Review: libkff 0.0~git20250321.cf4d866-1

Package Information

Description	C++ library to read and write kff k-mer files The Kmer File Format (kff) is a binary container for sets of kmers and their associated data, organised in typed sections: global values, raw or minimizer sequences, indexes and a footer. This library provides a low level API to read and write every kff section type and a high level API that enumerates kmers hiding the section structure. This package contains the shared library.
Maintainer	Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed By	Andreas Tille <tille@debian.org>
Sponsor	tille@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/med-team/libkff.git (browse)
Closes	#1152023
Tracker	https://tracker.debian.org/pkg/libkff
Uploaded	13 days ago

New Package Report

.changes◂

Date	Sun, 25 Oct 2026 16:54:00 +0100
Source	libkff
Version	0.0~git20250321.cf4d866-1
Changed-By	Andreas Tille <tille@debian.org>
Architecture	source amd64
Distribution	unstable

Changelog◂

libkff (0.0~git20250321.cf4d866-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152023)

.dsc◂

Section	libdevel
Priority	optional
Component	main
Package-List	libkff-dev deb libdevel optional arch=any libkff1 deb libs optional arch=any

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: kff-cpp-api
Upstream-Contact: Yoann Dufresne <yoann.dufresne0@gmail.com>
Source: https://github.com/Kmer-File-Format/kff-cpp-api

Files: *
Copyright: 2020-2025 Yoann Dufresne <yoann.dufresne0@gmail.com>
           2020 Pierre Marijon <pierre.marijon@hhu.de>
           2021 Rayan Chikhi <rchikhi@users.noreply.github.com>
           2021 Teo Lemane <teo.lemane@gmail.com>
           2021 Marek Kokot <marek.koki@gmail.com>
           2023 Jouni Siren <jouni.siren@iki.fi>
           2024 Pierre Peterlongo <pierre.peterlongo@inria.fr>
           2024 Glenn Hickey <glenn.hickey@gmail.com>
           2025 Antoine Limasset <antoine.limasset@gmail.com>
License: AGPL-3.0+

Files: debian/*
Copyright: 2026 Andreas Tille <tille@debian.org>
License: AGPL-3.0+

License: AGPL-3.0+
 This program is free software: you can redistribute it and/or modify it
 under the terms of the GNU Affero General Public License as published by
 the Free Software Foundation, either version 3 of the License, or (at your
 option) any later version.
 .
 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public
 License for more details.
 .
 You should have received a copy of the GNU Affero General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of the GNU Affero General Public
 License version 3 can be found in "/usr/share/common-licenses/AGPL-3".

DFSG Assistant LLM REVIEW 0 blocker, 2 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 13 days ago.

Report◂

DFSG NEW review for libkff version 0.0~git20250321.cf4d866-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 2 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The code is DFSG-compliant: the upstream LICENSE is the verbatim GNU Affero GPL version 3 text, a free licence, and every source file is covered by the Files: * stanza. However debian/copyright inaccurately declares the licence as AGPL-3.0+ (with 'or any later version'), whereas the LICENSE file grants version 3 only with no author-added 'or later' clause. No source file carries a per-file copyright header; the named holders come from upstream history, and the pre-review author check found no holder missing.

Packaging

Clean modern packaging: dh with the cmake buildsystem at compat 14, a correct binary split (libkff1 / libkff-dev) with Multi-Arch: same and Architecture: any, a DEP-3-headed patch adding install rules and a versioned soname, a meaningful autopkgtest that compiles against the installed header/lib and round-trips a file, and explicit LDFLAGS handling in rules to keep linker hardening (cmake.pm does not pass LDFLAGS). Standards-Version 4.7.4 is current; no maintainer scripts are needed for a library.

Issues

important licensing 1. debian/copyright declares AGPL-3.0+ but upstream is AGPL-3.0 (version 3 only, no 'or any later version') ◂

Files: debian/copyright:16, debian/copyright:22-26, LICENSE:1
Basis: checked, in the package or with a reference tool
Evidence: debian/copyright: License: AGPL-3.0+ and the standalone paragraph 'either version 3 of the License, or (at your option) any later version'; upstream LICENSE begins 'GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007' and contains no author-added 'or later' grant.
Problem: The upstream LICENSE is the verbatim AGPL-3.0 text. The 'or (at your option) any later version' wording in the licence's 'How to Apply These Terms' appendix is a template for licensing new programs, not a grant covering this project. So the code is licensed under AGPL-3.0 only, and the + suffix (and the corresponding wording) overstates the rights granted to recipients. The short name must match the actual text and version (copyright-format 6.7 / 7.1).
Fix: Change License: AGPL-3.0+ to License: AGPL-3.0 in both the Files: * and debian/* stanzas and the standalone paragraph, and drop 'or (at your option) any later version' so the text reads 'either version 3 of the License'.

important licensing 2. debian/copyright points to a licence text that /usr/share/common-licenses does not have ◂

Files: debian/copyright:37
Basis: found by the review tooling's own checks
Evidence: Named but not in /usr/share/common-licenses on the reviewing system: AGPL-3 (there is AGPL-3.0).
Problem: Policy 12.5 requires the licence to be in the copyright file or, for the licences base-files ships, a reference to the file under /usr/share/common-licenses. A reference to a file that is not there leaves the installed copyright file without the licence text.
Fix: Name the file as base-files names it, or include the licence text in the License paragraph.

Verified ◂

Read all 10 upstream files (excluding .pc/ and debian/): CMakeLists.txt, kff_io.cpp, kff_io.hpp.in, main.cpp, LICENSE, README.md, .gitignore, and benchmarks/{CMakeLists.txt, reader.cpp, perfs.tsv}.
LICENSE is the verbatim GNU Affero GPL version 3 text (661 lines); no source file carries a per-file copyright or licence header.
The pre-review dfsg-author-check reported 'every holder found is named in debian/copyright', so it listed no files needing account.
kff_io.hpp is generated from kff_io.hpp.in via configure_file(), so the preferred form for modification is present; benchmarks/perfs.tsv is two rows of benchmark result data covered by Files: *.
Read /usr/share/perl5/Debian/Debhelper/Buildsystem/cmake.pm: its configure() does not pass LDFLAGS to cmake, so debian/rules' explicit -DCMAKE_SHARED_LINKER_FLAGS="$(LDFLAGS)" is a legitimate hardening measure, not redundant.
Read every file under debian/ including the patch, tests and install files.
uscan found the packaged version as the newest upstream release (upstream 0.0~git20250321.cf4d866, packaged 0.0~git20250321.cf4d866).

Not confirmed ◂

The nine individual copyright holders and their years are not stated in any in-tree file (no file headers), so they are presumed drawn from upstream git history and could not be independently verified from the source; the pre-review author check found no discrepancy.

Proposed changes ◂

None.

Uploader's response to the LLM review

Just pushed the following commit and hope there is no need to reject / reupload:

commit 898f0f1bb5b43cb2b0e772c9909b00668a4d681f (HEAD -> master)
Author: Andreas Tille tille@debian.org
Date: Sun Oct 25 21:29:13 2026 +0100

s/AGPL-3.0+/AGPL-3.0/

diff --git a/debian/copyright b/debian/copyright
index 054bb37..5413ed1 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -13,25 +13,12 @@ Copyright: 2020-2025 Yoann Dufresne yoann.dufresne0@gmail.com
2024 Pierre Peterlongo pierre.peterlongo@inria.fr
2024 Glenn Hickey glenn.hickey@gmail.com
2025 Antoine Limasset antoine.limasset@gmail.com
-License: AGPL-3.0+
+License: AGPL-3.0

Files: debian/*
Copyright: 2026 Andreas Tille tille@debian.org
-License: AGPL-3.0+
+License: AGPL-3.0

-License: AGPL-3.0+

This program is free software: you can redistribute it and/or modify it
under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or (at your
option) any later version.
.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public
License for more details.
.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see https://www.gnu.org/licenses/.
.
+License: AGPL-3.0
On Debian systems, the complete text of the GNU Affero General Public
License version 3 can be found in "/usr/share/common-licenses/AGPL-3".

— Andreas Tille (tille), 13 days ago

Review Information

accepted — allocated to awm 12 days ago, started 12 days ago, completed 12 days ago.

Final Comment

Back to Dashboard | View all reviews for this package