DFSG NEW review for libkff version 0.0~git20250321.cf4d866-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: No
• Packaging is of good quality: Yes
• Issues: 0 blocker, 2 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The code is DFSG-compliant: the upstream LICENSE is the verbatim GNU Affero GPL version 3 text, a free licence, and every source file is covered by the Files: * stanza. However debian/copyright inaccurately declares the licence as AGPL-3.0+ (with 'or any later version'), whereas the LICENSE file grants version 3 only with no author-added 'or later' clause. No source file carries a per-file copyright header; the named holders come from upstream history, and the pre-review author check found no holder missing.

Packaging

Clean modern packaging: dh with the cmake buildsystem at compat 14, a correct binary split (libkff1 / libkff-dev) with Multi-Arch: same and Architecture: any, a DEP-3-headed patch adding install rules and a versioned soname, a meaningful autopkgtest that compiles against the installed header/lib and round-trips a file, and explicit LDFLAGS handling in rules to keep linker hardening (cmake.pm does not pass LDFLAGS). Standards-Version 4.7.4 is current; no maintainer scripts are needed for a library.

Issues

1. [important] [licensing] debian/copyright declares AGPL-3.0+ but upstream is AGPL-3.0 (version 3 only, no 'or any later version')

• Files: debian/copyright:16, debian/copyright:22-26, LICENSE:1
• Basis: checked, in the package or with a reference tool
• Evidence: debian/copyright: License: AGPL-3.0+ and the standalone paragraph 'either version 3 of the License, or (at your option) any later version'; upstream LICENSE begins 'GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007' and contains no author-added 'or later' grant.
• Problem: The upstream LICENSE is the verbatim AGPL-3.0 text. The 'or (at your option) any later version' wording in the licence's 'How to Apply These Terms' appendix is a template for licensing new programs, not a grant covering this project. So the code is licensed under AGPL-3.0 only, and the + suffix (and the corresponding wording) overstates the rights granted to recipients. The short name must match the actual text and version (copyright-format 6.7 / 7.1).
• Fix: Change License: AGPL-3.0+ to License: AGPL-3.0 in both the Files: * and debian/* stanzas and the standalone paragraph, and drop 'or (at your option) any later version' so the text reads 'either version 3 of the License'.

2. [important] [licensing] debian/copyright points to a licence text that /usr/share/common-licenses does not have

• Files: debian/copyright:37
• Basis: found by the review tooling's own checks
• Evidence: Named but not in /usr/share/common-licenses on the reviewing system: AGPL-3 (there is AGPL-3.0).
• Problem: Policy 12.5 requires the licence to be in the copyright file or, for the licences base-files ships, a reference to the file under /usr/share/common-licenses. A reference to a file that is not there leaves the installed copyright file without the licence text.
• Fix: Name the file as base-files names it, or include the licence text in the License paragraph.

Verified

• Read all 10 upstream files (excluding .pc/ and debian/): CMakeLists.txt, kff_io.cpp, kff_io.hpp.in, main.cpp, LICENSE, README.md, .gitignore, and benchmarks/{CMakeLists.txt, reader.cpp, perfs.tsv}.
• LICENSE is the verbatim GNU Affero GPL version 3 text (661 lines); no source file carries a per-file copyright or licence header.
• The pre-review dfsg-author-check reported 'every holder found is named in debian/copyright', so it listed no files needing account.
• kff_io.hpp is generated from kff_io.hpp.in via configure_file(), so the preferred form for modification is present; benchmarks/perfs.tsv is two rows of benchmark result data covered by Files: *.
• Read /usr/share/perl5/Debian/Debhelper/Buildsystem/cmake.pm: its configure() does not pass LDFLAGS to cmake, so debian/rules' explicit -DCMAKE_SHARED_LINKER_FLAGS="$(LDFLAGS)" is a legitimate hardening measure, not redundant.
• Read every file under debian/ including the patch, tests and install files.
• uscan found the packaged version as the newest upstream release (upstream 0.0~git20250321.cf4d866, packaged 0.0~git20250321.cf4d866).

Not confirmed

• The nine individual copyright holders and their years are not stated in any in-tree file (no file headers), so they are presumed drawn from upstream git history and could not be independently verified from the source; the pre-review author check found no discrepancy.

Proposed changes

None.