d, packaged 4.0.7+dfsg), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Artistic, GPL-1, LGPL-2.1, MPL-2.0).

Not confirmed ◂

Whether ${gir:Depends} gives libical-dev a dependency that supplies the GLib headers: its /usr/include/libical-glib/*.h include <glib.h> and <glib-object.h> and libical-glib.pc has Requires: glib-2.0, gobject-2.0, but libical-dev 4.0.7 only Depends on gir1.2-ical-4.0, libical4, ${gir:Depends} and libicu-dev, whereas 3.0.20-3 depended explicitly on gir1.2-glib-2.0-dev and gir1.2-gobject-2.0-dev. dh_girepository(1) does add -dev packages when they are in Build-Depends, which are not here, but only a build shows the generated Depends.
The other 4495 lines of debian/libical4.symbols were not read; only the seven soname headers and the icalbdbset #MISSING block were checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-11 20:27 UTC, because the review found serious issues.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
4.0.5-1	fd6c1df8…	2026-09-24 09:31	2026-09-24 09:38	awm	rejected	VIEW

Back to Dashboard | View all reviews for this package